Buffer Overflow

An out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker operating a rogue base station to escalate privileges on a wide range of MediaTek chipsets (e.g., MT6853, MT6980, MT6991, MT8798, MT6895) once the victim's device connects to that base station; no authentication is required, but exploitation is high-complexity and requires user interaction per the assessed vector. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is bounded by the need for RF proximity to a malicious base station rather than being a mass-exploitable remote flaw.

Local privilege escalation in MediaTek's APU (AI Processing Unit) allows a locally-executing attacker to corrupt memory via malformed input, potentially achieving kernel-level code execution on devices with affected chipsets (MT6899, MT8781, MT8910, MT8793, MT6993, MT8668). The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already run code on the device, such as a malicious Android app, with no additional privileges or user interaction needed. No public exploit identified at time of analysis, and the flaw is fixed by MediaTek patch ALPS11249004.

Local privilege escalation in MediaTek NeuroPilot on affected chipsets (MT8781, MT8189, MT6993, MT8793, MT8910, MT8668, MT8188, MT6881, MT8875) allows an attacker with local code execution to trigger an out-of-bounds write in the APU/AI driver, potentially gaining high-integrity code execution with no user interaction, though no additional privileges are needed once that local app context exists. Vendor patch ALPS11249062 is available; no public exploit identified at time of analysis. It is a high-priority patch target for affected MediaTek-based devices but is not remotely reachable, limiting its scope to privilege escalation rather than initial compromise.

Local privilege escalation in MediaTek's NeuroPilot component allows an attacker with an existing foothold on a device to corrupt memory and elevate privileges via an out-of-bounds write caused by a missing bounds check (CWE-787), rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected platforms are devices built on MediaTek chipsets MT8668, MT8875, MT8781, MT8910, MT6881, MT8188, MT8189 and MT6993 that ship an unpatched NeuroPilot build. The flaw is not remotely reachable and requires local code execution (typically a running or installed Android app with no special privileges); no user interaction or elevated permissions are needed once that foothold exists, and no public exploit code was identified at time of analysis.

Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.

Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.

An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.

A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway appliances running versions prior to the fixed builds (14.1-73.41, 13.1-64.28, 13.1-37.282, and 14.1-73.41 FIPS for ADC; 14.1-73.41 and 13.1-64.28 for Gateway). The vulnerability is network-reachable with low attack complexity and requires no user interaction, making internet-facing Gateway deployments the primary risk surface. No public exploit code or CISA KEV entry was identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high severity for the availability-only impact.

Unauthenticated remote denial of service in Mooncake Transfer Engine before 0.3.12 lets any host that can reach the peer-to-peer handshake socket crash the hosting process - including an SGLang inference server - by sending a single eight-byte handshake frame carrying a zero-length string field. The root cause is an out-of-bounds read (CWE-125) in the readString helper in include/common.h, rated 8.7 under CVSS 4.0 and independently assessed as CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N), with impact confined to availability: no code execution, no data disclosure. Exploitation needs nothing more than network reachability to the handshake port, which the advisory states listens on all interfaces by default; there is no public exploit identified at time of analysis, the issue is not in CISA KEV, and the only limiting factor is whether that port is firewalled or bound to loopback/trusted interfaces.

Heap-based buffer overflow in Google Chrome's WebRTC component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page; all Chrome builds prior to 154.0.8037.97 on desktop and mobile platforms are affected. Successful exploitation requires user interaction (the victim must navigate to or open the attacker-controlled page), but no authentication or prior privileges are needed, and WebRTC is enabled by default. Impact is high for confidentiality, integrity, and availability within the renderer process, though the attack scope is unchanged - breaking out to the host operating system would require chaining a separate sandbox-escape flaw. Exploitation signals are currently weak: EPSS is only 0.25% (15th percentile), CISA SSVC rates exploitation as 'none', and no public exploit code has been identified at time of analysis; a vendor patch is available.

Out-of-bounds write in the WebGL implementation of Google Chrome prior to 154.0.8037.97 allows remote attackers to corrupt memory and potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction - the target must visit or be redirected to an attacker-controlled page that exercises the WebGL path (enabled by default) - but no authentication or prior privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6, Chromium security severity Critical). No public exploit code or confirmed active exploitation was identified at time of analysis; Google credits its own Chrome team for the report, and a vendor patch is available, so the primary risk window is unpatched Chrome installations that continue to browse untrusted content.

Unauthenticated, network-reachable denial of service in Apache Thrift's PHP bindings before 0.25.0 lets attackers crash a Thrift service by sending crafted serialized messages that trigger a stack-based buffer overflow during protocol parsing. The vendor-supplied CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity impact (VC:N/VI:N/VA:H) and no privileges or user interaction required (PR:N/UI:N), and the assessed CVSS 3.1 vector agrees (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis, and the vendor scope bounds the consequence to service crash/denial of service rather than data disclosure or code execution.

Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send Thrift protocol messages to a parsing service trigger an integer-overflow-driven undersized heap allocation followed by an out-of-bounds write, resulting in a crash (denial of service) or potentially attacker-controlled memory corruption with high confidentiality, integrity, and availability impact. The affected surface is any service that deserializes untrusted Thrift traffic; the CVSS v4.0 score of 9.2 reflects network reachability and no required privileges or user interaction, while the AC:H and AT:P metrics (mirrored by the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate that a successful exploit depends on crafting malformed messages that reliably hit the overflow condition and on runtime factors such as heap layout, memory limits, and the specific protocol/transport in use. No public exploit code or confirmed active exploitation was identified at time of analysis, but the framework's broad embedding in RPC and serialization pipelines makes prompt upgrade to 0.25.0 the clear priority. Services that never parse Thrift input from untrusted or remote peers are not reachable through this vector.

Stack-based buffer overflow in the Tenda AC9 wireless router (firmware 15.03.02.13) allows an attacker to corrupt memory and potentially execute code remotely by sending a crafted POST request containing an oversized netWanType parameter to the /goform/fast_setting_internet_set endpoint. Exploitation requires a privileged session on the device's web management interface (CVSS 4.0 PR:H / assessed CVSS 3.1 PR:H), and in default deployments the management UI is LAN-facing, so remote reach generally depends on remote management being enabled or unchanged default credentials. Publicly available exploit code exists, but no CISA KEV entry confirms active exploitation at time of analysis.

