Buffer Overflow

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB), BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP (with sufficient MAC header room to insert the temporary HBH jumbo header). However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp") loosened the check in skb_gro_receive(), leading to several issues: 1. skb_gro_receive() checked skb_headroom(p) instead of the actual space before the MAC header (p->mac_header). Because skb_headroom(p) includes mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the temporary HBH jumbo header, the memmove() starts before skb->head, causing an out-of-bounds write and wrapping skb->mac_header. 2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q / ETH_P_8021AD) to aggregate beyond 64KB because p->protocol != ETH_P_IPV6 was true. 3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark, allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate beyond 64KB. Fix skb_gro_receive() to strictly enforce: - NAPI_GRO_CB(skb)->proto == IPPROTO_TCP - Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation) - Protocol must be either ETH_P_IP or ETH_P_IPV6 - If ETH_P_IPV6, p->mac_header must be at least sizeof(struct hop_jumbo_hdr) Returning -E2BIG from skb_gro_receive() ensures that packets which cannot become BIG TCP are cleanly flushed at <= 64KB and delivered intact without dropping. This issue does not exist in mainline (7.0+) because the subsystem was rewritten in commit 81be30c1f5f2 ("net/ipv6: Drop HBH for BIG TCP on RX side"), making this fix relevant only for older stable branches like 6.18.y.

Integer overflow in Klever-Go's semi-fungible token (SFT) add-quantity path prior to version 1.7.19 allows a mint-role holder to bypass a finite per-nonce MaxSupply constraint, minting approximately 9.2×10^18 tokens in a single transaction. The SFTAddCirculation function in core/kapp/systemAccount/systemAcount.go increments Circulation before checking the cap, enabling an int64 wraparound that makes the MaxSupply comparison permanently false. A proof-of-concept unit test is included in GHSA-mrpp-v6pg-p54x confirming the bypass; no CISA KEV listing is present at time of analysis.

Integer overflow in U-Boot's SquashFS filesystem parser (fs/squashfs/sqfs.c, function sqfs_concat_tokens) enables heap under-allocation followed by a heap-based buffer overflow via strcpy() when a crafted SquashFS image with manipulated token lists is processed during boot. All U-Boot releases through v2026.01-rc4 are affected. No public exploit code and no CISA KEV listing have been identified at time of analysis; a confirmed fix is available in v2026.04-rc1 (commit adccdb2).

Heap buffer overflow in U-Boot's do_mv shell command (fs/fs.c) affects all versions through v2026.01-rc4 and allows an attacker with U-Boot shell access to corrupt pre-boot heap memory and potentially execute arbitrary code before any OS-level security controls activate. The flaw is rooted in missing bounds checks during string length addition when constructing move-command path arguments: integer overflow causes a heap under-allocation, which is then overflowed by an unchecked strcpy() call. No public exploit code or active exploitation has been identified, and the upstream fix is confirmed in v2026.04-rc1.

Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in MongoDB BI Connector ODBC Driver allows an authenticated user who can influence the numeric argument of a SQL LIMIT clause to crash the hosting application process or corrupt adjacent stack memory. The vulnerability is gated by a non-default driver configuration: the prefetch feature must be explicitly enabled, narrowing real-world exposure to that subset of deployments. No public exploit code has been identified and the issue is absent from CISA's Known Exploited Vulnerabilities catalog; however, where conditions are met, availability impact is rated High by the reporter.

Token minting without source debit in klever-go's percentage-transfer royalty path (`processPercentageRoyaltiesTransfer`) allows an asset owner who configures a 100% split royalty to cause the blockchain to credit the full royalty amount to an attacker-controlled address on every subsequent transfer by any holder, while the sender debit is silently skipped due to an early-return guard placed before the collection call. The exploit fires automatically on third-party transfers once the asset is configured, enabling unbounded off-books token inflation. A full Go unit test and on-chain transaction trace confirming the mint are publicly available; no CISA KEV listing exists, but the patch's inclusion of a hardcoded freeze list for six specific Klever mainnet addresses strongly implies active exploitation occurred prior to the fix.

Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.

Memory corruption in the TP-Link TL-WR841N v14 embedded HTTP service allows an unauthenticated attacker with adjacent network access to trigger a buffer overflow by submitting a crafted multipart/form-data request containing an oversized boundary parameter. The confirmed impact is limited to undefined application behavior resulting from process memory corruption; TP-Link's own advisory and the CVE description both explicitly state that arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, despite those labels appearing in the CVE tags. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Heap out-of-bounds read and stack out-of-bounds access in GIMP's file-psd plugin allow an attacker to crash the application or disclose limited memory contents by convincing a user to open a specially crafted PSD image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6 through 9 and stems from missing validation of the channel-count parameter during PSD parsing. No active exploitation has been identified; the attack requires local file delivery and deliberate user interaction, significantly constraining real-world risk.

