Stack Overflow
Monthly
Denial of service with possible disclosure of memory contents in IBM MQ (all LTS and CD releases from 9.1.0.0 through 9.4.5.1 and 10.0.0.0) is reachable by a remote attacker who already holds a TLS client certificate the queue manager trusts. Improper validation of deeply nested certificate data during TLS certificate processing produces a stack-based buffer overflow (CWE-121) that can crash the queue manager and potentially expose fragments of process memory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has released fixes via its support advisory.
Stack-based buffer overflow in the rzgl_asp CGI handler of D-Link DI-8300 firmware 16.07 lets a remote attacker who can reach the device's web management interface (and, per the CVSS vector, holds high/admin privileges) crash or execute code on the router by supplying an oversized redirct_url parameter to /rzgl.asp. Publicly available exploit code exists, so the vulnerability is trivially reproducible, although no CISA KEV listing or confirmed in-the-wild campaign is reported. The device is a legacy D-Link gateway, and no vendor patch or advisory was found in the supplied references.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overwrite stack memory via oversized input to any of eight parameters - serv, user, host, wild, mx, bmx, cust, or ip - handled by the ddns_asp() function at the /ddns.asp DDNS configuration endpoint. Successful exploitation can yield arbitrary code execution on the device, giving an attacker full control over the router. A public exploit script exists on GitHub (ddns_asp.py), and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in the D-Link DIR-878 wireless router (firmware 120B05) lets an attacker corrupt the stack through the SetWan3Settings handler of the WAN Settings component by supplying an oversized Primary/Secondary argument (typically DNS/gateway fields). Successful exploitation can crash the device or achieve arbitrary code execution on the router. Reported by VulDB; a third-party technical advisory is published on GitHub, but there is no public exploit identified at time of analysis and it is not in CISA KEV.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers to corrupt stack memory by supplying an oversized value to the webAuthWhiteUserIndex argument in the formDelWebAuthWhiteUser function, potentially enabling arbitrary code execution in the web server process. The vulnerability is network-exploitable with low-privilege credentials (PR:L per CVSS 4.0), and the CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability. No public exploit has been confirmed and the vulnerability is not in CISA KEV, but a researcher-published GitHub advisory documents the attack surface.
Stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.61068_1546_841_CN_TDC) allows a low-privileged remote attacker to crash the device by sending a crafted HTTP request with an oversized IPMacBindRule argument to the formIPMacBindAdd handler. A public researcher advisory exists on GitHub from Amalll-Sec, indicating the vulnerability has been analyzed and documented with reproduction steps. Impact is assessed as high availability loss; remote code execution has not been independently confirmed from available data but cannot be excluded given the CWE-121 class.
Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided.
Stack-based buffer overflow in the camera driver of Samsung Exynos mobile processors (1330, 1380, 1480, 1580, 1680, 2400, 2500, 2600) allows a local low-privileged attacker to crash the camera subsystem or corrupt adjacent kernel memory by sending a malformed message to the driver. The vendor's CVSS vector (S:C, I:H, A:H) indicates that impact extends beyond a simple denial of service to potential kernel-level integrity corruption, though the advisory text describes only DoS - this discrepancy suggests the stack overflow may be exploitable beyond a crash. No public exploit code or active exploitation (KEV) has been identified at time of analysis.
Stack-based buffer overflow in SIPp through 3.7.7 allows a malicious SIP server to crash the client process by sending a crafted 401 or 407 authentication challenge containing an oversized algorithm parameter. The flaw originates in createAuthHeader() at src/auth.cpp:183-192, where the original code uses strncpy bounded by end-start (an attacker-controlled length derived from the algorithm field) rather than the fixed size of the stack-allocated algo buffer. No public exploit has been identified at time of analysis, but upstream fix code is publicly available via GitHub PR #880.
Stack buffer overflows in sngrep through 1.8.4 allow unauthenticated remote attackers to crash or execute arbitrary code on any host running sngrep while actively capturing SIP traffic. The flaws reside in `call_get_attribute()` (src/sip_call.c) and `msg_get_attribute()` (src/sip_msg.c), where unbounded `sprintf` calls copy SIP header values - including Call-ID, X-Call-ID, Reason, From, To, Contact, and request/response strings - into a fixed 255-byte stack buffer without length enforcement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the upstream fix commit is publicly accessible, making independent weaponization feasible.
Stack-based buffer overflow in the IBM Db2 DRDA client allows full system compromise on any host running an affected Db2 client version when that client connects to an attacker-controlled or impersonated DRDA server endpoint. Affected versions are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. By controlling a rogue or man-in-the-middle DRDA server, an unauthenticated network adversary can cause the client to copy unbounded server-supplied data into a fixed-size stack buffer, yielding arbitrary command execution. No public exploit is identified at time of analysis; vendor patch is available via IBM Support.
Kernel pool memory corruption in Silicon Labs silabser.sys (the Windows kernel driver for CP210x USB-to-serial bridge devices) v11.5.0 and earlier allows a local unprivileged user who physically attaches a malicious CP210x-compatible USB device to escalate privileges to kernel-level code execution. The driver fails to validate USB device-supplied packet data before processing, enabling crafted malformed packets to corrupt Windows kernel pool allocations. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, enabling denial of service and potential control-flow hijacking when a crafted `.traineddata` file is processed. The flaw originates in `Classify::ReadNormProtos` (normmatch.cpp), where unbounded `std::istream::operator>>(char*)` extraction into a fixed 61-byte stack buffer allows a 99-character NORMPROTO token to overwrite up to 39 bytes beyond the buffer boundary during `TessBaseAPI::Init`. No fixed release is available at time of analysis; an upstream fix commit exists but has not been tagged as a release, and no public exploit has been identified at time of analysis.
Stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI C library allows a malicious or compromised sensor or bus participant to corrupt host firmware stack memory, leading to denial of service or arbitrary code execution. The flaw resides in bhi385_parse_debug_message() (bhi385_parse.c), which reads an 8-bit message length directly from the attacker-controlled FIFO event payload and passes it unchecked to memcpy targeting a fixed 17-byte stack buffer - any length byte above 16 overwrites adjacent stack data. No public exploit or CISA KEV listing has been identified at time of analysis, but the vendor has published an advisory under BOSCH-SA-223618.
Unchecked memcpy in the Bosch Sensortec BHI360 SensorAPI C-Library's debug FIFO parser allows a physically-positioned attacker to overflow a 17-byte stack buffer in `bhi360_parse_debug_message()`, corrupting the host microcontroller's saved return address and enabling arbitrary code execution. A compounding format-string flaw - the overflowed buffer is subsequently passed to a printf-style logging sink - provides an additional write-anywhere primitive for `%n`-style exploitation. No public exploit code has been identified and exploitation is constrained to physical or bus-adjacent positions (CVSS AV:P), but the double-primitive nature makes this highly reliable on bare-metal targets lacking stack canaries.
Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.
Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.
Stack-based buffer overflow (CWE-121) in the Nintendo Switch local wireless networking subsystem allows an adjacent unauthenticated attacker within wireless range to execute arbitrary code via a Return-Oriented Programming (ROP) chain embedded in crafted network traffic. All Nintendo Switch firmware versions prior to 23.0.0 are affected, and Nintendo has released version 23.0.0 as the remediation. No public exploit code or active exploitation has been identified at time of analysis, though SSVC rates technical impact as total.
Stack-based buffer overflow in the TP-Link RE210 AC750 range extender's httpd component enables authenticated, adjacent-network attackers to achieve remote code execution by uploading a specially crafted configuration file that exceeds bounds in the `splitString` function. Affected firmware spans US builds through 3.14.2 Build 171205 Rel.71984n and EU builds through 3.14.2 Build 141218 Rel.36430n, per EUVD-2026-73942. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact triplet (C:H/I:H/A:H) indicates full device compromise upon successful exploitation.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution when a user opens a specially crafted workbook. The vulnerability (CWE-121) spans a wide range of Office suites from 2016 through 2024 LTSC on both Windows and macOS. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the broad affected surface - including Microsoft 365 Apps for Enterprise - makes patching a priority for enterprise environments.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution at the current user's privilege level when a victim opens a specially crafted workbook file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024 across both Windows and Mac platforms, making the potential victim population extremely large. Microsoft has released patches via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook, affecting all major Office product lines from Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. The vulnerability carries a CVSS 7.8 score reflecting high CIA impact against the Office process, with mandatory user interaction (opening the malicious file) as the sole prerequisite. Microsoft has released patches for all supported versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in Microsoft Office Word enables a remote unauthenticated attacker to execute arbitrary code on a victim's machine by delivering a specially crafted Word document and inducing the target to open it. The vulnerability spans a wide swath of Office product lines - from Word 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise - on both Windows and macOS platforms. Microsoft has released patches across Windows product lines; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stack-based buffer overflow in Microsoft Graphics Component enables remote code execution when a victim opens a specially crafted file containing malicious graphics content. Affected products include Microsoft Office LTSC for Mac 2021 and 2024, Microsoft 365 for Mac, and Microsoft Office for Android prior to 16.0.20430.20000. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects no privilege requirements on the target system and network-accessible delivery, though user interaction - opening a malicious document - is required. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the Windows Win32K kernel-mode driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM level via a network-accessible exploit path, affecting 12 distinct Windows releases spanning Windows 10 1809 through Windows Server 2025 and Windows 11 26H1. The CWE-121 flaw resides in the kernel subsystem handling GDI rendering and windowing, making successful exploitation equivalent to full operating system compromise. Microsoft has released patches addressing all affected build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Word's document parsing engine allows remote unauthenticated attackers to execute arbitrary code with the privileges of the victim user when a specially crafted Word document is opened. The flaw (CWE-121) spans Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016 on both Windows and macOS. Microsoft has released patched builds; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Stack-based buffer overflow in Microsoft Word (CWE-121) enables remote code execution by enticing a user to open a maliciously crafted document, with full compromise of confidentiality, integrity, and availability. Affected products span Office 2019, 2021, and 2024 LTSC on both Windows (x86/x64) and macOS, as well as Microsoft 365 Apps for Enterprise and Word 2016. Microsoft has released patches across all affected product lines; no public exploit code has been identified and CISA KEV confirmation is absent at time of analysis.
Stack-based buffer overflow in the Windows Device Association Service enables an authenticated, low-privileged network attacker to escalate privileges to full system compromise across Windows 10, Windows 11, and Windows Server 2012 through 2025. The vulnerability (CWE-121) requires user interaction to trigger but delivers complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has issued patches covering the full affected version range.
