Buffer Overflow

The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated remote SNMP packet whose object identifier uses BER multibyte length encoding to claim a length larger than the receive buffer, causing `_nx_snmp_utility_object_id_get` to decode adjacent heap bytes as OID components. On memory-protected (MMU/MPU) builds this faults into a crash of the SNMP agent thread, producing denial of service, while on bare-metal no-MMU targets the out-of-bounds read succeeds silently and instead corrupts the agent's internal OID state with neighboring heap data. Exposure is conditional: the NetX Duo SNMP addon must be compiled into the firmware and actively listening (typically UDP/161), so builds without an SNMP-enabled agent are unaffected; no public exploit code has been identified at time of analysis (no CISA KEV listing).

Heap out-of-bounds write in the mDNS responder of Eclipse ThreadX NetX Duo allows an unauthenticated attacker on the same local network segment to corrupt packet memory by sending two ordinary mDNS PTR records in response to a _http._tcp service query. The flaw arises from a string-table bucket collision: owner names of 12-15 characters round to the same slot size, causing the responder to reuse a shorter stored entry and write 1-3 bytes past the transmit packet's data end. With the mDNS addon active and adjacency to the target, the realistic impact is denial of service through corrupted neighboring packets or pool free lists, though code execution is not demonstrated; no public exploit code or active exploitation has been identified at time of analysis.

Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffers, causing denial of service on devices reachable from the same local link. The affected product is NetX Duo with IPv6/ICMPv6 ND enabled; an adjacent-network attacker with no authentication or user interaction can send crafted Router Advertisement, Router/Neighbor Solicitation, Neighbor Advertisement, or Redirect messages so that a one- or two-byte residue bypasses option validation and later processing loops indefinitely or underflows its counters. The vendor's CVSS 4.0 score is 7.1 (availability-only), the referenced advisory is GHSA-39p4-p83c-58hr, no public exploit identified at time of analysis, and no CISA KEV confirmation is provided.

Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an unauthenticated remote attacker sending a single oversized DATA datagram over the network, because the DATA branch enforces only a four-byte minimum (nxd_tftp_server.c:1037) and never validates an upper bound against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. The oversized length is passed as nx_packet_length - 4 into FileX via fx_file_write, and since nx_packet_length measures the whole packet chain rather than the first contiguous buffer, FileX reads past the end of that buffer and the leaked heap contents are written into the file the attacker is uploading, which a subsequent TFTP read request returns to the attacker; the same datagram also wedges the server permanently because nx_packet_copy with NX_WAIT_FOREVER suspends the server thread once the request exceeds the packet pool capacity. Rated CVSS 4.0 base 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H), consistent with an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H, and no public exploit code was identified at time of analysis, though the attack path is trivially scriptable and requires only that the optional TFTP addon be compiled in and reachable.

Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disclose up to 255 bytes of adjacent process memory over the network, or to crash the device. The flaw triggers on the very first ClientHello and requires no prior session, credentials, or user interaction, affecting default DTLS-enabled deployments with a reachable DTLS/UDP listener. No public exploit code has been identified at time of analysis, but the issue is rated CVSS 8.8 and is considered a high-priority risk among the NetX Secure DTLS/TLS advisory cluster.

An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACKET control block structures via a maliciously crafted masked WebSocket frame, potentially leading to code execution or denial of service. The vulnerability, tracked as CVE-2026-102761 with a CVSS 4.0 score of 9.3, affects all versions of NetX Duo per the CPE. No public exploit code has been identified at time of analysis, and no KEV status is reported.

NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitive that underlies every X.509 certificate operation, so a remote, unauthenticated peer can trigger it by supplying a crafted DER certificate during the TLS handshake - either against a TLS client validating a server certificate or a TLS server configured for client-certificate (mTLS) authentication. Per the independent assessment the realistic impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), because the over-read byte is discarded and a crash requires that byte to land in unmapped or guarded memory, which is layout- and platform-dependent and frequently harmless on MMU-less embedded targets; NVD's 7.5/H score reflects the worst-case interpretation of the same vector. There is no confirmed active exploitation (CISA SSVC: Exploitation = none) and no public exploit code identified at time of analysis, though CISA rates the issue Automatable = yes and Technical Impact = partial.

Privilege escalation in Eclipse ThreadX allows an unprivileged, memory-protected ThreadX module to break out of its MPU isolation boundary and obtain privileged (kernel-mode) read and write access to arbitrary memory, including the ability to clear the MPU enable bit and remove its own protection. The attack is local and low-complexity and requires the attacker to already be able to execute code as a loaded, unprivileged module (PR:L), for example by supplying or subverting a loadable module in a deployment that uses the ThreadX Module feature with MPU-based memory protection; systems that do not use isolated modules are not affected. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the high integrity and confidentiality impact on isolated-module deployments makes it significant.

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound message is compressed, truncated size calculations used to grow a GByteArray wrap, allowing zlib to write beyond the allocated buffer. The affected code is the outbound compression routine reached through the permessage-deflate extension (RFC 7692), so exploitation requires that the extension be negotiated on the WebSocket connection and that the endpoint emit a message large enough to cross the integer-truncation boundary - a precondition that materially narrows exploitation below the raw 9.8 base score. The CVSS vector indicates no privileges (PR:N) or user interaction (UI:N) are required, but no public exploit code has been identified and there is no confirmation of active exploitation (SSVC exploitation: none, no CISA KEV entry); EPSS is low at 0.30% (20th percentile), and Red Hat has published errata (RHSA-2026:83384, RHSA-2026:83618) addressing the flaw.

Heap memory corruption in libsoup can be triggered when a WebSocket client using libsoup constructs a masked outgoing frame for an extremely large payload near the 32-bit guint limit, truncating the GByteArray allocation size while the masking routine processes the full length. It affects libsoup as shipped in Red Hat Enterprise Linux 6 through 10. The assessed CVSS vector is network-reachable but high-complexity (AV:N/AC:H/PR:N/UI:N), and no public exploit identified at time of analysis.

Heap out-of-bounds read in libsoup's WebSocket implementation allows a remote, unauthenticated peer to trigger a heap buffer overflow when the application has configured max-incoming-payload-size to unlimited (0), a non-default setting; with the standard payload cap the overflow cannot be reached. The CVSS 3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), but our assessed vector raises complexity to AC:H because exploitation requires both the non-default unlimited setting and a frame large enough to wrap the GByteArray length counter, implying a very large transfer. No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds read and application crash in libsoup's soup_uri_decode_data_uri() affect applications that pass attacker-controlled base64 data: URIs to the GLib-based HTTP library, with Red Hat shipping vulnerable packages across Red Hat Enterprise Linux 6, 7, 8, 9 and 10. A crafted data URI whose percent-decoded payload contains embedded NUL bytes causes the decoded length to remain uninitialized and be used as the size of the returned GBytes, yielding a minor confidentiality leak (C:L) alongside a serious availability impact (A:H) rated 8.2 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. The issue is remotely triggerable without authentication (PR:N) and no public exploit code has been identified at time of analysis, though real-world exposure is limited to software that actually processes untrusted data: URIs (WebKit/GTK browsers, feed and mail readers, and other GNOME applications rendering remote content).