Stack-based buffer overflow in the Boa Web Server component of Tenda HG7, HG9 and HG10 XPON gateways running firmware 300001138_en_xpon allows remote, unauthenticated attackers to corrupt memory by sending a crafted request to the /boaform/formLoopBack endpoint with an oversized Ethtype argument. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms no authentication or user interaction is required, and publicly available exploit code exists, so the practical risk hinges on whether the device's management web interface is reachable from the WAN or another untrusted network. Impact is bounded to these specific XPON gateway firmware builds.

Integer underflow in Apache Thrift's C++ THeaderTransport can wrap a length or offset calculation and produce an out-of-bounds write, allowing a network attacker to crash or destabilize services that parse THeader-framed messages. The exposure is narrow: the library must be compiled as a 32-bit binary and must actually use THeaderTransport, while 64-bit builds and services relying on other transports are not affected, so the realistic outcome is denial of service rather than code execution or data disclosure. Affected releases are Apache Thrift before 0.25.0; no public exploit code has been identified at time of analysis, and the vendor's own scoring reflects availability-only impact (VA:H with no confidentiality or integrity effect).

Heap-based buffer overflow in the C++ THeaderTransport of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker corrupt heap memory when an application enables the non-default ZLIB transform for outgoing frames and poorly compressible, peer-influenced data expands during compression. The copy into the write buffer happens without a bounds check, so oversized input overflows the heap allocation and, for large frames, also reads past the end of the transform buffer; impact scales with frame size and reliable code execution versus a crash depends on heap layout. No public exploit code has been identified at time of analysis, and because exploitation requires the ZLIB write transform precondition (without it the vulnerable copy path is never reached), this is a credible high-priority issue rather than an automatic emergency.

Stack-based buffer overflow in the web management interface of Moxa MGate MB3170 and MB3270 series protocol gateways lets an attacker who already holds a valid, low-privilege read-only account corrupt program execution by submitting an over-length account_name value in an account-management request. Because the overwritten stack data can be leveraged to read device memory (including stored credentials), modify arbitrary memory, and crash or hang the device, the impact spans confidentiality, integrity, and availability of both the gateway and the downstream systems it bridges. No public exploit code or active exploitation has been observed (no CISA KEV listing; no public exploit identified at time of analysis), and the realistic barrier is the requirement for valid credentials rather than anonymity - though read-only accounts are often weakly protected or shared, which is why the issue still warrants urgent attention.

Remote denial of service against Apache Thrift C++ deployments that use the THeaderProtocol is achievable by sending a crafted frame header to a network-reachable Thrift endpoint, causing a stack-based buffer overflow that crashes the service; the flaw combines CWE-121 with an incorrect bitwise shift of an integer in the same header-parsing code path. Every Apache Thrift release before 0.25.0 ships the vulnerable C++ implementation, although only services that actually use the THeaderProtocol transport are exposed - services built against other Thrift protocols or transports are not affected by this specific code path. The CVSS 4.0 base score is 8.7 on a fully unauthenticated, network-reachable vector with availability-only impact (VC:N/VI:N/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Stack-based buffer overflow in Apache LDAP API 1.2.0 through 1.2.8 allows unauthenticated remote attackers to crash server-side LDAP filter decoders by sending deeply nested search filters before the bind step, producing a denial-of-service condition. No public exploit code or CISA KEV listing was identified at time of analysis and no EPSS score was provided; the independently assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so the primary risk is remote availability loss rather than code execution.

Out-of-bounds write in PeaZip's PEA archive extractor allows an attacker to execute arbitrary code with the privileges of the user who opens or extracts a crafted .pea file in PeaZip 11.2.0 and earlier, on Windows, Linux, macOS and BSD. The defect is in the first PCOMPRESS1 block: an attacker-controlled 32-bit compsize value is taken straight from the archive and used as both the blockread length and the copy-loop bound into fixed 1,114,112-byte global buffers, with no archive password, integrity tag or non-default configuration required. Exploitation is local and requires the victim to open or extract the archive (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H; CVSS 4.0 base 8.4), and no public exploit was identified at time of analysis, although the reporting researchers demonstrated code execution against the official Linux x86-64 and Windows x64 builds.

Out-of-bounds write in pgvector before 0.8.7 lets an authenticated database user corrupt memory while building or populating a vector index, which can escalate to arbitrary code execution on the PostgreSQL server host. Only users who can create/rebuild a vector index or insert rows into an indexed vector column can trigger it, and the trigger is supplying a vector whose dimensionality does not match the index definition, since affected versions perform no dimension validation. Patch status is a vendor-released fix (0.8.7) and no public exploit code was identified at time of analysis; SSVC scores exploitation as 'none' and automatable as 'no', and EPSS/KEV signals are absent, so this is a high-priority hardening item rather than an emergency - but SSVC rates technical impact as 'total', so multi-tenant databases where untrusted roles hold index or insert privileges are the realistic risk surface.

Stack-based buffer overflow in the TDDPv2 service (/usr/bin/tddp) on TP-Link Deco M9 Plus v2 mesh units lets a network-adjacent, unauthenticated attacker crash the device or potentially execute arbitrary code, but only while the unit is in its setup/provisioning phase. A crafted TDDP request whose decrypted payload is longer than the fixed-size stack buffer used by the subtype 0x91 handler (CWE-121) triggers the overflow with no user interaction. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; TP-Link has published fixed firmware. The risk is genuine but conditionally gated: the attacker must already sit on the same Wi-Fi/link-local segment during onboarding, which substantially narrows realistic exposure.

Heap-based buffer overflow in Fortra Core Privileged Access Manager (BoKS) allows remote attackers to corrupt heap memory when the product builds a human-readable failure reason for a revoked key, because the heap buffer allocated for that message is too small for the final sprintf() output. Per the vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) the flaw is network-reachable and does not require authentication, but it does require user interaction and the revoked-key error path must actually be entered with a failure string long enough to overrun the allocation; our independent assessment keeps the same confidentiality and integrity impact while raising attack complexity and adding availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is known.

Stack-based buffer overflow in the mod_vhost_alias module of Apache HTTP Server through 2.4.68 allows a remote, unauthenticated client to crash the server or potentially execute arbitrary code by sending an HTTP request whose Host header exceeds 8192 bytes. The flaw is not reachable in default deployments: the operator must have configured VirtualDocumentRoot (or VirtualScriptAlias) with a hostname format specifier such as %0 or %1 and must have raised LimitRequestFieldSize above its 8192-byte default, a non-default and uncommon combination that is reflected in the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No KEV listing, EPSS score, or public exploit code was available at time of analysis, so there is no public exploit identified at time of analysis; the dominant uncertainty is the absence of any quantitative exploitation signal, while the real-world exploitability is sharply constrained by the required operator-set configuration. Users are advised to upgrade to 2.4.69, which fixes the issue.

