Buffer Overflow

Out-of-bounds heap write in FluidSynth's command handler lets an attacker supply an out-of-range channel argument to the pitch_bend_range command, which is written through the selected synth channel without bounds checking. The worst-case exposure is unauthenticated remote code execution or denial of service (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) when FluidSynth runs as a TCP command server via new_fluid_server() or 'fluidsynth -s'; absent that network mode, the flaw is only locally reachable through malicious commands fed to the interactive shell on standard input, and applications that embed the library without the shell, command handler, or TCP server are unaffected. The vendor has released a fix in FluidSynth 2.5.6 (spanning affected releases from 1.1.2); no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).

Heap-based buffer overflow in the IBM MQ C client shipped with IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 lets a remote attacker who controls the queue manager's responses crash the client process or potentially execute arbitrary code in its context (CVSS 3.1 base 8.1). The flaw is triggered when the client requests AMS (Advanced Message Security) policy data and the client fails to properly validate the returned queue manager response; exploitation is unauthenticated from the client side (PR:N) but requires the attacker to operate a malicious or compromised queue manager or to man-in-the-middle the client-to-queue-manager channel, which is why the vector carries AC:H. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.

Improper validation of message header offset values in IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 allows an authenticated MQ user with network reach to an affected queue manager to trigger an out-of-bounds read, which can leak queue manager memory (high confidentiality impact) and crash the broker (high availability impact), yielding a CVSS 3.1 score of 8.1. Exploitation requires valid credentials - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - but no user interaction, and the requirement for authentication rules out anonymous abuse while the flaw is confined to the HPE NonStop platform port rather than all MQ deployments. No public exploit identified at time of analysis; a vendor patch is referenced in IBM's advisory.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 contain a heap-based buffer overflow (CWE-122) that is triggered during queue manager startup when improperly validated cluster migration data is processed. The flaw is exploitable only by an authenticated attacker who can supply crafted migration data to a queue manager participating in MQ clustering, and the dependable outcome is a denial of service (queue manager startup failure or crash), with arbitrary code execution considered only potentially achievable. Independent assessment rates the realistic impact lower than the vendor's 7.5 score (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), and there is confirmed no public exploit code and no CISA KEV listing - no public exploit identified at time of analysis. A vendor patch is available via IBM support page node 7287705.

An out-of-bounds read in Osmocom libsmpp34 allows remote attackers to disclose adjacent process memory when a crafted SMPP 3.4 PDU is passed to the smpp34_unpack() parser. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) describes an unauthenticated, low-complexity network-triggerable read with high confidentiality impact and no integrity or availability impact, meaning the practical effect is memory disclosure and potentially a crash rather than the broader 'memory corruption' implied by the description text. Risk is tempered by the library's niche deployment as telecom SMS/SMPP middleware, a low EPSS of 0.16% (5th percentile), and CISA SSVC rating of no known exploitation; no public exploit code was identified at time of analysis. A vendor patch exists, and the fixed boundary identified in EUVD advisory data is version 1.14.5.

Remote denial of service in Osmocom osmo-bsc 1.0.1 through 1.14.1: a heap-based buffer overflow in ipaccess_proxy_read_msg() is triggered when a crafted IPA frame carries an attacker-controlled length value that is used without adequate validation against the actual buffer size. The issue is remotely reachable and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) from any host able to talk to an osmo-bsc instance with the ipaccess proxy component deployed, and the assessed impact is availability-only (C:N/I:N/A:H), meaning a successful trigger corrupts heap memory and crashes the process. There is no public exploit identified at time of analysis and EPSS is a low 0.14% (4th percentile), consistent with the deployment reality that BSC signaling paths such as the IPA/A-bis proxy are normally confined to segmented, non-public operator networks.

Local privilege escalation in the virtio-win Viosock (vsock) paravirtualized driver, builds mm210 through mm319, lets an attacker who already has low-privilege code execution inside a Windows guest corrupt kernel memory and escalate to SYSTEM. The driver's IOCTL_SELECT handler adds three attacker-controlled descriptor counts with 32-bit arithmetic, so an integer-wrapped total passes the FD_SETSIZE bounds check while an individual fd_count remains far above the expected limit; the subsequent copy routine then walks the unchecked count and writes past the NonPagedPool-allocated pPkt->Fds array. Exploitation is local only (AV:L) and requires a low-privileged foothold (PR:L) with no user interaction; no public exploit code was identified at time of analysis, and the vendor fixed the issue in build mm320 via commit c6bef93d7909584bbda4e5c87603ea175825f342.

Remote unauthenticated denial of service affects NanoMQ MQTT brokers running versions earlier than 0.24.14, where a crafted MQTT v5 SUBSCRIBE packet triggers a heap out-of-bounds read in the broker receive path and can crash the broker process. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H): no confidentiality or integrity effect was confirmed, and the assessed vector carries PR:N, so exploitation is possible without credentials wherever anonymous MQTT access is enabled, though any authentication or ACL gate that requires a valid client before SUBSCRIBE is processed limits reachability. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiting factor on a successful crash (versus a benign over-read) is heap layout, which is why AC is rated High.

Heap-based memory corruption in the IBM MQ for HPE NonStop queue manager lets an attacker who already holds a valid, low-privileged authenticated channel connection (PR:L) crash or potentially take over the broker by sending a message carrying a malformed distribution list structure, yielding the full confidentiality, integrity and availability impact reflected in the CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a heap buffer overflow (CWE-122) arising from improper validation of the multi-recipient list records embedded in an MQ message, so exploitation is network-reachable and requires no user interaction, but it is not reachable pre-authentication or against a default queue manager configuration. IBM has published a vendor patch and no public exploit code or evidence of active exploitation was identified at time of analysis.

IBM MQ queue managers that process XA (X/Open distributed) transactions are vulnerable to a memory-corruption buffer overflow triggered when a malformed XA transaction identifier (XID) is parsed, allowing an authenticated attacker with network access to crash the queue manager and potentially execute arbitrary code in its context. Exploitation requires valid credentials and the ability to drive XA transaction operations over an MQ channel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 8.8), so the reliably achievable outcome is denial of service while code execution remains a potential, not guaranteed, consequence. There is no public exploit identified at time of analysis and no confirmed active exploitation, but a vendor patch is available and the low attack complexity combined with the complete loss of confidentiality, integrity and availability impact makes prompt remediation important.

Heap buffer underflow in IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 allows an authenticated remote attacker to crash or destabilize the queue manager, and potentially to execute arbitrary code, by submitting a crafted multi-segment message that is reassembled during processing. The dependable outcome is denial of service: reliable code execution is not confirmed, and exploitation requires valid low-privilege credentials (PR:L) plus access to a channel or queue that accepts submitted messages. There is no public exploit identified at time of analysis and the flaw has not been added to CISA KEV; urgency is real but constrained because only the specialized HPE NonStop build is affected, not general IBM MQ distributions.

Heap-based out-of-bounds write in libheif prior to 1.23.2 lets an attacker who can supply an independently constructed tile image to the uncompressed-codec tiled encoding path corrupt memory past the heap output buffer. The flaw is only reachable when the library is built with WITH_UNCOMPRESSED_CODEC enabled and the host application uses the tiled writing API (heif_context_add_image_tile), which makes the encoder encode rather than decode attacker-influenced data; because that path is an encoder-side, build-optional feature requiring a specific application design, the vendor's AC:H rating is appropriate. CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) with high integrity and availability impact but no confidentiality impact, and no public exploit code or active exploitation has been identified at time of analysis; a vendor fix is available in 1.23.2.