Privilege escalation via a stack-based buffer overflow in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server 2019/2022/2025 across a wide range of release builds. A low-privilege network attacker who induces victim user interaction can achieve full confidentiality, integrity, and availability compromise of the targeted system, consistent with elevation to SYSTEM-level access. A vendor-released patch is available via Microsoft Patch Tuesday; no public exploit has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Word's document-parsing engine enables network-delivered remote code execution with full system impact across all current Microsoft Office product lines on Windows and macOS. The vulnerability (CWE-121) is triggered when a user opens a specially crafted Word document, overflowing a fixed-size stack buffer and allowing an attacker to hijack control flow and execute arbitrary code in the context of the logged-in user. Affected versions span Word 2016 through Microsoft 365 Apps for Enterprise and LTSC editions on both x86/x64 Windows and macOS; patches are available per vendor advisory, and no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows MIDI Service Module enables local privilege escalation on Windows 11 systems across three major release branches. An authenticated local attacker with standard user privileges (PR:L) can trigger the overflow with low complexity and no user interaction, achieving full SYSTEM-level compromise (C:H/I:H/A:H). Microsoft has released patches covering Windows 11 versions 24H2, 25H2, and 26H1; no public exploit or KEV listing is present at time of analysis.
Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker with standard user privileges to escalate to full system control across Windows 10 and Windows 11. The flaw (CWE-121) is triggered locally with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 vector. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-privilege requirement and zero interaction needed make this a realistic post-compromise escalation primitive.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Stack-based buffer overflow in the Windows Broker Infrastructure Service (CWE-121) allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM on a wide range of Windows client and server editions. The vulnerability affects Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, including Server Core installations. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Stack-based buffer overflow in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated network attacker with low-level privileges to execute arbitrary code, with scope change enabling impact beyond the SQL Server process itself. The vulnerability carries CVSS 8.5 (S:C) with high confidentiality, integrity, and availability impact, indicating that successful exploitation can compromise not just the database engine but potentially the underlying OS. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though CVSS AC:H reflects meaningful exploitation complexity requiring careful payload construction against modern memory protections.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. A public proof-of-concept exploit has been published targeting this exact vector, and no vendor patch has been identified for this legacy device.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
Stack-based buffer overflow in libxml2 before 2.15.4 exposes applications that perform DTD element validation to potential arbitrary code execution via the `xmlSnprintfElements` function in `valid.c`. The function performs unbounded `strcat` calls into a caller-supplied fixed-size stack buffer when formatting element content model descriptions, with no remaining-capacity check before appending parentheses - allowing a crafted XML document with a sufficiently complex element content model to overflow adjacent stack memory. The fix is confirmed in libxml2 2.15.4 via a specific GitHub commit; no public exploit or active exploitation has been identified at time of analysis.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Done. The analysis is above as the JSON object. Key points of the synthesis: - **Same FreeIPMI 1.6.19 cluster** as CVEs 85504/85507/85508 already tracked — all client-side stack overflows (CWE-121) triggered by a malicious/compromised BMC returning oversized responses. - **CVSS 9.8 is overstated**: this is a client-side/rogue-BMC flaw, not an internet-facing service. I assessed it down to `AC:H/UI:R` (needs attacker control of a BMC plus an operator/job initiating the FRU read). - **Metadata is clean** — vendor tag, CPE, and CWE all correct, and no embedded injection note this time — so `data_quality_flags` is `[]`. - Fix confirmed as 1.6.19; no EPSS/KEV/POC signal, so exploitation status is unknown. Memory updated with the new CVE note and index entry.
Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (all versions before 1.6.19) can corrupt memory in the client host when the 'dell get-system-info cmc-info' subcommand parses a CMC info response, potentially leading to code execution in the context of the operator running the tool. The flaw lives in the response-handling routine _output_dell_system_info_cmc_info (ipmi-oem/ipmi-oem-dell.c), so it is triggered by the data returned from the queried BMC/CMC rather than by an inbound network request. No public exploit identified at time of analysis, and it is not in CISA KEV; EPSS data was not provided.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (versions before 1.6.19) lets a malicious or compromised Dell iDRAC BMC corrupt the memory of the client host running the 'dell get-system-info idrac-info' subcommand, potentially achieving code execution in the context of the operator (often root). The flaw sits in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c, which copies attacker-influenced OEM response data into a fixed-size stack buffer without bounds checking. No public exploit identified at time of analysis; disclosed via oss-security and fixed in FreeIPMI 1.6.19.
Stack-based buffer overflow in GNU FreeIPMI before 1.6.19 lets a malicious or compromised Fujitsu iRMC BMC corrupt client memory when the FreeIPMI tooling parses malformed Fujitsu SEL 'long text' responses in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text. Successful exploitation can crash the client or execute arbitrary code in the context of the process reading the System Event Log (typically ipmi-sel or libfreeipmi consumers). No public exploit is identified at time of analysis, and the flaw is fixed in FreeIPMI 1.6.19.
Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and below enables attackers to potentially achieve full system compromise, including code execution. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) indicates local access with low privileges, while the vendor description separately references a 'high privileged remote attacker' - a direct conflict in both attack vector and privilege level requiring vendor clarification. No public exploit or CISA KEV listing exists at time of analysis.
Stack-based buffer overflow in the GPU component of Google Chrome on Windows (prior to 152.0.7977.75) enables full sandbox escape and arbitrary code execution on the host operating system. Exploitation is a two-stage chained attack: an attacker must first compromise the renderer process (via a separate vulnerability or exploit), then leverage this GPU flaw to break out of Chrome's sandbox and execute code with elevated host privileges. Google has released a patch in the stable channel update for desktop; no public exploit code or CISA KEV listing has been identified at time of analysis.
Silent stack-based buffer overflow in Pyramid Solutions' NetStaX EtherNet/IP Stack before v5.6.1 lets a remote attacker send an oversized Class 3 explicit-message request that overruns the application-side receive buffer without any CIP error being returned, causing memory corruption, device crash, or a potential remote code-execution path. Any industrial device embedding the affected stack for EtherNet/IP communication is exposed over the network with no authentication. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the device's web management CGI interface. The setUploadSetting handler fails to validate the length of the FileName parameter before copying it onto the stack, allowing an attacker with low-privilege access to overwrite control data and execute arbitrary code on the router. A public proof-of-concept has been disclosed on GitHub, materially increasing exploitation risk even in the absence of a confirmed vendor patch.