An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processes request paths containing MS-DOS 8.3 short filenames that expand to longer names, giving a remote attacker a route to service disruption (assessed availability impact High) with limited confidentiality and integrity impact. Exploitation is Windows-only and conditional: 8.3 short-name generation must be enabled on the underlying NTFS volume (the historical default unless NtfsDisable8dot3NameCreation has been set) and the crafted path must actually reach the expanding-path code path, which is reflected in the assessed vector's AC:H. Apache published no CVSS score, and the supplied intelligence contains no CISA KEV listing, no public exploit code, and no EPSS probability, so there is no public exploit identified at time of analysis.

An out-of-bounds write in Apache HTTP Server's mod_proxy_html output filter affects versions 2.4.0 through 2.4.68 and can be triggered by a crafted HTML response body that the server parses and rewrites while proxying upstream content. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates remote unauthenticated attackers can reach the flaw, but high attack complexity reflects a significant deployment prerequisite: mod_proxy_html must be explicitly loaded and actively rewriting proxied HTML, which is not a default configuration, and the attacker must be able to influence the upstream/backend response body being processed. The result is memory corruption with low confidentiality and integrity impact and a high availability impact, and no public exploit has been identified at the time of analysis; servers used solely as origin web servers, or proxies that do not enable mod_proxy_html, are not affected.

An out-of-bounds write in Apache HTTP Server's optional mod_charset_lite module (affecting versions 2.4.0 through 2.4.68) can corrupt process memory when character-set translation is configured, potentially crashing the server or enabling limited data disclosure or modification. Exposure is narrow: mod_charset_lite is not loaded in default installations and must be explicitly enabled and bound to a content path via directives such as CharsetSourceEnc, CharsetDefault, or an associated input/output filter, which is why the assessed vector rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Independent signals are otherwise sparse - no public exploit code, no CISA KEV listing, and no EPSS score were available - so no public exploit identified at time of analysis, and the practical severity hinges on whether the module is deployed.

Unauthenticated remote attackers who can reach the boks_autoregisterd autoregistration service in Fortra's Core Privileged Access Manager (BoKS) can trigger a stack-based buffer overflow while the daemon processes a client response, potentially corrupting memory and achieving code execution under the daemon's privileges, as reflected by the maximum-severity CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected deployments are those running the BoKS autoregistration/enrollment daemon on a network segment reachable by the attacker, which in most environments is the internal management or agent network rather than the public internet. No public exploit identified at time of analysis; the issue was reported to the vendor by Fortra, and the only reference provided is Fortra's product security advisory FI-2026-017, with no CISA KEV listing and no EPSS data supplied.

Remote unauthenticated attackers can crash the boks_portmux daemon in Fortra BoKS Manager by sending a single malformed TLS ClientHello to its custom TLS listener, and repeated requests can sustain a denial-of-service condition because the daemon is normally restarted automatically. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates this as a high-availability-impact issue; no public exploit code, KEV listing, or active exploitation has been identified at time of analysis.

Perl's Imager image-manipulation module before version 1.037 exits the process when it reads a RAW-format image containing an out-of-range raw_datachannels value, because the line-buffer size is computed as image width multiplied by the channel count with no range or overflow validation and the module's allocator calls exit(3) when the resulting allocation fails. The flaw is reachable only where an application uses Imager->read() on RAW data and permits the raw_datachannels parameter to come from untrusted input; a hard-coded or non-exposed value makes it unreachable. Impact is limited to denial of service - process termination with no confidentiality or integrity effect - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; CISA's SSVC assessment rates exploitation as none, with the defect automatable but technically partial.

Processing a crafted TNEF file with uncompressed RTF data through tnef can trigger an out-of-bounds read in get_rtf_data_from_buf(), causing a crash (denial of service) or opportunistic leakage of adjacent memory into extracted output. The affected product is the tnef Project’s tnef utility, matched by CPE cpe:2.3:a:tnef_project:tnef:*:*:*:*:*:*:*:*, with no version restriction in that CPE and no fixed version provided. Exploitation requires user interaction or an automated mail/attachment-extraction pipeline that feeds untrusted winmail.dat files to tnef; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (9th percentile), and SSVC records exploitation as none, so this is a moderate rather than urgent priority consistent with the independent assessment.

Heap-based buffer overflow in iperf3 3.20 and 3.21 allows an unauthenticated remote client to overrun a 256-byte RSA buffer inside decrypt_rsa_message() by sending an oversized authtoken, corrupting heap memory on the server and potentially achieving remote code execution or a crash (CWE-122). The flaw is only reachable when an operator has explicitly started the iperf3 server in RSA-authentication mode with --rsa-private-key-path and --authorized-users-path; default iperf3 servers run without authentication and never enter the vulnerable code path, which is reflected in the upstream CVSS 4.0 vector's AT:P (attack requirements present) and in our independent assessment of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied; a vendor fix is released as iperf3 3.22.

Out-of-bounds write in the NVIDIA Virtual GPU Manager (vGPU plugin) lets an unprivileged user inside an assigned guest VM corrupt host-side memory by sending a specially crafted RPC call across the virtualization channel, resulting in privilege escalation, data tampering, and denial of service on the host. Rated CVSS 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), the bug is only reachable in vGPU/VDI/cloud-GPU deployments where the host runs the vGPU plugin and has at least one guest assigned; it is not a network-facing flaw and does not affect standard bare-metal Linux GPU driver installs, and no public exploit code has been identified at time of analysis. Real-world risk is therefore defined by the attack surface rather than by mass exploitability, since a successful attack requires an attacker to already hold an unprivileged local account inside a hosted guest VM.

An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with low privileges corrupt kernel memory, which the vendor rates as potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering (CVSS 3.1 base 7.8, HIGH). The attack is strictly local - vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - so it is not remotely exploitable and requires only an authenticated low-privileged context or a tenant/guest that can reach the host kernel module; the risk is highest in multi-tenant VDI and cloud-GPU deployments where local access is comparatively easy to obtain. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so there is no evidence of confirmed active exploitation.

Local privilege escalation, code execution, denial of service, and information disclosure affect Linux hosts running NVIDIA vGPU Virtual GPU Manager because of an out-of-bounds read in the kernel-mode layer that services vGPU requests. A low-privileged local account or existing code-execution context (CVSS PR:L) is required, and no user interaction is needed, but the flaw is not remotely reachable and only impacts hosts with the vGPU Manager component installed. No public exploit or proof-of-concept has been identified at time of analysis, and EPSS data was not provided; the independent assessment rates this as a moderate, locally-scoped risk.