A pre-authentication heap buffer overflow in IBM MQ Appliance protocol message processing lets a remote, unauthenticated attacker crash the appliance (denial of service) or potentially execute arbitrary code in the context of the MQ appliance firmware. Only network reachability to the appliance's protocol message listener is required - no credentials, session, or user interaction - and the vendor rates this 10.0 with a scope change, while our independent assessment keeps the same base metrics but scores scope as unchanged (S:U) because the overflow occurs in the MQ process itself rather than crossing a security boundary. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), but the combination of a CVSS 10.0, zero-click pre-auth reachability, and confirmed code-execution potential makes this a genuine top-priority vulnerability rather than a high-CVSS-but-low-real-risk case; an IBM vendor advisory with a patch is available.

Heap corruption in IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 allows an authenticated remote user with a valid MQ session to crash the queue manager via a crafted MQINQ inquire request, and the same integer-overflow defect in request validation creates the potential for privilege escalation under specific memory-layout conditions. The issue is rated 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning credentials are required and the overflow is non-trivial to trigger reliably; there is no public exploit code and no public exploit identified at time of analysis, and IBM has published a vendor fix. Risk is further bounded because exploitation is confined to the specialized HPE NonStop platform running the affected 8.1.0.x maintenance levels, so deployments that have applied the patched level are not exposed.

Heap-based buffer overflow in IBM MQ allows an authenticated, low-privilege attacker who can reach a queue manager to cause a denial of service or potentially escalate privileges by issuing an MQPUT operation that carries a malformed distribution header (the MQDH distribution-list header). The flaw is network-reachable, low complexity, and requires no user interaction (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the assessed impact spanning confidentiality, integrity, and availability, although reliable privilege escalation beyond a crash remains unconfirmed. No public exploit identified at time of analysis, and the vendor has published a patch advisory at IBM support node 7287778.

Heap-based out-of-bounds write in OpenImageIO before 3.1.16.0 lets remote attackers corrupt memory whenever an application linked against the library reads a crafted 1-bit contiguous CMYK TIFF, a condition that maps to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H (7.6). The flaw is reachable unauthenticated from the network perspective of the file, but exploitation is limited by the requirement that a victim open or process the malicious image (UI:R), and only that narrow PhotometricInterpretation 5 / BitsPerSample 1 / planarconfig contig code path is affected. Vendor-released patch: 3.1.16.0; no public exploit identified at time of analysis, though the upstream fix commit ships a regression test using a crafted sample (crash-cmyk-1bit.tif) that documents the exact triggering structure.

Heap out-of-bounds write in OpenImageIO's Cineon image reader (cineon.imageio) allows memory corruption when the library decodes a crafted .cin file that declares an unsupported per-channel bit depth, such as 26. Affected deployments are those running OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1, and exploitation requires that a victim or an automated pipeline actually open and parse the attacker-supplied Cineon file (CVSS vector PR:N with UI:R). The flaw is rated High (CVSS 3.1 base 8.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) and no public exploit code has been identified at time of analysis; vendor-released fixes are available in 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

Heap out-of-bounds write in OpenImageIO's Maya IFF decoder (src/iff.imageio/iffinput.cpp) lets a crafted .iff file corrupt heap memory in any application built against affected releases prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1. The trigger is a zbuffer-only tiled IFF whose Z-depth data is exposed through a 16-bit public ImageSpec while the decoder keeps a 32-bit internal pixel size, combined with a failure path that leaves m_buf partially populated so a later read_native_tile() copies half-initialized data into an undersized caller buffer sized by m_header.pixel_bytes() instead of ImageSpec::tile_bytes(true). The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) confirms no privileges are required but the attack is local and depends on a victim or pipeline opening the malicious image; no public exploit code or active exploitation has been identified at time of analysis, and risk is highest in automated render/asset pipelines that batch-process untrusted IFF files without human review.

Malformed compressed data delivered over an IBM MQ channel that has compression enabled can trigger an out-of-bounds heap write, allowing a remote attacker to crash the queue manager and, potentially, execute arbitrary code in the MQ process. The issue affects IBM MQ 9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / up to 9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / up to 9.4.5.1 CD, and 10.0.0.0, with the CVSS base of 9.8 reflecting a network-reachable, unauthenticated worst case, though our assessed vector raises attack complexity to High (AC:H) because the channel must be explicitly configured with compression and reachable by the attacker. Denial of service is the readily achievable outcome, while reliable code execution requires defeating the process's memory protections; no public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and EPSS is low at 0.37% (31st percentile).

Decoding a crafted tiled OpenEXR image with OpenImageIO releases prior to 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 can corrupt the heap, because the tiled reader copies decoded rows into the caller's buffer using a padded whole-tile stride instead of the width of the requested rectangle; affected files are those whose width is not an exact multiple of the tile width and are read as a partial edge-tile rectangle. The flaw is reachable without any privileges (PR:N) but requires the victim to open or process the malicious file (UI:R) and is scored as a local-vector bug (AV:L), yielding CVSS 7.8 with high confidentiality, integrity, and availability impact; both the classic and OpenEXR-Core readers (src/openexr.imageio/exrinput.cpp and exrinput_c.cpp) are affected. No public exploit identified at time of analysis, and vendor fixes are available in the three named release lines.

Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches allows a remote authenticated administrator to crash the device or, with carefully crafted input, potentially execute arbitrary code on the underlying operating system. Affected devices run V1 firmware before 1.2412b260707 or V2 firmware before 2.2412b260519, and exploitation requires valid administrative credentials plus network reachability to the switch's management interface; the high attack complexity means many payloads will only produce a denial of service rather than code execution. No public exploit has been identified at time of analysis, and PLANET has released fixed firmware for both branches.

Stack-based buffer overflow in the web management server of PLANET IGS-5225-8P2T4S industrial managed switches lets an authenticated remote attacker (PR:L) crash the device for a denial of service or, with greater effort, execute arbitrary code on the underlying operating system. Affected are V1 firmware before 1.2412b260707 and V2 firmware before 2.2412b260519; exploitation requires network reachability to the switch web interface, valid credentials, and high attack complexity (AC:H) to achieve reliable code execution, so a straightforward crash/DoS is the more accessible outcome. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; vendor firmware fixes are available.

Stack exhaustion in the Node.js 'braces' library (micromatch) through 3.0.3 lets unauthenticated remote attackers crash the hosting Node.js process by supplying brace patterns nested deeply enough to overflow the call stack - for example long chains of '{{{{...}}}}' kept just under the library's internal character-length limit, so length-based input validation does not block the payload. Exploitation requires an application path that forwards attacker-controlled strings into braces' recursive AST walkers (the braces(), expand(), or compile() paths referenced at parse.js L38-40, expand.js L102-105, and compile.js L49-53), such as a web parameter or filename routed through micromatch/chokidar-style globbing; the result is an uncaught RangeError that terminates the process. Per the supplied CVSS vector (PR:N/UI:N) no authentication or user interaction is needed on the vulnerable code path, and the CVSS 4.0 score of 8.7 is driven entirely by availability (VA:H) with no confidentiality or integrity impact; no public exploit code was identified at time of analysis.