Heap corruption and denial of service in libsoup stem from unbounded WebSocket message reassembly: the code accumulates fragmented frames in a GByteArray without checking the total reassembled size against the buffer type's size limit, so an oversized message can truncate the tracked length while the implementation continues to use the full length, producing out-of-bounds memory access (CWE-125) and possible crashes. The flaw is reachable by unauthenticated remote peers that can establish a WebSocket connection with a libsoup-based server, or by a libsoup client that connects to an attacker-controlled or man-in-the-middle server, but the assessed vector (AC:H) reflects that the attacker must drive reassembly to the underlying ~4 GB buffer-type boundary, so ordinary small-message WebSocket traffic does not trigger it. No public exploit code or CISA KEV active-exploitation confirmation was identified at time of analysis.

Heap memory corruption in 32-bit builds of libexpat 2.7.2 through 2.8.5 lets remote attackers supply malicious XML that drives expat_realloc() past SIZE_MAX while computing an allocation size, yielding an undersized buffer and a subsequent heap overflow. The assessed impact is denial of service (crash or process instability) rather than confirmed code execution, consistent with the vendor vector (CVSS 4.0 8.2, AV:N/AC:H/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. Exploitation is conditional: only 32-bit builds are exposed (64-bit builds do not overflow SIZE_MAX in this computation), the attacker must feed crafted XML to an application that parses it with the vulnerable library, and the input must push allocation sizes toward the maximum; no public exploit code or active exploitation has been identified at time of analysis.

Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary code execution at the victim user's privilege level when a crafted .tvs session recording is opened through the 'Play or convert recorded session…' feature. Exploitation is gated by heavy prerequisites: the attacker must land the malicious file on the target host and socially engineer the user into opening it (CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:R), and the resulting code runs only as the current user with no privilege escalation and no network-reachable path. No public exploit code or confirmed active exploitation is identified at time of analysis, so real-world risk is materially below the raw score.

Heap-based buffer overflow in CTranslate2 before 4.8.1 allows an attacker to cause a crash or potentially achieve arbitrary code execution by supplying a malicious binary model file (.bin) that is loaded by the victim. The flaw is in the binary model loader, which fails to validate the payload length against the allocated buffer size (CWE-787). Exploitation requires the victim to actively load an untrusted model, making it a local, user-interaction-dependent issue rather than a remotely reachable network threat. No public exploit has been identified at time of analysis. The CVSS score is 8.5.

Out-of-bounds read in OpenSSL's DTLS handshake retransmission path allows a remote, unauthenticated attacker to trigger a memory read past a stale buffer offset, crashing the DTLS endpoint (availability impact rated High) and potentially exposing a limited amount of adjacent process memory (confidentiality impact rated Low). Affected deployments are those built against OpenSSL 1.0.2 before 1.0.2zs, 1.1.1 before 1.1.1zj, 3.0.0 before 3.0.23, 3.4.0 before 3.4.8, 3.5.0 before 3.5.9, 3.6.0 before 3.6.5, or 4.0.0 before 4.0.3 that actually terminate DTLS-over-UDP sessions such as VPN concentrators, WebRTC/SRTP endpoints, and CoAP/IoT stacks; pure TLS-over-TCP deployments, the dominant use of OpenSSL, are not exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the CVSS 8.2 score reflects the unauthenticated network reachability of the DTLS handshake rather than broad applicability, so real-world priority is elevated but capped by the narrow DTLS-only attack surface.

Out-of-bounds memory access in OpenSSL during an in-progress TLS/DTLS handshake can crash or destabilize servers that call SSL_set_SSL_CTX() mid-handshake, producing a denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). The issue affects OpenSSL 4.0.0 through 4.0.2, 3.6.0 through 3.6.4, 3.5.0 through 3.5.8, and 3.4.0 through 3.4.7, and is fixed in 4.0.3, 3.6.5, 3.5.9, and 3.4.8 respectively. Exploitation is unauthenticated and requires only network reach to a server that swaps SSL_CTX objects inside the SNI (servername) callback for virtual hosting or multi-certificate selection; no public exploit identified at time of analysis, and this is a conditional availability issue rather than a critical priority.

An out-of-bounds read in lib0's binary decoder before version 0.2.119 lets remote attackers who control serialized input cause the decoder to return bytes from outside the intended buffer view, exposing adjacent process memory that may contain credentials, tokens, or log data. The flaw is unauthenticated and remotely reachable (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) because any application that decodes attacker-supplied data with lib0 - directly or transitively through Yjs - can be driven into the over-read; the leaked bytes are opportunistic contents of the backing/pooled ArrayBuffer rather than attacker-selected addresses. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the impact is limited to confidentiality with no integrity or availability effect; the vendor has published a fix in lib0 0.2.119.

Unauthenticated remote peers can read adjacent process memory from any service that feeds attacker-supplied bytes into the lib0 binary decoder, because readUint8Array never validated the wire-supplied length against the decoder's remaining view before the fix. Affected deployments are those running lib0 0.2.1 through 0.2.117, or 1.0.0-rc.32 and earlier - most notably Yjs-based collaboration and sync services where a peer can supply bytes to the decoder, including before authentication. The leak only completes when the consuming application echoes, stores, or re-serves the decoded value back to the attacker, but under that condition multi-tenant or shared-process hosts can expose other tenants' document content and live bearer session tokens; no public exploit code was identified at time of analysis and there is no CISA KEV entry, though the root cause is trivially reachable by anyone able to open a socket.

Sandbox escape in Mozilla Firefox stems from improper boundary checks in the XPCOM component, allowing remote attackers to break out of the browser's content sandbox and compromise the host when a victim loads attacker-controlled web content. The flaw carries a CVSS 9.6 with required user interaction (UI:R) and no authentication (PR:N), affecting unpatched versions below Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42. No public exploit identified at time of analysis, and CISA SSVC records Exploitation: none, so this is a high-severity patching priority rather than a confirmed active threat.

Remote code execution in Mozilla Firefox's SpiderMonkey JavaScript JIT engine allows unauthenticated attackers to corrupt memory via crafted web content, potentially leading to arbitrary code execution within the browser's content process. Exploitation requires the victim to visit or be redirected to a malicious page (UI:R) that triggers incorrect boundary conditions during JIT compilation; JIT is enabled by default, so no special victim configuration is needed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is near-critical due to the high-value JIT attack surface. Fixed in Firefox 157 and Firefox ESR 153.4.

Mozilla Firefox's Internationalization component contains incorrect boundary conditions that permit a sandbox escape, allowing an attacker who already has code execution inside the content process to break out of the browser sandbox. The flaw affects Firefox before 157, Firefox ESR before 153.4, and Firefox ESR before 140.17; exploitation requires a victim to load attacker-controlled web content (UI:R) and typically must be chained with a separate content-process memory-corruption vulnerability because this is not a direct remote code execution flaw. No public exploit code has been identified at the time of analysis, and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity despite the critical CVSS score of 9.6.

Boundary-condition errors in Mozilla Firefox's Graphics component allow an unauthenticated remote attacker to trigger memory corruption and achieve privilege escalation on the affected platform, provided the victim loads attacker-controlled content that reaches the vulnerable rendering code path. Only builds below Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 are affected - updating to any of those versions fully remediates the issue. Although the CVSS base score is 8.8 with high confidentiality, integrity, and availability impact, no public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and the flaw as not automatable, and the mandatory user-interaction requirement (UI:R) prevents automated or wormable spread, making this a genuine but not top-priority issue.

