Red Hat
Monthly
DNS rebinding bypass in OpenStack Glance's web-download URI validator allows authenticated tenant users to circumvent host-filter restrictions and force the image service to fetch arbitrary internal URLs, enabling full-read SSRF exfiltration via the image download API. The validator evaluates host filters against the raw pre-resolution hostname, creating a TOCTOU window: an attacker's domain passes the check resolving to a legitimate external IP, then DNS rebinding redirects the actual fetch to internal targets such as the cloud instance metadata service at 169.254.169.254. Glance versions 16.0.0 through 30.2.0, 31.0.0 through 31.1.0, and 32.0.0 are affected; no public exploit has been identified at time of analysis.
Server-side request forgery in OpenStack Glance 16.0.0 through 32.0.0 allows authenticated tenant users to make the image service fetch arbitrary internal URLs, including cloud metadata endpoints at 169.254.169.254, turning the image import pipeline into a full-read SSRF channel. Three related flaws (CVE-2026-71196, CVE-2026-71197, CVE-2026-71198) stem from insecure default host filtering in the web-download import method, a DNS rebinding bypass that evades the validator, and absent host filtering in the HTTP image location API respectively. Because Glance stores fetched bytes as downloadable image data, none of these are blind SSRF - the full response body is directly retrievable by the attacker. No public exploit has been identified, but the cloud-credential-theft impact warrants urgent remediation in any multi-tenant or internet-facing OpenStack deployment.
Full-read server-side request forgery in OpenStack Glance's HTTP image location API allows authenticated tenant users to exfiltrate arbitrary internal network resources, including cloud metadata endpoints, when the HTTP store backend is enabled. Unlike a typical blind SSRF, Glance stores the fetched content as image payload that the attacker can then download in full, making credential theft from the instance metadata service (169.254.169.254) directly achievable. CVE-2026-71198 is one of three coordinated SSRF issues (OSSA-2026-038) reported independently by Sergey Kanibor, Sami Yessou, and Abhishek Kekane; this specific variant was credited to Kekane of Red Hat.
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's `maxTotalMergeKeys` safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (`<<`) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.
Path traversal in Vitest's interceptorPlugin exposes local files on any development server with a network-accessible HMR WebSocket. The `vitest:interceptor:register` handler in `packages/mocker/src/node/interceptorPlugin.ts` accepts redirect mock registrations over Vite's unauthenticated HMR socket without calling `isFileLoadingAllowed()`, allowing a remote unauthenticated attacker who can reach the dev server to submit opaque-scheme URLs (e.g., `traversal:../../../etc/passwd`) whose `..` segments survive `URL.pathname` parsing and resolve outside the project root via `path.join()`. The plugin's `load` hook then returns `readFile(mock.redirect, 'utf-8')` as JavaScript module source, disclosing any file readable by the dev-server process. No public exploit or CISA KEV listing has been identified, but the GitHub fix PR includes a complete, working e2e test that serves as a functional PoC.
Execution-placement isolation bypass in Ansible Automation Platform's automation-controller (AWX) allows authenticated principals to route bulk jobs to instance groups they lack use-level authorization for. The Bulk Job Launch API endpoint (POST /api/v2/bulk/job_launch/) enforces only a read-level permission check on the instance_groups field, whereas the standard single-job launch path correctly requires use-level permission on the same field. A principal holding the built-in System Auditor role-or any role granting read but not use rights on instance groups-combined with execute permission on a job template can silently route automation workloads onto restricted infrastructure segments; no public exploit code has been identified at time of analysis.
Stored XSS in sanitize-html versions 1.9.0 through 2.17.6 allows authenticated low-privileged users to inject executable JavaScript via SVG SMIL animation elements that survive the library's scheme-policy sanitization. The sanitizer validates the `values` attribute as a single flat URL, missing that `attributeName="href"` gives `values` URI-list semantics under SVG SMIL; a payload of `#safe;javascript:alert(1)` passes the scheme check on its leading fragment while the `javascript:` entry survives intact. When a victim clicks the rendered link, the browser resolves the later entry and executes script in the application's origin. A working proof-of-concept is publicly disclosed in the GHSA advisory; no CISA KEV listing at time of analysis.
Exponential traversal denial-of-service in pypdf before 6.16.1 allows an attacker who can supply a crafted PDF to cause severe CPU stalls and memory exhaustion in any application invoking `PageObject._extract_text` or `PageObject.extract_xform_text`. The text extraction routines previously detected only direct cycles via a `known_ids` set, but failed to bound the total number of XForm invocations across a directed acyclic graph where each parent node reuses the same child XObject multiple times, producing O(2^n) traversal paths for n levels. No active exploitation or public exploit code has been identified; the fix is confirmed available in version 6.16.1.
Infinite loop denial of service in pypdf prior to 6.16.0 allows any attacker who can supply a crafted PDF to a pypdf-based write pipeline to permanently hang the processing worker. The root cause is in TreeObject.insert_child within pypdf/generic/_data_structures.py, which traverses /Next links without cycle detection; a PDF whose tree nodes form a circular reference (A→B→C→A) causes unbounded traversal. No public exploitation has been confirmed and no CISA KEV entry exists, but a functional proof-of-concept is embedded in the upstream fix PR (#3964).
Quadratic-time CPU exhaustion in Red Hat OpenShift Container Platform 4's OAuth login and error page endpoints allows unauthenticated remote attackers to deny authentication to all cluster users simultaneously. The attack exploits a bypass of the CVE-2022-32149 mitigation in golang.org/x/text/language.ParseAcceptLanguage(): the existing guard checks for hyphen ('-') character counts, but the BCP 47 scanner internally aliases underscore ('_') to '-' after the guard executes, allowing a crafted Accept-Language header with underscore subtag separators to slip through and trigger unbounded quadratic-time parsing. No public exploit has been identified at time of analysis, though the bypass mechanism is fully documented in the CVE description, meaningfully lowering the bar to exploitation.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.
Unsafe PyYAML deserialization in ModelScope through v1.40.0 enables remote code execution when users load model configuration files from attacker-controlled repositories. The vulnerability exists in at least two documented components - the audio TTS voice module (voice.py) and the multimodal mPLUG configuration loader (configuration_mplug.py) - which use PyYAML's unsafe yaml.Loader that processes Python object construction tags such as !!python/object: during deserialization. An attacker who publishes a poisoned model repository can achieve full code execution on any victim system that loads the model, with no public exploit identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
CPU exhaustion in Erlang/OTP's eldap library allows a malicious or compromised LDAP server to degrade availability by returning referral URLs containing port components composed of up to ~1.26 million digits. The function `eldap:parse_port/2` passes the port substring unbounded to Erlang's `list_to_integer/1`, which performs arbitrary-precision bignum arithmetic - consuming hundreds of milliseconds of CPU time per crafted referral. Exposure is limited to applications that explicitly pass server-supplied LDAP referrals to `eldap:parse_ldap_url/1`, as eldap itself never calls this function; no public exploit or CISA KEV listing exists at time of analysis.
Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through unvalidated characters in Document.createProcessingInstruction() targets. Versions prior to 0.8.15 and 0.9.12 - and all versions of the legacy xmldom package (0.6.0 and earlier, which has no fix) - emit malformed processing instructions when a target contains >, ?, whitespace, or other XML-Name-invalid characters, enabling injection of arbitrary XML structure into the serialized output. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.
Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small crafted HTML documents passed to DOMParser.parseFromString(). The parseHtmlSpecialContent function uses a case-sensitive indexOf() to locate closing tags for raw-text elements; when a mixed-case tag like </ScRiPt> is not found, indexOf() returns -1, and the subsequent substring(-1) call destabilizes parser progression and triggers O(N²) output amplification. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is unauthenticated and requires no access complexity beyond supplying crafted HTML to the parser.
Silent acceptance of malformed XML end tags in xmldom's DOMParser allows crafted input to bypass parse-before-trust well-formedness gates in security-sensitive Node.js applications. The flaw affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, as well as all versions of the legacy xmldom package (0.6.0 and earlier), for which no patch exists. No public exploit has been identified at time of analysis, but the parser differential is exploitable in any pipeline - SAML processors, XML signature verifiers, API validators - that treats a clean xmldom parse as a validity certificate.
XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injected verbatim into serialized XML or HTML output. Applications using @xmldom/xmldom prior to 0.8.14 or 0.9.11, or the legacy xmldom package at any version, are affected when they pass externally-supplied strings to Document.createElement() and then serialize the resulting DOM with XMLSerializer.serializeToString(). The serializer's requireWellFormed: true path failed to validate element qualified names and synthesized xmlns:PREFIX declarations against the XML QName production, meaning malformed names containing characters such as '>' or '<' pass through unchecked and cause XSS when the output is rendered in a browser. No public exploit has been identified at time of analysis, though the GitHub security advisory and PR diffs include explicit test cases demonstrating injection payloads.
Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Use-after-free in Firefox's DOM Core & HTML component allows network-reachable attackers to achieve limited memory disclosure and DOM integrity impact against users running Firefox below version 155 or Firefox ESR below 153.2. Exploitation requires user interaction - a victim must visit or be redirected to attacker-controlled content - but no authentication or elevated privileges are needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Mozilla has released patched versions addressing the flaw.
Use-after-free in Firefox's Audio/Video component exposes users running Firefox prior to version 155 and affected ESR branches to potential heap memory disclosure and limited data modification when processing attacker-controlled media. The vulnerability is network-reachable but requires user interaction - visiting a malicious or compromised page that triggers media playback - and carries a CVSS score of 5.4 reflecting bounded C:L/I:L impact with no availability loss. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation status as none and the vulnerability as non-automatable.
Quadratic time complexity in pypdf's `read_until_whitespace` function allows remote unauthenticated attackers to cause denial of service by supplying a crafted PDF containing a long non-whitespace byte stream. All versions prior to 6.15.0 accumulate bytes via immutable concatenation in a single-byte loop, producing O(N²) processing cost that stalls Python worker processes and degrades availability of any PDF-parsing pipeline exposed to untrusted input. A confirmed patch is available as version 6.15.0; no active exploitation has been identified at the time of analysis.