Local privilege escalation in NVIDIA vGPU Virtual GPU Manager for Linux stems from an out-of-bounds read in firmware (CWE-125) that a low-privileged local attacker can trigger with no user interaction and low complexity. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact on vGPU/VDI/cloud-GPU hosts that use the affected Linux Virtual GPU Manager. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold; it is not remotely exploitable despite the RCE tag.

Local attackers with low privileges on a Linux host running NVIDIA vGPU Virtual GPU Manager can trigger an out-of-bounds read in the kernel-mode layer, potentially leading to code execution, privilege escalation, denial of service, information disclosure, and data tampering. The flaw is not remotely reachable and affects only virtualization, VDI, or cloud-GPU hosts that run the vGPU Manager. No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds read in NVIDIA vGPU Virtual GPU Manager for Linux allows a local authenticated attacker with low privileges to potentially achieve code execution, denial of service, or information disclosure. The vulnerability resides in the kernel-mode driver and affects both the vGPU Manager and guest driver components. No public exploit code has been identified, and the flaw is not known to be actively exploited. Integrity impact is assessed as low, but confidentiality and availability impacts are high, making this a significant risk in multi-tenant vGPU deployments.

An out-of-bounds read in the kernel-mode layer of the NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker who can already reach the vGPU kernel interface trigger memory reads past the bounds of an allocated buffer, potentially yielding information disclosure, data tampering, privilege escalation, denial of service, or kernel code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is only reachable by an authenticated local principal - a low-privileged user or a guest context on the hypervisor - and not by an unauthenticated remote network attacker. Exposure is limited to hosts that actually deploy NVIDIA vGPU on Linux (VDI and cloud-GPU virtualization platforms), where the highest-impact scenario is a multi-tenant deployment in which the over-read crosses tenant isolation boundaries; no public exploit code or CISA KEV entry was identified at time of analysis, so this is a genuine but not emergency-grade issue warranting scheduled patching.

An out-of-bounds write in the NVIDIA Virtual GPU Manager (vGPU plugin) for Linux allows a user who already holds a low-privileged account inside a guest VM to corrupt host-side memory by sending a crafted RPC message whose performance-state list size parameters are invalid, potentially yielding code execution, privilege escalation, data tampering, denial of service, or information disclosure across the virtualization boundary. The defect is locally triggered (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires no user interaction, but it is only reachable on hosts actually running the vGPU Manager for multi-tenant vGPU/VDI/cloud-GPU workloads - single-tenant systems without vGPU virtualization are not exposed through this guest-to-host path. No public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); exploitability is constrained by the need for prior guest authentication and the presence of the vGPU component, making this a contained but genuine virtualization-trust-boundary flaw rather than a broad remote threat.

Out-of-bounds read (CWE-125) in the kernel-mode layer of NVIDIA's vGPU Virtual GPU Manager for Windows and Linux allows a low-privileged process inside a guest VM to force the host-side vGPU driver to read past the end of an allocated buffer (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), primarily exposing host memory contents and creating crash and denial-of-service risk, with code execution and privilege escalation described by the vendor only as possible rather than demonstrated. The issue is reachable only on hosts actively running vGPU configurations such as VDI or cloud GPU hosting where an attacker already holds a foothold inside a guest; bare-metal and non-vGPU installations are not affected, and no user interaction or network reach is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no fixed driver version appears in the available intelligence, so defenders should treat patch confirmation through NVIDIA's advisory as the priority action.

An out-of-bounds write in NVIDIA vGPU Manager's GPU System Processor (GSP) plugin lets an authenticated user inside a guest VM hit host-side plugin code with a specially crafted RPC message, potentially yielding code execution, privilege escalation, data tampering, denial of service, or information disclosure in the virtualization host stack. The practical barrier is an existing foothold in an authorized vGPU guest rather than network reachability, and no public exploit code has been identified at time of analysis. Scoring 7.8 under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N, with high confidentiality, integrity, and availability impact) it represents a Moderate, locally-scoped risk that matters most in multi-tenant vGPU deployments where guest-to-host isolation is a core control.

An out-of-bounds write in the kernel-mode layer of the NVIDIA vGPU Virtual GPU Manager for Windows and Linux allows a local attacker holding low privileges to corrupt kernel memory and potentially achieve code execution, privilege escalation, denial of service, information disclosure, and data tampering (CVSS 3.1 base 7.8). The flaw is local-only (AV:L) and requires an existing low-privileged foothold (PR:L) with no user interaction (UI:N); there is no public exploit identified at time of analysis and the package is not listed in CISA KEV. Although the numeric score is High, practical risk is assessed as MODERATE because exploitation demands local code execution on a host that specifically runs the vGPU manager - a component found in vGPU/VDI and cloud-GPU deployments rather than ordinary consumer driver installs.

Out-of-bounds write in the NVIDIA GPU Display Driver for Windows kernel module can let a local, authenticated low-privileged user execute code, escalate privileges, cause denial of service, disclose information, or tamper with data on affected GeForce, RTX/Quadro/NVS, and Tesla systems. Exploitation requires local access to the GPU-equipped Windows host plus a low-privileged account able to reach the kernel module, and the high attack complexity means it is not reliably one-shot; multi-user, VDI, and cloud/virtual-GPU environments are the main risk. No public exploit identified at time of analysis, and CVSS is 7.0 with high confidentiality, integrity, and availability impact.

Denial of service and kernel memory disclosure in the NVIDIA GPU Display Driver for Windows and Linux let a local, low-privileged user who already holds an interactive session on the host force the kernel-mode component to dereference an untrusted pointer, crashing the driver or leaking kernel memory. The flaw is scored CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) - a local-only, low-complexity attack requiring low-privilege authenticated access with no user interaction, delivering high confidentiality and availability impact but no integrity or write primitive, so it cannot by itself be chained into privilege escalation or code execution. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing); the most exposed deployments are multi-user, VDI, and cloud-GPU hosts where untrusted users share a GPU, since the attacker must first obtain code execution or an interactive session on the GPU host.

An out-of-bounds read in the NVIDIA Display Driver for Windows kernel module allows local attackers to cause denial of service and disclose sensitive kernel memory. Affected products include GeForce, RTX/Quadro/NVS, and Tesla driver lines on Windows; exploitation requires local access with no elevated privileges or user interaction. No public exploit code has been identified, and the vulnerability is not remotely exploitable.