A sandbox escape in Mozilla Firefox's Graphics: WebRender component lets attacker-controlled web content break out of the browser's content-process sandbox and reach the parent/broker process, with a 9.6 CVSS score driven by scope change plus high confidentiality, integrity and availability impact. Successfully triggering it requires an unpatched build and mandatory user interaction (PR:N, UI:R) - the victim must load or render a malicious page that exercises the WebRender path - and because the flaw sits in the rendering/sandbox boundary rather than in a directly reachable network service, realistic abuse typically depends on chaining it with a separate content-process compromise, which is consistent with SSVC rating Exploitation 'none' and Automatable 'no'. Fixed builds are Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17 and Firefox ESR 115.42; there is currently no public exploit identified at time of analysis and EPSS is low at 0.16% (4th percentile), so exploitation signals are sharply split between the very high severity rating and the low likelihood evidence.

Privilege escalation in Mozilla Firefox versions prior to 157 arises from incorrect boundary conditions in the Graphics: WebGPU component, a CWE-119 buffer-bounds flaw that a remote, unauthenticated attacker can trigger when a victim loads attacker-controlled web content. Exploitation depends on user interaction (UI:R) - typically visiting a malicious or compromised page - and is rated CVSS 8.8 with high confidentiality, integrity and availability impact, though scope is unchanged (S:U) so the effect is confined to Firefox's content process rather than the host operating system. No public exploit code was identified and CISA's SSVC assessment records Exploitation: none, so this is a mid-to-high priority browser patch rather than an emergency; the issue is fixed in Firefox 157.

Memory corruption in Mozilla Firefox's WebGPU graphics component (versions prior to 157) can be triggered when a user loads attacker-controlled web content that drives the vulnerable rendering path, yielding a buffer overflow with high confidentiality and availability impact. The flaw is remote, requires no authentication, and exploitation depends on the victim rendering a malicious page, so practical attacks rely on phishing, malvertising, or a compromised site rather than zero-click delivery. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is low at 0.15% (4th percentile), though the vendor's 9.1 CVSS rating and a patch in Firefox 157 indicate a serious memory-safety defect that should be prioritized for browser fleet updates.

Memory-corruption flaws in Firefox's Audio/Video Playback component (CWE-119) can be triggered when a user loads attacker-controlled audio or video content, potentially leading to high-integrity and high-confidentiality compromise of the browser process. The issue affects Firefox builds prior to 157 and the ESR branches prior to 153.4, 140.17, and 115.42, is rated CVSS 3.1 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), and requires user interaction - the victim must visit a malicious page or open crafted media that reaches the playback stack. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42.

A stack-based buffer overflow in the web management interface of the Shenzhen Dbit T-CPE301K 4G mini WiFi router allows an attacker who already holds a session on the device to crash the router and force a reboot by sending an HTTP POST to /js/common/do_cmd.js with an excessively long parameter. The published CVSS 4.0 score of 9.3 treats this as remote, unauthenticated, and full impact to confidentiality, integrity, and availability, but our independent assessment scores it under CVSS 3.1 as AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. an authenticated, availability-only denial-of-service, because exploitation requires network reachability to the management interface plus a valid session on the endpoint, and the confirmed outcome is a crash and restart rather than code execution. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is further limited by the small deployment footprint of this consumer/SOHO-class router; a vendor patch is available per the INCIBE advisory.

Heap-based out-of-bounds write in the RPM Package Manager (rpm) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, allowing a local, unauthenticated attacker to corrupt memory by crafting an RPM package that is then parsed with rpm2cpio, rpm2archive, or rpm -qlvp. The flaw arises from an integer overflow in iterReadArchiveNext() when a symlink entry declares RPMTAG_LONGFILESIZES as 0xFFFFFFFFFFFFFFFF, shrinking the buffer allocation to one byte and enabling attacker-controlled data from the cpio filesize field to overwrite heap memory. Exploitation requires user interaction to inspect the malicious package and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 7.1.

Out-of-bounds read in Qt for MCUs occurs when an application passes a Latin-1-optimized string containing Latin-1 characters into the QML String.arg() formatting function, causing an incorrect buffer size calculation that yields incorrect formatting output and out-of-bounds memory reads. The vendor rates this 8.8 (CVSS 4.0) with high availability impact, and the vendor vector indicates unauthenticated (PR:N) network exploitation with no user interaction (UI:N), though practical exploitation is limited by the specific Latin-1 encoding precondition and the need for attacker-influenced data to actually reach String.arg() in embedded MCU firmware. No public exploit identified at time of analysis.

Arbitrary code execution in Das U-Boot allows an unauthenticated attacker on the adjacent network segment to hijack the bootloader by replaying duplicated last-fragment IPv4 packets against stale IP reassembly state. Only builds compiled with the non-default CONFIG_IP_DEFRAG=y option and actively using U-Boot's network stack (for example TFTP or PXE netboot) are exposed, and the attacker must hit the narrow boot-time window while the bootloader is running, so the practical attack surface is narrower than the CVSS 9.0 base score implies. No public exploit code was identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; the vendor has released a fix in version 2026.07 (commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa).

Malformed SCTP traffic can crash the Wireshark/tshark dissector in versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18, turning a heap-based buffer overflow (CWE-122) in the SCTP dissector into a denial of service against the analyst's own capture session rather than against any remote service. Exploitation requires the tool to process an attacker-supplied packet - either live-captured on a monitored interface carrying crafted SCTP traffic or opened from a malicious capture file - and the packet must be specifically malformed, which is why the high attack-complexity rating applies. Access requirements are unauthenticated per the CVSS vector (PR:N), and the realistic outcome is a crash of the Wireshark/tshark process, not code execution or host compromise; no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the originally supplied CVSS vector claimed high confidentiality and integrity impact, which the independent assessment corrected to availability-only (C:N/I:N/A:H).

Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by processing attacker-controlled SPDY protocol data, an availability-only denial-of-service condition that our independent assessment scores as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The signals conflict and, on balance, point to a LOWER real-world priority than the headline 8.8 suggests: exploitation requires the victim to open a crafted capture file or live-capture crafted SPDY traffic, publicly available exploit code exists, EPSS is only 0.45% (37th percentile), and there is no confirmed active exploitation (CISA KEV). Unauthenticated attackers can trigger the crash, but user interaction is mandatory and the impact is limited to terminating the Wireshark process, not code execution or data compromise.

Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows a malformed X11 protocol message to crash the application via a heap-based buffer overflow in the X11 dissector. Exploitation requires a user to load a crafted capture file or dissect attacker-supplied live X11 traffic, giving a local, user-interaction-dependent vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) that, per the assessed vector, degrades only availability with no confidentiality or integrity impact - despite the vendor's 7.1 base score, which rated confidentiality high. Publicly available exploit code exists and CISA's SSVC rates the issue as proof-of-concept exploitation, not automatable, with partial technical impact; active exploitation is not indicated, and EPSS is only 0.13% (2nd percentile), so real-world risk is low. A vendor fix is available in 4.6.9 and 4.4.19.

A stack-based buffer overflow in the FAST FAC1203R router firmware (version 20200116_2.0.4) is reachable through the MmtAtePrase parser inside the _tWlanTask function, letting an attacker on the same LAN or WiFi segment send crafted input that corrupts the stack and can lead to full compromise of the device (assessed CVSS:3.1 base 8.8, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H). No authentication or user interaction is required once the attacker has local network adjacency, so the realistic exposure is confined to attackers who can join or reach the local network rather than the general internet. Publicly available exploit code exists and a proof-of-concept repository has been published, but there is no indication of confirmed active exploitation (CISA KEV) at time of analysis, and the vendor did not respond to disclosure, so no vendor patch is currently identified.

