Buffer Overflow

Buffer overflow in Altera Trusted Firmware (ARM Trusted Firmware-A) running on the Hard Processor System (HPS) of socfpga FPGA SoCs lets a locally-positioned attacker who already holds high privileges corrupt firmware memory through an incorrectly calculated buffer size. All Trusted Firmware releases up to and including the socfpga_v2.14.0 branch are affected, and exploitation requires local access combined with high-privileged normal-world code execution capable of reaching the firmware's service interface - the flaw is not remotely reachable and cannot be triggered by an unprivileged user. There is no confirmed active exploitation and no public exploit identified at time of analysis; the assessed risk is primarily post-compromise privilege and trust escalation on the specific embedded hardware, with real-world exposure constrained by the local, high-privilege prerequisite.

A stack-based buffer overflow in Altera's Trusted Firmware port for SoC FPGA devices (the SoCFPGA branch through socfpga_v2.14.0) lets a local attacker who already controls the non-secure rich OS - root or kernel on the HPS ARM cores - corrupt the secure monitor's stack via the SMC interface and potentially escalate across the trust boundary into the secure world. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) confirms this is an access-gated privilege/trust-boundary escalation requiring an existing high-privileged foothold, not a remotely reachable default-configuration flaw; impact to integrity and availability is high and scope is changed, but confidentiality impact is limited. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).

Heap over-read in DCMTK through 3.7.0 allows unauthenticated remote attackers to crash applications or leak adjacent heap memory by supplying a crafted DICOM instance whose declared NumberOfFrames exceeds the actual PixelData buffer length. The flaw resides in the ConcatenationLoader module (dcmfg) and is triggered when loading multi-frame DICOM concatenations; exploitation requires an ingestion path that processes untrusted instances (e.g., a DICOM network storage service), as offline viewers typically require a user to open the file. No public exploit code is identified at time of analysis, and a vendor patch is available via upstream commits.

An out-of-bounds write in GIMP's GIMPressionist plug-in allows an attacker to corrupt memory by convincing a user to load a malicious preset file, potentially leading to a crash or arbitrary code execution. The flaw is an unauthenticated local attack (CVSS PR:N) that requires user interaction (UI:R) to open a crafted preset file, and it affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 plus likely upstream GIMP versions. No public exploit has been identified at time of analysis, and the overall risk is assessed as genuine but not urgent due to the requirement for user interaction with a crafted file.

Heap-based buffer overflow in the Nanomsg WebSocket transport (versions 0.5-beta through 1.x before 1.2.3) allows remote attackers to corrupt heap memory by sending an oversized Sec-WebSocket-Version header during the WebSocket handshake, which is processed before any authentication or user interaction takes place. Exploitation requires that the target application actually enable and expose nanomsg's ws transport; TCP- or IPC-only deployments are unaffected. The flaw yields high integrity and availability impact, and while reliable code execution depends on heap layout and platform, no public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (not in CISA KEV).

Out-of-bounds write in the rp-l2tp component of D-Link DIR-825 firmware 3.00b32 allows a remote, unauthenticated attacker to corrupt memory by sending a crafted L2TP Host-Name AVP, with the CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity, and availability impact. The flaw resides in tunnel_set_params() in tunnel.c, where the peer_hostname argument is copied without adequate bounds validation, so an oversized or malformed value overwrites adjacent memory; because the vulnerable code sits in the L2TP tunnel setup path, an attacker only needs network reachability to the router's L2TP service and no credentials or user interaction. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the severity and low attack complexity make the exposure significant for any deployment that leaves L2TP enabled on a WAN-facing interface.

A stack-based buffer overflow in Espruino 2v29 (commit bffc6d0) lets an unauthenticated remote attacker crash the JavaScript interpreter by supplying script input that raises an exception and drives execution into the error stack-trace formatting path, where jslPrintTokenLineMarker() passes the address of a 4-byte int column variable to jsvGetLineAndCol(), which performs an 8-byte write through that mismatched pointer on 64-bit builds. The overwrite is small and the written value is not attacker-controlled, so the realistic outcome is a denial-of-service crash rather than code execution (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability impact only), and the flaw is specific to 64-bit builds - the ordinary 32-bit microcontroller firmware is not indicated as affected. Risk signals are currently low: EPSS is 0.17% (6th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, although genuine remote exploitation requires the interpreter to be reachable by untrusted input, since typical embedded deployments load JavaScript over USB, serial or Bluetooth from the developer.

Parsing a malformed PDF in SumatraPDF 3.6.1 can crash the reader through a signed integer overflow in the PageLabels handling code, producing a local denial-of-service condition. The bug is reached only when a user opens an attacker-crafted document whose /Nums array supplies an /St (start-at) value near INT_MAX, which overflows in EngineMupdf::BuildPageLabelRec(); an independent assessment scores this as AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (base 7.5 as published, but the network/no-interaction vector is inconsistent with a desktop file-parsing flaw that needs user interaction). There is no confirmed code execution, confidentiality or integrity impact, no public exploit code identified at time of analysis, no CISA KEV listing, and EPSS is only 0.17% (5th percentile), so exploit likelihood is low.

Heap-buffer-overflow in MPack 1.1.1's Node (tree) parsing API on 32-bit platforms lets remote, unauthenticated attackers corrupt memory and crash the host application by delivering a MessagePack array32 or map32 header that declares an oversized element count. The declared count overflows the size_t arithmetic used to size an internal page allocation in mpack_tree_parse_children(), producing an undersized heap buffer that is then written past its end with mpack_node_data_t records. Exploitation is constrained to 32-bit builds that call the tree/Node API on attacker-supplied data: on 64-bit builds the overflow is effectively unreachable, and applications using only the streaming Expect/Reader API are not affected. EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; NVD scores this 9.8, while independent assessment rates it lower (C:L/I:L/A:H) because of the 32-bit-only deployment prerequisite.

An out-of-bounds read in the dump() function of the jsmn JSON tokenizer's demo utility example/jsondump.c (commit 25647e6) allows an attacker who supplies crafted or malformed JSON to the program to disclose small amounts of adjacent process memory and to crash the utility, giving a confidentiality and availability impact rated Low. Only users who build and run the shipped example - or who copied that demo code into a tool or pipeline that parses untrusted JSON - are affected; consumers of the core jsmn.h library who do not use the example are not exposed. The 7.3 base score is not matched by real-world signals: EPSS is 0.15 percent (4th percentile), there is no CISA KEV entry, and no public exploit was identified at time of analysis, and the assessed vector is local with required user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), so this is a low practical priority rather than a remotely exploitable high-severity issue.