Stack-based buffer overflow in the D-Link DIR-825M 1.1.8 LTE Module Firmware Upgrade handler allows low-privileged remote attackers to achieve remote code execution by supplying an oversized fota_url argument to /boafrm/formLtefotaUpgradeFibocom. The CVSS 4.0 vector scores this at 8.6 with subsequent-system impact (SC:H/SI:H/SA:H), reflecting the potential to compromise the attached Fibocom LTE module as well as the primary router. A public proof-of-concept exploit is available on GitHub, significantly lowering the bar for exploitation; no public patch has been identified at time of analysis.
Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.
Stack-based buffer overflow in the Bendix EC80ESP brake ECU family enables adjacent-network attackers to crash the ECU or achieve remote code execution and arbitrary CAN bus traffic injection via a crafted payload. All known variants across both EC80ESP and EC80ESP+ product lines are affected, including J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, and 4S/4M configurations deployed on commercial vehicles. Successful exploitation could disable safety-critical functions including ABS, steering assist, speedometer, and automatic gear shifting. No public exploit has been identified at time of analysis; the flaw was disclosed by CISA ICS-CERT.
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.
Stack-based buffer overflow in GNOME Dia diagram editor (0.98.0 and earlier) permits stack exhaustion and potential return-address corruption when a victim opens a crafted .dia XML file containing a Bus object with an attacker-controlled bus_handles value and then moves a handle in the diagram. The root cause - an unbounded g_alloca() call driven by an unvalidated file attribute - is also present in objects/Misc/tree.c via Tree objects, widening the attack surface. No public exploit or CISA KEV listing exists at time of analysis, but the GitLab issue provides sufficient technical detail for proof-of-concept development.
Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact.
Remote code execution within the Chrome sandbox is possible in Google Chrome prior to 152.0.7977.65 via a stack-based buffer overflow in the V8 JavaScript engine, triggered by a crafted HTML page visited by an unpatched user. The vulnerability requires no authentication or elevated privileges from the victim - only that they visit an attacker-controlled page - and achieves arbitrary code execution within Chrome's renderer sandbox. No public exploit has been identified at time of analysis, and EPSS at 0.39% (31st percentile) indicates low current exploitation probability despite the 8.8 CVSS score; notably, Google's own internal severity rating is Medium, reflecting the sandbox containment.
Stack-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-in user. Exploitation is triggered by opening a specially crafted file, making this a file-parsing attack delivered through phishing or malicious asset distribution targeting 3D artists and designers. No public exploit code or active exploitation has been identified at time of analysis, though full confidentiality, integrity, and availability impact makes this a meaningful risk for affected users.
Stack-based buffer overflow in the SpaceDot AcubeSAT On-Board Computer (OBC) software allows remote unauthenticated attackers to crash the OBC by sending a crafted ECSS Telecommand (TC) message to the loadRawData function. The vulnerability, traced to commit eaf90ec, results in availability loss only - no confidentiality or integrity impact is indicated. No public exploit code or active exploitation has been confirmed; EPSS sits at 0.14% (4th percentile), consistent with the niche, mission-specific deployment footprint of this software.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. Publicly available exploit code exists and the flaw was reported by VulnCheck; CVSS 4.0 base is 9.3 (AV:N/AC:L/PR:N/UI:N), but no active exploitation (CISA KEV) is confirmed.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks.
Stack-based buffer overflow in UTT HiPER 1250GW firmware (≤ 3.2.7-210907-180535) exposes the device to remote code execution via a crafted HTTP request to the `/goform/aspRemoteApConfTempSend` endpoint. The unsafe `strcpy()` call processing the `Profile` parameter allows a low-privileged remote attacker to overwrite stack memory, with full confidentiality, integrity, and availability impact on both the device and downstream network systems per the CVSS 4.0 subsequent-system metrics. A public proof-of-concept is confirmed on GitHub; no public exploitation confirmed in CISA KEV at time of analysis.
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.
Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.
Stack-based buffer overflow in TP-Link TL-MR6400 v7 firmware update functionality enables an authenticated, adjacent-network attacker to achieve arbitrary code execution on the affected device. The flaw (CWE-121) arises from unsafe parsing of attacker-controlled metadata embedded in a firmware image, leading to memory corruption at the stack level. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is further constrained by requirements for high-privilege access (PR:H) and network adjacency (AV:A).
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 arises from a stack-based buffer overflow (CWE-121) that a remote attacker can trigger without authentication or user interaction, yielding total compromise of these Power-based enterprise Unix and virtualization-management systems. The CVSS 9.8 rating reflects a fully remote, low-complexity path to arbitrary code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low (0.61%, 47th percentile), indicating no observed widespread exploitation yet despite the critical severity.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.
Remote unauthenticated code execution is possible in swift-nio-ssh, Apple's Swift implementation of the SSH2 protocol built on SwiftNIO, where a single crafted SSH message triggers an out-of-bounds stack write of attacker-controlled length and content. Any server or client application built on swift-nio-ssh before 0.14.1 is affected, and an attacker can corrupt stack memory pre-authentication to potentially achieve arbitrary code execution. No public exploit identified at time of analysis, and despite the maximal 9.8 CVSS the EPSS probability is currently low (0.14%, 4th percentile).