Ledger value-creation (KLV minting) in Klever's marketplace settlement affects the klever-go node prior to v1.7.19: because referral and royalty cuts are paid in full while a negative seller remainder is silently dropped, any funded account can settle a self-dealt order whose referral% + royalty% exceeds 100% and mint the surplus into attacker-controlled addresses. Exploitation requires only an ordinary account (PR:L) reachable over the public transaction RPC (CVSS 9.6). Committed regression-test exploit code exists, and the vendor advisory (GHSA-p7gw-2pcp-5pf8) and community monitoring document active mainnet exploitation that minted tens of millions of KLV before an emergency guard was deployed, though this CVE is not listed in CISA KEV.

Stack-based buffer overflow vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch web management interface allow a remote authenticated attacker to crash the CGI process and disrupt web-based device administration. Three separate POST parameter handlers in /cgi-bin/dispatcher.cgi - processing usrPass, enbPass, usrName, and usrPass - copy user-supplied input into fixed-size stack buffers without bounds validation, triggering CWE-121 conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; impact is confined to denial of service against the web management plane.

Stack-based buffer overflow and null pointer dereference vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch firmware (all versions before 3.441b260626) allow a remote authenticated attacker to crash the CGI-based web management service by submitting crafted POST requests to RADIUS server configuration handlers. The `web_radiusSrv*_post` handler family in `/cgi-bin/dispatcher.cgi` copies user-controlled parameters into fixed-size stack buffers without bounds checking and dereferences `radName`/`radIp` pointers without confirming their presence. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis; a vendor-released firmware patch is available.

Stack-based buffer overflows in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allow a remote administrator to crash the web management interface by sending crafted HTTP POST requests to /cgi-bin/dispatcher.cgi. More than 30 named CGI handler functions - spanning VLAN, SNMP v3, ACL, AAA, DHCP, STP, PoE, and cable diagnostics subsystems - copy attacker-supplied POST parameters into fixed-size stack buffers without length validation. The confirmed impact is denial of service of the web management service; the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a vendor patch is available.

Stack buffer overflow in the PLANET GS-4210-16P2S managed switch web management interface exposes all firmware versions prior to 3.441b260626 to unauthenticated remote denial of service and potential memory corruption. The _readHttpParam function copies attacker-supplied HTTP query string data into a fixed-size stack buffer without enforcing size limits or guaranteeing NUL termination, after which parse_query_string processes the unbounded attacker-controlled content. No public exploit code has been identified at time of analysis and KEV status is not confirmed, but the pre-authentication network vector with no special preconditions makes this straightforwardly reachable; a vendor patch is available.

Heap out-of-bounds read in GIMP's file-pvr plugin exposes users of Red Hat Enterprise Linux 6 through 9 to application crashes and limited heap memory disclosure when opening a crafted PVR image file. The VQ (Vector Quantization) compressed-texture decoder omits mandatory bounds validation, allowing a malicious image to read beyond allocated heap regions. Impact is primarily denial of service via crash, with a secondary low-severity information disclosure path; no public exploit code and no CISA KEV listing are associated with this issue at time of analysis.

Heap out-of-bounds read in GIMP's file-ico plugin allows a local attacker to crash GIMP or leak limited heap memory contents by delivering a specially crafted ICO image file to a victim user. Affected packages span Red Hat Enterprise Linux 6 through 9. No public exploit code or CISA KEV listing exists at time of analysis, but the user-interaction requirement (opening a malicious file) is the primary delivery mechanism and a realistic social-engineering target in image-processing workflows.

Out-of-bounds memory write in libsolv crashes RPM-based package manager tools (dnf, yum, zypper) when processing a corrupted or specially crafted .solv repository cache file. The root cause is an absent array-index bounds check on directory-id values read from compressed filelist data during .solv file rewriting - but because the out-of-bounds write stores only a fixed, non-attacker-controlled value, the vendor explicitly rules out arbitrary code execution, confining impact to denial of service. No public exploit has been identified and no active exploitation is confirmed; note that the 'RCE' metadata tag conflicts directly with the description and appears to be erroneous.

Heap out-of-bounds read in GIMP's file-iff plugin allows a local attacker to crash the application or disclose limited heap memory contents by delivering a specially crafted IFF/ILBM image file. The flaw stems from missing validation of HAM row size when the number of color planes (nPlanes) is zero, causing a size mismatch that bypasses memory bounds checking. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-2025-40843 remediation: the safe_strcpy() call at ldlogger-tool-gcc.c:129 receives destination pointer fullPath + 2 but the full PATH_MAX (4096) as its size bound, causing a deterministic 2-byte overwrite past the 4094 bytes that actually remain on every invocation of the GCC logger component. The overflow is unconditional and input-independent; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric, though no active exploitation (CISA KEV) has been confirmed.