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore-scripts safety flag entirely. Affected are pnpm v10 before 10.34.5 and v11 before 11.11.0: the package manager's name validation in pickPackage.ts rejects slash characters only for unscoped package names, permitting a scoped name such as @evil/../../../home/user/.bashrc to pass unchecked into raw path joins across three resolver modules and extract package content to any attacker-controlled path. No public exploit has been identified at time of analysis, though GitHub-confirmed patches with regression tests are available.
Arbitrary file write in pnpm package manager versions before 10.34.5 and 11.0.0-11.11.0 allows an attacker who can supply a crafted `pnpm-lock.yaml` to escape the `node_modules` directory boundary and place package contents at attacker-controlled filesystem paths when a developer runs `pnpm install`. Even `--ignore-scripts` does not prevent the file-write primitive; when the project additionally enables `dangerouslyAllowAllBuilds` or a matching `allowBuilds` configuration entry, the escaped package's lifecycle scripts execute with the victim user's OS-level privileges. Vendor-released patches are available as pnpm 10.34.5 and 11.11.0; no public exploit has been identified at time of analysis.
Privilege escalation in zbus_polkit before 5.1.0 stems from Subject::new_for_owner() encoding the UID as D-Bus type u (unsigned 32-bit) rather than the type i (signed 32-bit) mandated by org.freedesktop.PolicyKit1.Authority, silently nullifying any caller-supplied UID and causing polkit to fall back to a TOCTOU-vulnerable /proc PID lookup. Applications that pass SO_PEERCRED-derived UIDs specifically to defend against PID reuse receive no benefit, as the value is discarded before polkit processes the authorization subject. A local low-privileged attacker who causes an authorized process to exit and wins the PID reassignment race is granted that process's polkit authorization; no public exploit code has been identified at time of analysis.
Denial of service in SmallRye GraphQL allows unauthenticated remote attackers to exhaust server CPU or heap memory by submitting a GraphQL query containing a large-exponent float literal (e.g., 1e999999999) that triggers unconstrained BigInteger allocation during scalar coercion. Affected deployments include any application built on Red Hat Build of Quarkus that exposes a GraphQL endpoint via SmallRye GraphQL. No public exploit or KEV listing has been identified at time of analysis, though the attack technique is trivially constructible from the public description.
Uncontrolled recursion in Samsung's rlottie animation library crashes any application embedding it when processing a crafted Lottie animation file containing pathologically nested shape-group structures. The flaw resides in lottieparser.cpp's parseGroupObject() function, which processed nested shape groups recursively without any depth ceiling, enabling stack exhaustion via a malicious .lottie/.json file. No active exploitation is confirmed and no public exploit has been identified at time of analysis; this is a local, user-interaction-dependent denial-of-service vulnerability.
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts, which default to unlimited, allowing unauthenticated remote attackers to exhaust JVM heap memory or hold connections open indefinitely until the server crashes. Affected deployments span Red Hat JBoss EAP 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Undertow packages in RHEL 8, 9, and 10. No public exploit code has been identified at time of analysis, though the attack primitive requires no specialized tooling and has no complexity or authentication barrier.
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. A reporter-verified proof-of-concept demonstrating the full interception flow against a self-signed HTTPS OAuth endpoint exists; no confirmed active exploitation in CISA KEV at time of analysis.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message normalization in all versions prior to 8.0.9, allowing attackers with control over message content fields to read local filesystem content or trigger outbound SSRF-style HTTP requests. Applications that use jsonTransport as a safe serializer or queue payload generator while trusting those access-control options as a security boundary are the primary affected population. No public exploit code has been identified and the CVE is not in CISA KEV, but the flaw's mechanics are straightforward and fully documented in the GHSA advisory.
Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level `raw` option. The `disableFileAccess` and `disableUrlAccess` flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a `MimeNode` is constructed for a `raw` message in `lib/mail-composer/index.js:34-35`, leaving the raw path completely unrestricted. Exfiltrated file contents or HTTP response bodies are delivered as the actual RFC822 message via every supported transport (SMTP, SES, sendmail, stream, JSON) to an attacker-controlled recipient. A local PoC is confirmed per GHSA-p6gq-j5cr-w38f; no KEV listing and no EPSS data are available.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's History Backend by sending crafted requests targeting the `UA_DataValue_backend_copyRange` function in the in-memory history data plugin. The impact is availability loss only - no confidentiality or integrity compromise. A public proof-of-concept exists via a GitHub issue, and the project closed the disclosure report on procedural grounds rather than issuing a formal security advisory.
CVE-2026-80489 cannot be meaningfully summarized - the description is absent and no CVSS, CWE, CPE, EPSS, KEV, or patch data was provided. The sole intelligence signal is a Ubuntu vendor report, suggesting the affected package may be distributed via Ubuntu repositories, but the specific product, vulnerability class, and impact are entirely unconfirmed. No exploitation status, severity, or affected scope can be determined from available data.
Exponential backtracking ReDoS in Protego (pip/protego <= 0.6.1) allows any party who can serve a crafted robots.txt to freeze the `can_fetch()` call indefinitely, denying service to any application using this library for robots.txt compliance. A working proof-of-concept is publicly available in the GitHub security advisory GHSA-wjmf-p669-5m5p; the CVSS 4.0 score of 7.1 (VA:H) reflects meaningful availability risk for web-crawling deployments. No public exploit identified at time of analysis beyond the published PoC, and no CISA KEV listing exists.
Use-after-free (CWE-416) in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to crash the browser through a crafted webpage, resulting in a denial-of-service condition. Critically, the CVE description claims code execution capability, but the CVSS vector (C:N/I:N/A:L, score 4.3) directly contradicts this - a genuine RCE would produce C:H/I:H impact in the 8-9+ range; this discrepancy should be verified against the full MSRC advisory. No active exploitation has been confirmed and no public POC has been reported; a vendor patch is available via the Microsoft Security Response Center.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
Unauthenticated access to Spring Boot Actuator management endpoints in Zipkin through 3.6.1 exposes sensitive operational data and configuration controls on the same port as the tracing API. Remote attackers with network reach to the Zipkin API port can read environment variables, bean configurations, and storage backend credentials via endpoints such as /actuator/env and /actuator/beans, or silently suppress security-relevant logging by modifying log levels via /actuator/loggers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.
Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.
vmclock in the Linux kernel exposes a shared ABI memory page that a low-privileged guest process can upgrade from read-only to writable using mprotect(), allowing direct corruption of host-maintained timekeeping fields including sequence counters, UTC time, and TSC offsets. Affected deployments are virtualized Linux guests running kernels prior to patched stable releases 6.18.47, 7.2.1, and 7.1.11, where the vmclock miscdevice driver fails to clear VM_MAYWRITE on read-only mmap paths. No public exploit code has been identified at time of analysis, and EPSS at 0.15% (5th percentile) reflects low observed exploitation pressure despite a CVSS 8.8 score driven by the scope-changing guest-to-host integrity impact.
Out-of-bounds memory write in the Linux kernel's device tree reserved memory subsystem allows an attacker with control over device tree content to corrupt kernel memory at boot time, with theoretical full kernel compromise (C:H/I:H/A:H). The fdt_scan_reserved_mem() function writes past the end of a fixed-size local array when a device tree blob defines more dynamically-placed /reserved-memory subnodes than MAX_RESERVED_REGIONS allows. Despite a CVSS score of 8.4, exploitation is heavily constrained by the requirement to modify device tree content before boot - a capability requiring privileged firmware access - and EPSS at 0.16% (5th percentile) reflects negligible observed exploitation probability. No public exploit has been identified and the vulnerability is absent from CISA KEV.
Insufficient validation of S1G (802.11ah/Wi-Fi HaLow) Target Wake Time setup frames in the Linux kernel's mac80211 subsystem allows an unauthenticated adjacent-network attacker to submit a malformed individual TWT agreement whose parameter block is shorter than the full struct ieee80211_twt_params. The driver callback drv_add_twt_setup() and associated kernel tracepoint both consume the complete parameters structure regardless of the truncated length, potentially triggering kernel memory corruption, out-of-bounds reads exposing sensitive kernel memory, or a denial-of-service crash. No public exploit code has been identified, CISA KEV listing is absent, and patches are confirmed across seven stable kernel branches; real-world exposure is substantially narrowed by the requirement for S1G hardware.
Dangling pointer dereference in the Linux kernel Bluetooth ISO subsystem exposes systems running kernel versions prior to 6.18.44, 7.1.8, and 7.2 to potential kernel memory corruption from adjacent Bluetooth attackers. After iso_conn_del() is invoked, ISO sockets may continue to dereference the freed hcon (HCI connection) pointer due to imprecise reference-counting logic, creating a use-after-free-class condition in kernel space. Despite a high NVD CVSS score of 8.8, the EPSS rating of 0.15% (5th percentile) and absence from CISA KEV indicate no public exploit or observed active exploitation at time of analysis.
Deadlock in the Linux kernel's iomap subsystem allows local attackers to cause a denial of service by exhausting the shared bioset used by both iomap_split_ioend and its input bios. The circular dependency in bioset allocation halts I/O completion on iomap-backed filesystems (XFS, ext4 direct I/O) and can hang the affected system. No active exploitation has been confirmed (not in CISA KEV) and the EPSS probability is very low at 0.15% (5th percentile), but the impact on availability is total for the affected I/O path.
Bitmap overflow and incorrect global accounting in the Linux kernel's percpu-km memory allocator (`mm/percpu-km`) allow a local low-privileged attacker on SMP/NUMA systems to corrupt kernel memory, with potential for privilege escalation or kernel crash. Two separate commits introduced the flaws: a63d4ac4ab609 caused `pcpu_create_chunk()` to write beyond the `chunk->populated` bitmap when `nr_units > 1`, and b539b87fed37f introduced the companion `pcpu_nr_empty_pop_pages` accounting error. Fixes have been backported to eight stable kernel branches (5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2); no public exploit has been identified at time of analysis.