Local privilege escalation in NVIDIA GPU Display Driver for Windows and Linux can be achieved by an unprivileged local user through the open-source kernel module's DMA-BUF import path, where importing a read-only buffer from another device's DMA-BUF exporter improperly preserves memory access permissions. Successful exploitation can result in code execution, privilege escalation, denial of service, information disclosure, and data tampering, with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.

Local privilege escalation in NVIDIA Display Driver for Windows allows an authenticated low-privileged user to trigger a stack-based out-of-bounds write in the kernel mode layer, potentially leading to code execution, privilege escalation, and denial of service. Affected systems include Windows hosts with GeForce, RTX/Quadro/NVS, or Tesla drivers, as well as the Guest Driver in virtualized deployments. No public exploit code or active exploitation has been identified at time of analysis, and the flaw requires local access, making it most relevant to shared multi-tenant environments.

An out-of-bounds read in the kernel-mode layer of NVIDIA GPU Display Driver on Windows and Linux allows a local, authenticated unprivileged user to potentially achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. Affected products include GeForce, RTX/Quadro/NVS, and Tesla GPUs, as well as Guest Driver and vGPU Manager deployments. With a CVSS score of 7.8, the vulnerability requires local access and low privileges (CVSS vector AV:L/AC:L/PR:L/UI:N), making it primarily a risk in multi-user or shared-GPU environments; no public exploit has been identified at time of analysis, and patched driver branches are available in NVIDIA security bulletin 5861.

Local code execution and denial of service on Windows systems with affected NVIDIA GPU Display Drivers stem from an integer overflow in the display driver's DIAG escape handler that results in an out-of-bounds write (CWE-787). An unprivileged local user (CVSS PR:L) can trigger the flaw via a device I/O call to the handler; no user interaction is required, and exploitation is confined to the local machine, meaning an attacker must already have a foothold. No public exploit identified at time of analysis (and no CISA KEV entry), but the shared-system impact-multi-user workstations, VDI, and cloud GPU instances-raises the risk profile.

An out-of-bounds write in NVIDIA NVAPI for Windows allows a locally authenticated attacker holding standard user privileges to corrupt memory by invoking NVAPI entry points, potentially leading to code execution, elevation of privileges, information disclosure, denial of service, or data tampering. The flaw affects hosts running the NVIDIA GPU driver package on Windows - including GeForce, RTX/Quadro/NVS, and Tesla driver-equipped systems - with a CVSS 3.1 base score of 7.8 (HIGH) under vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, but the local-only, low-privilege prerequisite makes shared and multi-tenant GPU/VDI hosts the most exposed environment.

Local privilege escalation in NVIDIA GPU Display Driver for Linux allows an unprivileged local user to trigger an out-of-bounds write in kernel memory via a crafted ioctl call with an unvalidated buffer size, enabling code execution, privilege escalation, information disclosure, and denial of service. The flaw affects GeForce, RTX/Quadro/NVS, and Tesla drivers, as well as Guest Driver and Virtual GPU Manager components, with highest risk in multi-tenant GPU environments such as VDI and cloud/HPC deployments. No public exploit identified at time of analysis; CVSS 3.1 score is 7.8 (local, low privileges, no user interaction).

Local privilege escalation, code execution, denial of service, and information disclosure in NVIDIA GPU Display Driver on Windows and Linux stem from an integer overflow (CWE-190) in the kernel-mode layer that an unprivileged user can trigger to cause an out-of-bounds write. Exploitation requires local access with an existing low-privilege account (authenticated, PR:L) on a host with an affected GeForce, RTX/Quadro/NVS, or Tesla driver; the CVSS v3.1 base score is 7.8 (High) with a local attack vector (AV:L/AC:L/PR:L/UI:N). No public exploit code or CISA KEV entry was identified at the time of analysis, but the flaw is genuine and actionable for local privilege escalation if the vulnerable driver interface is reachable.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows an unprivileged local user to corrupt kernel memory, which can lead to code execution in the kernel, privilege escalation, denial of service, information disclosure, or data tampering. Systems running GeForce, RTX/Quadro/NVS, or Tesla driver packages on either operating system are affected; per the CVSS vector (AV:L, PR:L, UI:N) the flaw is reachable only by a user who already has local code execution on the host, making it a local privilege-escalation primitive rather than a remote entry point. No public exploit has been identified at time of analysis.

Local privilege escalation in NVIDIA GPU Display Drivers for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU) allows an unprivileged local user to execute code in kernel mode by supplying an untrusted pointer that the driver dereferences without validation. Affected hosts include multi-user and virtualized Windows systems with default driver installations, where exploitation can lead to escalation to SYSTEM, denial of service, information disclosure, and data tampering. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE; the CVSS 3.1 base score is 7.8 (High).

A locally-triggered out-of-bounds write in the NVIDIA GPU Display Driver kernel-mode layer lets an attacker who already holds low-level privileges on a Windows or Linux host corrupt kernel memory, with the potential for code execution in kernel context, escalation of privileges, denial of service, information disclosure and data tampering. The affected driver ships by default across the GeForce, RTX/Quadro/NVS, Tesla and Virtual GPU Manager product lines, so any host with a current NVIDIA driver installed is in scope, but exploitation is not remote: an attacker must first obtain code execution on the target (an authenticated local user, a compromised low-privileged process, or sandboxed code with driver access) and then develop a reliable kernel corruption exploit. CVE-2026-47548 carries a vendor/NVD CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, High); no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.

Local attackers with low-privileged code execution can trigger an out-of-bounds read (CWE-125) in the kernel-mode layer of the NVIDIA GPU Display Driver on Windows and Linux, which may lead to escalation of privileges, code execution, denial of service, information disclosure, and data tampering. This locally exploitable flaw (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) affects GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager products, and no public exploit has been identified at the time of analysis. A vendor advisory with remediation guidance is available from NVIDIA via its product security page.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows a local, low-privileged authenticated user to corrupt kernel memory, with the potential to escalate privileges to kernel-level code execution, crash the system (denial of service), disclose information, or tamper with data. The flaw rates CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires pre-existing code execution as a standard user on a host with the driver loaded, but no user interaction and no non-default configuration; the vulnerable kernel-mode layer ships and loads by default once the driver is installed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but the affected GeForce, RTX/Quadro/NVS, and Tesla product families are extremely widely deployed, making this a genuine high-priority patch-management item rather than an emergency.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux lets a local attacker who already holds low-privilege code execution corrupt kernel memory, with potential outcomes of privilege escalation, arbitrary code execution, denial of service, information disclosure and data tampering (CWE-787, CVSS 7.8). The assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H shows low attack complexity and no user interaction, but the attack is strictly local: an attacker must first have a foothold on the host, or on a guest in a vGPU configuration, which confines it to privilege-escalation and sandbox-escape scenarios rather than remote mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis (no public exploit identified at time of analysis), so this is a genuine local privilege-escalation priority despite the absence of exploitation signals, and it warrants prompt patching on endpoint, workstation, and multi-tenant virtual-desktop estates.