Authenticated stack-based buffer overflow in the TOTOLINK N150RT (NTR150) web management interface (firmware V3.4.0-B20201030) allows a network-adjacent or remote attacker holding low-privilege credentials to crash or seize control of the device by posting an oversized ApCliWEPKey value to the /boafrm/formAjaxSet handler on the topicurl=setting/setWiFiRepeaterConfig branch. Successful exploitation yields total loss of confidentiality, integrity and availability on the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which in a home or small-office context means credential interception, DNS/traffic manipulation, and use of the device as a pivot. No public exploit has been identified at time of analysis, CISA SSVC records exploitation as 'none', and no vendor-released patch or fixed firmware version has been identified; exposure is largely gated by whether the administration interface is reachable (LAN-bound by default, internet-reachable only when remote management is enabled).

Stack-based buffer overflow in the TOTOLINK N150RT (NTR150) web management interface, firmware V3.4.0-B20201030, allows a remote attacker to corrupt memory and potentially gain code execution by sending oversized ip_subnet and fw_ip parameters to the /boafrm/formPortFw port-forwarding handler during the rule-addition flow. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), modeling an unauthenticated, low-complexity attack with full confidentiality, integrity and availability impact, although port-forwarding configuration is normally an admin-authenticated function and the PR:N assertion should be confirmed against the published proof-of-concept material before relying on it. No CISA KEV entry or confirmed public exploit was identified at time of analysis, and realistic exposure is primarily LAN-side unless the management interface has been deliberately exposed to the WAN or internet.

TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030 contains a stack-based buffer overflow in the web management handler /boafrm/formFilter that is triggered when an oversized url parameter is submitted with the addFilterUrl (or addFilterUrlFlag) action flag set, allowing an attacker who can reach the interface to corrupt stack memory and gain full control of the device (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Exploitation is network-reachable and low-complexity but requires low-privilege authenticated access, so the realistic exposure is limited to management interfaces reachable on the LAN or to deployments where WAN-side remote administration has been enabled. No public exploit identified at time of analysis, no CISA KEV entry is present, and SSVC records Exploitation: none with Technical Impact: total; a third-party gist reference is linked but is not confirmed as weaponized exploit code.

A static buffer overflow in ZoneMinder's Remote HTTP camera response parser (RemoteCameraHttp::GetResponse()) affects all versions before 1.38.4 and lets a malicious or compromised HTTP camera - or an on-path attacker able to modify the camera's traffic - corrupt fixed-size buffers by sending oversized HTTP status messages, Connection headers, Content-Type values, or multipart boundaries. Successful abuse corrupts parser state and can crash the capture process or corrupt memory; integrity impact is limited (VI:L) while availability impact is high (VA:H), and no public exploit has been identified at time of analysis. Exploitation is unauthenticated but conditional: it requires a monitor configured for a remote HTTP camera source and attacker positioning on the camera side of the connection rather than against ZoneMinder's own listening interface.

An insufficient buffer-size validation defect in Zephyr RTOS's ADI MAX32 ADC driver (drivers/adc/adc_max32.c) allows a local, low-privileged user-mode thread to write up to twice the length of its supplied buffer into kernel memory, producing attacker-controlled out-of-bounds writes at an attacker-chosen offset. Exploitation requires a build compiled with CONFIG_USERSPACE running on ADI MAX32 hardware where the calling thread has already been granted access to a MAX32 ADC device object; on such a build the attacker fully controls channels, buffer, buffer_size and options->extra_samplings, and the resulting corruption of adjacent memory, kernel data or thread stacks is a plausible local privilege-escalation and denial-of-service primitive (CVSS 7.8, AV:L/PR:L). The flaw is not remotely exploitable, and builds without CONFIG_USERSPACE are reduced to a caller-side robustness defect since the application supplies its own buffer; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).

An out-of-bounds kernel-mode write in Zephyr RTOS's NXP MCUX LPADC driver (drivers/adc/adc_mcux_lpadc.c) lets an unprivileged user-mode thread corrupt memory outside its own partition, providing a genuine local privilege-escalation and denial-of-service primitive rather than an inflated high-severity score. The bug affects builds compiled with CONFIG_USERSPACE that use the MCUX LPADC driver in interrupt-driven mode (or DMA-driven mode on releases carrying the DMA path), where adc_read()/adc_read_async() are system calls: a thread already granted access to the LPADC device object controls channels, buffer, buffer_size and options->extra_samplings, and can demand up to channels × 65536 samples into a tiny buffer, causing the driver's ISR or DMA callback to walk past the buffer while running in kernel mode where the MPU does not confine it. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the CVSS vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact from an authenticated local attacker, and upstream fixes are available.

Kernel memory corruption in Zephyr RTOS arises from the RTIO userspace syscall verifier z_vrfy_rtio_sqe_copy_in_get_handles(), which validates the RTIO object handle and the incoming sqes array but never checks that the caller-supplied handle out-parameter is writable before executing *handle = sqe in supervisor mode. Any user-mode thread that has been granted a struct rtio kernel object - the normal situation for applications using sensor_read_async_mempool() or the async ADC helpers, which call rtio_sqe_copy_in_get_handles() internally - can supply an arbitrary destination address and thereby obtain a write-what-where primitive that stores a pointer to attacker-controlled ring data at any kernel location, corrupting function pointers, thread structures or memory-domain partition tables and breaking the CONFIG_USERSPACE isolation boundary. The issue is local-only and build-gated (CVSS 7.8, AV:L/PR:L, CWE-787), requires both CONFIG_USERSPACE and CONFIG_RTIO, and no public exploit code has been identified at time of analysis, although an upstream vendor fix and GitHub security advisory are available.

Memory corruption in Wind River VxWorks 7 occurs when a task passes crafted arguments to a specific system call, causing an out-of-bounds write inside the RTOS memory-management subsystem and giving the caller full confidentiality, integrity, and availability impact on the running instance (CVSS 3.1 7.8 HIGH). The flaw is local in nature - per the vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the attacker must already execute code on the device as at least a low-privileged task, so only VxWorks 7 deployments that run untrusted or lower-trust code are realistically exposed; locked-down devices that execute only vendor-signed firmware are not remotely reachable through this bug. All VxWorks 7 builds prior to version 26.09 are affected, and there is no public exploit code or CISA KEV entry identified at time of analysis.

Use-after-free in GCC's libstdc++ handling of erase_if on a binary-heap priority queue (std::priority_queue) allows unauthenticated remote attackers to crash applications, and potentially corrupt memory, when the application invokes that operation with attacker-influenced contents that force a storage reallocation; the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H (7.0 High) reflects high attack complexity and low confidentiality/integrity impact against high availability impact. Exploitation is conditional rather than self-contained: the flaw is a library primitive, so reachability depends entirely on whether the consuming application exposes the erase_if code path to external input, and the demonstrated outcome is a crash with memory corruption described only as 'potential.' No public exploit identified at time of analysis and the issue is not in CISA KEV; this is a genuine but conditional memory-safety flaw whose real-world priority is moderate, not urgent.