Out-of-bounds read in the Linux kernel SCTP subsystem leaks up to four bytes of receive-buffer tail memory to remote unauthenticated attackers via a malformed INIT chunk. When an Adaptation Layer Indication parameter is sent with only its 4-byte header (omitting the mandatory 32-bit Adaptation Code Point), the kernel reads past the declared parameter boundary and copies those bytes into the state cookie of the INIT ACK response, exposing them to the peer. No public exploit has been identified and EPSS of 0.16% (6th percentile) indicates low exploitation probability, though the unauthenticated, network-accessible attack surface on any SCTP-enabled system warrants prompt patching.
Use-after-free in the Linux kernel ALSA PCM subsystem allows a local low-privilege attacker to corrupt kernel memory by exploiting a race between snd_pcm_drain() and snd_pcm_unlink() on linked streams. When a drain wait terminates by signal or timeout while group membership is concurrently modified by an unlink, a stack-allocated wait queue entry is left queued on a freed peer stream's sleep list; a subsequent wake_up() call then dereferences that freed stack frame. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS of 0.16% (6th percentile) reflects low near-term exploitation probability.
Use-after-free in the Linux kernel's IPVS (IP Virtual Server) connection-synchronization path allows corruption of the connection hash table on backup directors running the IPVS sync daemon. When a synced connection is bound to a destination that carries the IP_VS_CONN_F_ONE_PACKET flag, expiry logic wrongly skips unlinking the conn_tab node, leaving a stale hash entry pointing at a freed struct ip_vs_conn. There is no public exploit identified at time of analysis and EPSS is very low (0.16%), so despite the auto-assigned 9.8 rating this is a memory-safety defect in a specialized load-balancing feature rather than a broadly weaponizable RCE.
Restriction bypass in the Linux kernel's io_uring subsystem allows a local low-privileged user to shed per-task io_uring security restrictions by executing exec(). When a task that has established io_uring restrictions calls exec(), the kernel's exec cancellation path invokes __io_uring_free(), which incorrectly frees both the task context and the per-task restriction simultaneously. Any io_uring ring created by the post-exec process is then entirely unrestricted, defeating sandbox and policy enforcement intended to constrain io_uring operations. No public exploit has been identified at time of analysis, but the CVSS score of 8.4 with Changed Scope (S:C) reflects that the bypass can expose confidentiality and integrity of resources guarded by the dropped restrictions.
The spi-qpic-snand NAND flash driver in Linux kernel 6.18 and later contains a command-ordering defect that causes every SET_FEATURE write to apply the previous operation's value rather than the intended one, producing an off-by-one effect. On Qualcomm IPQ5018-based hardware (confirmed on TP-Link Archer AX55 v1 with ESMT F50L1G41LB flash), this defect became destructive in v6.18 when SPI-NAND OTP support was introduced: the 'disable OTP mode' call erroneously leaves CFG_OTP_ENABLE set permanently, causing all subsequent flash reads to return OTP area content and all writes to fail with -EIO, rendering the device unbootable. No public exploit identified at time of analysis; EPSS of 0.15% (5th percentile) correctly reflects that this is a driver logic defect rather than a traditionally attacker-controllable vulnerability.
Integer truncation in the Linux kernel s390/dasd ECKD driver exposes IBM Z systems to a heap buffer overflow via a caller-controlled track range supplied to dasd_eckd_check_device_format(). The root cause is that fmt_buffer_size is declared as int while the buffer-size expression evaluates at size_t width, causing the result to be silently truncated on assignment; kzalloc() then allocates a buffer far smaller than needed, while the subsequent channel program builder operates on the untruncated track count and writes past the allocation. Systems running unpatched kernels before 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2 on s390 architecture face potential kernel heap corruption with consequences ranging from denial of service to local privilege escalation. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Heap out-of-bounds memory access in the Linux kernel s390/zcrypt subsystem exposes EP11 crypto card administrative paths to local low-privileged users. The flaw resides in the domain value upper-limit check processed when sending EP11 CPRBs (Control Program Request Blocks) through custom zcrypt device nodes - the missing AP_DOMAINS (256) ceiling allows an attacker-supplied domain index to reach heap memory beyond the `perms->adm` structure. No public exploit code has been identified and this is not listed in CISA KEV, but the CVSS 7.8 local vector and confirmed multi-version patch backports across stable kernel branches indicate the Linux security team treats the impact as high. EPSS at 0.16% (6th percentile) reflects the platform-specific nature of the flaw.
Uninitialized receive buffer allocation in the Linux kernel's CAN J1939 transport layer exposes residual kernel heap memory to J1939 session participants. The function j1939_session_fresh_new() allocates a buffer without zeroing it, meaning any system running a CAN-capable Linux kernel with J1939 transport support may leak prior heap contents to peers exchanging Extended Transport Protocol (ETP) messages. No public exploit has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), consistent with a low-exploitation-probability kernel information-disclosure flaw in a specialized networking subsystem.
Out-of-bounds read and write vulnerabilities in the Linux kernel's softing CAN driver `fw_parse()` function allow a local low-privileged attacker to corrupt kernel DPRAM memory by supplying a crafted firmware image. Affected kernels span from 2.6.38 through pre-patch stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2), with fixes backported across all active stable trees. No public exploit or active exploitation has been identified at time of analysis.
Memory corruption in the Linux kernel's VMware graphics (vmwgfx) DRM driver allows a local, low-privileged user on a VMware guest system to corrupt MOB (Memory Object Buffer) allocation metadata, leading to out-of-bounds reads or writes with high confidentiality, integrity, and availability impact. A field-naming bug in vmwgfx_resource.c writes boolean literals (0/false and 1/true) to the guest_memory_size unsigned-long field instead of the adjacent guest_memory_dirty bitfield, causing subsequent size-dependent operations to compute zero-length or wrap-around memory ranges on the MOB bitmap. No public exploit has been identified at time of analysis; EPSS is very low at 0.17% (6th percentile), though the CVSS 7.8 score reflects meaningful severity if triggered locally on a VMware guest.
Out-of-bounds memory corruption in the Linux kernel's vmwgfx DRM driver (vmw_external_bo_copy()) allows a local attacker with low-privilege DRM access to corrupt kernel memory via a crafted atomic display commit using an imported dma-buf framebuffer. Two distinct code paths are vulnerable: the equal-stride memcpy path suffers unsigned integer underflow when caller-supplied offsets exceed the buffer object size, and the non-equal-stride row-by-row path performs no bounds validation at all, allowing the copy loop to walk arbitrarily past the vmap end. Vendor-released patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid f_path for page cache sharing Previously, backing files for page cache sharing were set up with f_path left as NULL (only f_inode was valid). It worked, but a recent mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on 7.2-rc4): BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy) Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014 RIP: 0010:__do_sys_mincore+0xc0/0x2c0 ... Specify valid paths using valid disconnected dentries together with erofs_ishare_mnt instead of leaving f_path empty, so they are more like real backing files in a pseudo filesystem and standard backing_file_open() can be used directly.
Out-of-bounds memory access in the Linux kernel's ltc4282 hwmon driver exposes systems with this hardware monitor to kernel memory disclosure or destabilization via the VGPIO minimum alarm voltage sysfs read path. A missing return statement in the driver causes the kernel to access memory beyond intended bounds when a local user reads the VGPIO channel's minimum alarm voltage attribute. Patch versions are available across multiple stable branches; no public exploit exists and EPSS sits at 0.17% (6th percentile), indicating very low current exploitation pressure despite the 7.8 CVSS score.
Denial of service in the Linux kernel's MediaTek mtk_eth_soc Ethernet driver: mtk_poll_controller() passed a net_device pointer to mtk_handle_irq_rx(), which expects a struct mtk_eth pointer (the value registered as the request_irq cookie). When CONFIG_NET_POLL_CONTROLLER is enabled and the ndo_poll_controller path is exercised (e.g. via netconsole/netpoll), the resulting bad-pointer dereference crashes the kernel. Only devices using the MediaTek SoC Ethernet driver are affected; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds slab write in the Linux kernel idpf network driver lets a malicious or compromised control plane (a PF or a hypervisor's device model) corrupt kernel heap memory during interrupt-vector setup. idpf_get_reg_intr_vecs() fills the reg_vals[] array bounded only by per-chunk num_vectors from a VIRTCHNL2_OP_ALLOC_VECTORS reply, which is never reconciled against the smaller num_allocated_vectors used to size the allocation, so a reply whose chunk counts sum higher writes struct idpf_vec_regs entries past the buffer. It carries a CVSS of 9.3, but EPSS is only 0.15%, it is not on CISA KEV, and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem exposes systems running vulnerable kernel versions (6.6.51-pre-6.7 and 6.8.9-pre-6.9) to potential kernel-context memory corruption from an adjacent attacker with no privileges required. The race condition occurs when hci_connect_acl/le_sync() callbacks dereference a freed hci_conn object during concurrent connection teardown, yielding a theoretical path to arbitrary code execution or kernel panic. No public exploit code has been identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates very low observed exploitation activity.
Null pointer dereference in the Linux kernel's SCSI target iblock driver crashes the kernel when processing Persistent Reservation PREEMPT or RELEASE operations against storage backends with unimplemented PR hooks. Systems running the kernel as an iSCSI target are vulnerable - an attacker who can issue SCSI Persistent Reservation commands can trigger a kernel panic, causing a complete denial of service. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but patches are available across multiple stable branches and should be applied promptly on iSCSI target infrastructure.
Out-of-bounds vmemmap read in the Linux kernel's mm/util snapshot_page() crashes or leaks kernel memory during page isolation on memory-remove paths. The function incorrectly reads __page_2 when nr_pages > 1 rather than the correct threshold of nr_pages > 2, causing an illegal access into an adjacent, unmapped vmemmap section when an order-1 folio sits at a vmemmap section boundary. This was observed producing a kernel oops on ppc64le systems during DLPAR memory remove on a 22 TB LPAR. No public exploit is identified and EPSS is 0.17%, but the defect can cause a local denial-of-service or kernel memory disclosure. Patches are available across multiple stable kernel branches.