Remote unauthenticated denial of service in µD3TN v0.15.0: an integer overflow (CWE-190) in the TCPCLv3 handshake processing path leads to a heap overflow that, per the reported analysis, reliably crashes the daemon. Any host able to reach a µD3TN node's TCPCLv3 listener can trigger it without credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but the impact is confined to availability - no confidentiality or integrity loss and no code execution is indicated. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation also requires the deployment to actually run TCPCLv3 rather than another convergence layer.

Privileged users inside a QEMU guest running on the Q35 machine type with the KVM accelerator can abuse the VAPIC setup hypercall (hw/i386/vapic.c) to break SMM isolation, because the code fails to verify that a writable RAM alias stays inside the option ROM window. By repositioning that alias over chipset-locked SMRAM, an attacker with root-equivalent guest access defeats D_LCK protection and injects code into System Management Mode memory, which QEMU scores as a scope-changing, total-impact compromise (CVSS 8.2). Exploitation is local to the guest with high privileges required (AV:L, PR:H, S:C), publicly available exploit code exists according to the CISA SSVC assessment, but there is no confirmed active exploitation and EPSS is low at 0.20% (10th percentile).

Pre-authentication denial of service in the Moxa TN-4500B series Ethernet switches: improper validation of the username field length during Web login processing lets a remote, unauthenticated attacker send an overly long username that overflows a buffer and crashes the authentication process. No credentials (PR:N) and no user interaction (UI:N) are required, so any TN-4500B switch whose HTTP/HTTPS management login is reachable from the attacker's network is at risk, and the vendor-supplied CVSS 4.0 vector scores it 8.8 with availability impact rated High. The exploit's practical constraint is exposure rather than complexity - switches with web management confined to an isolated OT/management VLAN are not reachable and therefore not exploitable. Realized impact is limited to a crash-driven loss of availability; no data disclosure or confirmed code execution has been demonstrated, and no public exploit code was identified at time of analysis.

Memory corruption in snappy-java through 1.1.10.8 lets an attacker terminate the JVM hosting the library: the Snappy.compress(ByteBuffer, ByteBuffer) overload writes past the end of the destination buffer when incompressible input exceeds its remaining capacity, corrupting off-heap memory. Exposure is limited to Java applications that call that specific ByteBuffer overload with attacker-influenceable, low-compressibility data and a destination buffer that was not sized using Snappy.maxCompressedLength(); code using the byte[]-based compress API or compressing only trusted data is not exposed. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 vector reports PR:N, and the independent assessment agrees with AV:N/PR:N/UI:N), but the impact is availability-only - no confidentiality or integrity loss and no code execution - and no public exploit code or confirmed active exploitation was identified at time of analysis.

Stack exhaustion in go-openapi/swag's jsonutils package before 0.27.1 allows unauthenticated remote attackers to crash any Go service that parses or serializes ordered JSON from untrusted input - most notably endpoints that accept OpenAPI specification documents or otherwise route attacker-controlled JSON through the ordered marshal/unmarshal path - by submitting a deeply nested document that recurses without any depth limit. The result is a fatal Go stack overflow that terminates the process and drops all in-flight requests; there is no data exposure or modification, so impact is confined to availability (CVSS 8.7, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VA:H). No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but exploitation requires only a single crafted request, so exposure should be treated as high for internet-facing services built on this library. The underlying defect is CWE-674 (uncontrolled recursion).

An out-of-bounds heap write in Imager::File::PNG 1.003 - and in the identical reader bundled with Imager releases before 1.035 - allows a crafted 8-bit, non-palette PNG carrying a tRNS transparency chunk to overflow the row buffer during decoding, corrupting the heap and crashing the process. The bug is reachable unauthenticated by any application that hands attacker-supplied image data to Imager->read() or the PNG reader, but the demonstrated and assessed impact is denial of service through a process crash, not confirmed remote code execution. Exploitation requires that the host application actually decode untrusted PNGs; the issue is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is low (0.18%, roughly the 7th percentile), though a vendor-released patch exists in Imager::File::PNG 1.004.

Unauthenticated remote attackers can crash or corrupt the Hamlib rigctld daemon on TCP port 4532 by sending a crafted send_raw command with a short payload terminated by CR, exploiting a one-byte out-of-bounds NUL write on the stack and an oversized memory copy that returns up to 198 bytes of uninitialized stack data. Affecting Hamlib versions before 4.7.2 under the default no-password configuration, the issue is fixed in 4.7.2. No public exploit code has been identified at time of analysis, and realistic exposure is limited to deployments that deliberately expose rigctld beyond localhost.

Heap buffer overflow in PDFium, the PDF rendering engine built into Google Chrome, allows a remote attacker to potentially execute arbitrary code inside the Chrome renderer sandbox on Windows systems running versions prior to 153.0.8010.52. Exploitation requires the victim to open an attacker-supplied crafted PDF (UI:R), so the attack is delivered via social engineering rather than direct network exploitation; no credentials are needed (PR:N) and default Chrome installations render PDFs without any special configuration. The vendor rates this High severity with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and although a vendor patch is available, no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). Because code execution is confined to the renderer sandbox, full host compromise would additionally require a separate sandbox-escape vulnerability not covered by this advisory.

Remote code execution outside the browser sandbox in Google Chrome on Android prior to 153.0.8010.52 is possible when a victim opens a crafted HTML page containing malicious WebGL content that triggers a stack-based buffer overflow. Unauthenticated remote attackers can achieve code execution in the context of the GPU/renderer process with high impact to confidentiality, integrity, and availability, though exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6, Chromium security severity Critical). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Google has released a fixed build (153.0.8010.52) and the flaw is tracked as EUVD-2026-82476 and VulDB 407131.

Heap-based buffer overflow in the TLS transport layer of the MongoDB C Driver on Windows TLS-backend builds allows the endpoint a client connects to - or an attacker able to impersonate, redirect, or man-in-the-middle that connection - to write attacker-supplied data outside the bounds of a heap allocation while the driver processes incoming encrypted traffic, causing memory corruption, disclosure of adjacent heap memory, or termination of the client process. The flaw is reachable before any application-level authentication completes, so no credentials or user interaction are needed (CVSS PR:N/UI:N), and the vendor rates it 9.2 under CVSS 4.0; however, our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the real gating factors - this is a client-side defect that only fires when the driver connects to an attacker-controlled endpoint or when the attacker can intercept or redirect the connection (AC:H, AT:P), and only in builds compiled against the Windows platform TLS backend. All C Driver releases in the affected ranges (1.24.0 through the 2.4.0 series per ENISA EUVD) are in scope, tracked as CDRIVER-6417; no public exploit code was identified at time of analysis.

Heap-based buffer overflow in the SAIL image library's PSD decoder affects versions 0.9.10 and earlier, letting a crafted PSD file corrupt heap memory, reliably crash the host process, and potentially achieve code execution. Any application that passes attacker-controlled PSD data to sail_load_from_file() or sail_load_from_memory() is exposed; the CVSS vector carries PR:N (unauthenticated against the library), but practical exploitation still requires a victim to open or process a malicious image (UI:R), so the vendor's 9.8/UI:N rating overstates real-world risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in SAIL 1.0.0.