An out-of-bounds read in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows a local, low-privileged user to read beyond the bounds of kernel heap memory, producing information disclosure and denial of service, with potential for privilege escalation, code execution, and data tampering if the read primitive is successfully leveraged. The flaw affects GeForce, RTX/Quadro/NVS, and Tesla product families on systems with the vulnerable driver branch installed, and exploitation requires an attacker to already hold local access to the host (per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N vector, base 7.8), with no user interaction needed. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so exploitation is currently expected to require a motivated local attacker rather than being broadly weaponized.

An out-of-bounds read in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux lets a local attacker who already holds a low-privileged execution context on the host read past the bounds of a kernel buffer, exposing kernel memory contents and creating a pathway toward further privilege escalation or data tampering. Exploitation is constrained to the local attack surface: the attacker must already be able to run code on the machine (AV:L, PR:L) and no user interaction or network path is involved, so despite the 7.8 headline score the practical risk is a local privilege/information-disclosure concern rather than a remotely reachable, mass-exploitable flaw. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the affected hardware spans GeForce, RTX/Quadro/NVS, and Tesla products, with an NVIDIA vendor advisory available.

Local privilege escalation in the NVIDIA GPU Display Driver kernel-mode layer allows a user with standard privileges to trigger an out-of-bounds write in kernel memory, potentially achieving kernel-level code execution, denial of service, information disclosure and data tampering. The affected driver branches span NVIDIA GeForce, RTX/Quadro/NVS and Tesla families on both Windows and Linux, and the 'Guest Driver' tag indicates virtualized/vGPU and guest-VM driver deployments are also in scope, which matters for GPU-accelerated VDI and datacenter estates. Exploitation is constrained to the host: the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), so an attacker must already have a foothold and the ability to run code as a low-privileged local user; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Local privilege escalation in NVIDIA GPU Display Driver for Windows and Linux allows a low-privileged local user to trigger an integer overflow in the kernel mode layer, resulting in an out-of-bounds write to GPU memory that can lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. Affected platforms include GeForce, RTX/Quadro/NVS, and Tesla drivers, with the 'Guest Driver' tag indicating that VM guests with GPU access are also in scope for guest-to-host or in-guest escalation. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 3.1 score is 7.8 (AV:L/PR:L/UI:N).

Integer overflow in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager can be triggered by a low-privileged user inside a guest VM, causing memory corruption with high confidentiality, integrity, and availability impact. The vulnerability affects vGPU deployments on Windows and Linux hosts across GeForce, RTX/Quadro/NVS, and Tesla driver branches, and successful exploitation could enable code execution, denial of service, privilege escalation, information disclosure, or data tampering. No public exploit code or active exploitation has been identified in the provided intelligence at time of analysis.

Local privilege escalation in the NVIDIA GPU Display Driver for Linux allows an authenticated, low-privileged user to drive an out-of-bounds write in the driver's kernel-mode layer by supplying mismatched memory buffers during event buffer setup, with a successful exploit potentially leading to kernel code execution, denial of service, privilege escalation, information disclosure, and data tampering (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected code is the Linux kernel-mode component shipped with GeForce, RTX/Quadro/NVS and Tesla driver packages, and the same path can be reached by untrusted code inside a guest VM using the NVIDIA vGPU guest driver on a host running the Virtual GPU Manager. No public exploit code was identified and there is no confirmed active exploitation (CISA KEV) at time of analysis; the bug is local-only, requiring the attacker to already run code with at least low privileges on the host or in a guest, and it is not remotely reachable.

Stack-based buffer overflow in apcupsd through 3.14.14 allows unauthenticated remote attackers to corrupt memory and potentially execute code through the optional CGI web interface. The flaw lives in getupsvar() in src/cgi/upsfetch.c, which is invoked by upsstats.cgi, multimon.cgi, and upsfstats.cgi; exploitation requires one of those CGI scripts to be deployed and reachable, plus the ability to control or man-in-the-middle the UPS variable data fed to it from an apcupsd Network Information Server. This is an AC:H, PR:N issue with full confidentiality, integrity, and availability impact; no public exploit code has been identified at time of analysis, and it is a related issue to CVE-2026-15544.

An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or compromised broker - or a man-in-the-middle on the WebSocket connection - crash the embedded network stack and potentially disclose a limited amount of adjacent memory. Affected builds are NetX Duo 6.4.4 through 6.5.1.202602, and only firmware that actually compiles in and uses the MQTT client over WebSocket is exposed; devices running plain MQTT/TCP or no MQTT are unaffected. Exploitation is not confirmed as active (not in CISA KEV) and no public exploit code has been identified at time of analysis, but CISA SSVC rates the issue Automatable with partial technical impact, so the practical risk is a conditional availability problem rather than an emergency, with a confidentiality impact the vendor's original CVSS score omits but which the independent assessment reflects as C:L/A:H.

Heap-based buffer overflow in RPM's package-header parsing lets a crafted, unsigned RPM overwrite memory when a victim merely inspects it with rpm2cpio, rpm2archive, or 'rpm -qlvp', giving an attacker-controlled heap write past a one-byte allocation (CWE-122, assessed CVSS 3.1 7.1). Affected code ships with RPM as distributed in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat Hardened Images, so build farms, CI pipelines, package mirrors, and malware-analysis hosts that routinely open untrusted packages are the realistic exposure surface. Exploitation is local (AV:L), low complexity (AC:L), and unauthenticated (PR:N) but requires user interaction (UI:R) to invoke an rpm tool against the malicious file; signature verification is no barrier because the overflow happens during header decoding. No public exploit identified at time of analysis.

Unauthenticated denial of service in Apache WSS4J lets remote attackers exhaust server memory by sending SOAP messages that carry a specially crafted X.509 certificate: the certificate's SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF, and an integer overflow in WSS4J's DER bounds check allows the oversized allocation to pass validation, so an eleven-byte extension can trigger an approximately 2 GB allocation. Because the certificate is decoded while resolving the signature's key reference - before the message is authenticated - no credentials are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and repeated requests can drive an exposed WS-Security endpoint to OutOfMemory conditions. Affected releases are WSS4J 4.0.0 through 4.0.1, 3.0.0 through 3.0.5, and all versions before 2.4.4; impact is limited to availability, with no code execution or data disclosure path identified. No public exploit code, EPSS score, or CISA KEV entry is present in the provided data, so risk is driven by Apache's "important" severity rating and the pre-authentication nature of the flaw rather than confirmed active exploitation.