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code execution when a victim opens a maliciously crafted file, scoring CVSS 8.8 (AV:N/AC:L/PR:N/UI:R, CWE-787). Apple fixed the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and states it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records an exploitation value of 'none' with the attack assessed as non-automatable.

Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows a high-privileged, authenticated remote attacker to corrupt memory and potentially achieve code execution on the device by supplying a manipulated 'opt' argument to the menu_nat_more.asp endpoint handled by the menu_nat_more_asp function. The flaw is remotely reachable with low attack complexity and no user interaction, but exploitation requires valid admin-level credentials (CVSS PR:H) plus network reachability of the Web Administration Service, which is normally confined to the LAN unless remote management is enabled. Publicly available exploit code exists - a Python PoC and a technical write-up are published on GitHub - but there is no confirmation of active exploitation (no CISA KEV listing), and only firmware 16.07 is confirmed affected.

Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.

A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated remote attackers corrupt stack memory by sending a crafted message to the copy_msg_element function, with high impact on confidentiality, integrity, and availability. The flaw is remotely reachable with no privileges or user interaction required (CVSS:4.0 base 9.3; independent assessment of 3.1/AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H), and publicly available exploit code exists, so any deployment where the service is reachable - typically LAN-adjacent, or WAN-exposed if the device forwards the service externally - is at risk. Exploitation is not confirmed as active (no CISA KEV entry), and the vendor was contacted early but never responded, so no official patch has been identified.

Stack-based buffer overflow in the MmtAtePrase parser of the twlantask component on FAST FAC1200R routers running firmware 5.0_20201119_1.0.2 allows an attacker who already holds valid credentials for the device management interface to send crafted input that overwrites stack memory, with the potential for arbitrary code execution or device crash/reboot. Exploitation is network-reachable but gated by authentication (CVSS PR:L) and by the fact that this router's management interface is normally LAN-only, so WAN-side attacks depend on non-default remote-management configuration. A publicly available exploit exists (published proof-of-concept code referencing the twlantask MmtAtePrase overflow), and the vendor was contacted but did not respond, so no vendor patch is available; the flaw is not known to be actively exploited in the wild. The vendor score of 8.6 overstates real-world risk given the narrow affected build, the sub-brand's limited deployment base, and the authentication prerequisite.

Stack-based buffer overflow in the devdiscover service of the FAST FAC1200R router running firmware 5.0_20201119_1.0.2 allows an attacker who can reach the device-discovery endpoint to overwrite stack memory with a crafted advertisement frame, with the assessed impact being full loss of confidentiality, integrity and availability (remote-code-execution class, CWE-121). Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch has been identified at time of analysis. The vendor-supplied CVSS 4.0 vector specifies PR:L, so some level of privilege or authentication is presumed to be required even though the advisory text does not confirm the exact prerequisite, and no CISA KEV entry indicates that this is currently being exploited in the wild.

An out-of-bounds read in libXtst's RECORD reply parser (CWE-126) allows a malicious or compromised X server to crash attached X clients that link the library and use the XTEST/RECORD extension, affecting all versions before 1.2.6. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, meaning unauthenticated attackers in the network position of the rogue server can trigger a low-integrity information leak and a denial of service, but only if the victim voluntarily connects to that server (UI:R). This is a reverse-trust scenario: it is not exploitable against clients that connect only to trusted local or remote X servers, and the X server itself is unaffected. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; vendor patch data indicates a fix is available, with the upstream correction landing in the libXtst 1.2.6 line.

Unauthenticated stack-based buffer overflow in Buffalo WSR-300HP routers and WEX-G300 Wi-Fi extenders allows network-adjacent attackers to crash devices via crafted HTTP requests, causing denial-of-service. Exploitation requires network access to the HTTP management interface, typically only reachable from the local network unless remote administration is exposed to the WAN. No public exploit code or confirmed active exploitation (CISA KEV) has been identified, and the issue is assessed as genuine but low-priority due to reachability constraints.

Remote unauthenticated denial of service in Eyeplus 57.0.0.0308 p2pcam HTTP parser allows an attacker who can reach the camera's HTTP/P2P service to crash the device by sending an over-long URI, exploiting a stack-based buffer overflow (CWE-121). Publicly available exploit code exists; CISA KEV does not list this CVE in the provided data, so it is not confirmed actively exploited. The vendor CVSS 4.0 score is 7.7 with PR:N/UI:N and only availability impact (VC:N/VI:N/VA:H), and the independent assessment likewise rates it as a denial-of-service flaw rather than code execution.

Remote unauthenticated attackers can trigger a memory overflow in Citrix NetScaler ADC and Gateway, leading to unpredictable behavior or denial of service. Affected versions include ADC before 14.1-73.37 and 13.1-64.23 (plus FIPS/NDcPP builds before 14.1-73.37 and 13.1.37.279), and Gateway before 14.1-73.37 and 13.1-64.23. The vendor CVSS 4.0 base score is 8.8 with availability as the dominant impact (VA:H), and no public exploit has been identified at time of analysis.

A memory overflow in Citrix NetScaler ADC and NetScaler Gateway can be triggered by unauthenticated remote attackers (CVSS vector PR:N/UI:N/AV:N), causing unpredictable appliance behavior and denial of service. Affected deployments are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS/NDcPP, plus Gateway before 14.1-73.37 and before 13.1-64.23. The vendor rates the flaw 8.8, and the dominant impact is availability (VA:H) rather than confidentiality or integrity compromise; no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status.

Memory overflow in Citrix NetScaler ADC and NetScaler Gateway running versions prior to 14.1-73.37 or 13.1-64.23 (and the corresponding FIPS/NDcPP builds) can be triggered over the network by an unauthenticated attacker with no user interaction, producing unpredictable or erroneous appliance behavior or a denial of service. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) is dominated by availability impact, with only incidental confidentiality and integrity exposure, so the demonstrated risk is service disruption rather than confirmed remote code execution. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical exposure driver is network reachability to an unpatched ADC or Gateway instance; fixed builds are available via Citrix bulletin CTX697096.

Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the corresponding FIPS and NDcPP builds 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) can be driven by an unauthenticated remote attacker to achieve remote code execution or cause a denial-of-service condition. Per the available CVSS 4.0 vector the attack is network-reachable with no privileges or user interaction required, but Attack Complexity is High, meaning the attacker must first satisfy a specific, non-default precondition or timing/state condition rather than issuing a single trivial request. The vendor assigns a 9.5 base score with high impact to both the vulnerable appliance and subsequent systems; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the underlying weakness class was not disclosed (CWE: N/A).

An out-of-bounds write in the L2TP control-channel parsing routine (tunnel_set_params in tunnel.c) of D-Link DIR-895L firmware A1_102b07 lets a remote attacker corrupt memory by sending a crafted L2TP control message containing a malformed Host Name AVP. The vendor's CVSS 4.0 score of 8.6 reflects a network-reachable, low-complexity attack requiring low privileges (PR:L), and VulDB has published a public proof-of-concept write-up, so publicly available exploit code exists. Note that the vendor vector's subsequent-system (SC/SI/SA:H) clause appears inflated - the flaw is an in-process memory corruption on a single consumer router - and the DIR-895L is a discontinued model, so no vendor patch has been identified.