Heap-based buffer overflow in the SAIL cross-platform image library version 0.9.10 and earlier allows an attacker who supplies a crafted color-mapped, run-length-encoded TGA file (image_type == 9) to write attacker-controlled bytes past the end of a heap pixel buffer, causing heap corruption, a reliable crash, or potential code execution. The flaw is an incomplete fix for CVE-2026-40494: the earlier pixel-count clamp limits how many pixels are written but never constrains the per-pixel write width, which is derived from an attacker-controlled header bpp value of 9 through 32 (2-4 bytes) while the destination buffer is allocated as one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED. Although the CVSS vector is AV:N/PR:N, exploitation requires the victim's application to load the malicious image through sail_load_from_file() or sail_load_from_memory(), so a user-interaction condition is inherent; no public exploit code was identified at time of analysis, and the issue is fixed in SAIL 1.0.0. Note that the vendor-published CVSS of 9.8 (UI:N) overstates exploitability relative to the independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Stack-based buffer overflow in MCC Universal Library for Linux (uldaq) 1.2.1 and earlier lets a local attacker corrupt memory inside any process that loads the library, yielding arbitrary code execution or information disclosure at that process's privilege level. Exploitation requires crafted input to reach the vulnerable parsing routine - realistically an attacker-controlled or spoofed MCC USB data-acquisition device attached to the host, or attacker-supplied data processed by an application linked against uldaq - and needs no credentials and no user interaction (CVSS 4.0 8.6; assessed CVSS 3.1 8.4-equivalent vector AV:L/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, and although impact is high, the local-only attack vector makes this a genuinely high-impact but access-constrained flaw.

Remote, unauthenticated denial of service in OpenDDS versions prior to 3.34.0: any network attacker who can reach an OpenDDS participant's RTPS/UDP endpoint can crash the node by sending a single malformed RTPS submessage, killing the DDS process and taking down every DDS entity hosted by that participant. Exploitation requires no credentials, no prior protocol handshake, and no victim interaction - the crafted length or sequence-number state simply drives the receive parser past the end of the valid data, causing a SIGSEGV in the receive thread. Impact is confined to availability (the process terminates rather than being taken over), and fixed builds are available in 3.34.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation.

Heap-based buffer overflow in rabbitmq-c, the C-language AMQP client library, affects all versions prior to 0.16.0 and is triggered when a malicious or compromised AMQP broker sends an undersized connection.tune frame_max value during the amqp_login() handshake. Because amqp_tune_connection() reallocates the outbound frame buffer using the attacker-supplied value without enforcing AMQP_FRAME_MIN_SIZE, the immediately serialized connection.tune-ok frame overflows the undersized heap allocation, producing memory corruption and likely denial of service, with code execution considered theoretically possible but not demonstrated. Exploitation requires the victim client to initiate a connection to attacker-controlled infrastructure (CVSS 7.1, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), or an on-path attacker to inject the malicious tune frame into plaintext, non-TLS AMQP traffic; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch in version 0.16.0 is available.

Out-of-bounds read and write in the Linux kernel's dm-pcache device-mapper persistent cache target, where cache segment ids decoded from on-disk cache metadata are used to index cache->segments[] without a bounds check against cache->n_segs. Because that metadata is protected only by a CRC with a fixed, publicly known seed, a local attacker who supplies the cache device in a device-mapper table load - an operation gated on CAP_SYS_ADMIN - can forge an out-of-range seg_id and force dereference and write-through of a wild pcache_cache_segment pointer in kernel context. The vendor CVSS of 7.8 overstates real-world risk given that privileged-local prerequisite; the assessed vector is AV:L/PR:H (confidentiality low, integrity low, availability high). There is no public exploit identified at time of analysis, and vendor fixes are available via upstream commits b4bf8af5e7d7db4c5e179e15017da55857761ac4 and 90c990a68460d7b5720e5634cf650eccdf0f4098, which EUVD maps to patched Linux 7.2.6 and 7.3-rc1.

An out-of-bounds stack write exists in the Linux kernel's platform/chrome cros_ec_typec driver, where cros_typec_register_partner_pdos() copies USB-C Power Delivery objects from the ChromeOS Embedded Controller's TYPEC_STATUS response into the fixed seven-entry caps_desc.pdo array without validating the accompanying source_cap_count and sink_cap_count fields. If either 8-bit count exceeds PDO_MAX_OBJECTS (7), the memcpy overruns the stack buffer (a count of 255 overruns it by roughly 1 KB) and also reads past the equally narrow EC-side arrays. Affected systems are Chromebook-class hardware running the cros_ec_typec driver, and exploitation is gated on the EC firmware reporting a count above 7 - stock ChromeOS EC firmware caps these counts, so the flaw is only reachable with non-compliant, buggy, or attacker-controlled EC firmware; no public exploit identified at time of analysis, and the vendor score of 8.4 overstates real-world risk (our assessment is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H).

A BPF verifier scalar-id tracking flaw in the Linux kernel allows a local attacker who can load eBPF programs to make the verifier believe a sign-extended stack-filled register holds a different value than it does at runtime, which can be converted into an out-of-bounds memory access. Exploitation is local and requires the privilege to load BPF programs - CAP_BPF or CAP_SYS_ADMIN, or a system where the unprivileged BPF sysctl has been left enabled (disabled by default on most modern distributions) - and the kernel must be new enough to support BPF_MEMSX sign-extending narrowing loads (roughly 6.6 / cpu=v4 and later). The verifier miscalculation is deterministic once the precise instruction pattern is built, so attack complexity is low, but no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); EPSS-style urgency therefore stems from the high confidentiality, integrity and availability impact (CVSS 7.8) rather than observed exploitation.

A heap out-of-bounds write in the Linux kernel's CXL Features subsystem (cxlctl_get_feature) lets a local user who can reach the FWCTL_RPC interface corrupt kernel heap memory by supplying a small fwctl_rpc.out_len alongside a large cxl_mbox_get_feat_in.count, causing the CXL device to write past the end of a kvzalloc()'d buffer. Only systems running kernel 6.15 or later with the CXL Features subsystem built in and a Features-capable CXL device bound are affected, and the attacker must hold a handle to the fwctl character device (/dev/fwctl) and the privileges required to use it (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, 7.8). This is a genuinely attacker-controlled out-of-bounds write rather than a probe or error-path crash, but it is not remotely reachable, no public exploit has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).

A buffer overflow in the Linux kernel's iwlwifi MEI coexistence code (iwlmei) lets a party able to inject SAP messages over the MEI bus trigger an out-of-bounds memory write by declaring a message length larger than the driver's local buffer, which the code reads without validating. Affected systems are limited to kernels built with CONFIG_IWLMEI on Intel hardware where CSME/AMT coexists with the Wi-Fi device - a non-default, enterprise-oriented configuration; standard iwlwifi deployments are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the flaw is remotely reachable only from a compromised CSME/ME firmware or equivalent MEI-side attacker, so the practical prerequisites are substantial even though the vendor score of 8.4 (AV:L/AC:L/PR:N) overstates ease of reach. Vendor-released fixes are available in 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1.