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve filter with the editheader extension corrupt memory during mail delivery, leaking out-of-bounds buffer contents into the delivered message and potentially crashing or executing code in the delivery process. The flaw is remotely reachable with low-privilege credentials (CVSS 9.1, scope-changed) and combines information disclosure with a denial-of-service and possible RCE. No public exploit is identified at time of analysis and it is not on CISA KEV, so risk is currently theoretical but severe.

Authenticated availability disruption in OX Dovecot Pro and OX Dovecot CE allows any valid credential holder to crash the imap-hibernate service by opening many concurrent connections and sending malformed IMAP commands, triggering an intermittent out-of-bounds read (CWE-125). The crash terminates the imap-hibernate process, dropping hibernated IMAP sessions for co-hosted users and degrading service availability. No public exploit code is known and the vulnerability is not listed in CISA KEV; however, the low attack complexity means any authenticated user on a shared mail platform could attempt disruption.

Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.

Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.

Bitmap overflow and incorrect global accounting in the Linux kernel's percpu-km memory allocator (`mm/percpu-km`) allow a local low-privileged attacker on SMP/NUMA systems to corrupt kernel memory, with potential for privilege escalation or kernel crash. Two separate commits introduced the flaws: a63d4ac4ab609 caused `pcpu_create_chunk()` to write beyond the `chunk->populated` bitmap when `nr_units > 1`, and b539b87fed37f introduced the companion `pcpu_nr_empty_pop_pages` accounting error. Fixes have been backported to eight stable kernel branches (5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2); no public exploit has been identified at time of analysis.

Integer truncation in the Linux kernel s390/dasd ECKD driver exposes IBM Z systems to a heap buffer overflow via a caller-controlled track range supplied to dasd_eckd_check_device_format(). The root cause is that fmt_buffer_size is declared as int while the buffer-size expression evaluates at size_t width, causing the result to be silently truncated on assignment; kzalloc() then allocates a buffer far smaller than needed, while the subsequent channel program builder operates on the untruncated track count and writes past the allocation. Systems running unpatched kernels before 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2 on s390 architecture face potential kernel heap corruption with consequences ranging from denial of service to local privilege escalation. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmw_cursor_plane_atomic_check() bounds cursor width and height only on the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the default on modern hosts -- accepts any size. When the requested size exceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE, vmw_cursor_mob_get() returns -EINVAL and leaves vps->cursor.mob NULL. Its return value is then discarded in vmw_cursor_plane_prepare_fb(), so the subsequent vmw_cursor_update_mob() calls vmw_bo_map_and_cache(NULL) and oopses inside vmw_bo_map_and_cache_size() on the tbo.base.size load. Reachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a sufficiently large width or height (e.g. cursor_max_dim + 1). Reject oversized cursors in atomic_check for both MOB-backed cursor update types. The MOB byte-size limit only applies to the SVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for GB_ONLY); compute the required MOB size in 64-bit to avoid overflow when very large dimensions are requested. In prepare_fb only call vmw_cursor_mob_get()/_map() for VMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo->map.virtual directly and would otherwise be silently downgraded to NONE on hosts without SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always returns -EINVAL). Degrade the update to NONE if vmw_cursor_mob_get() or vmw_cursor_mob_map() fails so the update path does not run with a NULL backing MOB.

Out-of-bounds memory corruption in the Linux kernel's vmwgfx DRM driver (vmw_external_bo_copy()) allows a local attacker with low-privilege DRM access to corrupt kernel memory via a crafted atomic display commit using an imported dma-buf framebuffer. Two distinct code paths are vulnerable: the equal-stride memcpy path suffers unsigned integer underflow when caller-supplied offsets exceed the buffer object size, and the non-equal-stride row-by-row path performs no bounds validation at all, allowing the copy loop to walk arbitrarily past the vmap end. Vendor-released patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis.

Out-of-bounds memory access in the Linux kernel's ltc4282 hwmon driver exposes systems with this hardware monitor to kernel memory disclosure or destabilization via the VGPIO minimum alarm voltage sysfs read path. A missing return statement in the driver causes the kernel to access memory beyond intended bounds when a local user reads the VGPIO channel's minimum alarm voltage attribute. Patch versions are available across multiple stable branches; no public exploit exists and EPSS sits at 0.17% (6th percentile), indicating very low current exploitation pressure despite the 7.8 CVSS score.

Out-of-bounds slab write in the Linux kernel idpf network driver lets a malicious or compromised control plane (a PF or a hypervisor's device model) corrupt kernel heap memory during interrupt-vector setup. idpf_get_reg_intr_vecs() fills the reg_vals[] array bounded only by per-chunk num_vectors from a VIRTCHNL2_OP_ALLOC_VECTORS reply, which is never reconciled against the smaller num_allocated_vectors used to size the allocation, so a reply whose chunk counts sum higher writes struct idpf_vec_regs entries past the buffer. It carries a CVSS of 9.3, but EPSS is only 0.15%, it is not on CISA KEV, and there is no public exploit identified at time of analysis.