Crafted MAT4 (MATLAB v4) files cause an integer overflow in libsndfile 1.2.2's mat4_read_header() parser, crashing the process and producing a denial of service. The flaw is network-reachable without authentication (CVSS 3.1 PR:N), but our assessment requires a victim to open the file or a backend service to ingest untrusted audio (UI:R); impact is limited to availability, with no code execution or data disclosure. No public exploit code and no vendor-released patch are confirmed at time of analysis.

Memory corruption in Espruino 2v29 (commit bffc6d0) allows local attackers to trigger a one-byte out-of-bounds write by supplying crafted JavaScript with an overlong token, corrupting the adjacent tokenValue pointer and causing application crashes or denial of service. The flaw only manifests in RELEASE/NO_ASSERT firmware builds; debug builds with assertions enabled catch the overlong token before the write. No public exploit code has been identified at time of analysis, and the assessed CVSS 3.1 vector rates this as AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (score 7.7).

Heap out-of-bounds write in QuickJS's bytecode deserializer (JS_ReadFunctionTag) lets a crafted serialized blob corrupt heap memory, giving an attacker the potential for arbitrary code execution in the context of the host process. The flaw is only reachable when the embedding application calls JS_ReadObject with the JS_READ_OBJ_BYTECODE flag on attacker-controlled input - not the default pattern of executing JavaScript source - so exposure is confined to plugin, cache, or IPC loaders that treat serialized bytecode as untrusted data; where that path is exposed, the flaw is remotely triggerable by an unauthenticated attacker (CVSS vector PR:N) with a single malformed blob and no user interaction. Public exploit code has not been identified at time of analysis (EPSS 0.17%, 5th percentile), and while the vendor score is 9.8 with AC:L, an independent assessment rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because exploitation depends on a non-default deserialization path in the hosting application.

Integer overflow in minimp3's mp3dec_skip_id3v1() tag-parsing routine allows a crafted APEv2 tag-size field inside an MP3 file to corrupt internal size arithmetic, which can lead to memory corruption in any application that decodes untrusted audio with a build at or around commit ea99364f. The CVSS vector supplied with the record is 9.8 (AV:N/AC:L/PR:N/UI:N), but our assessment lowers user interaction to UI:R: minimp3 is a passive single-header decoder library, so a victim or automated ingestion pipeline must open or feed the malicious file before the overflow is reachable, and there is no direct network attack surface in the library itself. No public exploit code has been identified at time of analysis, EPSS is low at 0.15% (3rd percentile), and the CVE is not listed in CISA KEV, so exploitation is unconfirmed and real-world risk depends on whether the consuming application processes hostile media.

Remote code execution in Microsoft Outlook affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 when a targeted user opens or previews a specially crafted email message. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated remote attacker can trigger the flaw with no credentials, but success depends on the victim interacting with the malicious message - Outlook's Preview Pane is a plausible trigger surface for message-borne code execution. No public exploit code has been identified at time of analysis (E:U) and Microsoft has released an update, so this is a high-priority patching candidate given the enormous installed base of Outlook, but not an emergency requiring emergency change control.

Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that overflows a buffer and achieves arbitrary code execution under the privileges of the affected process, matching the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. IBM's own advisory scores the issue 9.8 with a network/unauthenticated vector (AV:N/AC:L/PR:N/UI:N), but the vendor description explicitly states a 'local user' is required, so realistic exposure is confined to systems where an attacker already has a local account - a foothold-to-full-compromise escalation rather than a pre-authentication remote RCE. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM has published an advisory with a vendor-supplied fix.

Heap-based memory corruption in Claris FileMaker Server's database engine block-parsing routine allows a maliciously crafted .fmp12 database file to overflow a heap buffer, potentially enabling arbitrary code execution in the context of the FileMaker Server process. All FileMaker Server releases prior to 26.0.3 are affected; exploitation requires that the crafted database be delivered to and processed by the server and that an operator open or host it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), so the local delivery path and required user interaction are the principal limiting factors rather than any authentication barrier, since no privileges are needed (PR:N). No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and EPSS is low at 0.16% (4th percentile), making this a moderate-priority memory-corruption fix rather than an urgent field threat; Claris has released a vendor patch in FileMaker Server 26.0.3.

Server-side thumbnail generation in FileMaker Server for Linux can be forced to over-read process memory when an attacker uploads a specially crafted image into a container field reachable through FileMaker WebDirect, leaking contents of the server's process memory and potentially crashing the worker process. Only the Linux server variant is affected; exploitation requires WebDirect to be enabled and a hosted solution that exposes a writable container field, which in most deployments implies a WebDirect guest or low-privilege authenticated session (the assessed vector is PR:L, while NVD's published vector claims PR:N - a discrepancy worth noting when scoring). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is a low 0.14% (3rd percentile); Claris has released a fix in FileMaker Server 26.0.3, so this is a genuine but not urgent priority - patch on a normal cycle rather than under emergency change.

A heap buffer overflow in BusyBox's romfs filesystem image parsing path can be triggered when the utility processes an attacker-crafted romfs image whose volume ID metadata is read with an unbounded strlen, producing an out-of-bounds heap write (CWE-787) rated CVSS 3.1 base 7.3. Because the attack vector is local (AV:L), the malicious image must be delivered to the target system - for example via removable media, a downloaded archive, a firmware/container image, or a package - and some process or user must then parse or mount it (UI:R); it is not remotely triggerable over a network. Under the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) no privileges are required, and successful corruption could yield code execution in the context of the parsing process with high impact to confidentiality, integrity, and availability; no public exploit or POC was identified in the supplied intelligence and there is no confirmed active exploitation.

Pre-authentication heap memory corruption in BusyBox's built-in TLS implementation can be triggered by a remote, unauthenticated attacker who sends a single crafted ClientKeyExchange handshake message to a BusyBox process acting as a TLS server, corrupting the heap and crashing the process (CVSS 3.1 base 7.5, availability-only with no confidentiality or integrity impact rated). Exploitation requires a BusyBox binary compiled with TLS support and reachable in a server role, a deployment pattern that is the exception rather than the norm since BusyBox TLS is most often used outbound (for example by wget https), which sharply narrows the realistically exposed population. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence; the issue is tracked by Red Hat via its CVE page and Bugzilla, with no public exploit identified at time of analysis.