An out-of-bounds read in the Linux kernel's RDMA/rxe (Soft-RoCE) driver lets a local unprivileged user who can post work queue entries directly into a user queue pair's submission ring drive copy_data() to index past the per-WQE scatter/gather array using an attacker-controlled cur_sge value or an oversized num_sge, producing a vmalloc out-of-bounds read that can crash the kernel. Exploitation is strictly local and requires the rdma_rxe module to be loaded with an rxe device configured plus the ability to open the InfiniBand uverbs interface and create a user-space QP that posts a payload-bearing WQE - a niche, non-default configuration; kernel-created QPs already enforce the num_sge bound. There is no public exploit code or confirmed active exploitation identified at time of analysis, and the issue was reported and fixed upstream, with patched stable releases including 6.1.188, 6.6.157, 6.12.110 and 6.18.52, so this is best treated as a low-priority local denial-of-service issue with limited confidentiality exposure.

Signed integer overflow in the Linux kernel's mlx5 RDMA driver (RDMA/mlx5) lets a local user who already holds RDMA access to a Mellanox/NVIDIA ConnectX device create a user QP with a buffer smaller than the hardware will write into, producing a local out-of-bounds write and memory corruption (CVSS 3.1 base 7.8; our independent assessment scores it AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H). Only hosts exposing an mlx5 device through the verbs uAPI (for example /dev/infiniband/uverbs*) to a user with RDMA permissions are exposed; the vector is local and not network-reachable. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but vendor patches are available for all supported stable branches.

Malformed NILFS2 filesystem images can drive the Linux kernel's nilfs2 super-root block parser to read past the end of the super-root block, because the super-root inode's metadata size is trusted before nilfs_read_inode_common() validates it; the fix rejects inode sizes whose computed on-disk footprint exceeds the filesystem block size. Exploitation requires a local user to mount an attacker-supplied image (assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H), so this is not reachable by a remote, unauthenticated network attacker, and the realistic outcome is a kernel crash or a bounded kernel-memory disclosure rather than code execution or reliable data theft. nilfs2 must be compiled in or loaded, which is uncommon outside specialized storage deployments, and no public exploit identified at time of analysis or confirmed actively exploited (CISA KEV) status was found in the available intelligence.

Out-of-bounds memory access in the Linux kernel's IB/isert iSER (iSCSI-over-RDMA) target allows a remote attacker who can reach an exposed iSER portal over an RDMA fabric to trigger reads beyond a fixed-size receive descriptor, and in the immediate-data path to hand an oversized scatterlist to the SCSI backend, potentially corrupting the backing store. Affected systems are Linux targets running the isert target driver with a configured LUN/backing store; the attacker must complete login and reach the full-feature phase, then negotiate a large TargetRecvDataSegmentLength and send a PDU whose BHS-declared data-segment length exceeds the bytes actually received. Vendor-released fixes exist for the stable branches (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.3-rc1), no public exploit code has been identified at time of analysis, and the vendor CVSS of 9.1 (AV:N) is assessed as overstated because exploitation requires RDMA-fabric adjacency rather than open-internet reachability.

A pre-authentication out-of-bounds read in the Linux kernel iSER (iSCSI Extensions for RDMA) target login path lets an attacker who can reach the RDMA fabric crash the host kernel, producing a denial of service. Only hosts exporting an LIO/target-core iSCSI target over the iSER RDMA transport (RoCE, iWARP, or InfiniBand) are affected; iSCSI targets served over plain TCP are explicitly not vulnerable because that path validates the declared login length with iscsi_target_check_login_request(), while isert never calls it. The vendor rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H); our independent assessment keeps AV:N/AC:L/PR:N/UI:N but treats impact as availability-only (C:N/I:N/A:H), and no public exploit has been identified at time of analysis - though the upstream commit includes a deterministic soft-RoCE/KASAN reproducer.

An out-of-bounds read in the ath12k Qualcomm WiFi 7 driver (ath12k_wmi_process_csa_switch_count_event) can be triggered when the driver parses a WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT whose firmware-supplied num_vdevs field exceeds the actual TLV payload, or when the TLV is shorter than the fixed event struct - the missing TLV policy entry means the parse layer enforces no minimum length. Systems running affected kernels (roughly 6.3 onward) with ath12k hardware and driver loaded are exposed, and because the malformed values originate from the device firmware, practical triggering requires control of the firmware image or the host-to-firmware WMI event channel rather than a plain remote network frame. Impact is limited to memory disclosure or a kernel crash rather than code execution, no public exploit code has been identified at time of analysis, and vendor fixes are available in Linux 7.2.6 and 7.3-rc1.

Out-of-bounds reads in the Linux kernel's ath11k Qualcomm WiFi-6 driver allow a malformed WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT from device firmware to read past the bounds of a TLV payload. The flaw exists because no TLV policy entry enforces a minimum length for this event struct, and the firmware-supplied num_vdevs field is used directly as a loop bound over the vdev_ids array without validation; per the CVSS vector this is a local (AV:L) attack with no privileges required (PR:N), though the independent assessment rates it AC:H/C:L rather than the vendor's AC:L/C:H framing. Triggering it requires an affected Qualcomm ath11k adapter running a firmware image that emits an inconsistent num_vdevs value or event length - meaning a malicious or genuinely buggy firmware blob, not a remote network peer or unprivileged userspace API - and no public exploit has been identified at time of analysis. The kernel reads are limited to disclosure of adjacent memory (information leak) plus a potential denial-of-service if the out-of-bounds access faults.

Malformed coreboot firmware tables can drive the Linux kernel's coreboot_table driver into mapping and parsing memory outside its declared platform resource, producing out-of-bounds reads that disclose kernel memory and crash the system on affected coreboot-based platforms. The flaw lives entirely in the boot/probe-time firmware parsing path (drivers/firmware/google/coreboot_table.c), so it is not reachable from an ordinary unprivileged local process: an attacker must be able to supply or corrupt the coreboot table itself, via firmware reflash, a malicious or compromised firmware image, or physical access, and the vulnerable code is absent altogether on systems that do not boot coreboot firmware. No public exploit code and no confirmed active exploitation were identified at time of analysis; vendor-released fixes are available in the stable kernels 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1.

An integer overflow in the Linux kernel's AppArmor verify_tags() bounds check allows an authenticated local attacker with low privileges to trigger an out-of-bounds read by loading a crafted AppArmor policy blob, primarily causing a kernel crash and limited potential information disclosure. Reachability requires the ability to manage AppArmor policy; under the default unprivileged_userns_apparmor_policy=1 setting an unprivileged user in a matched-level nested user namespace can reach the path, otherwise CAP_MAC_ADMIN in the initial user namespace is required. The assessed vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, no public exploit was identified at time of analysis, and vendor patches exist.

A heap out-of-bounds read in the Linux kernel's NVMe-over-Fabrics target (nvmet) DH-HMAC-CHAP authentication path lets a remote attacker who can reach a fabric transport trigger reads past an allocated message buffer by sending a crafted AUTH_Send negotiate command with an undersized transfer length or oversized hash/group identifier counts. Because authentication is negotiated before any credential check, no login is needed, but exploitation requires the target to have DH-HMAC-CHAP auth explicitly enabled (opt-in, not default) on a kernel in the affected range starting at 6.0. The reliable outcome is a kernel crash or corrupted response data rather than code execution or arbitrary memory disclosure, giving the flaw a strong availability impact with limited confidentiality impact; no public exploit code was identified at time of analysis, and it is not confirmed as actively exploited.