Denial-of-service in the Linux kernel's KVM subsystem on IBM Z (s390) mainframes stems from an unchecked airq_iv_create() return value in the zPCI adaptive-interrupt path. When AIBV allocation fails, zdev->aibv is left NULL and later dereferenced in kvm_zpci_set_airq(), crashing the host kernel. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.17% (7th percentile), consistent with a hard-to-trigger, resource-exhaustion-dependent bug rather than a broadly weaponizable flaw.
Use-after-free in the Linux kernel Bluetooth SCO subsystem allows an adjacent unauthenticated attacker to corrupt freed kernel memory by exploiting a reference-counting race between socket close() and Bluetooth controller Disconnection Complete events. The race causes sco_conn_del() to perform a double put on a kref, confirmed by KASAN as slab-use-after-free, with potential to escalate privileges or crash the system. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), consistent with the race condition complexity limiting practical exploitation.
Incorrect unit conversion in the RISC-V memory management subsystem causes vmemmap_start_pfn to be computed with a physically misaligned base, violating the mask-alignment requirement for compound_info encoding in the sparse memory model. Linux kernel versions incorporating commit 476849b0fba4 on RISC-V hardware where DRAM base is not aligned to MAX_FOLIO_NR_PAGES × PAGE_SIZE are affected - a condition confirmed on QEMU virt machines and potentially other RISC-V platforms. CVSS 7.8 (AV:L/PR:L/C:H/I:H/A:H) reflects potential local privilege escalation via kernel memory corruption; EPSS of 0.17% (7th percentile) and no CISA KEV listing indicate no observed exploitation activity. No public exploit is identified at time of analysis.
Use-after-free in the Linux kernel's VXLAN transmit path (vxlan_xmit) lets a stale Ethernet header pointer be dereferenced after route_shortcircuit() calls pskb_may_pull() and reallocates skb->head, corrupting or reading freed memory when accessing eth->h_dest. The flaw affects systems using a VXLAN overlay interface and is most realistically a denial-of-service (kernel crash) with potential information disclosure; no public exploit identified at time of analysis and EPSS is low (0.18%). It is not listed in CISA KEV and no proof-of-concept is known.
Use-after-free in the Linux kernel's AMD MP2 I2C driver (i2c-amd-mp2) enables local low-privileged users to corrupt kernel memory, potentially achieving privilege escalation or system crash on AMD hardware. The flaw occurs during driver probe: when i2c_add_adapter() fails, devres frees the platform I2C context, but the MP2 PCI driver retains a stale pointer in its IRQ and system-sleep callback table, allowing subsequent dereference of freed memory. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting the hardware-specific and error-path-dependent nature of this flaw; vendor-released patches are available across all major stable kernel branches.
Race condition and error-handling flaws in the i2c-imx I2C controller driver allow a NULL pointer dereference via the kernel interrupt handler on NXP i.MX SoC-based systems. The vulnerability affects multiple stable kernel branches (5.15 through 7.x) and is triggered when I2C slave registration fails partway through a PM runtime resume, leaving a stale or NULL pointer that the shared IRQ handler can dereference concurrently. The realistic impact is a kernel panic causing system unavailability; no public exploit exists and EPSS is 0.17%, consistent with no observed active exploitation.
Race condition in the Linux kernel's driver core `dev_has_sync_state()` exposes a TOCTOU (Time-of-Check Time-of-Use) flaw allowing local low-privileged users to potentially trigger kernel memory corruption, information disclosure, or a system crash. The function reads `dev->driver` twice without holding `device_lock()`, enabling a concurrent device unbind operation to clear the pointer between the NULL check and its subsequent dereference, resulting in use of a stale or NULL pointer in kernel context. No active exploitation has been identified (no CISA KEV listing, EPSS 0.18%), but the kernel-level impact class warrants prompt patching on affected stable branches.
The BPF signed loader in the Linux kernel fails to enforce map exclusivity before performing SHA-based integrity validation of metadata maps, allowing a local attacker with BPF privileges to race a mutation of the shared map's contents after the hash is computed but before validation completes. Systems running Linux kernel between commit fb2b0e290147ba01a53dfd92cf91058c9d2ee254 and the patched stable releases (6.18.40, 7.1.5, 7.2) are affected. Exploitation bypasses the integrity guarantees of the signed BPF loader, enabling the attacker to make the check pass on stale, attacker-controlled data; no public exploit exists and EPSS is 0.17% (6th percentile), indicating low current exploitation probability.
Out-of-bounds kernel memory reads in the Linux kernel's NTFS driver arise because ntfs_read_locked_inode() copies a resident $ATTRIBUTE_LIST into ni->attr_list via a plain memcpy() with no sanity checking, while only the non-resident path was ever validated by load_attribute_list(). A crafted NTFS volume with a malformed resident attribute list is then trusted by every subsequent walk (ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), ntfs_attrlist_need()), which read fixed-header fields past the buffer. The fix factors per-entry validation into ntfs_attr_list_entry_is_valid()/ntfs_attr_list_is_valid() and applies it on the resident path and inside load_attribute_list() itself; no public exploit identified at time of analysis and EPSS probability is very low (0.15%).
Out-of-bounds slab read in the Linux kernel's legacy in-kernel NTFS driver lets a crafted on-disk $ATTRIBUTE_LIST leak or crash adjacent kernel heap memory when a malicious NTFS volume is mounted and read. The flaw is in ntfs_external_attr_find(), where a look-ahead attribute-list entry is dereferenced past the end of the kvmalloc'd buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.15%, 5th percentile), and it is not listed in CISA KEV.
Out-of-bounds kernel heap read in the Linux kernel's classic in-tree NTFS driver (`fs/ntfs/`) allows a local, low-privileged user to disclose kernel memory - and potentially chain to privilege escalation - by mounting a crafted NTFS image at the filesystem layer. The flaw is a u16 integer truncation in `ntfs_check_restart_area()` that silently defeats a page-size bounds check, causing `ntfs_check_log_client_array()` to dereference up to ~64 KiB beyond an allocated heap buffer using attacker-controlled on-disk values. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.15% (5th percentile), reflecting negligible observed exploitation pressure.
Heap and integer-overflow memory corruption in the Linux kernel's userspace perf tool (perf sched) lets a malicious perf.data file corrupt memory when parsed by register_pid(). An analyst who runs 'perf sched' against an attacker-supplied perf.data trace can trigger out-of-bounds heap writes, an unchecked strcpy into a 20-byte comm buffer, and denial of service, potentially leading to code execution in the context of the user running perf. A vendor fix is available; EPSS is low (0.18%) and there is no public exploit identified at time of analysis.
Out-of-bounds heap read in the Linux kernel's perf userspace tooling (perf tools) lets a crafted perf.data file trigger memory disclosure or a crash when parsed. The flaw sits in machine__resolve(), which trusts an attacker-controlled CPU index (al->cpu) from sample data and indexes env->cpu[] without validating it against env->nr_cpus_avail; a large index reads past the heap allocation, and values like 65536 truncate to int16_t and silently resolve to CPU 0. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile).
Use-after-free / stale-pointer race in the Linux kernel netfilter nf_conntrack_expect subsystem was resolved by replacing the per-expectation timer API with the conntrack garbage-collection worker. Under the old timer scheme, expectation removal could lose a race with an expiring timer (timer_del() returning false), leaving an expectation referencing an already-released exp->master conntrack, enabling stale-pointer access. The issue affects systems using connection-tracking helpers/expectations (e.g. FTP, SIP, or nft_ct expectations); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.15% (5th percentile).
Availability denial in the Linux kernel's KVM ARM64 nested virtualization stack allows a guest VM to crash the host through improper Synchronous External Abort (SEA) handling when Stage 1 translation resolves a Guest Frame Number outside configured memory slots. Affected systems must run a vulnerable Linux 6.16-era kernel on ARM64 hardware with KVM nested virtualization explicitly enabled; fixed versions are 6.18.40, 7.1.5, and 7.2. No public exploit exists and no active exploitation is confirmed; EPSS stands at 0.18% (7th percentile), reflecting the niche attack surface.
NULL pointer dereference in the Linux kernel netfilter subsystem's xt_nat module allows a local attacker with low privileges to crash the kernel by instantiating SNAT or DNAT targets through the nft_compat compatibility layer using an unsupported bridge family, triggering a NULL dereference in nf_nat_setup_info(). Multiple stable kernel branches from 5.10 through 7.x are affected across numerous long-term support trees. No public exploit has been identified at time of analysis, and EPSS probability is very low at 0.18% (7th percentile); critically, the description itself notes the original crash was already mitigated by a prior upstream commit, making this patch a defense-in-depth hardening measure rather than a primary fix.
Symlink-based file clobbering in the Linux kernel's intel-speed-select daemon allows a local low-privileged user to redirect root-process writes to an attacker-chosen file by pre-positioning a symlink at the daemon's fixed /tmp pidfile path. Affected systems are those running Linux 5.18 through unpatched 6.x and 7.x branches on Intel Speed Select Technology hardware with the daemon active. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile), but the attack is mechanically simple and requires only a local shell account.
DNS rebinding bypass in OpenStack Glance's web-download URI validator allows authenticated tenant users to circumvent host-filter restrictions and force the image service to fetch arbitrary internal URLs, enabling full-read SSRF exfiltration via the image download API. The validator evaluates host filters against the raw pre-resolution hostname, creating a TOCTOU window: an attacker's domain passes the check resolving to a legitimate external IP, then DNS rebinding redirects the actual fetch to internal targets such as the cloud instance metadata service at 169.254.169.254. Glance versions 16.0.0 through 30.2.0, 31.0.0 through 31.1.0, and 32.0.0 are affected; no public exploit has been identified at time of analysis.