Malformed HEIF image-grid files can trigger a signed integer overflow in FFmpeg before 9.0, causing memory corruption or crashes when width/height fields from a crafted ispe box exceed INT_MAX. All FFmpeg versions before 9.0 are affected, particularly deployments that process HEIF/HEIC images, such as transcoding or thumbnailing services. The independent assessment is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning an unauthenticated attacker can trigger it if a crafted file is processed through a local path, though user interaction is required; no public exploit identified at time of analysis, and EPSS is low at 0.11% (percentile 1%).

Denial of service via JVM crash affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8, where a buffer over-read (CWE-126) during the TLS handshake lets a malicious client terminate the server process, rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The flaw is reachable remotely and unauthenticated with no user interaction, but only where the APR/OpenSSL-based native TLS connector is actually deployed and handling TLS connections; Tomcat instances using the pure-Java JSSE/NIO connector are not affected. Impact is confined to availability - no confidentiality or integrity loss, no data exposure and no code execution - and no public exploit was identified at time of analysis, with no CISA KEV entry.

An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered when a victim opens a specially crafted PDF containing malformed color space data, causing the application to crash and potentially allowing remote code execution in the context of the logged-in user. The flaw is rated CVSS 3.1 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: exploitation is unauthenticated per the vector but strictly local in attack path and requires user interaction, meaning the attacker must deliver the file and convince the target to open it on an affected default installation. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; the confirmed outcome is a crash, with code execution described by the vendor as potential rather than demonstrated, and EPSS data was not provided with this record.

Opening a malicious PDF in Foxit PDF Editor or Foxit PDF Reader can corrupt memory and terminate the application: the document forces a page-structure change while the file is being rendered, so the page-tree logic accesses a page object that has already been released (CWE-416, use-after-free). Rated CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw requires no authentication on the victim's side but does require the user to open the crafted file, making social engineering the sole delivery gate. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Memory corruption in Foxit PDF Editor and Reader arises from a heap-based out-of-bounds write (CWE-787) that occurs when the application renders a Circle annotation with a malformed 'Cloudy' appearance stream inside a crafted PDF. The flaw stems from insufficient validation of the annotation's appearance geometry during rendering, requiring the victim to open a malicious file (UI:R) with no privileges needed (PR:N). CVSS is 7.8, but no public exploit code has been identified at time of analysis, and the need for user interaction plus a deliberately malformed annotation structure limits practical, widespread exploitation.

Heap-based out-of-bounds memory write in Foxit PDF Editor and Foxit PDF Reader's PRC 3D-content parser (CVSS 7.8) lets an attacker corrupt process memory by getting a user to open a crafted PDF that embeds a PRC model with malformed vertex indices in a triangular fan texture mesh. The attack is not network-triggerable on its own (AV:L) and requires the victim to open the file (UI:R), with no authentication needed (PR:N); successful exploitation yields memory corruption, a likely application crash, and potential code execution in the context of the Foxit process (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the risk is concentrated in email, web-download, and file-share delivery of weaponizable PDFs to engineering/3D-CAD workflows that exercise Foxit's PRC rendering path.

Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image data inside a PDF and fail to sufficiently validate the embedded image metadata, allowing the malformed metadata to drive writes past the end of an allocated heap buffer. An attacker can deliver the trigger inside an ordinary-looking PDF; because the CVSS vector is AV:L with UI:R and PR:N, the flaw is not remotely exploitable without interaction - the victim must open or render the crafted file, and exploitation then runs in that user's context with high confidentiality, integrity and availability impact (CVSS 7.8). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and this is a client-side file-parsing bug rather than a wormable or pre-auth network service issue.

Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF to corrupt process memory and potentially achieve remote code execution when the victim opens the file. Exploitation requires user interaction (the document must be opened and the malicious 3D model or GIF texture must actually be rendered) and is delivered through the local file/processing path (AV:L), while no application-level authentication is required (PR:N). No confirmed active exploitation and no public exploit code were identified at time of analysis; Foxit directs users to its security bulletins page for version guidance.

Remote stack-based buffer overflow in the Device Discovery Service of FAST FAC1203R Gigabit Edition 2.0.4 routers allows unauthenticated attackers to execute arbitrary code via a crafted message processed by the copy_msg_element function. A public proof-of-concept exploit has been published, and the vendor has not released a patch. While the CVSS vector indicates network exploitable (AV:N), the discovery service is typically limited to the LAN broadcast domain, so attackers most likely need adjacent network access rather than internet routing.

Heap-based buffer overflow (CWE-122) in Google Chrome's stable channel, addressed in the September 2026 desktop stable-channel update, lets remote, unauthenticated attackers corrupt heap memory in a vulnerable build and potentially escape the browser's renderer sandbox for full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.6, S:C). Exploitation requires the victim to interact with attacker-controlled web content - typically visiting a malicious page or rendering a hostile ad - so the practical window depends on how quickly users and Linux distributions apply the update. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; details remain limited because the referenced Chromium issue tracker entry is access-restricted.

An out-of-bounds memory write in Google Chrome allows an unauthenticated, remote attacker to corrupt memory and potentially execute arbitrary code or crash the browser when a victim opens a crafted web page, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6, scope-changed). The flaw is classified as CWE-787 (out-of-bounds write) and is addressed by the vendor's stable channel update for desktop, with the fix credits originating from the Ubuntu vendor reporting channel, meaning downstream Chromium packages are also in scope. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS data provided; however, because browser memory-corruption bugs of this class are historically attractive to exploit developers, this remains a high-priority patching item despite the absence of exploitation telemetry.

Unspecified security defects in Google Chrome desktop builds are addressed by a September 2026 stable-channel update, meaning only users running outdated installations remain exposed. The exact vulnerability class, attack vector, and privilege requirements are not disclosed in the available data, so the primary applicability condition is simply that the victim runs an unpatched Chrome desktop build and loads attacker-influenced web content, which implies user interaction (browsing) as a limiting factor. There is no CVSS score or vector, no CWE mapping, no EPSS probability, no CISA KEV listing, and no public exploit code identified at time of analysis, so no quantitative severity or exploitation-probability framework can be applied to this record.