Malformed NFC LLCP Service Name Lookup (SNL) frames can drive an out-of-bounds read in the Linux kernel's nfc_llcp_recv_snl() routine, typically resulting in a kernel crash and denial of service, with a marginal possibility of limited memory disclosure. An attacker within NFC radio proximity (adjacent, AV:A) can trigger this without authentication or user interaction, because LLCP link activation happens automatically after NFC-DEP peer discovery; systems without CONFIG_NFC or NFC hardware are not affected. Vendor-released stable fixes cover 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, and 7.2.6, and no public exploit code was identified at time of analysis.

Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem can be triggered when a victim mounts and processes a crafted or corrupted OCFS2 image whose on-disk inode sets OCFS2_ORPHANED_FL with an i_orphaned_slot value outside the mounted filesystem's valid slot range, causing ocfs2_wipe_inode() to index osb_orphan_wipes out of bounds during orphan wipe and inode eviction. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, i.e. a local, low-complexity, unauthenticated-per-vector flaw that nonetheless requires the victim to interactively mount the malicious image and, in most real deployments, to hold CAP_SYS_ADMIN to mount at all, which sharply narrows realistic exposure. Vendor patches are available in Linux 6.18.52, 7.2.6, and 7.3-rc1, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.

The Linux kernel's in-kernel SMB server, ksmbd (CONFIG_SMB_SERVER), can be driven to read up to 65535 bytes past the end of a fixed-size hash buffer during NTLM authentication, producing a KASAN-confirmed slab-out-of-bounds read and a kernel crash (denial of service) with only partial adjacent-memory disclosure. Exploitation is not achieved with a plain remote SMB packet: the oversized hash_sz value arrives in the mountd IPC login response delivered over the ksmbd generic-netlink family, so the attacker must control, spoof, or compromise that privileged userspace-to-kernel channel (normally the ksmbd.mountd daemon, reachable with CAP_NET_ADMIN-class access), which is why the assessed vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H rather than a network-vector issue. ksmbd is a non-default, opt-in feature, which materially narrows the exposed population, and no public exploit code was identified at time of analysis.

An out-of-bounds read in the Linux kernel EROFS file-system driver lets a local attacker who can supply a crafted EROFS image cause unrelated kernel memory to be copied into a user-visible page cache when a victim mounts the image and reads the crafted file. The flaw requires user interaction (UI:R) and is local only (AV:L); the vendor CVSS 3.1 base is 7.1 with Confidentiality and Availability High, while independent assessment rates availability impact Low. No public exploit code was identified at time of analysis, and fixes are available in stable kernels 6.18.52, 7.2.6, and 7.3-rc1.

Out-of-bounds DMA reads and IOMMU faults, along with silent transmission of corrupted packets, can be triggered through the transmit path of the Huawei hinic3 NIC driver in Linux kernels from roughly 6.16 onward. Per the independent assessment (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H), the issue is local-only and requires an authenticated low-privileged user who can transmit a non-linear (fragmented) skb over a hinic3 interface using a tunnel checksum-offload configuration the driver cannot offload, which forces the skb_checksum_help() software fallback, linearizes the skb, and leaves the driver building a TX descriptor from a stale fragment count. Impact is availability-dominant (IOMMU fault/panic) with limited confidentiality exposure from the out-of-bounds DMA read; no public exploit code was identified at time of analysis and CISA KEV does not list this CVE. Systems without Huawei HiNIC3 hardware are unaffected regardless of kernel version, and vendor patches are available in Linux 6.18.52, 7.2.6, and 7.3-rc1.

Integer overflow in the Linux kernel's IPVS FTP application helper (ip_vs_ftp_get_addrport()) lets an unauthenticated remote attacker who can control an FTP PASV/EPSV reply that traverses an IPVS/LVS director wrap a data-connection port or address octet, causing the helper to program the expected data connection with a truncated port or address. Only kernels built with CONFIG_IP_VS_FTP and actively load-balancing FTP are exposed - a non-default, niche configuration - and the practical impact is confined to a misconfigured or truncated data connection rather than code execution or memory corruption, so the vendor CVSS of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) overstates real-world priority, as reflected in the independent assessment (A:N). Vendor patches are available in the stable branches (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1); no public exploit code and no confirmed active exploitation were identified at the time of analysis.

An out-of-bounds read in the Linux kernel's hp-bioscfg platform driver lets a malformed PSWD_ENCODINGS ACPI package cause the parser to read past the end of the ACPI object array and hand an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(), resulting in kernel-memory disclosure or a kernel crash (the assessed vector is AV:L/AC:H/PR:H with high availability impact and limited confidentiality impact). Only systems running the hp-bioscfg driver - i.e. HP hardware whose firmware exposes the BIOS-configuration WMI/ACPI interface - are affected, and exploitation requires the attacker to control or modify the platform ACPI tables, since the index bound is only violated when firmware declares a non-zero encoding count without supplying enough string objects. The vendor-published CVSS of 7.7 depicts an unauthenticated, low-complexity local attacker, but this assessment rates the realistic path as higher-complexity and privileged because it depends on attacker-influenced firmware data; no public exploit code and no confirmed active exploitation were identified at time of analysis.

A heap out-of-bounds write in the Linux kernel's legacy in-tree NTFS driver (fs/ntfs) lets a local attacker corrupt kernel heap memory when a crafted NTFS filesystem image is mounted and subsequently triggers a directory index reparent, at which point ntfs_ir_to_ib() copies oversized index_root entries into an index_block_size allocation without a bounds check. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8) is local-only and requires the victim to mount and exercise an attacker-supplied image, and the maintainer explicitly notes that crafted-filesystem attacks fall outside the kernel threat model; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation. The real-world risk is LOW-to-MODERATE despite the High CVSS, because reach is sharply constrained by the local attack vector, the user-interaction requirement, the need for the legacy driver to be built and loaded, and the narrow reparent-only code path. Vendor-released patches are available (stable 7.2.6 and 7.3-rc1, plus the upstream commits referenced by the CVE), so exposure is largely limited to systems that still load fs/ntfs and process untrusted NTFS images.

Out-of-bounds memory corruption during early-boot ACPI MADT parsing in the Linux kernel's irqchip/gic-v5 driver (gic_acpi_parse_iaffid) can crash or corrupt kernel memory on Arm systems that use the new GIC-v5 interrupt controller and boot via ACPI. The flaw affects mainline kernels up to the fix, with vendor-released fixes landing in Linux 7.2.6 and 7.3-rc1 (commits 6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69 and 328affc639ce9873a7a0a3fd6b8339f19767529b); no public exploit code was identified at time of analysis and there is no CISA KEV listing. Although the vendor scored this 8.4 with PR:N, the realistic risk is far lower: triggering it requires GIC-v5 hardware that boots ACPI, a vulnerable kernel, and attacker control of the MADT firmware table (firmware or physical access), and the corruption occurs only during kernel initialization rather than from an unprivileged runtime process.

An off-by-one out-of-bounds write in the Linux kernel's legacy NTFS driver (fs/ntfs) allows a local user to corrupt kernel memory by mounting a crafted NTFS filesystem and reading a compressed file from it. ntfs_decompress() accepts dp_addr == dp_sb_end as a valid state, so the final symbol copy writes one byte past the destination page and leaves *dest_ofs pointing one past the sub-block end; because the page is never finalized, subsequent sub-blocks keep writing further out of bounds, producing a bounded run of writes beyond the page. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is local, requires no privileges but does require the victim to mount the image and read the offending file, and no public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical priority is moderate rather than urgent because the vulnerable code lives in the deprecated fs/ntfs driver that is frequently not built or loaded on modern systems.