Denial of service with possible disclosure of memory contents in IBM MQ (all LTS and CD releases from 9.1.0.0 through 9.4.5.1 and 10.0.0.0) is reachable by a remote attacker who already holds a TLS client certificate the queue manager trusts. Improper validation of deeply nested certificate data during TLS certificate processing produces a stack-based buffer overflow (CWE-121) that can crash the queue manager and potentially expose fragments of process memory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has released fixes via its support advisory.
Stack-based buffer overflow in the rzgl_asp CGI handler of D-Link DI-8300 firmware 16.07 lets a remote attacker who can reach the device's web management interface (and, per the CVSS vector, holds high/admin privileges) crash or execute code on the router by supplying an oversized redirct_url parameter to /rzgl.asp. Publicly available exploit code exists, so the vulnerability is trivially reproducible, although no CISA KEV listing or confirmed in-the-wild campaign is reported. The device is a legacy D-Link gateway, and no vendor patch or advisory was found in the supplied references.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overwrite stack memory via oversized input to any of eight parameters - serv, user, host, wild, mx, bmx, cust, or ip - handled by the ddns_asp() function at the /ddns.asp DDNS configuration endpoint. Successful exploitation can yield arbitrary code execution on the device, giving an attacker full control over the router. A public exploit script exists on GitHub (ddns_asp.py), and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in the D-Link DIR-878 wireless router (firmware 120B05) lets an attacker corrupt the stack through the SetWan3Settings handler of the WAN Settings component by supplying an oversized Primary/Secondary argument (typically DNS/gateway fields). Successful exploitation can crash the device or achieve arbitrary code execution on the router. Reported by VulDB; a third-party technical advisory is published on GitHub, but there is no public exploit identified at time of analysis and it is not in CISA KEV.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers to corrupt stack memory by supplying an oversized value to the webAuthWhiteUserIndex argument in the formDelWebAuthWhiteUser function, potentially enabling arbitrary code execution in the web server process. The vulnerability is network-exploitable with low-privilege credentials (PR:L per CVSS 4.0), and the CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability. No public exploit has been confirmed and the vulnerability is not in CISA KEV, but a researcher-published GitHub advisory documents the attack surface.
Stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.61068_1546_841_CN_TDC) allows a low-privileged remote attacker to crash the device by sending a crafted HTTP request with an oversized IPMacBindRule argument to the formIPMacBindAdd handler. A public researcher advisory exists on GitHub from Amalll-Sec, indicating the vulnerability has been analyzed and documented with reproduction steps. Impact is assessed as high availability loss; remote code execution has not been independently confirmed from available data but cannot be excluded given the CWE-121 class.
Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided.
Stack-based buffer overflow in the camera driver of Samsung Exynos mobile processors (1330, 1380, 1480, 1580, 1680, 2400, 2500, 2600) allows a local low-privileged attacker to crash the camera subsystem or corrupt adjacent kernel memory by sending a malformed message to the driver. The vendor's CVSS vector (S:C, I:H, A:H) indicates that impact extends beyond a simple denial of service to potential kernel-level integrity corruption, though the advisory text describes only DoS - this discrepancy suggests the stack overflow may be exploitable beyond a crash. No public exploit code or active exploitation (KEV) has been identified at time of analysis.
Stack-based buffer overflow in SIPp through 3.7.7 allows a malicious SIP server to crash the client process by sending a crafted 401 or 407 authentication challenge containing an oversized algorithm parameter. The flaw originates in createAuthHeader() at src/auth.cpp:183-192, where the original code uses strncpy bounded by end-start (an attacker-controlled length derived from the algorithm field) rather than the fixed size of the stack-allocated algo buffer. No public exploit has been identified at time of analysis, but upstream fix code is publicly available via GitHub PR #880.
Stack buffer overflows in sngrep through 1.8.4 allow unauthenticated remote attackers to crash or execute arbitrary code on any host running sngrep while actively capturing SIP traffic. The flaws reside in `call_get_attribute()` (src/sip_call.c) and `msg_get_attribute()` (src/sip_msg.c), where unbounded `sprintf` calls copy SIP header values - including Call-ID, X-Call-ID, Reason, From, To, Contact, and request/response strings - into a fixed 255-byte stack buffer without length enforcement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the upstream fix commit is publicly accessible, making independent weaponization feasible.
Stack-based buffer overflow in the IBM Db2 DRDA client allows full system compromise on any host running an affected Db2 client version when that client connects to an attacker-controlled or impersonated DRDA server endpoint. Affected versions are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. By controlling a rogue or man-in-the-middle DRDA server, an unauthenticated network adversary can cause the client to copy unbounded server-supplied data into a fixed-size stack buffer, yielding arbitrary command execution. No public exploit is identified at time of analysis; vendor patch is available via IBM Support.
Kernel pool memory corruption in Silicon Labs silabser.sys (the Windows kernel driver for CP210x USB-to-serial bridge devices) v11.5.0 and earlier allows a local unprivileged user who physically attaches a malicious CP210x-compatible USB device to escalate privileges to kernel-level code execution. The driver fails to validate USB device-supplied packet data before processing, enabling crafted malformed packets to corrupt Windows kernel pool allocations. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, enabling denial of service and potential control-flow hijacking when a crafted `.traineddata` file is processed. The flaw originates in `Classify::ReadNormProtos` (normmatch.cpp), where unbounded `std::istream::operator>>(char*)` extraction into a fixed 61-byte stack buffer allows a 99-character NORMPROTO token to overwrite up to 39 bytes beyond the buffer boundary during `TessBaseAPI::Init`. No fixed release is available at time of analysis; an upstream fix commit exists but has not been tagged as a release, and no public exploit has been identified at time of analysis.
Stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI C library allows a malicious or compromised sensor or bus participant to corrupt host firmware stack memory, leading to denial of service or arbitrary code execution. The flaw resides in bhi385_parse_debug_message() (bhi385_parse.c), which reads an 8-bit message length directly from the attacker-controlled FIFO event payload and passes it unchecked to memcpy targeting a fixed 17-byte stack buffer - any length byte above 16 overwrites adjacent stack data. No public exploit or CISA KEV listing has been identified at time of analysis, but the vendor has published an advisory under BOSCH-SA-223618.
Unchecked memcpy in the Bosch Sensortec BHI360 SensorAPI C-Library's debug FIFO parser allows a physically-positioned attacker to overflow a 17-byte stack buffer in `bhi360_parse_debug_message()`, corrupting the host microcontroller's saved return address and enabling arbitrary code execution. A compounding format-string flaw - the overflowed buffer is subsequently passed to a printf-style logging sink - provides an additional write-anywhere primitive for `%n`-style exploitation. No public exploit code has been identified and exploitation is constrained to physical or bus-adjacent positions (CVSS AV:P), but the double-primitive nature makes this highly reliable on bare-metal targets lacking stack canaries.
Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.
Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.
Stack-based buffer overflow (CWE-121) in the Nintendo Switch local wireless networking subsystem allows an adjacent unauthenticated attacker within wireless range to execute arbitrary code via a Return-Oriented Programming (ROP) chain embedded in crafted network traffic. All Nintendo Switch firmware versions prior to 23.0.0 are affected, and Nintendo has released version 23.0.0 as the remediation. No public exploit code or active exploitation has been identified at time of analysis, though SSVC rates technical impact as total.
Stack-based buffer overflow in the TP-Link RE210 AC750 range extender's httpd component enables authenticated, adjacent-network attackers to achieve remote code execution by uploading a specially crafted configuration file that exceeds bounds in the `splitString` function. Affected firmware spans US builds through 3.14.2 Build 171205 Rel.71984n and EU builds through 3.14.2 Build 141218 Rel.36430n, per EUVD-2026-73942. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact triplet (C:H/I:H/A:H) indicates full device compromise upon successful exploitation.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution when a user opens a specially crafted workbook. The vulnerability (CWE-121) spans a wide range of Office suites from 2016 through 2024 LTSC on both Windows and macOS. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the broad affected surface - including Microsoft 365 Apps for Enterprise - makes patching a priority for enterprise environments.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution at the current user's privilege level when a victim opens a specially crafted workbook file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024 across both Windows and Mac platforms, making the potential victim population extremely large. Microsoft has released patches via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook, affecting all major Office product lines from Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. The vulnerability carries a CVSS 7.8 score reflecting high CIA impact against the Office process, with mandatory user interaction (opening the malicious file) as the sole prerequisite. Microsoft has released patches for all supported versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in Microsoft Office Word enables a remote unauthenticated attacker to execute arbitrary code on a victim's machine by delivering a specially crafted Word document and inducing the target to open it. The vulnerability spans a wide swath of Office product lines - from Word 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise - on both Windows and macOS platforms. Microsoft has released patches across Windows product lines; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stack-based buffer overflow in Microsoft Graphics Component enables remote code execution when a victim opens a specially crafted file containing malicious graphics content. Affected products include Microsoft Office LTSC for Mac 2021 and 2024, Microsoft 365 for Mac, and Microsoft Office for Android prior to 16.0.20430.20000. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects no privilege requirements on the target system and network-accessible delivery, though user interaction - opening a malicious document - is required. No public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the Windows Win32K kernel-mode driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM level via a network-accessible exploit path, affecting 12 distinct Windows releases spanning Windows 10 1809 through Windows Server 2025 and Windows 11 26H1. The CWE-121 flaw resides in the kernel subsystem handling GDI rendering and windowing, making successful exploitation equivalent to full operating system compromise. Microsoft has released patches addressing all affected build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Word's document parsing engine allows remote unauthenticated attackers to execute arbitrary code with the privileges of the victim user when a specially crafted Word document is opened. The flaw (CWE-121) spans Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016 on both Windows and macOS. Microsoft has released patched builds; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Stack-based buffer overflow in Microsoft Word (CWE-121) enables remote code execution by enticing a user to open a maliciously crafted document, with full compromise of confidentiality, integrity, and availability. Affected products span Office 2019, 2021, and 2024 LTSC on both Windows (x86/x64) and macOS, as well as Microsoft 365 Apps for Enterprise and Word 2016. Microsoft has released patches across all affected product lines; no public exploit code has been identified and CISA KEV confirmation is absent at time of analysis.
Stack-based buffer overflow in the Windows Device Association Service enables an authenticated, low-privileged network attacker to escalate privileges to full system compromise across Windows 10, Windows 11, and Windows Server 2012 through 2025. The vulnerability (CWE-121) requires user interaction to trigger but delivers complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has issued patches covering the full affected version range.