Risk cannot be meaningfully assessed from the available data. CVE-2026-95281 is tracked in the Ubuntu security database, which establishes only that it affects software shipped as a package within the Ubuntu distribution; the upstream project, the vulnerable component, and the affected Ubuntu releases are all unspecified. No description, CVSS vector, CWE, CPE, KEV status, or exploit data was provided, and no public exploit has been identified at time of analysis, so the attack vector, privilege requirements, and user-interaction prerequisites remain unknown and must be sourced from the corresponding Ubuntu Security Notice or the NVD entry.

CVE-2026-95318 is currently an unenriched record that cannot be meaningfully risk-assessed: the only attributable data point is that it was reported by vendor:ubuntu, with no description, no CPE strings, no CWE, no CVSS score or vector, and no references supplied. There is no confirmation of what component, package, or Ubuntu release is affected, whether exploitation requires authentication or user interaction, or what the resulting impact would be. Neither confirmed active exploitation (CISA KEV) nor publicly available exploit code exists in the available data, so the exploitation status is best described as no public exploit identified at time of analysis. This analysis should be treated as provisional and re-run once Ubuntu Security Notices or NVD enrichment supply a description, affected version range, and CVSS vector.

Risk cannot be meaningfully assessed from the supplied data: CVE-2026-95283 is recorded only as a vendor-reported entry from Ubuntu, with the description marked '[Unknown description]' and no CVSS score, CVSS vector, CWE, CPE, or affected source package provided. Because the impacted component, deployment mode, and attack surface are all unidentified, no statement can be made about what an attacker could achieve, which versions are affected, or what preconditions (authentication, user interaction, configuration) would be required. There is no KEV listing and no public exploit code identified at time of analysis, so the entry should be treated as an unassessed tracking record rather than a confirmed exploitable issue.

Out-of-bounds memory write in Google Chrome allows remote attackers to corrupt memory in a victim's browser by having them load attacker-controlled web content, rated CVSS 3.1 base 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). No authentication or non-default configuration is required, but exploitation depends on user interaction (the victim must visit or load the malicious page) and on running an unpatched build predating the September 2026 stable-channel fix; exact affected versions are not confirmed in the available data. The scope-change component suggests impact extending beyond the initially affected component - the classic profile of a renderer-process compromise crossing Chrome's process boundary - and while a vendor patch is available, no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.

Heap-based buffer overflow in Google Chrome desktop (stable channel) allows a remote, unauthenticated attacker to corrupt heap memory when a victim renders attacker-controlled web content such as a malicious page, iframe, or ad, yielding high impact to confidentiality, integrity, and availability with a changed scope that suggests effects can extend beyond the initially affected component. Exploitation requires user interaction (UI:R) - the victim must load the hostile content - but needs no credentials (PR:N), is network-reachable (AV:N) and low complexity (AC:L), making actively browsing, unpatched endpoints the realistic exposure. No public exploit has been identified at time of analysis; the referenced Chrome stable channel advisory and Chromium issue 551573368 confirm a vendor fix, and the independent assessment rates this a genuine high priority at CVSS 9.6.

Out-of-bounds write (CWE-787) in Google Chrome permits a remote, unauthenticated attacker to corrupt memory in the browser when a victim opens or is redirected to attacker-controlled web content (UI:R), with high confidentiality and integrity impact and a scope change (S:C) that the independent assessment reads as the corruption crossing the renderer sandbox boundary. Exploitation is not turnkey: the high attack complexity (AC:H) reflects a precondition the attacker must satisfy - typically heap grooming, a race, or a specific object/memory state - before the write is reachable, which constrains reliability and mass exploitation. No public exploit identified at time of analysis, and the fixed build 154.0.8037.57 is already shipping, so exposure is limited to un-updated Chrome clients, making this a genuine high-priority browser issue rather than a top-tier emergency.

Out-of-bounds memory write in Google Chrome (desktop builds) lets remote, unauthenticated attackers corrupt browser memory when a victim loads attacker-controlled web content. The vendor CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U with C:H/I:H/A:H (base 8.8), so the only prerequisite is that a user navigates to or renders a malicious page, and because the vector is scope-unchanged the memory corruption is expected to remain within the renderer/browser process rather than granting an inherent sandbox escape. The underlying flaw is an out-of-bounds write (CWE-787) in Chrome builds predating the vendor's September 2026 stable channel fix; patched builds are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Heap-based buffer overflow in Google Chrome builds earlier than 154.0.8037.57 allows unauthenticated remote attackers to corrupt memory when a victim loads attacker-controlled web content, with a CVSS base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflecting scope change and potential high confidentiality, integrity, and availability impact. Exploitation requires user interaction - visiting a malicious site, a compromised page, or a malicious ad - and full host compromise would most likely require chaining this renderer-process overflow with a separate sandbox-escape bug rather than this flaw alone. Risk signals conflict in the usual browser-bug pattern: EPSS is only 0.29% (19th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, while Chrome's silent auto-update rapidly shrinks the vulnerable population and a vendor patch is already available.

Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffer overflow (out-of-bounds write) in an FTM component lets an attacker with valid low-privilege credentials submit crafted input and gain code execution in the containerized transaction platform. The vendor rates this 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment concurs on high confidentiality and integrity impact while treating the scope change as unproven (S:U). Exploitation requires authentication (PR:L) and is not considered reliably repeatable on the first attempt (AC:H), and no public exploit identified at time of analysis. A vendor patch is available per IBM advisory node/7288641, so organizations running FTM on OpenShift should treat this as a priority patch action for their FTM estate.

Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated quantity value to a vulnerable feature, causing an out-of-bounds write (CWE-787) that can lead to arbitrary code execution. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis; a vendor patch is available via IBM support node 7288641.

Double-free memory corruption in the lwIP (Lightweight IP) stack's API layer lets an unauthenticated attacker on an adjacent network segment crash or corrupt memory on embedded devices and firmware that link lwIP, with confidentiality, integrity, and availability all assessed as high impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack requires the attacker to already sit on the same or an adjacent L2 segment rather than the open internet, but needs no credentials or user interaction; successful exploitation can cause a denial of service and, depending on the target's heap hardening and allocator behavior, may extend to code execution, though reliable RCE on embedded targets is constrained by the difficulty of exploiting double-free conditions. No public exploit is identified at time of analysis, this CVE is not in CISA KEV, and no fixed version is published in the referenced sources, so mitigation currently rests on network segmentation rather than patching.