A local heap out-of-bounds write exists in the Linux kernel's dm-integrity device-mapper target when a keyed sector marker is configured with a tag size smaller than the hash digest size, allowing a local actor holding some privilege to write past the end of a kmalloc'ed checksums buffer (the description cites a 4MiB discard under hmac(sha256) with tag size 16 writing 16 bytes beyond the page). It is assessed as CVSS 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting a locally reachable kernel memory-corruption primitive requiring low-level local privileges and a non-default dm-integrity configuration. Vendor fixes are available as stable-branch commits (59e6f919d77d72ec79cbf171256f2f7819737580, 9988c1c9e0d1c78391e3d8e2817beb667470c76f, dd08a645195f410f2dcaa40de379a45ce110e873) and no public exploit was identified at time of analysis, with no CISA KEV listing.

Memory corruption in BlueKitchen BTstack through 1.8.2 allows a bonded Bluetooth peer to overflow the fixed AVDTP stream-endpoint table during A2DP SEP discovery, corrupting adjacent static objects and crashing the stack or severing event delivery on the host device. The flaw is reachable only by an authenticated, already-paired peer that is within Bluetooth radio range and is participating in A2DP stream-endpoint discovery (assessed CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) - unpaired or purely network-remote attackers cannot trigger it, and no user interaction is required. Confidentiality is not affected; the practical impact is low integrity and high availability loss, making this a moderate-priority memory-safety availability bug. No public exploit code and no confirmed actively exploited status were identified at time of analysis, and a vendor patch is available.

Remote code execution as root on FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life 10.1.2r60p100 firmware is possible when an attacker can reach the management interface and submit a crafted authentication request that overflows a fixed-size stack buffer in /usr/sbin/auth_user_pass. The vendor score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact, but real-world exposure is gated: the management interface is disabled by default and must be affirmatively enabled by the customer, and WAN access control lists are recommended to restrict reachability to trusted administrative networks. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; because 10.1.2r60p100 is end-of-life, no patched firmware version has been identified, so exposure persists until the appliance is decommissioned or tightly network-isolated.

Stack-based buffer overflow in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 allows an attacker who already holds high privileges on the OMSA service to achieve remote code execution over the network. Exploitation is constrained by the CVSS PR:H prerequisite-only compromised administrative accounts, malicious insiders, or chaining from another privilege-granting flaw can trigger it-but no user interaction is required and attack complexity is low. No public exploit code or CISA KEV active exploitation is identified in the available intelligence.

Out-of-bounds reads in the Redis Open Source cluster bus packet parser (versions 7.0.0 through 8.8.1) allow an adjacent-network attacker to crash a cluster node or leak small amounts of process memory by sending a crafted PING/PONG/MEET message containing a string-carrying extension that lacks a null terminator. The cluster bus is unauthenticated by default (CVSS PR:N, AV:A), so any peer that can reach a node's cluster bus port can deliver the malformed packet; the behavior is rated CVSS 7.1 with high availability impact and low confidentiality impact. Vendor-released patch: the fix is included in Redis 8.10.0, and no public exploit code has been identified at time of analysis; non-cluster single-node deployments and Redis Software / Redis Enterprise are not affected.

Remote code execution in Dell OpenManage Server Administrator (OMSA) managed-node installations prior to 11.1.0.3: a heap-based buffer overflow (CWE-122) that an attacker holding administrator-level privileges on the OMSA service can trigger over the network without user interaction, gaining code execution on the managed host with full confidentiality, integrity, and availability impact. The flaw scores 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and affects Windows, RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 managed nodes. No public exploit code and no confirmed active exploitation were identified at time of analysis; the high-privilege prerequisite keeps this a privileged-user-to-code-execution escalation rather than a pre-authentication internet-facing exploit, with risk rising where OMSA is exposed to untrusted networks or chained after an authentication bypass such as CVE-2026-81475 in the same DSA-2026-403 bundle.

A heap-based buffer overflow in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 allows an authenticated local attacker with low privileges to corrupt process memory and escalate to full root/SYSTEM-level control of the managed node. Only hosts with the OMSA managed-node component installed and running are affected, across Windows, RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 packages. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) confirms a local elevation-of-privilege primitive requiring an existing local account but no user interaction; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory's 'network access' title does not imply an unauthenticated remote path for this CVE.

Transient denial of service affecting Qualcomm Snapdragon chipsets, where an attacker positioned on the adjacent radio network (AV:A) can send a malformed frame that is parsed while a channel is in active use, triggering a fault that disrupts availability. The flaw is an out-of-bounds read (CWE-126) in the wireless frame-parsing path and is reachable unauthenticated and without user interaction (PR:N/UI:N), though exploitation is confined to radio range and produces only a recoverable outage with no confidentiality or integrity impact (C:N/I:N). CVSS 3.1 scores it 7.4 (High) with Scope Changed (S:C), reflecting impact beyond the vulnerable radio component; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory does not enumerate specific affected chipset models. Practical exposure requires the vulnerable radio subsystem to be powered and actively using a channel.

Local memory corruption in Qualcomm Snapdragon-based devices can be triggered by a low-privileged local attacker supplying a crafted large data buffer that overflows an additive length check. Successful exploitation grants high confidentiality, integrity, and availability impact within the affected component, matching a local privilege-escalation profile rather than a remote attack primitive. No public exploit code or confirmed active exploitation was identified at time of analysis, and the advisory does not specify the vulnerable subsystem or exact chipset models.

Local information disclosure in Qualcomm Snapdragon chipsets allows a low-privileged process to read freed memory from a higher trust boundary, potentially leaking sensitive data. The vulnerability requires local access and low privileges (CVSS 7.3, AV:L/PR:L), with no user interaction or network vector. No public exploit identified at time of analysis; affected chipset SKUs and software versions require cross-referencing the Qualcomm September 2026 security bulletin.

Stack-based memory corruption in Qualcomm Snapdragon firmware allows a locally-resident, low-privileged process to overflow a fixed-size stack buffer by supplying oversized 'external source' data, yielding high confidentiality, integrity and availability impact that crosses a security boundary. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) an attacker must already hold a low-privileged foothold on the device, so this is a local privilege-escalation / code-execution primitive rather than a remotely reachable bug; no user interaction is required. No confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; applicability depends on the specific Snapdragon SoC and firmware build, which the vendor bulletin does not enumerate in the supplied data.

Out-of-bounds memory access in Qualcomm Snapdragon platform firmware allows a locally authenticated low-privileged attacker on the device to induce a transient, recoverable denial of service, with minor leakage of confidentiality and integrity. The issue (CWE-125, out-of-bounds read) is triggered when the affected component consumes unvalidated data arriving from a neighboring on-chip subsystem; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H gives a vendor score of 7.9, and the scope-change flag reflects impact that crosses from the vulnerable subsystem into other components. Exploitation requires local access with low privileges (PR:L) and no user interaction, so the 'neighboring system' wording should not be read as remote reachability. Vendor-released patch: not confirmed from the provided data; no public exploit identified at time of analysis, and no CISA KEV listing is present.