Privilege escalation via a stack-based buffer overflow in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server 2019/2022/2025 across a wide range of release builds. A low-privilege network attacker who induces victim user interaction can achieve full confidentiality, integrity, and availability compromise of the targeted system, consistent with elevation to SYSTEM-level access. A vendor-released patch is available via Microsoft Patch Tuesday; no public exploit has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Word's document-parsing engine enables network-delivered remote code execution with full system impact across all current Microsoft Office product lines on Windows and macOS. The vulnerability (CWE-121) is triggered when a user opens a specially crafted Word document, overflowing a fixed-size stack buffer and allowing an attacker to hijack control flow and execute arbitrary code in the context of the logged-in user. Affected versions span Word 2016 through Microsoft 365 Apps for Enterprise and LTSC editions on both x86/x64 Windows and macOS; patches are available per vendor advisory, and no public exploit code has been identified at time of analysis.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows MIDI Service Module enables local privilege escalation on Windows 11 systems across three major release branches. An authenticated local attacker with standard user privileges (PR:L) can trigger the overflow with low complexity and no user interaction, achieving full SYSTEM-level compromise (C:H/I:H/A:H). Microsoft has released patches covering Windows 11 versions 24H2, 25H2, and 26H1; no public exploit or KEV listing is present at time of analysis.
Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker with standard user privileges to escalate to full system control across Windows 10 and Windows 11. The flaw (CWE-121) is triggered locally with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 vector. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-privilege requirement and zero interaction needed make this a realistic post-compromise escalation primitive.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Stack-based buffer overflow in the Windows Broker Infrastructure Service (CWE-121) allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM on a wide range of Windows client and server editions. The vulnerability affects Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, including Server Core installations. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Stack-based buffer overflow in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated network attacker with low-level privileges to execute arbitrary code, with scope change enabling impact beyond the SQL Server process itself. The vulnerability carries CVSS 8.5 (S:C) with high confidentiality, integrity, and availability impact, indicating that successful exploitation can compromise not just the database engine but potentially the underlying OS. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though CVSS AC:H reflects meaningful exploitation complexity requiring careful payload construction against modern memory protections.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. A public proof-of-concept exploit has been published targeting this exact vector, and no vendor patch has been identified for this legacy device.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
Stack-based buffer overflow in libxml2 before 2.15.4 exposes applications that perform DTD element validation to potential arbitrary code execution via the `xmlSnprintfElements` function in `valid.c`. The function performs unbounded `strcat` calls into a caller-supplied fixed-size stack buffer when formatting element content model descriptions, with no remaining-capacity check before appending parentheses - allowing a crafted XML document with a sufficiently complex element content model to overflow adjacent stack memory. The fix is confirmed in libxml2 2.15.4 via a specific GitHub commit; no public exploit or active exploitation has been identified at time of analysis.
Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.
Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.
Done. The analysis is above as the JSON object. Key points of the synthesis: - **Same FreeIPMI 1.6.19 cluster** as CVEs 85504/85507/85508 already tracked — all client-side stack overflows (CWE-121) triggered by a malicious/compromised BMC returning oversized responses. - **CVSS 9.8 is overstated**: this is a client-side/rogue-BMC flaw, not an internet-facing service. I assessed it down to `AC:H/UI:R` (needs attacker control of a BMC plus an operator/job initiating the FRU read). - **Metadata is clean** — vendor tag, CPE, and CWE all correct, and no embedded injection note this time — so `data_quality_flags` is `[]`. - Fix confirmed as 1.6.19; no EPSS/KEV/POC signal, so exploitation status is unknown. Memory updated with the new CVE note and index entry.
Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (all versions before 1.6.19) can corrupt memory in the client host when the 'dell get-system-info cmc-info' subcommand parses a CMC info response, potentially leading to code execution in the context of the operator running the tool. The flaw lives in the response-handling routine _output_dell_system_info_cmc_info (ipmi-oem/ipmi-oem-dell.c), so it is triggered by the data returned from the queried BMC/CMC rather than by an inbound network request. No public exploit identified at time of analysis, and it is not in CISA KEV; EPSS data was not provided.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (versions before 1.6.19) lets a malicious or compromised Dell iDRAC BMC corrupt the memory of the client host running the 'dell get-system-info idrac-info' subcommand, potentially achieving code execution in the context of the operator (often root). The flaw sits in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c, which copies attacker-influenced OEM response data into a fixed-size stack buffer without bounds checking. No public exploit identified at time of analysis; disclosed via oss-security and fixed in FreeIPMI 1.6.19.
Stack-based buffer overflow in GNU FreeIPMI before 1.6.19 lets a malicious or compromised Fujitsu iRMC BMC corrupt client memory when the FreeIPMI tooling parses malformed Fujitsu SEL 'long text' responses in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text. Successful exploitation can crash the client or execute arbitrary code in the context of the process reading the System Event Log (typically ipmi-sel or libfreeipmi consumers). No public exploit is identified at time of analysis, and the flaw is fixed in FreeIPMI 1.6.19.
Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and below enables attackers to potentially achieve full system compromise, including code execution. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) indicates local access with low privileges, while the vendor description separately references a 'high privileged remote attacker' - a direct conflict in both attack vector and privilege level requiring vendor clarification. No public exploit or CISA KEV listing exists at time of analysis.
Stack-based buffer overflow in the GPU component of Google Chrome on Windows (prior to 152.0.7977.75) enables full sandbox escape and arbitrary code execution on the host operating system. Exploitation is a two-stage chained attack: an attacker must first compromise the renderer process (via a separate vulnerability or exploit), then leverage this GPU flaw to break out of Chrome's sandbox and execute code with elevated host privileges. Google has released a patch in the stable channel update for desktop; no public exploit code or CISA KEV listing has been identified at time of analysis.