Server-side request forgery in OpenStack Glance 16.0.0 through 32.0.0 allows authenticated tenant users to make the image service fetch arbitrary internal URLs, including cloud metadata endpoints at 169.254.169.254, turning the image import pipeline into a full-read SSRF channel. Three related flaws (CVE-2026-71196, CVE-2026-71197, CVE-2026-71198) stem from insecure default host filtering in the web-download import method, a DNS rebinding bypass that evades the validator, and absent host filtering in the HTTP image location API respectively. Because Glance stores fetched bytes as downloadable image data, none of these are blind SSRF - the full response body is directly retrievable by the attacker. No public exploit has been identified, but the cloud-credential-theft impact warrants urgent remediation in any multi-tenant or internet-facing OpenStack deployment.
Full-read server-side request forgery in OpenStack Glance's HTTP image location API allows authenticated tenant users to exfiltrate arbitrary internal network resources, including cloud metadata endpoints, when the HTTP store backend is enabled. Unlike a typical blind SSRF, Glance stores the fetched content as image payload that the attacker can then download in full, making credential theft from the instance metadata service (169.254.169.254) directly achievable. CVE-2026-71198 is one of three coordinated SSRF issues (OSSA-2026-038) reported independently by Sergey Kanibor, Sami Yessou, and Abhishek Kekane; this specific variant was credited to Kekane of Red Hat.
Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to exhaust server CPU by submitting a small YAML document containing aliased sequences of empty mappings merged into many targets, triggering O(N×K) processing while the library's `maxTotalMergeKeys` safety counter is never incremented. Any Node.js application that exposes js-yaml parsing to untrusted input is affected, because merge key (`<<`) processing is enabled by default on both release lines. No confirmed active exploitation appears in CISA KEV at time of analysis, but the attack is trivially reproducible from the published advisory and pathological test case, and the library's ubiquity in the npm ecosystem makes this a high-priority availability risk.
Path traversal in Vitest's interceptorPlugin exposes local files on any development server with a network-accessible HMR WebSocket. The `vitest:interceptor:register` handler in `packages/mocker/src/node/interceptorPlugin.ts` accepts redirect mock registrations over Vite's unauthenticated HMR socket without calling `isFileLoadingAllowed()`, allowing a remote unauthenticated attacker who can reach the dev server to submit opaque-scheme URLs (e.g., `traversal:../../../etc/passwd`) whose `..` segments survive `URL.pathname` parsing and resolve outside the project root via `path.join()`. The plugin's `load` hook then returns `readFile(mock.redirect, 'utf-8')` as JavaScript module source, disclosing any file readable by the dev-server process. No public exploit or CISA KEV listing has been identified, but the GitHub fix PR includes a complete, working e2e test that serves as a functional PoC.
Execution-placement isolation bypass in Ansible Automation Platform's automation-controller (AWX) allows authenticated principals to route bulk jobs to instance groups they lack use-level authorization for. The Bulk Job Launch API endpoint (POST /api/v2/bulk/job_launch/) enforces only a read-level permission check on the instance_groups field, whereas the standard single-job launch path correctly requires use-level permission on the same field. A principal holding the built-in System Auditor role-or any role granting read but not use rights on instance groups-combined with execute permission on a job template can silently route automation workloads onto restricted infrastructure segments; no public exploit code has been identified at time of analysis.
Stored XSS in sanitize-html versions 1.9.0 through 2.17.6 allows authenticated low-privileged users to inject executable JavaScript via SVG SMIL animation elements that survive the library's scheme-policy sanitization. The sanitizer validates the `values` attribute as a single flat URL, missing that `attributeName="href"` gives `values` URI-list semantics under SVG SMIL; a payload of `#safe;javascript:alert(1)` passes the scheme check on its leading fragment while the `javascript:` entry survives intact. When a victim clicks the rendered link, the browser resolves the later entry and executes script in the application's origin. A working proof-of-concept is publicly disclosed in the GHSA advisory; no CISA KEV listing at time of analysis.
Exponential traversal denial-of-service in pypdf before 6.16.1 allows an attacker who can supply a crafted PDF to cause severe CPU stalls and memory exhaustion in any application invoking `PageObject._extract_text` or `PageObject.extract_xform_text`. The text extraction routines previously detected only direct cycles via a `known_ids` set, but failed to bound the total number of XForm invocations across a directed acyclic graph where each parent node reuses the same child XObject multiple times, producing O(2^n) traversal paths for n levels. No active exploitation or public exploit code has been identified; the fix is confirmed available in version 6.16.1.
Infinite loop denial of service in pypdf prior to 6.16.0 allows any attacker who can supply a crafted PDF to a pypdf-based write pipeline to permanently hang the processing worker. The root cause is in TreeObject.insert_child within pypdf/generic/_data_structures.py, which traverses /Next links without cycle detection; a PDF whose tree nodes form a circular reference (A→B→C→A) causes unbounded traversal. No public exploitation has been confirmed and no CISA KEV entry exists, but a functional proof-of-concept is embedded in the upstream fix PR (#3964).
Quadratic-time CPU exhaustion in Red Hat OpenShift Container Platform 4's OAuth login and error page endpoints allows unauthenticated remote attackers to deny authentication to all cluster users simultaneously. The attack exploits a bypass of the CVE-2022-32149 mitigation in golang.org/x/text/language.ParseAcceptLanguage(): the existing guard checks for hyphen ('-') character counts, but the BCP 47 scanner internally aliases underscore ('_') to '-' after the guard executes, allowing a crafted Accept-Language header with underscore subtag separators to slip through and trigger unbounded quadratic-time parsing. No public exploit has been identified at time of analysis, though the bypass mechanism is fully documented in the CVE description, meaningfully lowering the bar to exploitation.
Crash of the gvfsd-mtp daemon in gvfs is achievable by anyone who can connect a malicious USB MTP device to a target Linux system. The do_read() function in gvfsbackendmtp.c accepts the byte-count reported by the device at face value and passes it uncapped to memcpy(), causing an out-of-bounds read that triggers a segmentation fault when the device deliberately over-reports its response length. The vulnerability affects gvfs as packaged across Red Hat Enterprise Linux 6 through 10; no public exploit has been identified and exploitation is constrained by physical proximity.
Uninitialized heap memory disclosure in gvfs's SFTP backend enables a malicious SFTP server to deterministically defeat ASLR on client systems running RHEL 6 through 10. When a user mounts a crafted SFTP share, the read_string() parser allocates a buffer for the FXP_HANDLE response but does not verify that the buffer is fully populated; the client subsequently echoes the uninitialized remainder - containing heap base pointers and the libgio load address - back to the attacker on every subsequent file-handle request. No public exploit has been identified at time of analysis, and the issue does not appear in CISA KEV, but the ASLR bypass it achieves is a high-value precursor for chained memory-corruption attacks against gvfsd-sftp.
Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.
Unsafe PyYAML deserialization in ModelScope through v1.40.0 enables remote code execution when users load model configuration files from attacker-controlled repositories. The vulnerability exists in at least two documented components - the audio TTS voice module (voice.py) and the multimodal mPLUG configuration loader (configuration_mplug.py) - which use PyYAML's unsafe yaml.Loader that processes Python object construction tags such as !!python/object: during deserialization. An attacker who publishes a poisoned model repository can achieve full code execution on any victim system that loads the model, with no public exploit identified at time of analysis.
Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.
CPU exhaustion in Erlang/OTP's eldap library allows a malicious or compromised LDAP server to degrade availability by returning referral URLs containing port components composed of up to ~1.26 million digits. The function `eldap:parse_port/2` passes the port substring unbounded to Erlang's `list_to_integer/1`, which performs arbitrary-precision bignum arithmetic - consuming hundreds of milliseconds of CPU time per crafted referral. Exposure is limited to applications that explicitly pass server-supplied LDAP referrals to `eldap:parse_ldap_url/1`, as eldap itself never calls this function; no public exploit or CISA KEV listing exists at time of analysis.
Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through unvalidated characters in Document.createProcessingInstruction() targets. Versions prior to 0.8.15 and 0.9.12 - and all versions of the legacy xmldom package (0.6.0 and earlier, which has no fix) - emit malformed processing instructions when a target contains >, ?, whitespace, or other XML-Name-invalid characters, enabling injection of arbitrary XML structure into the serialized output. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.
Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small crafted HTML documents passed to DOMParser.parseFromString(). The parseHtmlSpecialContent function uses a case-sensitive indexOf() to locate closing tags for raw-text elements; when a mixed-case tag like </ScRiPt> is not found, indexOf() returns -1, and the subsequent substring(-1) call destabilizes parser progression and triggers O(N²) output amplification. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is unauthenticated and requires no access complexity beyond supplying crafted HTML to the parser.
Silent acceptance of malformed XML end tags in xmldom's DOMParser allows crafted input to bypass parse-before-trust well-formedness gates in security-sensitive Node.js applications. The flaw affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, as well as all versions of the legacy xmldom package (0.6.0 and earlier), for which no patch exists. No public exploit has been identified at time of analysis, but the parser differential is exploitable in any pipeline - SAML processors, XML signature verifiers, API validators - that treats a clean xmldom parse as a validity certificate.
XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injected verbatim into serialized XML or HTML output. Applications using @xmldom/xmldom prior to 0.8.14 or 0.9.11, or the legacy xmldom package at any version, are affected when they pass externally-supplied strings to Document.createElement() and then serialize the resulting DOM with XMLSerializer.serializeToString(). The serializer's requireWellFormed: true path failed to validate element qualified names and synthesized xmlns:PREFIX declarations against the XML QName production, meaning malformed names containing characters such as '>' or '<' pass through unchecked and cause XSS when the output is rendered in a browser. No public exploit has been identified at time of analysis, though the GitHub security advisory and PR diffs include explicit test cases demonstrating injection payloads.
Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Use-after-free in Firefox's DOM Core & HTML component allows network-reachable attackers to achieve limited memory disclosure and DOM integrity impact against users running Firefox below version 155 or Firefox ESR below 153.2. Exploitation requires user interaction - a victim must visit or be redirected to attacker-controlled content - but no authentication or elevated privileges are needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Mozilla has released patched versions addressing the flaw.