Decompiling a maliciously crafted binary with Ghidra through 12.1.4 can drive a stack-based out-of-bounds write inside the decompiler's leftshift128 routine, letting the sample corrupt process memory and potentially achieve code execution in the analyst's Ghidra session. The flaw is triggered when a specific instruction sequence lowers to p-code containing a negative shift amount that reaches the RuleDivOpt/RuleDivTermAdd divisor-optimization path; no privileges are required (PR:N in both the reported CVSS 4.0 vector and the independent CVSS 3.1 assessment), but exploitation is gated on the victim loading and decompiling the attacker-supplied file (UI:P/UI:R), making this a targeted threat against reverse engineers rather than a remote one. At the time of analysis, no public exploit code has been identified for this issue and there is no confirmed active exploitation (CISA KEV status is not present).

Heap-based out-of-bounds write in the Esri LERC raster library 4.1.0 and earlier lets a remote, unauthenticated attacker crash an application that decodes attacker-supplied LERC imagery, resulting in a denial of service. Exploitation is possible only where a consuming application exposes a decode path for untrusted LERC input (for example imagery uploads, tile requests, or raster ingestion pipelines); the library is not a network service itself, so reachability is entirely dependent on the host application, and impact is confined to a process crash with no confirmed route to code execution or data disclosure. No public exploit code was identified at time of analysis and the issue has not been confirmed as actively exploited (CISA KEV); CVSS 3.1 scores it 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact requiring no privileges or user interaction on a reachable decode path.

Heap out-of-bounds reads in pgPointcloud through 1.2.5 allow an authenticated PostgreSQL user who can supply or store pcpatch values to copy bytes from adjacent backend heap memory into a persisted patch, enabling information disclosure or a backend crash (CVSS 4.0 base 7.2, CWE-125). The defect lives in dimensional patch WKB deserialization, where an attacker-controlled dimension size field is trusted without being validated against the remaining buffer length; exploitation requires a valid database session, the pgPointcloud extension installed, and the ability to insert or construct pointcloud-typed values. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and an upstream fix is available via pull request 388.

Remote code execution in Microsoft Outlook (Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024) can be triggered when a user opens or previews a specially crafted message, though successful exploitation depends on shaping an integer overflow into controllable memory corruption. The CVSS 3.1 base score is 7.5 with high attack complexity (AC:H), no attacker authentication (PR:N), and required user interaction (UI:R); the independent assessment characterizes the risk as constrained and non-urgent rather than an imminent threat. An official vendor patch is available, and no public exploit or active exploitation (CISA KEV) is identified in the provided data.

Unauthenticated attackers on the management network can crash the ASMI web interface on IBM Server Firmware by sending a malformed HTTPS request, causing a temporary denial of service that may become sustained with repeated exploitation. The vulnerability is an out-of-bounds read (CWE-125) with a CVSS score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H); while the interface restarts automatically after a single crash, sustained attacks could lead to a persistent loss of management access. No public exploit identified at time of analysis; this is a moderate-risk availability flaw, not a critical priority, and exposure is limited to attackers already on the management network segment.

Out-of-bounds read in the Linux kernel NTFS driver allows a local attacker who can mount a crafted NTFS volume to read past a heap allocation while the in-memory $AttrDef table is walked, producing a kernel crash (denial of service) and potential disclosure of adjacent kernel memory. Only systems that mount attacker-controlled NTFS images are affected - the kernel must have the NTFS driver enabled and the attacker needs either local mount capability (CAP_SYS_ADMIN) or an automount service that mounts untrusted removable media; authentication requirements are low privileges per the CVSS vector (AV:L/PR:L). No public exploit code has been identified at time of analysis and EPSS is negligible (0.14%, 3rd percentile), though a vendor patch is available and carries a moderate 7.1 severity score.

Out-of-bounds memory access in the Linux kernel's IPv6 Segment Routing (SRv6) receive path can be triggered by remote, unauthenticated attackers who send a crafted IPv6 packet containing a Segment Routing Header (SRH) with segments_left > 0 that is preceded by another extension header such as a Hop-by-Hop options header. Because ipv6_srh_rcv() restores skb->data by pushing a fixed sizeof(struct ipv6hdr) instead of re-establishing the real network header, skb_network_offset() remains negative; that negative value is then consumed as an unsigned length by the flow dissector during ip6_route_input(), or by sch_fragment()/neighbour output when the packet is forwarded via ip6_forward() or redirected via act_mirred, producing an out-of-bounds memcpy or buffer overflow that can crash the kernel and corrupt memory. Exploitation is not automatic: the target must be built with CONFIG_IPV6_SEG6 and configured as an SRv6 endpoint, and the packet must be specifically structured, which is reflected in the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H; no public exploit code and no confirmed active exploitation were identified at time of analysis. Vendor fixes are available in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2.

Local users who already hold access to a vdpa_sim_blk virtio-block device can drive requests whose start sector is at or beyond the device capacity, causing an unsigned underflow in vdpasim_blk_check_range() that forwards a wildly out-of-range buffer offset into the data path and yields out-of-bounds writes (VIRTIO_BLK_T_OUT copy-in, VIRTIO_BLK_T_WRITE_ZEROES memset) and out-of-bounds reads (VIRTIO_BLK_T_IN). The flaw affects Linux kernels built with the CONFIG_VDPA_SIM_BLK simulator driver since the feature was introduced (around 5.13) and is fixed by stable patches 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3; there is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and the practical risk is bounded because this is a development/simulation driver that is rarely enabled on production systems. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H) treats integrity and availability as the dominant impacts and downgrades confidentiality relative to the vendor score.

Heap out-of-bounds write in the Linux kernel's hinic network driver (Huawei HiNIC NICs), where check_mbox_seq_id_and_seg_len() permits the final mailbox segment (seq_id=42) to carry a full 48-byte payload, writing 16 bytes past the 2048-byte MBOX_MAX_BUF_SZ receive buffer. The bug is reachable only where the hinic driver is loaded and a mailbox segment can be injected with seq_id=42 and a maximal payload - realistically via the PF/VF hardware mailbox path (for example a malicious VF in an SR-IOV setup) or a compromised device - so per our independent assessment the input CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) materially overstates real-world risk relative to the more realistic AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H profile, which favors a device crash or DoS over reliable code execution. There is no public exploit identified at time of analysis and no CISA KEV listing; vendor patches are available in the stable trees. The sibling hinic3 driver already handled this case correctly via MBOX_LAST_SEG_MAX_LEN, and the same check has now been ported to hinic.

An out-of-bounds write in the Linux kernel's ASoC compress-audio platform driver for Spreadtrum/Unisoc (sprd) SoCs lets an authenticated local user who can open the SPRD compress PCM device corrupt kernel memory: the driver allocates fixed 32 KB IRAM and 2 MB DDR stage buffers but derives all copy lengths from the user-controlled fragment_size and buffer_size supplied via SNDRV_COMPRESS_SET_PARAMS, so an oversized request overflows past those fixed allocations during write(). The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H (7.8, HIGH), reflecting deterministic local exploitation with no user interaction and no need for SNDRV_PCM_TRIGGER_START, though impact is confined to Unisoc/Spreadtrum platforms that actually build and load this driver. Vendor-released patches are available (Linux 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Discovery is credited to Atuin, an automated vulnerability discovery engine, and the issue is tracked as EUVD-2026-86764.