Out-of-bounds kernel memory reads in the Linux kernel's NTFS driver arise because ntfs_read_locked_inode() copies a resident $ATTRIBUTE_LIST into ni->attr_list via a plain memcpy() with no sanity checking, while only the non-resident path was ever validated by load_attribute_list(). A crafted NTFS volume with a malformed resident attribute list is then trusted by every subsequent walk (ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), ntfs_attrlist_need()), which read fixed-header fields past the buffer. The fix factors per-entry validation into ntfs_attr_list_entry_is_valid()/ntfs_attr_list_is_valid() and applies it on the resident path and inside load_attribute_list() itself; no public exploit identified at time of analysis and EPSS probability is very low (0.15%).

Out-of-bounds slab read in the Linux kernel's legacy in-kernel NTFS driver lets a crafted on-disk $ATTRIBUTE_LIST leak or crash adjacent kernel heap memory when a malicious NTFS volume is mounted and read. The flaw is in ntfs_external_attr_find(), where a look-ahead attribute-list entry is dereferenced past the end of the kvmalloc'd buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.15%, 5th percentile), and it is not listed in CISA KEV.

Out-of-bounds kernel heap read in the Linux kernel's classic in-tree NTFS driver (`fs/ntfs/`) allows a local, low-privileged user to disclose kernel memory - and potentially chain to privilege escalation - by mounting a crafted NTFS image at the filesystem layer. The flaw is a u16 integer truncation in `ntfs_check_restart_area()` that silently defeats a page-size bounds check, causing `ntfs_check_log_client_array()` to dereference up to ~64 KiB beyond an allocated heap buffer using attacker-controlled on-disk values. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.15% (5th percentile), reflecting negligible observed exploitation pressure.

Heap and integer-overflow memory corruption in the Linux kernel's userspace perf tool (perf sched) lets a malicious perf.data file corrupt memory when parsed by register_pid(). An analyst who runs 'perf sched' against an attacker-supplied perf.data trace can trigger out-of-bounds heap writes, an unchecked strcpy into a 20-byte comm buffer, and denial of service, potentially leading to code execution in the context of the user running perf. A vendor fix is available; EPSS is low (0.18%) and there is no public exploit identified at time of analysis.

Out-of-bounds heap read in the Linux kernel's perf userspace tooling (perf tools) lets a crafted perf.data file trigger memory disclosure or a crash when parsed. The flaw sits in machine__resolve(), which trusts an attacker-controlled CPU index (al->cpu) from sample data and indexes env->cpu[] without validating it against env->nr_cpus_avail; a large index reads past the heap allocation, and values like 65536 truncate to int16_t and silently resolve to CPU 0. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile).

Out-of-bounds memory access in the Linux kernel's ARM SCMI firmware subsystem allows a local low-privileged attacker on ARM-based hardware to trigger kernel memory corruption via the scmi_power_name_get() function, which fails to validate the domain number supplied by external callers. Affected kernel versions span from the introduction commit 76a6550990e2 through multiple stable branches, with patches backported to LTS lines 5.15, 6.1, 6.6, 6.12, and 6.18. No public exploit code has been identified at time of analysis, and EPSS probability is very low at 0.17% (7th percentile), indicating no current attacker tooling interest despite the 7.8 CVSS score.

In the Linux kernel, the following vulnerability has been resolved: cxl/fwctl: Fix __fortify_panic Fix a runtime assertion in cxlctl_get_supported_features(). Fortify complains that it is potentially overflowing the entries array per __counted_by_le(num_entries). Quiet the false positive by initializing @num_entries earlier. memcpy: detected buffer overflow: 48 byte write of buffer size 0 WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#7: fwctl/1398 RIP: 0010:__fortify_report+0x50/0xa0 Call Trace: __fortify_panic+0xd/0xf cxlctl_get_supported_features.cold+0x23/0x35 [cxl_core]

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix __fortify_panic Fix a runtime assertion in setup_xor_mapping(). Fortify complains that it is potentially overflowing the xormaps array per __counted_by(nr_maps). Quiet the false positive by initializing @nr_maps earlier. memcpy: detected buffer overflow: 32 byte write of buffer size 0 WARNING: lib/string_helpers.c:1036 at __fortify_report+0x4d/0xa0, CPU#8: modprobe/2728 Call Trace: __fortify_panic+0xd/0xf setup_xor_mapping+0x6c/0xa0 [cxl_translate] [ dj: Fixed up @nr_entries to @nr_maps in commit log. ]

Out-of-bounds write in the Linux kernel's OCFS2 cluster filesystem driver corrupts adjacent kernel memory when a low-privileged user unlinks a refcounted file whose refcount tree contains leaf blocks, triggering a fortify panic on hardened kernels. The root cause is an incorrect memset bound in `ocfs2_remove_refcount_extent()` arising from a union aliasing issue between `rf_records.rl_count` and `rf_list.l_tree_depth`. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile) and the vulnerability does not appear in CISA KEV, reflecting low real-world exploitation risk at time of analysis.

Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver allows an adjacent-network attacker to corrupt Block Acknowledgment session state by sending crafted 802.11 frames that elicit a short firmware response. Kernels from 4.7 through pre-patch stable branches on devices equipped with Qualcomm WCN3660/WCN3620/WCN3680 WiFi hardware are affected. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.17% (7th percentile) reflects negligible observed exploitation probability consistent with the hardware-specific attack surface.

Null-pointer dereference in the Linux kernel's btrfs LZO decompression path can crash the kernel when reading a crafted compressed extent, causing a denial-of-service. Kernels in the range starting at commit a6e66e6f8c1b685e11b778bef614480a9c1a5278 through the two fix commits are affected across multiple stable branches (5.15 and later). No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.15% (5th percentile) confirms this is not yet being exploited at scale. Exploitation requires the attacker to introduce a malformed btrfs filesystem image with LZO-compressed extents that the kernel then reads.

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: npc: Fix size of entry2cntr_map KASAN prints below splat. This is caused by allocating counter for reserved mcam entry for cpt 2nd pass entry. But mcam->entry2cntr_map is not allocated for reserved entries. BUG: KASAN: slab-out-of-bounds in npc_map_mcam_entry_and_cntr+0xb0/0x1a0 Write of size 2 at addr ffff0001033e7ffe by task kworker/0:1/14 CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 6.1.67 #1 Hardware name: Marvell CN106XX board (DT) Workqueue: events work_for_cpu_fn Call trace: dump_backtrace.part.0+0xe4/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x88/0xb4 print_report+0x154/0x458 kasan_report+0xb8/0x194 __asan_store2+0x7c/0xa0 npc_map_mcam_entry_and_cntr+0xb0/0x1a0 rvu_mbox_handler_npc_mcam_write_entry+0x268/0x280 npc_install_flow+0x840/0xfe0 rvu_npc_install_cpt_pass2_entry+0x138/0x190 rvu_nix_init+0x148c/0x2880 rvu_probe+0x1800/0x30b0 local_pci_probe+0x78/0xe0 work_for_cpu_fn+0x30/0x50 process_one_work+0x4cc/0x97c worker_thread+0x360/0x630 kthread+0x1a0/0x1b0 ret_from_fork+0x10/0x20

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maar_res_walk() maar_res_walk() uses wi->num_cfg as the index into the fixed-size wi->cfg array, but checks whether the array is full only after it has filled the selected entry. If walk_system_ram_range() reports more than 16 memory ranges, the overflow call writes one struct maar_config past the end of the array before WARN_ON() prevents num_cfg from advancing. Move the full-array check before taking the array slot and return non-zero when the scratch array is full, so walk_system_ram_range() terminates the walk instead of invoking the callback for further ranges.

Heap buffer overflow in the Linux kernel's Airoha (airoha_eth) network driver allows the packet-processing engine (PPE) flow-offload logic to write past an undersized allocation, corrupting kernel heap memory and crashing affected systems. The bug affects Linux 6.18.x through 6.18.39 and 6.19/7.x pre-release trees on hardware using the Airoha PPE flow-offload driver, and is triggered when airoha_ppe_foe_verify_entry() processes a flow hash at or above half the entry count. It is not in CISA KEV and has a low EPSS (0.18%), with no public exploit identified at time of analysis; impact is primarily denial of service.

Kernel memory corruption path in Linux's tunnel metadata subsystem (`tun_dst_unclone`) triggers a FORTIFY_SOURCE memcpy overflow warning when the kernel is built with clang, due to the `__counted_by` annotation on a flexible array member being evaluated as zero at copy time. Systems using GENEVE tunneling on clang-built kernels with source fortification enabled may experience kernel availability disruption if the warning escalates to a panic. No public exploit has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability, and the vulnerability is not listed in CISA KEV.

Out-of-bounds memory access in the Linux kernel's qede network driver (QLogic FastLinQ/QL4xxx Ethernet) occurs because the driver reads into cqe->len_list[] before validating the index, allowing a crafted or malformed completion-queue entry to trigger reads past the array bounds. The flaw affects multiple stable branches (5.15, 6.1, 6.6, 6.12, 6.17/6.18) on systems that load the qede driver, with a vendor fix that reorders the bounds check before element access. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).

Out-of-bounds read in the Linux kernel HID subsystem (hid_get_report) allows an adjacent, unauthenticated attacker to trigger a kernel panic or leak kernel memory by submitting a zero-length numbered HID report via a crafted Bluetooth or USB device. The vulnerability affects multiple stable kernel branches from 5.10.x through 7.1.x, with patches backported across all supported trees. No public exploit has been identified at time of analysis, and EPSS remains very low at 0.18% (7th percentile), indicating limited threat actor awareness thus far.