Use-after-free in Firefox's Audio/Video component exposes users running Firefox prior to version 155 and affected ESR branches to potential heap memory disclosure and limited data modification when processing attacker-controlled media. The vulnerability is network-reachable but requires user interaction - visiting a malicious or compromised page that triggers media playback - and carries a CVSS score of 5.4 reflecting bounded C:L/I:L impact with no availability loss. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation status as none and the vulnerability as non-automatable.
Quadratic time complexity in pypdf's `read_until_whitespace` function allows remote unauthenticated attackers to cause denial of service by supplying a crafted PDF containing a long non-whitespace byte stream. All versions prior to 6.15.0 accumulate bytes via immutable concatenation in a single-byte loop, producing O(N²) processing cost that stalls Python worker processes and degrades availability of any PDF-parsing pipeline exposed to untrusted input. A confirmed patch is available as version 6.15.0; no active exploitation has been identified at the time of analysis.
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore-scripts safety flag entirely. Affected are pnpm v10 before 10.34.5 and v11 before 11.11.0: the package manager's name validation in pickPackage.ts rejects slash characters only for unscoped package names, permitting a scoped name such as @evil/../../../home/user/.bashrc to pass unchecked into raw path joins across three resolver modules and extract package content to any attacker-controlled path. No public exploit has been identified at time of analysis, though GitHub-confirmed patches with regression tests are available.
Arbitrary file write in pnpm package manager versions before 10.34.5 and 11.0.0-11.11.0 allows an attacker who can supply a crafted `pnpm-lock.yaml` to escape the `node_modules` directory boundary and place package contents at attacker-controlled filesystem paths when a developer runs `pnpm install`. Even `--ignore-scripts` does not prevent the file-write primitive; when the project additionally enables `dangerouslyAllowAllBuilds` or a matching `allowBuilds` configuration entry, the escaped package's lifecycle scripts execute with the victim user's OS-level privileges. Vendor-released patches are available as pnpm 10.34.5 and 11.11.0; no public exploit has been identified at time of analysis.
Privilege escalation in zbus_polkit before 5.1.0 stems from Subject::new_for_owner() encoding the UID as D-Bus type u (unsigned 32-bit) rather than the type i (signed 32-bit) mandated by org.freedesktop.PolicyKit1.Authority, silently nullifying any caller-supplied UID and causing polkit to fall back to a TOCTOU-vulnerable /proc PID lookup. Applications that pass SO_PEERCRED-derived UIDs specifically to defend against PID reuse receive no benefit, as the value is discarded before polkit processes the authorization subject. A local low-privileged attacker who causes an authorized process to exit and wins the PID reassignment race is granted that process's polkit authorization; no public exploit code has been identified at time of analysis.
Denial of service in SmallRye GraphQL allows unauthenticated remote attackers to exhaust server CPU or heap memory by submitting a GraphQL query containing a large-exponent float literal (e.g., 1e999999999) that triggers unconstrained BigInteger allocation during scalar coercion. Affected deployments include any application built on Red Hat Build of Quarkus that exposes a GraphQL endpoint via SmallRye GraphQL. No public exploit or KEV listing has been identified at time of analysis, though the attack technique is trivially constructible from the public description.
Uncontrolled recursion in Samsung's rlottie animation library crashes any application embedding it when processing a crafted Lottie animation file containing pathologically nested shape-group structures. The flaw resides in lottieparser.cpp's parseGroupObject() function, which processed nested shape groups recursively without any depth ceiling, enabling stack exhaustion via a malicious .lottie/.json file. No active exploitation is confirmed and no public exploit has been identified at time of analysis; this is a local, user-interaction-dependent denial-of-service vulnerability.
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts, which default to unlimited, allowing unauthenticated remote attackers to exhaust JVM heap memory or hold connections open indefinitely until the server crashes. Affected deployments span Red Hat JBoss EAP 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Undertow packages in RHEL 8, 9, and 10. No public exploit code has been identified at time of analysis, though the attack primitive requires no specialized tooling and has no complexity or authentication barrier.
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. A reporter-verified proof-of-concept demonstrating the full interception flow against a self-signed HTTPS OAuth endpoint exists; no confirmed active exploitation in CISA KEV at time of analysis.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message normalization in all versions prior to 8.0.9, allowing attackers with control over message content fields to read local filesystem content or trigger outbound SSRF-style HTTP requests. Applications that use jsonTransport as a safe serializer or queue payload generator while trusting those access-control options as a security boundary are the primary affected population. No public exploit code has been identified and the CVE is not in CISA KEV, but the flaw's mechanics are straightforward and fully documented in the GHSA advisory.
Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level `raw` option. The `disableFileAccess` and `disableUrlAccess` flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a `MimeNode` is constructed for a `raw` message in `lib/mail-composer/index.js:34-35`, leaving the raw path completely unrestricted. Exfiltrated file contents or HTTP response bodies are delivered as the actual RFC822 message via every supported transport (SMTP, SES, sendmail, stream, JSON) to an attacker-controlled recipient. A local PoC is confirmed per GHSA-p6gq-j5cr-w38f; no KEV listing and no EPSS data are available.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's History Backend by sending crafted requests targeting the `UA_DataValue_backend_copyRange` function in the in-memory history data plugin. The impact is availability loss only - no confidentiality or integrity compromise. A public proof-of-concept exists via a GitHub issue, and the project closed the disclosure report on procedural grounds rather than issuing a formal security advisory.
CVE-2026-80489 cannot be meaningfully summarized - the description is absent and no CVSS, CWE, CPE, EPSS, KEV, or patch data was provided. The sole intelligence signal is a Ubuntu vendor report, suggesting the affected package may be distributed via Ubuntu repositories, but the specific product, vulnerability class, and impact are entirely unconfirmed. No exploitation status, severity, or affected scope can be determined from available data.
Exponential backtracking ReDoS in Protego (pip/protego <= 0.6.1) allows any party who can serve a crafted robots.txt to freeze the `can_fetch()` call indefinitely, denying service to any application using this library for robots.txt compliance. A working proof-of-concept is publicly available in the GitHub security advisory GHSA-wjmf-p669-5m5p; the CVSS 4.0 score of 7.1 (VA:H) reflects meaningful availability risk for web-crawling deployments. No public exploit identified at time of analysis beyond the published PoC, and no CISA KEV listing exists.
Use-after-free (CWE-416) in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to crash the browser through a crafted webpage, resulting in a denial-of-service condition. Critically, the CVE description claims code execution capability, but the CVSS vector (C:N/I:N/A:L, score 4.3) directly contradicts this - a genuine RCE would produce C:H/I:H impact in the 8-9+ range; this discrepancy should be verified against the full MSRC advisory. No active exploitation has been confirmed and no public POC has been reported; a vendor patch is available via the Microsoft Security Response Center.
Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.
Unauthenticated access to Spring Boot Actuator management endpoints in Zipkin through 3.6.1 exposes sensitive operational data and configuration controls on the same port as the tracing API. Remote attackers with network reach to the Zipkin API port can read environment variables, bean configurations, and storage backend credentials via endpoints such as /actuator/env and /actuator/beans, or silently suppress security-relevant logging by modifying log levels via /actuator/loggers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.
Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.
Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.
Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.
vmclock in the Linux kernel exposes a shared ABI memory page that a low-privileged guest process can upgrade from read-only to writable using mprotect(), allowing direct corruption of host-maintained timekeeping fields including sequence counters, UTC time, and TSC offsets. Affected deployments are virtualized Linux guests running kernels prior to patched stable releases 6.18.47, 7.2.1, and 7.1.11, where the vmclock miscdevice driver fails to clear VM_MAYWRITE on read-only mmap paths. No public exploit code has been identified at time of analysis, and EPSS at 0.15% (5th percentile) reflects low observed exploitation pressure despite a CVSS 8.8 score driven by the scope-changing guest-to-host integrity impact.
Out-of-bounds memory write in the Linux kernel's device tree reserved memory subsystem allows an attacker with control over device tree content to corrupt kernel memory at boot time, with theoretical full kernel compromise (C:H/I:H/A:H). The fdt_scan_reserved_mem() function writes past the end of a fixed-size local array when a device tree blob defines more dynamically-placed /reserved-memory subnodes than MAX_RESERVED_REGIONS allows. Despite a CVSS score of 8.4, exploitation is heavily constrained by the requirement to modify device tree content before boot - a capability requiring privileged firmware access - and EPSS at 0.16% (5th percentile) reflects negligible observed exploitation probability. No public exploit has been identified and the vulnerability is absent from CISA KEV.
Insufficient validation of S1G (802.11ah/Wi-Fi HaLow) Target Wake Time setup frames in the Linux kernel's mac80211 subsystem allows an unauthenticated adjacent-network attacker to submit a malformed individual TWT agreement whose parameter block is shorter than the full struct ieee80211_twt_params. The driver callback drv_add_twt_setup() and associated kernel tracepoint both consume the complete parameters structure regardless of the truncated length, potentially triggering kernel memory corruption, out-of-bounds reads exposing sensitive kernel memory, or a denial-of-service crash. No public exploit code has been identified, CISA KEV listing is absent, and patches are confirmed across seven stable kernel branches; real-world exposure is substantially narrowed by the requirement for S1G hardware.
Dangling pointer dereference in the Linux kernel Bluetooth ISO subsystem exposes systems running kernel versions prior to 6.18.44, 7.1.8, and 7.2 to potential kernel memory corruption from adjacent Bluetooth attackers. After iso_conn_del() is invoked, ISO sockets may continue to dereference the freed hcon (HCI connection) pointer due to imprecise reference-counting logic, creating a use-after-free-class condition in kernel space. Despite a high NVD CVSS score of 8.8, the EPSS rating of 0.15% (5th percentile) and absence from CISA KEV indicate no public exploit or observed active exploitation at time of analysis.
Deadlock in the Linux kernel's iomap subsystem allows local attackers to cause a denial of service by exhausting the shared bioset used by both iomap_split_ioend and its input bios. The circular dependency in bioset allocation halts I/O completion on iomap-backed filesystems (XFS, ext4 direct I/O) and can hang the affected system. No active exploitation has been confirmed (not in CISA KEV) and the EPSS probability is very low at 0.15% (5th percentile), but the impact on availability is total for the affected I/O path.