Silent stack-based buffer overflow in Pyramid Solutions' NetStaX EtherNet/IP Stack before v5.6.1 lets a remote attacker send an oversized Class 3 explicit-message request that overruns the application-side receive buffer without any CIP error being returned, causing memory corruption, device crash, or a potential remote code-execution path. Any industrial device embedding the affected stack for EtherNet/IP communication is exposed over the network with no authentication. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the device's web management CGI interface. The setUploadSetting handler fails to validate the length of the FileName parameter before copying it onto the stack, allowing an attacker with low-privilege access to overwrite control data and execute arbitrary code on the router. A public proof-of-concept has been disclosed on GitHub, materially increasing exploitation risk even in the absence of a confirmed vendor patch.
Stack-based buffer overflow in the D-Link DIR-825M 1.1.8 LTE Module Firmware Upgrade handler allows low-privileged remote attackers to achieve remote code execution by supplying an oversized fota_url argument to /boafrm/formLtefotaUpgradeFibocom. The CVSS 4.0 vector scores this at 8.6 with subsequent-system impact (SC:H/SI:H/SA:H), reflecting the potential to compromise the attached Fibocom LTE module as well as the primary router. A public proof-of-concept exploit is available on GitHub, significantly lowering the bar for exploitation; no public patch has been identified at time of analysis.
Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.
Stack-based buffer overflow in the Bendix EC80ESP brake ECU family enables adjacent-network attackers to crash the ECU or achieve remote code execution and arbitrary CAN bus traffic injection via a crafted payload. All known variants across both EC80ESP and EC80ESP+ product lines are affected, including J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, and 4S/4M configurations deployed on commercial vehicles. Successful exploitation could disable safety-critical functions including ABS, steering assist, speedometer, and automatic gear shifting. No public exploit has been identified at time of analysis; the flaw was disclosed by CISA ICS-CERT.
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.
Stack-based buffer overflow in GNOME Dia diagram editor (0.98.0 and earlier) permits stack exhaustion and potential return-address corruption when a victim opens a crafted .dia XML file containing a Bus object with an attacker-controlled bus_handles value and then moves a handle in the diagram. The root cause - an unbounded g_alloca() call driven by an unvalidated file attribute - is also present in objects/Misc/tree.c via Tree objects, widening the attack surface. No public exploit or CISA KEV listing exists at time of analysis, but the GitLab issue provides sufficient technical detail for proof-of-concept development.
Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact.
Remote code execution within the Chrome sandbox is possible in Google Chrome prior to 152.0.7977.65 via a stack-based buffer overflow in the V8 JavaScript engine, triggered by a crafted HTML page visited by an unpatched user. The vulnerability requires no authentication or elevated privileges from the victim - only that they visit an attacker-controlled page - and achieves arbitrary code execution within Chrome's renderer sandbox. No public exploit has been identified at time of analysis, and EPSS at 0.39% (31st percentile) indicates low current exploitation probability despite the 8.8 CVSS score; notably, Google's own internal severity rating is Medium, reflecting the sandbox containment.
Stack-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-in user. Exploitation is triggered by opening a specially crafted file, making this a file-parsing attack delivered through phishing or malicious asset distribution targeting 3D artists and designers. No public exploit code or active exploitation has been identified at time of analysis, though full confidentiality, integrity, and availability impact makes this a meaningful risk for affected users.
Stack-based buffer overflow in the SpaceDot AcubeSAT On-Board Computer (OBC) software allows remote unauthenticated attackers to crash the OBC by sending a crafted ECSS Telecommand (TC) message to the loadRawData function. The vulnerability, traced to commit eaf90ec, results in availability loss only - no confidentiality or integrity impact is indicated. No public exploit code or active exploitation has been confirmed; EPSS sits at 0.14% (4th percentile), consistent with the niche, mission-specific deployment footprint of this software.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. Publicly available exploit code exists and the flaw was reported by VulnCheck; CVSS 4.0 base is 9.3 (AV:N/AC:L/PR:N/UI:N), but no active exploitation (CISA KEV) is confirmed.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks.
Stack-based buffer overflow in UTT HiPER 1250GW firmware (≤ 3.2.7-210907-180535) exposes the device to remote code execution via a crafted HTTP request to the `/goform/aspRemoteApConfTempSend` endpoint. The unsafe `strcpy()` call processing the `Profile` parameter allows a low-privileged remote attacker to overwrite stack memory, with full confidentiality, integrity, and availability impact on both the device and downstream network systems per the CVSS 4.0 subsequent-system metrics. A public proof-of-concept is confirmed on GitHub; no public exploitation confirmed in CISA KEV at time of analysis.
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.
Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.
Stack-based buffer overflow in TP-Link TL-MR6400 v7 firmware update functionality enables an authenticated, adjacent-network attacker to achieve arbitrary code execution on the affected device. The flaw (CWE-121) arises from unsafe parsing of attacker-controlled metadata embedded in a firmware image, leading to memory corruption at the stack level. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is further constrained by requirements for high-privilege access (PR:H) and network adjacency (AV:A).
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 arises from a stack-based buffer overflow (CWE-121) that a remote attacker can trigger without authentication or user interaction, yielding total compromise of these Power-based enterprise Unix and virtualization-management systems. The CVSS 9.8 rating reflects a fully remote, low-complexity path to arbitrary code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low (0.61%, 47th percentile), indicating no observed widespread exploitation yet despite the critical severity.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.
Remote unauthenticated code execution is possible in swift-nio-ssh, Apple's Swift implementation of the SSH2 protocol built on SwiftNIO, where a single crafted SSH message triggers an out-of-bounds stack write of attacker-controlled length and content. Any server or client application built on swift-nio-ssh before 0.14.1 is affected, and an attacker can corrupt stack memory pre-authentication to potentially achieve arbitrary code execution. No public exploit identified at time of analysis, and despite the maximal 9.8 CVSS the EPSS probability is currently low (0.14%, 4th percentile).