Stack-based buffer overflow in Pgpool-II (versions 3.5.x through 4.7.2) allows unauthenticated remote attackers to crash the connection pooler process by sending a crafted message, causing a denial of service against Pgpool-II and the PostgreSQL databases it fronts. The vendor-assigned CVSS 4.0 score of 8.7 reflects strictly availability-only impact (VC:N/VI:N/VA:H), and no public exploit code has been identified at time of analysis. Exploitation requires only network reachability to the Pgpool-II listening socket; instances on internal or firewalled networks are at reduced risk.

An out-of-bounds write in the Pgpool-II connection pooling and load-balancing middleware allows an authenticated remote attacker to trigger abnormal termination of the Pgpool-II process, denying service to PostgreSQL clients routed through it. Exploitation requires valid credentials accepted by the Pgpool-II frontend (PR:L) and network reachability to its listening port; no user interaction or high privileges are needed, and the assessed impact is availability only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, vendor-scored 7.1 under CVSS 4.0). Affected releases are Pgpool-II 3.5.x through 4.2.x, 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7 and 4.7.0-4.7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a genuine but bounded-severity availability issue rather than an active exploitation campaign.

An out-of-bounds write (CWE-787) in Pgpool-II, the PostgreSQL connection pooler, allows an authenticated attacker who already holds valid low-privileged credentials to cause abnormal termination of the Pgpool-II process or, depending on memory layout and build hardening, to achieve arbitrary code execution. Affected branches span 3.5.x through 4.2.x as well as 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7 and 4.7.0-4.7.2; exploitation is remote (AV:N), low complexity and requires no user interaction, but the PR:L authentication prerequisite makes this a post-authentication flaw rather than an unauthenticated internet-facing one. The vendor score is 8.7 (CVSS 4.0) and the independent assessment maps it to 8.8 (CVSS 3.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis and there is no CISA KEV listing confirming active exploitation.

Out-of-bounds write in PCRE2, the regular-expression library embedded in PHP, nginx, Apache httpd, Git and numerous language runtimes, allows memory corruption when a consuming application compiles an attacker-controlled pattern through the JIT compilation API in the manner described by the vendor advisory. Only releases before 10.49 are affected, and exploitation is gated on two conditions holding at once: the application must accept untrusted, user-supplied regexes and must route them through PCRE2's JIT path, so default library presence alone does not imply exploitability. The assessed vector is network-reachable with high attack complexity and no privileges required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, base 7.6); no public exploit code and no CISA KEV entry were identified at time of analysis. A vendor patch is available per the advisory, so upgrading to a fixed release remediates.

Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an attacker who can reach the node over the network to run arbitrary code as an unprivileged service account by sending crafted input that triggers an out-of-bounds write. Affected builds are all versions before 38.2 as well as 39.0, 39.1 and 40.0; a fixed 38.2 release and corresponding maintenance releases are referenced in Pexip's security bulletins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), but exploitation requires no authentication, no user interaction and no special conditions, and the resulting code execution is unprivileged - full host takeover would require chaining a separate local privilege-escalation bug such as sibling CVE-2026-103106.

Improper input validation in Pexip Infinity's media implementation allows an unauthenticated remote party to send a crafted media stream that causes memory corruption or a controlled software abort on the conferencing node, resulting in denial of service. Affected releases are Infinity before 38.2 and the 39.0, 39.1, and 40.0 branches; because the published vector is network-reachable with no privileges (PR:N) and no user interaction (UI:N), any host able to route media to an exposed node can attempt exploitation, though CISA's SSVC assessment rates the issue as not automatable, indicating a hand-crafted rather than commodity attack. The confirmed outcome is a controlled abort (availability impact), with memory corruption explicitly a stated potential rather than demonstrated, and the published 9.4 score is moderated in independent assessment (C:N/I:L/A:H) since confidentiality impact is not established; there is no public exploit identified at time of analysis and EPSS is low at 0.24% (14th percentile).

Authenticated attackers with administrator privileges can exploit a stack-based buffer overflow in the spamBlocker (spamd) service of WatchGuard Fireware OS by sending a specially crafted management request, causing a service crash or potentially achieving arbitrary code execution. The vulnerability requires the spamBlocker feature to be licensed and enabled, and the management plane to be reachable; exploitation is therefore limited to insiders, stolen admin credentials, or post-compromise scenarios. No public exploit code has been identified at the time of analysis.

Unauthenticated code execution is possible on WatchGuard Fireware OS through its DHCP fingerprinting daemon (fingerd), which overflows a fixed-size stack buffer when it parses a specially crafted DHCP packet. An attacker only needs Layer 2 adjacency to a Firebox interface whose DHCP-processing path reaches fingerd - the same broadcast domain or VLAN - with no credentials (PR:N) and no user interaction (UI:N); the adjacency requirement keeps this off the internet-attackable surface, since it cannot be triggered across a routed boundary. Successful exploitation yields full compromise of the daemon's process context (high confidentiality, integrity, and availability impact per the assessed vector), with the process crash as the minimum outcome; no public exploit code has been identified at time of analysis and the flaw is not reported as confirmed actively exploited (CISA KEV).

Memory corruption in U-Boot's DHCPv6 netboot path allows an attacker on the same local network to crash or corrupt the bootloader by sending crafted DHCPv6 ADVERTISE or REPLY packets with oversized DUID (SERVERID/CLIENTID) option lengths. All U-Boot builds prior to 2026.10-rc5 that perform DHCPv6-based network boot are affected; the assessed impact is availability-focused (CVSS:3.1 AV:A/AC:L/PR:N/UI:N/C:N/I:L/A:H), with confidentiality unaffected and integrity impact limited. Exploitation requires adjacency to the booting device and only works during the brief netboot window, so devices that boot from local storage are not exposed; no public exploit and no confirmed active exploitation were identified at time of analysis.

Memory corruption in U-Boot’s NFS READLINK handling can crash the bootloader on devices booting over NFS. A malicious or man-in-the-middle NFS server can return a crafted symlink length that triggers a signed-to-unsigned conversion error (CWE-195) and out-of-bounds access in nfs_readlink_reply(), affecting U-Boot versions before 2026.10-rc5; the vendor CVSS 4.0 base score is 8.8. Exploitation requires the device to be actively performing an NFS netboot and reaching the attacker-controlled server, so idle or non-NFS-boot devices are unaffected, and no public exploit code or CISA KEV active exploitation is identified at time of analysis.