An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates the MQTT broker that a device connects to corrupt heap/stack memory and potentially achieve full code execution on that device. Only devices built with lwIP's optional MQTT client compiled in are exposed, and because MQTT connections are client-initiated the device is not directly reachable inbound: the attacker must operate a malicious broker, compromise the legitimate broker, or hold a man-in-the-middle position on the client-to-broker path (feasible where TLS is absent or certificate validation is disabled). No authentication or user interaction is required once that broker-side position is achieved, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N) presents this as trivially exploitable, whereas the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the significant broker-control/MITM prerequisite.

Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local attack (CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) requires user interaction and is not known to be actively exploited; no public exploit code has been identified at time of analysis. The flaw affects the application's file parsing logic and could lead to full compromise of confidentiality, integrity, and availability for the current user.

An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file in the application. The flaw is triggered during parsing of a malicious asset, so exploitation is local and requires user interaction: there is no network-reachable or drive-by path, and no public exploit code has been identified at time of analysis. With a CVSS base of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and no CISA KEV listing, this is a genuine but lower-priority-than-the-headline-number memory-corruption bug whose real-world impact is bounded by the privileges of the user who opens the file.

Opening a maliciously crafted file in Adobe Substance 3D Modeler can trigger a stack-based buffer overflow that lets an attacker execute arbitrary code in the context of the current user. The flaw is client-side and local in nature - there is no network-facing exposure - so exploitation depends on social engineering to convince a victim to open a poisoned file, and any code that runs inherits only that user's privileges (no privilege escalation). The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) matches that assessment: high confidentiality and integrity impact, but gated behind the requirement that the user opens the file; no public exploit code or confirmed active exploitation was identified at time of analysis.

Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write during file parsing, allowing an attacker to corrupt memory and execute arbitrary code under the privileges of the user running the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no privileges are required (PR:N), but exploitation is gated by mandatory user interaction - the victim must open the hostile file - and the impact is confined to the current user's session rather than escalating to SYSTEM or root. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so risk is limited to environments where users routinely open untrusted 3D asset files; Adobe has published vendor guidance in advisory APSB26-155.

Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Adobe rates the flaw 7.8 (HIGH) under CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local, client-side vector that requires user interaction rather than any network-facing or service exposure, with PR:N simply meaning no application authentication is needed while social engineering remains a prerequisite. No public exploit code or confirmed active exploitation was identified from the available intelligence at time of analysis, and the affected version range is unspecified in the source data, so any deployed Adobe Bridge build should be assumed potentially vulnerable until the vendor advisory is reconciled against the installed release.

Opening a crafted file in Adobe Bridge can trigger a heap-based buffer overflow that results in arbitrary code execution with the privileges of the user running Bridge (CVE-2026-75649, CVSS 7.8). The attack is local-host only and depends on user interaction - a victim must open an attacker-supplied malicious file - so it cannot be triggered remotely or automatically, and code executes in the current user's context with no privilege escalation (AV:L/PR:N/UI:R/S:U). At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, but because the advisory is vendor-published and the flaw is a memory-corruption RCE class, it should be treated as a genuine but conditional risk requiring social engineering to deliver.

Stack-based buffer overflow in Adobe Bridge lets a crafted file achieve arbitrary code execution with the privileges of the user who opens it (CVSS 7.8, CWE-121). The attack is local and requires user interaction - an attacker must deliver a malicious file and convince the victim to open it in Bridge (AV:L/AC:L/PR:N/UI:R/S:U), after which code runs in the current user's context without privilege escalation. Impact is limited by the strong social-engineering and delivery prerequisites, and no public exploit identified at time of analysis; risk is concentrated in users who routinely open files from untrusted or external sources.

Heap-based buffer overflow in Adobe Bridge lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning the attacker needs no prior privileges but must rely on social engineering to get the target to open a malicious file locally; successful exploitation yields full confidentiality, integrity, and availability impact within the user's own security context, with no privilege escalation to system level. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but non-urgent priority that should be handled through routine vendor patching; Adobe has published an advisory (APSB26-148) with fixed builds.

Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing memory corruption that may lead to arbitrary code execution in the context of the current user. Only systems with Bridge installed where users routinely open untrusted asset files are exposed; the vector is local (AV:L) with mandatory user interaction (UI:R), so there is no unattended or remotely reachable attack path and no privilege escalation beyond the logged-in user (S:U). Adobe self-reported the flaw in advisory APSB26-148 and rates it CVSS 3.1 7.8 HIGH; no public exploit code was identified at time of analysis and there is no KEV status confirming active exploitation.

Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).

Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.

Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.

Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.

Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.

Integer overflow combined with improper access control in the core libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.0 6.1.x branch) allows manipulation of shared resources, giving an attacker high impact to confidentiality, integrity, and availability of the affected host. Exploitation is not remote: it requires local access to a host running the Connext core libraries plus an existing low-privileged authenticated context, and the trigger conditions are hard to control (high attack complexity), so this is realistically a post-compromise privilege/resource escalation on DDS-participant hosts rather than a remotely reachable flaw. No CISA KEV listing and no public exploit code were identified for this issue at time of analysis. This is a genuine but access-gated issue, not a drop-everything remote emergency.

Heap-based memory corruption in RTI Connext Professional Core Libraries (7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1, 6.0, 5.3, and 5.2.3 branches) lets unauthenticated remote attackers who can reach a DDS domain corrupt heap memory by sending crafted RTPS/DDS traffic, yielding high integrity and availability impact with no confidentiality exposure. No public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), though the CVSS 4.0 AT:P metric indicates exploitation depends on a specific attack precondition such as a particular message state or sequence. Risk is concentrated in environments where DDS traffic is reachable from untrusted network positions rather than in isolated OT, robotics, or simulation segments.

A stack-based buffer overflow in the RTI Connext Professional Core Libraries lets a remote, unauthenticated attacker corrupt memory by sending a crafted message to a reachable Connext/DDS endpoint, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates the result as high impact across confidentiality, integrity, and availability with scope change. Affected builds are Connext Professional 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the legacy 6.1.0, 6.0.0, 5.3.0, 5.2.0, and 4.3x branches before their respective fixed releases; systems already on 7.7.0.1 or 7.3.1.6 (or later fixed builds) are not exploitable. The CVE carries a CVSS 4.0 base score of 10.0, and there is no public exploit identified at time of analysis, although the real-world exposure is bounded by the fact that DDS deployments are commonly placed on segmented or isolated real-time data-bus networks rather than the public internet.