Out-of-bounds read in the Linux kernel's netfilter nf_conntrack_irc connection-tracking helper (parse_dcc) allows a one-byte stale read past the IRC DCC parse buffer, potentially producing an incorrect DCC IP or port in the resulting conntrack expectation. The flaw stems from parse_dcc() treating data_end as an inclusive pointer while its caller passes an exclusive one-past-the-end limit; the read currently cannot fault because irc_buffer is over-allocated by one byte and datalen is capped at MAX_SEARCH_SIZE. It affects only systems with the nf_conntrack_irc helper active, and there is no public exploit identified at time of analysis (not in CISA KEV; EPSS 0.18%).

Out-of-bounds read in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking subsystem exposes adjacent-network attackers to kernel memory disclosure and system crash. The vulnerability exists in batadv_dat_get_vid() within the Distributed ARP Table (DAT) component, which calls batadv_get_vid() to access the proto field of an ethernet header without first verifying that the underlying data is accessible - an obligation other call sites fulfill but this path omits. A network-adjacent unauthenticated attacker can send a crafted Layer 2 frame to trigger the flaw, yielding High confidentiality impact (kernel memory disclosure) and High availability impact (kernel panic). EPSS is 0.18% (7th percentile) and the flaw is not in CISA KEV, indicating no public exploitation at time of analysis.

Out-of-bounds read in the Linux kernel's ntfs3 LZNT decompression handler allows a local attacker with low privileges to trigger kernel memory access violations by mounting a specially crafted NTFS3 filesystem image. Affected stable branches span 5.15 through 7.x, with patched releases available across all branches. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low predicted exploitation probability despite the high CVSS score of 7.8.

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add checks for the expected response length before accessing the buffers.

Out-of-bounds read in the Linux kernel's asus_atk0110 hardware monitoring driver allows a malformed ACPI GGRP firmware package to trigger kernel memory corruption. Systems running ASUS ATK0110-equipped hardware with a BIOS that returns zero-count sub-packages in its GGRP management group response are affected across a wide range of Long-Term Support and mainline kernel versions from 2.6.32 onward. Exploitation is contingent on a specific hardware/firmware defect condition rather than a direct user action, but the resulting out-of-bounds read in kernel space carries high potential impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche hardware prerequisite.

Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.

Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to the appliance's VPN listener. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication RCE profile on an internet-facing firewall makes this high priority.

Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic, resulting in a Denial of Service condition. All Fireware OS versions appear affected per the wildcard CPE, and the vulnerability is reachable without authentication from any network path to the iked listener. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic target for disrupting VPN availability on WatchGuard appliances.

Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.

Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.

Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.

Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to disrupt VPN operations by sending specially crafted network packets. The flaw resides in VPN processing logic and can crash or destabilize the IKE service, cutting off IPsec/IKEv2 tunnels for connected clients and sites. No public exploit has been identified at time of analysis and CISA KEV listing is not confirmed; however, the unauthenticated network attack vector and CVSS 4.0 score of 8.7 place this in the priority triage tier for organizations relying on WatchGuard Firebox VPN connectivity.

Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.

Buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to trigger a denial-of-service condition or potentially execute arbitrary code by submitting specially crafted traffic to the management interface. The root cause is CWE-787 (out-of-bounds write) in the web-based management component, and the CVSS 4.0 vector confirms network reachability with high-privilege authentication as prerequisites. No public exploit code or active exploitation has been identified at time of analysis, though the RCE potential on a network perimeter device elevates the severity beyond what the privilege requirement alone might suggest.

Out-of-bounds read in V8, Chrome's JavaScript engine, enables remote code execution confined within the renderer sandbox on all platforms running Chrome prior to 151.0.7922.72. The flaw is triggered by a specially crafted HTML page, requiring only that a user visit a malicious site - no authentication or elevated privileges are needed from the attacker. No public exploit code has been identified and no active exploitation is confirmed; EPSS probability stands at 0.30%, aligning with SSVC's 'exploitation: none' classification despite the high CVSS score.

Heap-based buffer overflow in WatchGuard Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon by saving a specially crafted configuration, resulting in denial of service and disruption of IPsec VPN services. The CVSS 4.0 score of 6.9 with PR:H reflects the high-privilege requirement, meaning exploitation is gated behind valid administrator credentials. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis.

Stack-based buffer overflow in the Bendix EC80ESP brake ECU family enables adjacent-network attackers to crash the ECU or achieve remote code execution and arbitrary CAN bus traffic injection via a crafted payload. All known variants across both EC80ESP and EC80ESP+ product lines are affected, including J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, and 4S/4M configurations deployed on commercial vehicles. Successful exploitation could disable safety-critical functions including ABS, steering assist, speedometer, and automatic gear shifting. No public exploit has been identified at time of analysis; the flaw was disclosed by CISA ICS-CERT.

Out-of-bounds write across all Bendix EC80ESP Brake ECU variants enables an unauthenticated attacker with adjacent vehicle-network access to deliver a crafted payload that establishes an arbitrary write primitive, crashing the safety-critical brake Electronic Control Unit. Reported by ICS-CERT and documented in CISA advisory ICSA-26-237-05, all ten identified EC80ESP hardware configurations are affected with no version constraint specified in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the safety implications of a crashed brake ECU demand prioritized attention by fleet operators beyond what the base score alone conveys.