Heap out-of-bounds write in the Linux kernel CIFS/SMB client (fs/smb/client) can corrupt slab memory when an ACL rewrite expands owner/group SIDs beyond the buffer that was sized from the on-disk DACL length. It is only reachable on systems that mount an SMB/CIFS share with the non-default cifsacl or modefromsid options and then trigger a local ACL-modifying operation such as chown or chmod, so the realistic outcome is kernel memory corruption or a crash rather than a remote attack; the source CVSS vector (8.8, AV:N/AC:L/PR:N/UI:R) is inconsistent with this local, mount-option-gated path. No confirmed active exploitation (no CISA KEV) and no public exploit code have been identified, and vendor patches are available with fixed builds including 6.18.53, 6.12.111, 7.2.7 and 7.3-rc3.

An integer overflow in the BSON encoder of the MongoDB Python Driver's bundled native C extension (PyMongo before 4.18.2) can cause an out-of-bounds write inside the process hosting the driver when an application encodes a single document built from an unusually large (~2 GB) caller-supplied value. Only builds that link the C extension are affected - the pure-Python BSON fallback is not - and successfully triggering it requires that a large attacker-influenced value actually reach the encoding path, so most applications are exposed only through data they already accept from untrusted sources. The flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the vendor has released 4.18.2 as the fixed version, and because impact is confined to the hosting application's own process, risk is best treated as a genuine but precondition-heavy memory-corruption issue.

Malicious or compromised X servers can crash X clients linked against libXi before 1.8.4 by returning malformed XI2 device-class data that the library's XI2 class parser reads out of bounds, producing an availability-only denial of service against the connected client. The attack needs no authentication on the server side (CVSS AV:N/PR:N) but is gated by user interaction (UI:R), because the victim must establish an X protocol connection to the attacker-controlled server; there is no memory disclosure back to the attacker, no integrity impact, and no code execution. A vendor fix is available (upstream merge request 23, commit e2089ab, with the affected range documented as libXi before 1.8.4), and no public exploit code was identified at time of analysis. Practically, the risk is lower than the 7.4 base score suggests, since the only outcome is a client-side crash.

Out-of-bounds access in the Linux kernel's ACPICA AML parser function acpi_ps_get_next_field allows crafted ACPI/AML field definitions to be parsed beyond intended boundaries, producing a crash-dominant denial of service; exploitation requires malicious or tampered platform firmware that supplies crafted DSDT/SSDT tables, or a privileged local user with CAP_SYS_ADMIN injecting custom AML via configfs/custom_method. The NVD CVSS 3.1 base is 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), but the independent assessment treats the practical vector as AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because this is not reachable by a remote or unprivileged local attacker on a default configuration. Vendor patches are available in Linux 6.12.111, 6.18.53, and 7.2; no public exploit code or CISA KEV active exploitation is identified in the provided data.

Integer overflow in the Linux kernel's ACPICA AML interpreter allows memory corruption and a likely kernel crash when a crafted Mid() (three-operand) AML operation is evaluated with operand values chosen so that Index + Length wraps around. Affected are Linux kernels before 6.12.111, before 6.18.53, and before 7.2 in the mainline tree, as tracked under CPE cpe:2.3:a:linux:linux and EUVD-2026-86064. This is not remotely reachable: exploitation realistically requires either the ability to supply malicious ACPI firmware tables (DSDT/SSDT) or root/CAP_SYS_ADMIN-level access such as via debugfs custom_method, so an ordinary unprivileged local user cannot trigger it on a default configuration; no public exploit has been identified at time of analysis, and vendor patches are available. Note that the NVD CVSS of 8.4 (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk for this class of Linux-kernel ACPICA flaw; our assessment rates it AV:L/AC:H/PR:H/UI:N with impact dominated by kernel memory corruption and denial of service rather than a realistic full confidentiality/integrity compromise.

Kernel crash risk in the Linux Kernel arises from insufficient buffer validation in ACPICA's acpi_ut_walk_aml_resources(), allowing malformed ACPI resource descriptors to overflow internal buffers. Exploitation requires control over ACPI resource descriptor data - firmware, a rogue device advertising crafted resource data, or a privileged local path that feeds ACPI tables into the kernel - so the NVD CVSS 3.1 score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) overstates real-world risk; the independently assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H with a predominant kernel-crash impact. Vendor-released patches are available, and no public exploit identified at time of analysis.

Out-of-bounds reads in the Linux kernel's ACPI interpreter (ACPICA) - specifically in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() - can cause a kernel crash or expose adjacent memory contents when parsing malformed AML bytecode from ACPI tables. All kernel versions tracing back to the initial git commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) are affected; fixes are published in Linux 6.12.111 and 6.18.53 (mainline 7.2). Exploitation requires the ability to supply crafted ACPI tables - malicious or modified firmware/BIOS, physical boot-time table override, root-level override via initrd (CONFIG_ACPI_TABLE_UPGRADE), or a hostile hypervisor - which is why our independent assessment lowers the supplied CVSS 7.7 (PR:N, AC:L, C:H) to AV:L/AC:H/PR:L with confidentiality impact limited to adjacent-memory leakage; the realistic outcome is a kernel denial of service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the patch is available from the vendor via the referenced upstream stable commits.

Out-of-bounds access to native Wi-Fi header fields in the Linux kernel's ath11k driver can corrupt kernel stack memory when a received frame's length exceeds the maximum native Wi-Fi header size in the DP_RX_DECAP_TYPE_NATIVE_WIFI decapsulation path (ath11k_dp_rx_h_undecap_nwifi). Unauthenticated adjacent attackers within radio range (AV:A, PR:N, UI:N) against systems running the ath11k driver on supported Qualcomm Wi-Fi hardware - tested on WCN6855 hw2.1 PCI with WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 firmware - can trigger a malformed over-the-air frame that leads to kernel stack corruption and a crash; no public exploit has been identified at time of analysis. Independent assessment rates this CVSS 3.1 AV:A/AC:H/PR:N/UI:N/C:L/I:L/A:H, meaning the vendor/NVD score of 8.8 overstates real-world risk: the trigger path must be active, the attacker must be radio-adjacent, and the confirmed outcome is memory corruption/crash rather than demonstrated code execution.

Mounting a crafted NTFS volume on a system running the Linux kernel's ntfs3 driver can drive a slab out-of-bounds read: a malformed directory index entry declares a key_size larger than the bytes actually present in its NTFS_DE payload, and the subsequent directory lookup passes that key to cmp_fnames(), which reads past the end of the kmalloc'ed index buffer. The flaw is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 7.1) and requires the victim to mount and access the malicious image, typically via removable media, a supplied disk image, or a desktop automount path; the practical consequence is most often a kernel crash or denial of service rather than reliable disclosure of meaningful data, so real-world risk is lower than the headline score implies. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist in Linux 6.18.53, 6.12.111, and 7.2.

An out-of-bounds read exists in the Linux kernel's ntfs3 driver: the readdir path in ntfs_dir_emit() compares a UTF-16LE character count (fname->name_len) against a byte count (e->size) without accounting for the 2-byte encoding or the ATTR_FILE_NAME header, so a crafted NTFS image with a small declared entry size but a large name length slips past the bounds check and lets ntfs_utf16_to_nls() read beyond the index entry. Exploitation is local and requires the victim to mount and list a directory on the attacker-supplied filesystem, typically via removable media or a disk image opened by an auto-mount daemon, and mounting normally requires CAP_SYS_ADMIN or equivalent auto-mount privileges, with user interaction needed to insert the media or open the image. The impact is information disclosure (kernel memory contents adjacent to the entry) plus a denial-of-service crash; no public exploit code or active exploitation was identified at time of analysis, and no EPSS score was supplied, though patch code is already public in the upstream stable trees.