Notepad++ installations prior to 8.9.8 crash when a local attacker can control the -settingsDir= command-line argument and points it at an abnormally long directory path. When Notepad++ subsequently saves its session, NppParameters::writeSession copies the derived session path into a fixed MAX_PATH stack buffer with unbounded wcscpy/wcscat calls and appends the session-backup suffix, overflowing the buffer; on protected release builds the stack canary halts the process, producing a denial of service rather than exploitable code execution. Exploitation requires local influence over launch arguments (for example a malicious shortcut or portable install) plus the victim actually launching Notepad++ and reaching a session-save, so default installations using normal-length settings directories are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's CVSS of 7.8 overstates impact given the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).

Loading a crafted Notepad++ plugin that reports more than 30 external lexers can overflow a 30-element stack array inside PluginsManager::loadPluginFromPath(), corrupting adjacent control data and potentially yielding arbitrary code execution in the Notepad++ process; the flaw affects all releases prior to 8.9.8. The attack is local and requires user interaction (the victim must install and load the malicious native plugin DLL), and because any loaded native plugin already runs in-process with full editor privileges, the incremental risk over simply distributing malicious plugin code is minimal - no public exploit identified at time of analysis, and the issue is not reachable remotely or through opened documents. Vendor-released patch: 8.9.8 (CVSS 8.6 base score; our assessment keeps the same 8.6 but treats scope as Unchanged rather than Changed).

An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console management devices lets a user who can reach the terminal or CLI interface invoke an undocumented 'mfc eeprom write' command and supply oversized input that overflows a fixed stack buffer before the data is handed to a system() call, potentially yielding arbitrary code execution with full loss of confidentiality, integrity and availability on the device and on serial-attached downstream equipment. The flaw is scored 9.4 (CVSS 4.0, PR:L, scope-changed downstream impact) and requires authentication as any user, including low-privilege accounts, so exposure depends on whether the management interface is network-reachable and on credential strength. Vendor firmware fixes are available for SLC8000 (9.7.0.2), EMG8500 (9.7.0.1) and EMG7500 (9.7.0.1); no public exploit code was identified at time of analysis, though the undocumented command has now been publicly documented by VulnCheck and revrb.net, and SLB882/SLCx-03/SLCx-02 have no vendor patch.

Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers allows an attacker who can reach the terminal/CLI management interface and authenticate with any low-privilege account to trigger a stack-based buffer overflow by invoking the undocumented mfc eeprom read command with oversized input; successful exploitation can potentially achieve arbitrary code execution and complete loss of confidentiality, integrity, and availability, with potential impact to downstream serial-attached devices. Vendor-released patches exist for SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1, but no patch was identified for SLB882, SLCx-03, or SLCx-02; no public exploit identified at time of analysis, and real-world urgency is tempered by the authentication requirement and niche console-server deployment. This is consistent with the independent CVSS:3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and the CVSS 4.0 score of 9.4.

Remote code execution affects F5 BIG-IP systems that terminate traffic on a virtual server configured with both an APM (Access Policy Manager) access policy and an OAuth profile, where crafted malicious traffic can trigger a heap-based buffer overflow in the data plane. The flaw is remotely reachable, unauthenticated and low complexity per the vendor's CVSS 4.0 base score of 9.3, and the independent assessment confirms full confidentiality, integrity and availability impact (C:H/I:H/A:H) with no control-plane exposure; Appliance mode does not mitigate it. Exploitability is sharply limited by configuration - instances without APM or without an OAuth profile bound to a virtual server are not affected - and no public exploit code was identified at time of analysis, though the combination of unauthenticated RCE and a widely deployed enterprise appliance makes prompt hotfix deployment the priority.

Integer overflow in libstdc++ within Red Hat Hardened Images can cause undersized memory allocations, leading to memory corruption or application instability when a consuming application passes an attacker-controllable large size to the C++ new or new[] operator. Exploitation requires a specific application input path that triggers CWE-190 and an exploitable heap layout, as reflected in the High severity (CVSS 7.7, AC:H) assigned by Red Hat; the flaw is not exploitable against libstdc++ in isolation. No public exploit code, proof-of-concept, or CISA KEV listing is identified in the available data.

Heap-based buffer overflow in libslirp's DHCPv6 and TFTP reply builders lets a malicious guest write attacker-controlled content and length past the end of the host-side reply buffer, causing host process crashes (denial of service) and potentially arbitrary code execution in the host. The flaw only manifests when the host interface is configured with a small, non-default MTU - the default MTU is explicitly unaffected - and requires the guest to reach libslirp's built-in DHCPv6 or TFTP service, which makes this a guest-to-host escape surface for QEMU user networking and slirp4netns rootless containers. Red Hat Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4 ship affected builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector is unauthenticated (PR:N) but high complexity (AC:H) because of the configuration prerequisite.

A one-byte heap buffer over-read in flatcc (commit 4c3b999e) allows an attacker to crash the schema compiler by supplying a malicious FlatBuffers schema that is exactly the length of the input buffer and ends with an unterminated quotation mark. The flaw requires local access and user interaction to feed the crafted schema into the parser, resulting in a single-process denial of service with no code execution or data disclosure. Publicly available exploit code exists, but the issue is not known to be actively exploited (not in CISA KEV); EPSS is 0.22% (13th percentile), indicating low predicted exploitation activity.

Denial of service in YARA 4.5.8 occurs when libyara deserializes a crafted compiled rule file (.yrc): malformed external-variable pointers or an out-of-range type field are not validated in the yr_rules_load/yr_rules_from_arena path, resulting in an invalid free in yr_rules_destroy() or a wild pointer dereference in yr_object_create(). Only deployments that load compiled rules from untrusted or third-party sources are exposed, since the assessed vector requires a user or process to actively load the file (UI:R) and no authentication (PR:N); the realistic outcome is a process crash rather than code execution (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and the issue is not confirmed actively exploited (CISA KEV).

Supplying a FlatBuffers schema whose exact-length buffer terminates on a digit character pushes flatcc's schema lexer one byte past the end of the input, producing a single-byte heap over-read that crashes the process (denial of service). The defect lives in external/lex/luthor.c at flatcc commit 4c3b999e and requires the application to hand attacker-controlled schema text to lex(); in typical build-time and CI usage that input is local, so unauthenticated remote triggering only applies to services that compile or lex untrusted schemas at runtime (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:A:H). Impact is confined to availability - no memory write, no code execution and no data disclosure - and no public exploit identified at time of analysis.