Heap buffer overflow in GNU C Library (glibc) 2.45 and earlier triggers when an effectively empty string is passed via the ,ccs= mode-argument extension to fopen(), enabling limited heap memory corruption in applications that expose this code path to externally controlled input. The vendor-assigned CVSS 3.1 score of 4.9 (Medium) with a local attack vector and high complexity accurately reflects the narrow preconditions required. No public exploit code has been identified at time of analysis, and the glibc advisory itself explicitly notes this vulnerable usage pattern is absent from mainstream GNU/Linux applications.

Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. No active exploitation has been identified (no CISA KEV listing), and no public exploit code is known at time of analysis, but the availability-only impact and user-interaction requirement make this a realistic denial-of-service risk in desktop and server image-processing contexts.

Out-of-bounds read in Adobe DNG SDK 1.7.1 2502 and earlier exposes sensitive memory contents when a victim opens a maliciously crafted DNG file. The flaw resides in the SDK's file parser and affects any application built on top of the DNG SDK that processes untrusted DNG inputs. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, limiting current urgency despite the High confidentiality impact.

Out-of-bounds write in Adobe DNG Software Development Kit versions 1.7.1 2502 and earlier allows memory corruption when a victim opens a maliciously crafted DNG file, causing the consuming application to crash or become unresponsive. The flaw (CWE-787) is constrained to a local, user-interaction-dependent attack path, limiting automated exploitation. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.

Root code execution in Unitree G1 EDU robot firmware through version 1.5.2 is achievable by proximate unauthenticated attackers via a chained BLE GATT and WiFi provisioning exploit requiring no pairing or credentials. Crafted BLE writes overflow a fixed BSS buffer in the SSID chunk accumulator, corrupting an adjacent mainloop function pointer dispatch entry; the cleanup path subsequently invokes this corrupted pointer, passing attacker-controlled data to system() as uid 0. A public proof-of-concept (UniBLEed) is available, and the CVSS 4.0 score of 7.7 reflects the adjacent attack vector and high complexity of the exploit chain.

Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.

Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.

Out-of-bounds heap read in the DHCPv4 packet capture code of wicked (all versions through 0.6.80) allows an unauthenticated attacker on the same Layer-2 network segment to send a crafted DHCP/UDP packet that causes wickedd-dhcp4 to read up to 68 bytes past the end of its 1500-byte receive buffer. Adjacent heap contents - including allocator metadata and pointer values - may be parsed as DHCP options and stored into lease fields, constituting limited information disclosure with a secondary low-integrity configuration impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; an upstream fix exists in GitHub PR #1079, though a tagged release version has not been independently confirmed.

Integer underflow in the wicked DHCPv4 packet capture daemon (wickedd-dhcp4) on SUSE Linux systems allows an unauthenticated adjacent-network attacker to crash the daemon by sending a malformed DHCPv4 packet with an IP total length field smaller than the IP header length. The missing bounds check in ni_capture_inspect_udp_header() triggers an out-of-bounds read, causing a process crash depending on memory layout - resulting in a denial of service to network configuration. No information disclosure has been demonstrated, and no public exploit or CISA KEV listing exists at time of analysis.

Out-of-bounds read and write primitives in the hank-ai Darknet neural network framework (all versions through 6.0) are triggered by parsing a crafted configuration file, yielding a reliable crash and a single fixed-byte heap write at an attacker-controlled offset. The parser in src-lib/darknet_cfg.cpp consumes the `from` field of shortcut, scale_channels, and sam sections-and the `layers` field of route sections-as a direct array index into the layer heap allocation without validating it against the array's declared size. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Stack buffer overflow in Greenbone's OpenVAS Scanner and Greenbone OS allows a remote attacker holding user-level privileges to achieve full system compromise by supplying a malicious or compromised NASL vulnerability test (VT). Both the Greenbone OS platform and the openvas-scanner engine are confirmed affected, making this a meaningful risk in any multi-user GVM deployment or environment where user accounts may be compromised. No public exploit code has been identified at time of analysis, but the network-accessible, low-complexity attack vector and high-impact outcome place this in the immediate patching tier for production scanner infrastructure.

WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains.

Out-of-bounds write in the SmiFlash SMM (System Management Mode) module affects ASUS FA507NU and FA507NV laptop BIOS firmware across all versions. A local administrator can dispatch a crafted Software SMI (SW SMI) request with an oversized length value, causing the SmiFlash handler to write beyond its allocated SMRAM buffer boundary, resulting in a system crash (BSOD) or irreversible BIOS flash corruption. The affected models are designated 'unsupported-when-assigned,' meaning these products were already outside active vendor support when this CVE was issued; no public exploit has been identified at time of analysis.