Out-of-bounds reads in the Linux kernel amdgpu FRU PIA parser can crash affected systems when malformed or truncated EEPROM data is processed during driver initialization. Exploitation requires local access with low privileges and high attack complexity on AMD GPUs that expose a FRU PIA, primarily datacenter or professional models, and an attacker must be able to supply corrupted on-board EEPROM contents rather than network or ordinary userspace input. The assessed impact is low confidentiality and high availability, not reliable code execution or data theft; vendor patches are available in Linux 6.12.111, 6.18.53, and 7.2, and no public exploit was identified at time of analysis.

Boundary-condition mishandling in the Linux kernel's RDMA user-memory path (ib_umem_find_best_pgsz()) lets a local user who can register a user memory region through RDMA verbs drive out-of-range iova/length arithmetic into a GENMASK, producing incorrect page-size masks and, in the worst case, kernel memory corruption or a crash. Exposure is narrow and architecture-dependent: the truncation and >4G GENMASK overflow cases are principally reachable on 32-bit kernels where iova is passed as a 32-bit value, while 64-bit builds are far less affected, and access is gated by PR:L (an RDMA/InfiniBand or RoCE-capable device plus permission to call ib_umem_get()). Our independent assessment is less severe than the published 7.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), since the patch addresses arithmetic on page-size masks rather than a direct attacker-controlled heap write; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.

Out-of-bounds array indexing in the Linux kernel's iwlwifi mvm wireless driver can crash the kernel and read a small amount of adjacent memory when a compromised or malicious Intel WiFi adapter firmware sends a BA_WINDOW_STATUS_NOTIFICATION containing an out-of-range station ID. Systems running affected kernels before 6.12.111 or before 6.18.53 with an active Intel WiFi device are in scope, but the attacker must already control the firmware-side notification, so the NVD CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N) substantially overstates real-world risk. No public exploit code or confirmed active exploitation was identified at time of analysis.

Out-of-bounds tid_data array access in the Linux kernel's iwlwifi mvm driver (CVE-2026-93790) is a theoretical flaw that writes the lq_color value into an unrelated tid_data slot, but it is not practically triggerable because multi-TID blockack is not in use, meaning the TFD loop counter 'i' is always 0 and the write remains in-bounds on unpatched systems. The affected component is the Intel iwlwifi mvm Wi-Fi driver in Linux kernel versions prior to 6.18.53, 6.12.111, and 7.2. An attacker within Wi-Fi radio range (adjacent, unauthenticated per the assessed CVSS vector) would need a contrived multi-TID blockack scenario to cause minor rate-control state corruption; no public exploit code exists and there is no evidence of active exploitation, so real-world risk is low.

An out-of-bounds slab read in the Linux kernel's SMB/CIFS client allows an attacker-controlled SMB1 server to make a victim's kernel read past the end of a kmalloc'd response buffer when that victim lists a directory on a mounted share. cifs_filldir() trusts the server-supplied de.namelen field from a TRANS2_FIND_FIRST/FIND_NEXT response without verifying that the name stays inside the response buffer, so an oversized FileNameLength drives memchr() (via filldir64()/verify_dirent_name()) beyond the allocation and produces a KASAN slab-out-of-bounds report; CVSS 3.1 is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H), with high confidentiality and availability impact from the out-of-bounds read. Exploitation requires the victim to mount a share from a hostile server using the deprecated SMB1 dialect and then browse it, so user interaction is required; no public exploit identified at time of analysis.

Oversized SMBus block transfers in the Linux kernel I2C subsystem can reach tracepoints and native driver callbacks without ever being validated against I2C_SMBUS_BLOCK_MAX, allowing local memory corruption and out-of-bounds reads. The flaw is fixed by adding an early length check in __i2c_smbus_xfer(), which previously deferred validation to i2c_smbus_xfer_emulated() - too late for the smbus_write tracepoint and skipped entirely by adapters that supply a native .smbus_xfer implementation. The independently assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H) reflects that exploitation requires local access to an /dev/i2c-* interface plus a non-default configuration - SMBus tracing enabled (Bug 1) or the i2c-stub testing module loaded (Bug 2) - and default production kernels without tracing, i2c-stub, or unprivileged i2cdev access are not readily exploitable; no public exploit code was identified at time of analysis.

Heap out-of-bounds write in the MongoDB C Driver (libmongoc) allows an unauthenticated attacker who controls DNS resolution and the responses of hosts in a client's connection string to corrupt memory and crash the application. Exploitation requires a privileged network position (MITM or rogue server) and results in denial of service, not code execution or data disclosure. Patched versions 1.30.12 and 2.5.5 are available; no public exploit code or active exploitation has been identified at time of analysis.

A stack-based buffer overflow in Altera Trusted Firmware (the ARM Trusted Firmware-A port for Altera/Intel SoC FPGA Hard Processor Systems) through socfpga_v2.14.0 lets a high-privileged local attacker corrupt a fixed-size stack buffer inside the secure monitor and cross the normal-world-to-secure-world trust boundary. The attacker must already control the normal-world OS on the affected HPS device (CVSS vector PR:H, AV:L, UI:N), so this is an access-gated escalation primitive rather than a remotely reachable issue; the assessed impact is high integrity and availability loss with limited confidentiality exposure in the secure world (CVSS 8.3). No public exploit code has been identified at time of analysis, and no evidence of active exploitation was provided by the vendor or in the supplied intelligence.

Out-of-bounds read in Altera Trusted Firmware for SoCFPGA hard processor systems (all builds through socfpga_v2.14.0) lets an attacker who already holds high privileges in the normal world corrupt or read beyond intended memory bounds inside the secure monitor, enabling escalation from the non-secure HPS environment into the secure world. Exploitation requires local access and pre-existing root-level code execution (CVSS PR:H), so it is not a remote or pre-authentication vector; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The independent assessment rates this a genuine but access-limited priority given the privileged local precondition.

Local privilege escalation in Altera Trusted Firmware (TF-A) on socfpga Hard Processor Systems lets an attacker who already holds high privileges on the normal-world OS drive an out-of-bounds read inside the secure monitor, exposing and corrupting secure-world memory and escalating execution context, in all versions through socfpga_v2.14.0. The flaw is reachable only by invoking secure-monitor calls from an already-privileged local context, with no network vector and no user interaction, but because it crosses the normal-world/secure-world boundary it yields high integrity and availability impact beyond the vulnerable component (CVSS 4.0 base 8.3; independent assessment CVSS 3.1 8.3). No public exploit code has been identified and the issue is not listed in CISA KEV, so exposure is confined to devices where an adversary has already achieved privileged local execution.

Privilege-gated out-of-bounds write in Altera Trusted Firmware (the SoCFPGA port of ARM Trusted Firmware-A) through socfpga_v2.14.0 allows an attacker who already holds high privileges in the normal world to corrupt memory in the secure firmware, degrading the integrity and availability of the trusted execution environment and extending the scope of compromise beyond the attacker's original context. The root cause is an improperly configured or implemented memory protection (CWE-787) that is reachable only from a local, already-privileged position on Altera/Intel SoC FPGA Hard Processor System platforms, so it is not remotely reachable and does not affect general-purpose systems; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).