Bitmap overflow and incorrect global accounting in the Linux kernel's percpu-km memory allocator (`mm/percpu-km`) allow a local low-privileged attacker on SMP/NUMA systems to corrupt kernel memory, with potential for privilege escalation or kernel crash. Two separate commits introduced the flaws: a63d4ac4ab609 caused `pcpu_create_chunk()` to write beyond the `chunk->populated` bitmap when `nr_units > 1`, and b539b87fed37f introduced the companion `pcpu_nr_empty_pop_pages` accounting error. Fixes have been backported to eight stable kernel branches (5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2); no public exploit has been identified at time of analysis.
Out-of-bounds read in the Linux kernel SCTP subsystem leaks up to four bytes of receive-buffer tail memory to remote unauthenticated attackers via a malformed INIT chunk. When an Adaptation Layer Indication parameter is sent with only its 4-byte header (omitting the mandatory 32-bit Adaptation Code Point), the kernel reads past the declared parameter boundary and copies those bytes into the state cookie of the INIT ACK response, exposing them to the peer. No public exploit has been identified and EPSS of 0.16% (6th percentile) indicates low exploitation probability, though the unauthenticated, network-accessible attack surface on any SCTP-enabled system warrants prompt patching.
Use-after-free in the Linux kernel ALSA PCM subsystem allows a local low-privilege attacker to corrupt kernel memory by exploiting a race between snd_pcm_drain() and snd_pcm_unlink() on linked streams. When a drain wait terminates by signal or timeout while group membership is concurrently modified by an unlink, a stack-allocated wait queue entry is left queued on a freed peer stream's sleep list; a subsequent wake_up() call then dereferences that freed stack frame. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS of 0.16% (6th percentile) reflects low near-term exploitation probability.
Use-after-free in the Linux kernel's IPVS (IP Virtual Server) connection-synchronization path allows corruption of the connection hash table on backup directors running the IPVS sync daemon. When a synced connection is bound to a destination that carries the IP_VS_CONN_F_ONE_PACKET flag, expiry logic wrongly skips unlinking the conn_tab node, leaving a stale hash entry pointing at a freed struct ip_vs_conn. There is no public exploit identified at time of analysis and EPSS is very low (0.16%), so despite the auto-assigned 9.8 rating this is a memory-safety defect in a specialized load-balancing feature rather than a broadly weaponizable RCE.
Restriction bypass in the Linux kernel's io_uring subsystem allows a local low-privileged user to shed per-task io_uring security restrictions by executing exec(). When a task that has established io_uring restrictions calls exec(), the kernel's exec cancellation path invokes __io_uring_free(), which incorrectly frees both the task context and the per-task restriction simultaneously. Any io_uring ring created by the post-exec process is then entirely unrestricted, defeating sandbox and policy enforcement intended to constrain io_uring operations. No public exploit has been identified at time of analysis, but the CVSS score of 8.4 with Changed Scope (S:C) reflects that the bypass can expose confidentiality and integrity of resources guarded by the dropped restrictions.
The spi-qpic-snand NAND flash driver in Linux kernel 6.18 and later contains a command-ordering defect that causes every SET_FEATURE write to apply the previous operation's value rather than the intended one, producing an off-by-one effect. On Qualcomm IPQ5018-based hardware (confirmed on TP-Link Archer AX55 v1 with ESMT F50L1G41LB flash), this defect became destructive in v6.18 when SPI-NAND OTP support was introduced: the 'disable OTP mode' call erroneously leaves CFG_OTP_ENABLE set permanently, causing all subsequent flash reads to return OTP area content and all writes to fail with -EIO, rendering the device unbootable. No public exploit identified at time of analysis; EPSS of 0.15% (5th percentile) correctly reflects that this is a driver logic defect rather than a traditionally attacker-controllable vulnerability.
Integer truncation in the Linux kernel s390/dasd ECKD driver exposes IBM Z systems to a heap buffer overflow via a caller-controlled track range supplied to dasd_eckd_check_device_format(). The root cause is that fmt_buffer_size is declared as int while the buffer-size expression evaluates at size_t width, causing the result to be silently truncated on assignment; kzalloc() then allocates a buffer far smaller than needed, while the subsequent channel program builder operates on the untruncated track count and writes past the allocation. Systems running unpatched kernels before 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2 on s390 architecture face potential kernel heap corruption with consequences ranging from denial of service to local privilege escalation. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Heap out-of-bounds memory access in the Linux kernel s390/zcrypt subsystem exposes EP11 crypto card administrative paths to local low-privileged users. The flaw resides in the domain value upper-limit check processed when sending EP11 CPRBs (Control Program Request Blocks) through custom zcrypt device nodes - the missing AP_DOMAINS (256) ceiling allows an attacker-supplied domain index to reach heap memory beyond the `perms->adm` structure. No public exploit code has been identified and this is not listed in CISA KEV, but the CVSS 7.8 local vector and confirmed multi-version patch backports across stable kernel branches indicate the Linux security team treats the impact as high. EPSS at 0.16% (6th percentile) reflects the platform-specific nature of the flaw.
Uninitialized receive buffer allocation in the Linux kernel's CAN J1939 transport layer exposes residual kernel heap memory to J1939 session participants. The function j1939_session_fresh_new() allocates a buffer without zeroing it, meaning any system running a CAN-capable Linux kernel with J1939 transport support may leak prior heap contents to peers exchanging Extended Transport Protocol (ETP) messages. No public exploit has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), consistent with a low-exploitation-probability kernel information-disclosure flaw in a specialized networking subsystem.
Out-of-bounds read and write vulnerabilities in the Linux kernel's softing CAN driver `fw_parse()` function allow a local low-privileged attacker to corrupt kernel DPRAM memory by supplying a crafted firmware image. Affected kernels span from 2.6.38 through pre-patch stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2), with fixes backported across all active stable trees. No public exploit or active exploitation has been identified at time of analysis.
Memory corruption in the Linux kernel's VMware graphics (vmwgfx) DRM driver allows a local, low-privileged user on a VMware guest system to corrupt MOB (Memory Object Buffer) allocation metadata, leading to out-of-bounds reads or writes with high confidentiality, integrity, and availability impact. A field-naming bug in vmwgfx_resource.c writes boolean literals (0/false and 1/true) to the guest_memory_size unsigned-long field instead of the adjacent guest_memory_dirty bitfield, causing subsequent size-dependent operations to compute zero-length or wrap-around memory ranges on the MOB bitmap. No public exploit has been identified at time of analysis; EPSS is very low at 0.17% (6th percentile), though the CVSS 7.8 score reflects meaningful severity if triggered locally on a VMware guest.
Out-of-bounds memory corruption in the Linux kernel's vmwgfx DRM driver (vmw_external_bo_copy()) allows a local attacker with low-privilege DRM access to corrupt kernel memory via a crafted atomic display commit using an imported dma-buf framebuffer. Two distinct code paths are vulnerable: the equal-stride memcpy path suffers unsigned integer underflow when caller-supplied offsets exceed the buffer object size, and the non-equal-stride row-by-row path performs no bounds validation at all, allowing the copy loop to walk arbitrarily past the vmap end. Vendor-released patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid f_path for page cache sharing Previously, backing files for page cache sharing were set up with f_path left as NULL (only f_inode was valid). It worked, but a recent mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on 7.2-rc4): BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy) Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014 RIP: 0010:__do_sys_mincore+0xc0/0x2c0 ... Specify valid paths using valid disconnected dentries together with erofs_ishare_mnt instead of leaving f_path empty, so they are more like real backing files in a pseudo filesystem and standard backing_file_open() can be used directly.
Out-of-bounds memory access in the Linux kernel's ltc4282 hwmon driver exposes systems with this hardware monitor to kernel memory disclosure or destabilization via the VGPIO minimum alarm voltage sysfs read path. A missing return statement in the driver causes the kernel to access memory beyond intended bounds when a local user reads the VGPIO channel's minimum alarm voltage attribute. Patch versions are available across multiple stable branches; no public exploit exists and EPSS sits at 0.17% (6th percentile), indicating very low current exploitation pressure despite the 7.8 CVSS score.
Denial of service in the Linux kernel's MediaTek mtk_eth_soc Ethernet driver: mtk_poll_controller() passed a net_device pointer to mtk_handle_irq_rx(), which expects a struct mtk_eth pointer (the value registered as the request_irq cookie). When CONFIG_NET_POLL_CONTROLLER is enabled and the ndo_poll_controller path is exercised (e.g. via netconsole/netpoll), the resulting bad-pointer dereference crashes the kernel. Only devices using the MediaTek SoC Ethernet driver are affected; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds slab write in the Linux kernel idpf network driver lets a malicious or compromised control plane (a PF or a hypervisor's device model) corrupt kernel heap memory during interrupt-vector setup. idpf_get_reg_intr_vecs() fills the reg_vals[] array bounded only by per-chunk num_vectors from a VIRTCHNL2_OP_ALLOC_VECTORS reply, which is never reconciled against the smaller num_allocated_vectors used to size the allocation, so a reply whose chunk counts sum higher writes struct idpf_vec_regs entries past the buffer. It carries a CVSS of 9.3, but EPSS is only 0.15%, it is not on CISA KEV, and there is no public exploit identified at time of analysis.
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem exposes systems running vulnerable kernel versions (6.6.51-pre-6.7 and 6.8.9-pre-6.9) to potential kernel-context memory corruption from an adjacent attacker with no privileges required. The race condition occurs when hci_connect_acl/le_sync() callbacks dereference a freed hci_conn object during concurrent connection teardown, yielding a theoretical path to arbitrary code execution or kernel panic. No public exploit code has been identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates very low observed exploitation activity.