Memory corruption in the U-Boot bootloader's NFS client lets a malicious or man-in-the-middle NFS server overflow the packet buffer in nfs_read_reply(), crashing the bootloader or corrupting memory before control is handed to the kernel. Affected are U-Boot builds prior to 2026.10-rc5 that perform NFS netboot (CPE cpe:2.3:a:u-boot:u-boot:*); the flaw is reachable by an unauthenticated network attacker (CVSS vector PR:N), though per our assessment the practical outcome is a boot-time denial of service with limited integrity impact rather than confirmed code execution, since the device must be actively NFS-booting and the attacker must control or intercept the NFS server on the boot network. A vendor patch exists (commit 0bbf0985, fixed in 2026.10-rc5) and no public exploit code was identified at time of analysis.

Memory corruption in U-Boot's IP fragment reassembly code (net/net.c) allows remote, unauthenticated attackers on the boot network to crash the bootloader and corrupt adjacent memory while a device is performing a netboot. Only builds compiled with CONFIG_IP_DEFRAG are affected - an opt-in, frequently disabled compile option - so deployments without it are not vulnerable, and exploitation requires delivering a crafted IP fragment with a non-zero offset and the More-Fragments flag onto the boot path during the narrow netboot window. The CVSS 4.0 base score is 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H), an availability-dominant flaw with only limited integrity impact and no confidentiality loss, and no public exploit has been identified at time of analysis (no CISA KEV listing).

A stack-based buffer overflow (CWE-121) in the V8 JavaScript engine allows remote code execution inside the renderer sandbox of Google Chrome builds prior to 154.0.8037.92 when a victim is lured to a crafted HTML page. Exploitation requires user interaction - the target must open or be navigated to the attacker-controlled page - but no authentication or privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and the default browser configuration is sufficient. No public exploit code or active exploitation has been identified, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no'; the practical ceiling on impact is the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. All signals align on a genuine but not emergency-level browser RCE, and Google has shipped a vendor patch.

An out-of-bounds write in the GPU process of Google Chrome prior to 154.0.8037.92 allows an attacker to break out of the browser sandbox and potentially execute arbitrary code at the browser's privilege level via a crafted HTML page. The attack is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed exploitation conditions indicate the attacker must have already compromised Chrome's renderer process, and the victim must load attacker-controlled content, making this a sandbox-escape link in a multi-stage exploit chain rather than a directly reachable remote bug. Only Chrome builds below 154.0.8037.92 are affected, and effective exploitation requires overcoming non-trivial memory-corruption and chaining conditions (AC:H); no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Google has released a vendor patch in Chrome 154.0.8037.92.

Remote code execution is possible in Google Chrome on Android builds prior to 154.0.8037.92, where a heap-based buffer overflow in the ANGLE graphics layer can be triggered when a user renders a crafted HTML page. Successful exploitation corrupts memory out of bounds and, per Google's Critical severity rating and the scope-changed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), can potentially execute arbitrary code outside the browser sandbox. The issue is remotely deliverable without authentication but hinges on user interaction, and no public exploit code or active exploitation has been identified at time of analysis; CISA's SSVC assessment likewise records no observed exploitation and rates the flaw non-automatable, while a vendor patch (154.0.8037.92) is available.

Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can trigger a buffer overflow in an exposed interface and execute arbitrary commands on the device's underlying operating system. Firmware versions at or below 3.4.1.0 are affected, including default configurations, and the CVSS 3.1 base score of 9.6 reflects a scope change (S:C) from the network-facing interface to the AP operating system, with high confidentiality, integrity, and availability impact. The adjacency requirement (AV:A) is the primary limiting factor, confining realistic attackers to associated Wi-Fi clients, hosts on the local LAN, or anyone with physical proximity; no public exploit code and no CISA KEV entry were identified in the provided data, and no EPSS score was supplied, so exploitation is not confirmed as active at time of analysis.

Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can reach the device's affected network interface to exploit a buffer overflow and execute arbitrary code as a privileged user on the underlying host (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but exploitation requires only network reachability to the exposed interface, so internet-facing or unsegmented Instant On access points and switches carry the greatest exposure. HPE has addressed the flaw in firmware versions above 3.4.1.0.

An out-of-bounds heap write in Eclipse ThreadX LevelX's NAND flash-translation-layer metadata parser can give a local attacker control-flow hijack when the device mounts a crafted NAND flash image through lx_nand_flash_open(), overwriting a driver function pointer with an attacker-chosen 8-byte value; two accompanying out-of-bounds reads were also demonstrated. The bug (CWE-787) is rated 8.6 under CVSS 4.0 and independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication or user interaction is needed but the attacker must first supply or tamper with the flash image (removable or attached NAND media, modified firmware or OTA image, or supply-chain/provisioning substitution). No public exploit code was identified at time of analysis, though the issue was reproduced verbatim under ASan at HEAD 9f1cfdc; devices that only mount internally trusted flash images are not realistically reachable, while those accepting field-swappable or externally sourced NAND are directly exposed, with the worst impact on bare-metal or non-memory-protected targets where the hijacked pointer yields code execution.

Denial of service in MobilityDB 1.3.0 and earlier allows an authenticated PostgreSQL database user with the MobilityDB extension installed to crash the backend process - and thereby terminate all sessions on that instance - by supplying a crafted Well-Known Binary (WKB) payload with a negative length field. Exploitation requires only a valid low-privileged database login (CVSS AV:N/PR:L) and the ability to invoke a binary input path such as ttextFromBinary, ttextFromHexWKB, COPY ... BINARY, or binary-protocol parameters; no public exploit code has been identified at time of analysis. Vendor patches are available in MobilityDB v1.3.1 and v1.2.2.

Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through 6.5.1.202602 allow an attacker who controls or impersonates the TLS/DTLS server to make the client parse a truncated handshake message and read a few bytes past the end of the buffer. The flaw is reachable over the network with no authentication or user interaction in the CVSS vector (AV:N/AC:L/PR:N/UI:N), but it is only triggerable when a NetX Secure client initiates a handshake toward attacker-steered server infrastructure; devices that only connect to trusted or pinned servers are substantially less exposed. No public exploit code and no CISA KEV activity were identified at time of analysis, and the impact is bounded: the independent assessment rates it confidentiality-low/availability-low (CVSS 3.1 base 6.x-equivalent) rather than the vendor's confidentiality-high score, since the over-read leaks a small amount of adjacent memory rather than yielding arbitrary disclosure or code execution.