A crafted, attacker-controlled serialized graph payload processed by FalkorDB 4.20.1 through 4.20.4 overflows a buffer in the GraphBLAS matrix decoder (_Decode_GrB_Matrix in /v19/decode_matrix.c), crashing the Redis module process and denying service to the instance. Reaching the flaw requires an authenticated network connection to the FalkorDB/Redis port (CVSS PR:L) plus the ability to submit matrix data into the decode/restore path; no user interaction is needed, and the confirmed outcome is a process-crash DoS rather than code execution or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-published CVSS 8.8 (C:H/I:H/A:H) overstates impact relative to the availability-only assessment.

A crafted graph query submitted to FalkorDB (Redis module) versions 4.20.1 through 4.20.4 drives an out-of-bounds read in the node_token_count/relation_token_count code path, crashing the module and the Redis process that hosts it - a purely availability-impacting denial of service with no data exposure or code execution. The flaw is network reachable and low complexity; per our independent assessment the practical authentication requirement depends on the deployment, since exploitation is effectively unauthenticated when Redis is exposed without requirepass or ACLs, but requires an attacker to already hold valid query privileges wherever Redis authentication or ACLs are enforced. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and impact is confined to service availability (base 7.5, NVD vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

A stack overflow in the _ValidateUnion_Clauses routine of FalkorDB (a Redis graph module) versions 4.20.1 through 4.20.4 lets a crafted graph query containing a malicious UNION clause crash the database process, producing a denial of service. Per the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) the flaw is network-reachable, low-complexity, and requires no privileges or user interaction, with impact confined to availability - no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation nonetheless requires network reachability to the FalkorDB/Redis endpoint, and in hardened deployments with Redis AUTH or ACLs the PR:N assumption may not hold in practice.

A heap-based buffer overflow (CWE-122) in the IOCTL handler (sub_140001000) of mtdispkm64.sys, the kernel-mode display driver shipped with the Moore Threads MTT S80 GPU driver package up to version 340.150, lets a local low-privileged user who can open a handle to the driver's device object supply a malformed IOCTL request and corrupt kernel pool memory, potentially achieving elevation to SYSTEM. The flaw is not remotely reachable (AV:L, PR:L per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, rated 9.3), and exploitation is confined to Windows hosts that actually have this niche GPU driver installed and loaded. There is no vendor patch because Moore Threads did not respond to the disclosure, and no public exploit code has been identified at time of analysis.

Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread that holds access to the Intel time-aware GPIO (TGPIO) device object to perform two uncontrolled 8-byte supervisor-mode writes to attacker-chosen kernel addresses via the tgpio_pin_read_ts_ec() syscall. The syscall's verification handler omitted the K_SYSCALL_MEMORY_WRITE() check that the sibling handlers in the same file already perform, converting a benign timestamp read-back into a write-what-where primitive that can corrupt kernel data structures, escalate the calling thread to supervisor privilege, or crash the system. Exposed builds are narrow: CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y must both be set, and because the affected source file failed to compile from v3.6.0 until after it was repaired past v4.4.0, the realistically exposed population is v3.5.0 builds plus downstream trees that locally patched that build breakage; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though it is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Stack-based buffer overflow in Fluent Bit's out_forward Secure Forward plugin (versions 0.11.0 through releases prior to 5.0.8) lets an attacker who controls or can impersonate the configured forwarding destination overwrite stack memory while Fluent Bit processes the handshake PONG response. The vulnerable path is only reachable when the out_forward output plugin is configured in Secure Forward mode with Shared_Key or Empty_Shared_Key - not the default output configuration - and the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) plus the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) both characterize it as an unauthenticated network attack that depends on specific deployment preconditions. Impact ranges from reliable process termination on builds compiled with a stack canary to full remote code execution as the Fluent Bit process user on builds lacking canary protection or where a memory-disclosure primitive exists; the opt-in --supervisor mode with fork-only respawns further weakens hardened builds by preserving canary and address layout across restarts. No public exploit code has been identified at time of analysis, and the issue is fixed in version 5.0.8.

Heap-based buffer overflow in X.Org libXrender before 0.9.13 allows a malicious or compromised X server to inject and execute arbitrary code in attached X11 clients via a crafted response to the RenderQueryPictFormats request. This is a reverse-direction attack where the victim must actively connect a vulnerable X11 client (linked against libXrender < 0.9.13) to an attacker-controlled or hijacked X server - typical exposure is via SSH X11 forwarding to an untrusted host or a remote DISPLAY connection; local trusted X servers are not affected. No public exploit code has been identified at time of analysis, and exploitation is non-trivial (AC:H) with no attacker authentication required (PR:N), but an upstream fix is available and the CVE description identifies 0.9.13 as the fixed version boundary.

Heap-based buffer overflow in libX11 before 1.8.14 allows a malicious or compromised X server to corrupt memory in connecting X11 clients via a crafted XkbGetMap reply that overflows the key_sym_map. This client-side vulnerability has an inverted threat model: the attacker must control the X server the victim connects to, with exploitation requiring user interaction (UI:R) and high attack complexity (AC:H). CVSS 3.1 score is 7.5 High; no public exploit code has been identified at time of analysis.

Local privilege escalation in BioStar BIOS Update Utility 1.9.7.3 enables a low-privileged local attacker to gain kernel-level code execution on Windows via a write-what-where condition in the BSMEM64_W10.sys driver. The driver's IOCTL handler (sub_110BC) fails to validate user-supplied PhysicalAddress and Size parameters, resulting in arbitrary physical memory writes. Publicly available exploit code exists, and the vendor has not responded to disclosure, leaving no official fix at time of analysis.

Buffer overflow in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an authenticated, low-privileged attacker who can reach the device's management interface to corrupt memory through the wan_num argument processed by vlan_load_form_uci in /usr/bin/routerd, with high impact to confidentiality, integrity and availability. Publicly available exploit code exists, and the researcher published the details after the vendor did not respond to early notification; no CISA KEV listing or EPSS score was supplied at time of analysis. Exploitation is gated by a valid credential/session and by exposure of the configuration handler, which on consumer and SMB routers is normally LAN-side by default, and requires no user interaction.