Out-of-bounds stack array access in the tdelete function affects the GNU C Library (glibc) as reported by Ubuntu. The tdelete function, part of POSIX binary tree search routines (tsearch family), contains a memory safety flaw where a stack-allocated array can be accessed beyond its bounds during tree node deletion. Exploitation depends on an application passing attacker-influenced input to tdelete, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.

HCL BigFix Quantum Risk Analyzer's binary executable lacks multiple industry-standard binary hardening protections, leaving it susceptible to a stack-based buffer overflow (CWE-121). The vulnerability requires local access with high privileges and high attack complexity, yielding a CVSS score of 3.9 (Low). No public exploit code has been identified at the time of analysis, and the combination of local-only access, elevated privilege requirements, and high exploitation complexity significantly constrains real-world risk despite the theoretical severity of a stack overflow primitive.

Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process crash when a user opens a crafted WPG file. The WPG color palette buffer is allocated for exactly 256 entries (768 bytes), but the COLORMAP record parser fails to validate that the supplied start index (i16) or total entry count (iNum16) stay within that bound, allowing a malicious file to drive fread() to write beyond the heap allocation. Affecting all Dia versions on the upstream master branch through at least 2026-08-21, no public exploit or patch version has been confirmed at time of analysis, though the description provides sufficient detail to construct proof-of-concept input.

Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.

Out-of-bounds memory write in the Linux kernel's ASoC lpass-tx-macro audio codec driver allows a local low-privileged user to corrupt kernel memory via misconfigured ALSA enum kcontrol access, with potential for privilege escalation. The driver's get and put handlers for DEC0-DEC7 MODE controls incorrectly access the 8-byte integer union field instead of the 4-byte enumerated union field, writing 4 bytes beyond the intended boundary on 64-bit systems. No public exploit code has been identified at time of analysis, but the pattern mirrors two previously fixed sibling drivers (rx-macro, va-macro), confirming the root cause is well-understood.

Out-of-bounds hardware I/O reads in the Linux kernel's fbdev framebuffer subsystem allow low-privileged local users to read memory beyond valid hardware bounds, with high confidentiality and availability impact. The flaw in fb_io_read() stems from pointer desynchronization after a partial copy_to_user() transfer: the hardware source pointer advances by the full original chunk size while count is only decremented by successfully copied bytes, causing subsequent loop iterations to read from incorrect, over-advanced offsets. No public exploit or CISA KEV listing exists at time of analysis; patches are available across multiple stable kernel branches.

Out-of-bounds kernel heap write in the Linux kernel's Focaltech touchpad input driver allows local attackers to corrupt kernel memory through a signed integer underflow in the finger index variable. The `focaltech_process_rel_packet` function incorrectly handles a packet reporting finger index 0: subtracting 1 from a signed variable produces -1 rather than wrapping to a large unsigned value, bypassing the FOC_MAX_FINGERS bounds check and writing to `state->fingers[-1]`. Affected kernel versions span multiple stable branches from Linux 4.0 through the pre-patch revisions of 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2; no CISA KEV listing and no public proof-of-concept exploit exist at time of analysis.

Heap buffer overflow in the Linux kernel synaptics-rmi4 driver allows local low-privileged users to overwrite kernel heap memory by exploiting stale state in the F54 diagnostics function. Affected systems must have Synaptics RMI4 touchpad hardware present and the driver loaded; exploitation involves manipulating V4L2 buffer sizes to trigger the overflow after an error condition leaves f54->report_size containing a stale value from a prior successful operation. Patches are available across all supported stable branches; no public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Heap buffer overflow in the Linux kernel's synaptics-rmi4 driver allows a local low-privileged user to trigger memory corruption by issuing VIDIOC_S_INPUT while the V4L2 diagnostic queue is actively streaming. The F54 function allocates V4L2 buffers sized to the report type at stream start; switching the input mid-stream to a larger report type overflows those buffers, enabling potential privilege escalation to root. Patches have been released across all active stable kernel branches; no public exploit code or CISA KEV listing has been identified at time of analysis.

Slab-out-of-bounds reads in the Linux kernel's libceph client (cls_lock_client.c decode_locker()) allow a malicious or compromised Ceph OSD to read kernel memory past a validated buffer when a client parses lock information. Any kernel Ceph/RBD client that issues the lock.get_info class method - for example during RBD exclusive lock acquisition - is affected across a wide range of stable branches. The input assigns CVSS 9.8, but no public exploit identified at time of analysis and the flaw is an out-of-bounds read (information disclosure / crash) rather than confirmed code execution, so the practical impact is narrower than the score suggests.

Out-of-bounds memory access in the Linux kernel's libceph client (net/ceph) allows a malicious or corrupted Ceph osdmap to steer requests toward a non-existent OSD index. The flaw stems from an unvalidated osd index taken from the osdmap's primary_temp mapping, which is used to index the fixed-size osd_state, osd_weight, and osd_addr arrays. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed across multiple stable trees.