Null pointer dereference in the Linux kernel's SCSI target iblock driver crashes the kernel when processing Persistent Reservation PREEMPT or RELEASE operations against storage backends with unimplemented PR hooks. Systems running the kernel as an iSCSI target are vulnerable - an attacker who can issue SCSI Persistent Reservation commands can trigger a kernel panic, causing a complete denial of service. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but patches are available across multiple stable branches and should be applied promptly on iSCSI target infrastructure.
Out-of-bounds vmemmap read in the Linux kernel's mm/util snapshot_page() crashes or leaks kernel memory during page isolation on memory-remove paths. The function incorrectly reads __page_2 when nr_pages > 1 rather than the correct threshold of nr_pages > 2, causing an illegal access into an adjacent, unmapped vmemmap section when an order-1 folio sits at a vmemmap section boundary. This was observed producing a kernel oops on ppc64le systems during DLPAR memory remove on a 22 TB LPAR. No public exploit is identified and EPSS is 0.17%, but the defect can cause a local denial-of-service or kernel memory disclosure. Patches are available across multiple stable kernel branches.
Denial-of-service in the Linux kernel's KVM subsystem on IBM Z (s390) mainframes stems from an unchecked airq_iv_create() return value in the zPCI adaptive-interrupt path. When AIBV allocation fails, zdev->aibv is left NULL and later dereferenced in kvm_zpci_set_airq(), crashing the host kernel. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.17% (7th percentile), consistent with a hard-to-trigger, resource-exhaustion-dependent bug rather than a broadly weaponizable flaw.
Use-after-free in the Linux kernel Bluetooth SCO subsystem allows an adjacent unauthenticated attacker to corrupt freed kernel memory by exploiting a reference-counting race between socket close() and Bluetooth controller Disconnection Complete events. The race causes sco_conn_del() to perform a double put on a kref, confirmed by KASAN as slab-use-after-free, with potential to escalate privileges or crash the system. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), consistent with the race condition complexity limiting practical exploitation.
Incorrect unit conversion in the RISC-V memory management subsystem causes vmemmap_start_pfn to be computed with a physically misaligned base, violating the mask-alignment requirement for compound_info encoding in the sparse memory model. Linux kernel versions incorporating commit 476849b0fba4 on RISC-V hardware where DRAM base is not aligned to MAX_FOLIO_NR_PAGES × PAGE_SIZE are affected - a condition confirmed on QEMU virt machines and potentially other RISC-V platforms. CVSS 7.8 (AV:L/PR:L/C:H/I:H/A:H) reflects potential local privilege escalation via kernel memory corruption; EPSS of 0.17% (7th percentile) and no CISA KEV listing indicate no observed exploitation activity. No public exploit is identified at time of analysis.
Use-after-free in the Linux kernel's VXLAN transmit path (vxlan_xmit) lets a stale Ethernet header pointer be dereferenced after route_shortcircuit() calls pskb_may_pull() and reallocates skb->head, corrupting or reading freed memory when accessing eth->h_dest. The flaw affects systems using a VXLAN overlay interface and is most realistically a denial-of-service (kernel crash) with potential information disclosure; no public exploit identified at time of analysis and EPSS is low (0.18%). It is not listed in CISA KEV and no proof-of-concept is known.
Use-after-free in the Linux kernel's AMD MP2 I2C driver (i2c-amd-mp2) enables local low-privileged users to corrupt kernel memory, potentially achieving privilege escalation or system crash on AMD hardware. The flaw occurs during driver probe: when i2c_add_adapter() fails, devres frees the platform I2C context, but the MP2 PCI driver retains a stale pointer in its IRQ and system-sleep callback table, allowing subsequent dereference of freed memory. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting the hardware-specific and error-path-dependent nature of this flaw; vendor-released patches are available across all major stable kernel branches.
Race condition and error-handling flaws in the i2c-imx I2C controller driver allow a NULL pointer dereference via the kernel interrupt handler on NXP i.MX SoC-based systems. The vulnerability affects multiple stable kernel branches (5.15 through 7.x) and is triggered when I2C slave registration fails partway through a PM runtime resume, leaving a stale or NULL pointer that the shared IRQ handler can dereference concurrently. The realistic impact is a kernel panic causing system unavailability; no public exploit exists and EPSS is 0.17%, consistent with no observed active exploitation.
Race condition in the Linux kernel's driver core `dev_has_sync_state()` exposes a TOCTOU (Time-of-Check Time-of-Use) flaw allowing local low-privileged users to potentially trigger kernel memory corruption, information disclosure, or a system crash. The function reads `dev->driver` twice without holding `device_lock()`, enabling a concurrent device unbind operation to clear the pointer between the NULL check and its subsequent dereference, resulting in use of a stale or NULL pointer in kernel context. No active exploitation has been identified (no CISA KEV listing, EPSS 0.18%), but the kernel-level impact class warrants prompt patching on affected stable branches.
The BPF signed loader in the Linux kernel fails to enforce map exclusivity before performing SHA-based integrity validation of metadata maps, allowing a local attacker with BPF privileges to race a mutation of the shared map's contents after the hash is computed but before validation completes. Systems running Linux kernel between commit fb2b0e290147ba01a53dfd92cf91058c9d2ee254 and the patched stable releases (6.18.40, 7.1.5, 7.2) are affected. Exploitation bypasses the integrity guarantees of the signed BPF loader, enabling the attacker to make the check pass on stale, attacker-controlled data; no public exploit exists and EPSS is 0.17% (6th percentile), indicating low current exploitation probability.
Out-of-bounds kernel memory reads in the Linux kernel's NTFS driver arise because ntfs_read_locked_inode() copies a resident $ATTRIBUTE_LIST into ni->attr_list via a plain memcpy() with no sanity checking, while only the non-resident path was ever validated by load_attribute_list(). A crafted NTFS volume with a malformed resident attribute list is then trusted by every subsequent walk (ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), ntfs_attrlist_need()), which read fixed-header fields past the buffer. The fix factors per-entry validation into ntfs_attr_list_entry_is_valid()/ntfs_attr_list_is_valid() and applies it on the resident path and inside load_attribute_list() itself; no public exploit identified at time of analysis and EPSS probability is very low (0.15%).
Out-of-bounds slab read in the Linux kernel's legacy in-kernel NTFS driver lets a crafted on-disk $ATTRIBUTE_LIST leak or crash adjacent kernel heap memory when a malicious NTFS volume is mounted and read. The flaw is in ntfs_external_attr_find(), where a look-ahead attribute-list entry is dereferenced past the end of the kvmalloc'd buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.15%, 5th percentile), and it is not listed in CISA KEV.
Out-of-bounds kernel heap read in the Linux kernel's classic in-tree NTFS driver (`fs/ntfs/`) allows a local, low-privileged user to disclose kernel memory - and potentially chain to privilege escalation - by mounting a crafted NTFS image at the filesystem layer. The flaw is a u16 integer truncation in `ntfs_check_restart_area()` that silently defeats a page-size bounds check, causing `ntfs_check_log_client_array()` to dereference up to ~64 KiB beyond an allocated heap buffer using attacker-controlled on-disk values. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.15% (5th percentile), reflecting negligible observed exploitation pressure.
Heap and integer-overflow memory corruption in the Linux kernel's userspace perf tool (perf sched) lets a malicious perf.data file corrupt memory when parsed by register_pid(). An analyst who runs 'perf sched' against an attacker-supplied perf.data trace can trigger out-of-bounds heap writes, an unchecked strcpy into a 20-byte comm buffer, and denial of service, potentially leading to code execution in the context of the user running perf. A vendor fix is available; EPSS is low (0.18%) and there is no public exploit identified at time of analysis.
Out-of-bounds heap read in the Linux kernel's perf userspace tooling (perf tools) lets a crafted perf.data file trigger memory disclosure or a crash when parsed. The flaw sits in machine__resolve(), which trusts an attacker-controlled CPU index (al->cpu) from sample data and indexes env->cpu[] without validating it against env->nr_cpus_avail; a large index reads past the heap allocation, and values like 65536 truncate to int16_t and silently resolve to CPU 0. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile).
Use-after-free / stale-pointer race in the Linux kernel netfilter nf_conntrack_expect subsystem was resolved by replacing the per-expectation timer API with the conntrack garbage-collection worker. Under the old timer scheme, expectation removal could lose a race with an expiring timer (timer_del() returning false), leaving an expectation referencing an already-released exp->master conntrack, enabling stale-pointer access. The issue affects systems using connection-tracking helpers/expectations (e.g. FTP, SIP, or nft_ct expectations); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.15% (5th percentile).
Availability denial in the Linux kernel's KVM ARM64 nested virtualization stack allows a guest VM to crash the host through improper Synchronous External Abort (SEA) handling when Stage 1 translation resolves a Guest Frame Number outside configured memory slots. Affected systems must run a vulnerable Linux 6.16-era kernel on ARM64 hardware with KVM nested virtualization explicitly enabled; fixed versions are 6.18.40, 7.1.5, and 7.2. No public exploit exists and no active exploitation is confirmed; EPSS stands at 0.18% (7th percentile), reflecting the niche attack surface.
NULL pointer dereference in the Linux kernel netfilter subsystem's xt_nat module allows a local attacker with low privileges to crash the kernel by instantiating SNAT or DNAT targets through the nft_compat compatibility layer using an unsupported bridge family, triggering a NULL dereference in nf_nat_setup_info(). Multiple stable kernel branches from 5.10 through 7.x are affected across numerous long-term support trees. No public exploit has been identified at time of analysis, and EPSS probability is very low at 0.18% (7th percentile); critically, the description itself notes the original crash was already mitigated by a prior upstream commit, making this patch a defense-in-depth hardening measure rather than a primary fix.
Symlink-based file clobbering in the Linux kernel's intel-speed-select daemon allows a local low-privileged user to redirect root-process writes to an attacker-chosen file by pre-positioning a symlink at the daemon's fixed /tmp pidfile path. Affected systems are those running Linux 5.18 through unpatched 6.x and 7.x branches on Intel Speed Select Technology hardware with the daemon active. No public exploit is identified at time of analysis and EPSS is low (0.17%, 7th percentile), but the attack is mechanically simple and requires only a local shell account.