Authenticated buffer overflow in the Netcore NBR200V2 router's management daemon (/usr/bin/routerd) allows a low-privilege logged-in user to corrupt memory and potentially achieve code execution or a denial of service by supplying a manipulated vlan_wanX.ports argument to the WAN VLAN reconfiguration function wan_config_set_vlan. Only firmware build 1.3.241127.071246 has been confirmed affected, and publicly available exploit code exists; there is no confirmed actively exploited (CISA KEV) status and no vendor patch, as Netcore did not respond to the disclosure. This is a classic high-CVSS-but-modest-real-risk embedded-router flaw: it requires an authenticated session (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector), the specific WAN VLAN reconfiguration code path must be exercised, and the affected management interface is typically LAN-side rather than internet-facing, which constrains realistic remote reach.

Pre-authentication stack-based buffer overflow in the D-Link DIR-868L router running firmware 2.01b05 allows remote attackers to corrupt memory by sending crafted values in the id or password parameters to /webfa_authentication.cgi, potentially leading to crash or arbitrary code execution on the device. The attack requires only network reachability to the router's HTTP management interface, with no authentication or user interaction (PR:N/UI:N per both the vendor-supplied CVSS 4.0 vector and our independent CVSS 3.1 assessment). Publicly available exploit code exists - a proof-of-concept crash script (poc_crash.py) published on GitHub - but there is no confirmed actively exploited (CISA KEV) status, and the practical attack surface is limited because the web admin interface is typically LAN-only by default, with WAN-side exploitation requiring remote management to be enabled or the device to be internet-exposed; the CVSS 4.0 score of 10.0 conflicts sharply with the realistically constrained exposure and crash-only nature of the published PoC, so the finding warrants caution rather than alarm.

An unauthenticated stack-based buffer overflow in the web management interface of the Comfast CF-N1-S (firmware 2.6.0.1) allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution or crash the device by sending a crafted request to the /cgi-bin/mbox-config CGI endpoint. The flaw resides in the get_css_path_from_uri function, which fails to bound-check attacker-supplied input before copying it onto the stack; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact across both the vulnerable system and subsequent systems) reflects a maximum 10.0 score, and our independent reassessment under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) likewise rates it critical. Publicly available exploit code exists (a proof-of-concept was disclosed via a public GitHub issue referenced by VulDB), though there is no confirmed active exploitation (no CISA KEV listing); practical exploitation is constrained by whether the management panel is reachable, since these devices are typically deployed behind a LAN, and reliable code execution versus a simple crash depends on the target's memory-protection configuration.

A stack-based buffer overflow in the TOTOLINK A3002MU wireless router (firmware Hh-B20211125.1046) allows remote attackers to corrupt memory through the 'submit-url' argument handled by the formWlWds function at /boafrm/formWlWds, with the CVSS 4.0 vector scoring 9.3 and indicating no authentication or user interaction prerequisite (PR:N/UI:N), though the independent assessment notes the endpoint's pre-authentication status is not explicitly confirmed by the description. Impact is potentially full compromise of confidentiality, integrity, and availability on the device, but practical success depends on network reachability to the Boa web management interface, the specific firmware build, and the difficulty of converting an embedded-MIPS stack overflow into reliable code execution rather than a simple crash. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.

Buffer overflow in the TOTOLINK A3002MU router (firmware Hh-B20211125.1046) lets remote attackers corrupt memory by sending a crafted submit-url value to the /boafrm/formWlEncrypt endpoint, with the vendor's CVSS 4.0 vector rated 9.3 and full confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The CVSS 4.0 vector specifies PR:N and UI:N, meaning the attack is unauthenticated and requires no user interaction, and publicly available exploit code exists, though no confirmed active exploitation has been reported (no CISA KEV listing). The dominant practical gating factor is exposure of the device's boa-based HTTP management interface, which on most SOHO deployments is reachable only from the LAN, narrowing the threat to local or adjacent-network attackers unless remote administration is enabled.

A buffer overflow in TOTOLINK A3002MU routers running firmware Hh-B20211125.1046 lets an authenticated remote attacker corrupt memory by sending an oversized submit-url value to the formWlAc handler at /boafrm/formWlAc, potentially gaining full control over the device's confidentiality, integrity and availability. Publicly available exploit code exists - a proof-of-concept write-up is published on GitHub and the flaw is documented by VulDB - but there is no evidence of confirmed active exploitation (CISA KEV). Multiple signals align to a moderate-to-high real-world risk, with the practical prerequisite being valid credentials or an active admin session and a management interface reachable from the attacker's network.

Authenticated buffer overflow in the web management interface of the TOTOLINK A3002MU router (firmware build Hh-B20211125.1046) lets an attacker who already holds a valid management session corrupt memory via an oversized 'webpage' argument submitted to /boafrm/formSchedule, with the potential for code execution and full loss of confidentiality, integrity, and availability. The reporting source rates it 8.6 (CVSS 4.0), and publicly available exploit code exists, but there is no confirmed active exploitation and the flaw is not in CISA KEV. In practice this is a genuine but moderate-priority issue: the CVSS vector's PR:L and the device's normally LAN-only management plane mean the attacker needs authenticated access reachable to the router's admin interface, so risk rises sharply only where remote/WAN administration or default credentials are exposed.

Out-of-bounds heap read and write in FluidSynth's MIDI player channel-tracking logic corrupts memory whenever the synth.midi-channels setting is configured above its default of 16, letting a local user who can influence that configuration crash the synthesizer and potentially achieve memory corruption with confidentiality, integrity and availability impact in the playing process. All releases from 2.2.4 up to but not including 2.5.6 are affected; the unsafe state is created by configuration alone plus ordinary playback, so no specially crafted MIDI file is required. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and although the assessed CVSS 3.1 score is 7.8 High (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H), the real-world risk is materially lower because default installations that leave synth.midi-channels at 16 never reach the vulnerable path.

Out-of-bounds reads in FluidSynth 2.5.0 through 2.5.5 can be triggered when the process loads and renders an attacker-controlled DLS soundfont, allowing memory disclosure and denial of service. Only builds compiled with the CMake option enable-native-dls enabled expose the vulnerable loader in src/sfloader/fluid_dls.cpp; builds with that option set to OFF are unaffected. The vendor rates this 8.0 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H), while independent assessment narrows the impact to confidentiality and availability (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) because the crafted file must reach the process locally and no public exploit code has been identified at time of analysis. A vendor-released fix is available in version 2.5.6.