Local privilege escalation in Qualcomm Snapdragon platforms can occur when a low-privileged local process supplies an insufficiently sized user buffer to an escape handling driver flow, producing an out-of-bounds write (CWE-787). The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so an attacker who already has a foothold on the device as a low-privileged user could corrupt memory and potentially achieve code execution or elevation; authentication requirements are local low privileges per the vector, and no user interaction is required. No public exploit identified at time of analysis, and the assessed risk is a genuine local privilege-escalation issue that is not a drop-everything emergency; Qualcomm's September 2026 security bulletin is the primary advisory, though exact affected chipsets and patched versions are not enumerated in the provided data.

Memory corruption in Qualcomm Snapdragon I2C transfer request handling can allow a local low-privileged attacker to corrupt memory and potentially achieve privilege escalation or impact confidentiality, integrity, and availability by winning a race condition between memory allocation and data copying. The assessed risk is local-only and high-complexity because exploitation requires code execution on the device and repeated concurrent requests to hit the timing window, and no public exploit identified at time of analysis. Affected platforms are Qualcomm Snapdragon chipsets, with the vendor's September 2026 security bulletin providing the authoritative mapping and remediation guidance.

Transient denial of service in the Qualcomm Snapdragon WLAN stack allows an attacker within Wi-Fi radio range to knock a device's wireless link offline by sending 802.11 authentication frames carrying FILS (Fast Initial Link Setup) information elements with deliberately malformed header lengths. Devices using affected Snapdragon Wi-Fi chipsets are exposed; exploitation is unauthenticated and requires no user interaction (CVSS:3.1/PR:N/UI:N), but it is bounded by radio proximity and the resulting outage is temporary, with no confidentiality or integrity impact. The vendor score of 7.5 (HIGH) is driven entirely by availability, and no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.

Memory corruption in Qualcomm Snapdragon rear sensor IOCTL handling allows a local high-privileged attacker to execute code, tamper with data, or cause denial of service on affected devices. Exploitation requires local access and high privileges (PR:H) to invoke the rear (camera) sensor IOCTL, typically only reachable from a privileged camera HAL or system service; no user interaction is needed, but crafted parameters must be supplied to the vulnerable interface. No public exploit identified at time of analysis, and the required high privilege level narrows the practical attacker population.

Bluetooth denial of service in Qualcomm Snapdragon firmware allows an attacker within Bluetooth radio range (adjacent network, CVSS 7.4, AV:A/AC:L/PR:N/UI:N, S:C) to trigger a transient crash of the Bluetooth subsystem by supplying a crafted channel map that declares an insufficient number of used channels while adaptive frequency hopping (AFH) is fully enabled on the target. The impact is availability-only (C:N/I:N/A:H) and lasts only while the device is processing the malformed channel map; no confidentiality, integrity, code-execution, or authentication preconditions are present in the assessed vector. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, and exploitation is bounded by physical radio proximity rather than internet reachability. Affected devices are Qualcomm Snapdragon platforms identified by the wildcard CPE cpe:2.3:a:qualcomm,_inc.:snapdragon:*:*:*:*:*:*:*:* and addressed by the Qualcomm September 2026 security bulletin.

Memory corruption in the Qualcomm Snapdragon device-control handler can be triggered when multiple threads of a local, low-privilege process open the driver and issue concurrent IOCTL requests, exposing the driver to an improper-synchronization race that can corrupt memory and, in the worst case, allow code execution at the privilege level of the driver (C:H/I:H/A:H). Exploitation is not remote and is not automated: the attacker must already hold local low-privilege code execution on the affected device (AV:L, PR:L), must be able to reach the device-control handler, and must win a non-deterministic inter-thread race (AC:H; SSVC Automatable: no). Risk is currently low-to-moderate in practice - EPSS is 0.11% (1st percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis - so this is a genuine but not urgent prioritization item for OEMs and device manufacturers shipping affected Snapdragon platforms.

Local privilege escalation on Qualcomm Snapdragon devices is possible via an out-of-bounds write (CWE-787) in data-copy operations that fail to validate large offset and length values. An attacker with low privileges already executing code on the device-such as an unprivileged application-can trigger memory corruption to achieve high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published a security bulletin (September 2026) but exact patched versions are not enumerated in the available CPE data.

Memory corruption in the Qualcomm Snapdragon decode-statistics processing path allows a locally present, low-privilege attacker - typically a malicious or compromised app that already runs on the device - to trigger an out-of-bounds write by supplying an offset that is not validated against the target structure's size, potentially achieving code execution with high confidentiality and integrity impact (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is bounded: it requires an existing local foothold, targets only the Snapdragon SKUs and firmware/driver builds that embed the vulnerable routine, and reliable escalation depends on memory-layout grooming. No public exploit identified at time of analysis, and Qualcomm has published a fix through its September 2026 security bulletin, so this is a legitimate but bounded patching priority rather than an urgent remote or pre-auth risk.

Opening an attacker-crafted Affinity document in Affinity by Canva versions prior to 3.3.0 can trigger a stack-based buffer overflow that may lead to arbitrary code execution on the victim's endpoint. Exploitation is not remote or automatic: it requires the user to open the malformed document (UI:R) on a machine where Affinity is installed, and attack complexity is assessed as high (AC:H), reflecting the difficulty of turning the stack corruption into reliable code execution in the presence of modern stack and memory protections. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at the time of analysis, and the risk is genuine but not top-tier - it is confined to endpoints that handle untrusted Affinity files.

Out-of-bounds memory writes in LightGBM through 4.7.0 can be triggered when a text-format model file containing invalid child/split node references is loaded and SHAP feature-contribution prediction (pred_contrib) is subsequently run, letting the attacker control where data is written inside the leaf_depth_ buffer. The flaw is classified CWE-787 (out-of-bounds write) with a high impact on confidentiality, integrity and availability (CVSS 4.0 base 8.5; independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and exploitation is not remote: per the CVSS vector the attack is local (AV:L) and requires user interaction, meaning the victim must open a malicious model and execute the SHAP prediction path. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and environments that only load trusted, self-generated models or that never compute feature contributions are not exposed.

Denial of service in Cisco Identity Services Engine (ISE) RADIUS handling allows an unauthenticated, remote attacker to make an affected ISE node unavailable by sending a single crafted RADIUS request directly to the device (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H; CWE-119). Every ISE release from 3.2.0 through 3.5 is reported as affected, including numerous 3.2, 3.3 and 3.4 patch levels; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing). Impact is availability-only and the node recovers on its own, but in single-node deployments endpoints that have not already authenticated cannot reach the network for the duration of the outage, whereas multi-node clusters limit the blast radius.

Malformed IGMP packets sent by a network-adjacent, unauthenticated attacker can terminate the IGMP snooping agent on Arista EOS switches, causing multicast traffic to flood to all ports of the affected VLAN until the agent recovers. Because IGMP snooping is enabled by default on all VLANs in EOS, most deployments are exposed out of the box, but the attacker needs Layer 2 adjacency to a target VLAN (a compromised host, rogue device, or insider on the switched segment) rather than arbitrary internet reachability, and the impact is a bounded, self-recovering availability disruption that must be repeatedly triggered to be prolonged. No public exploit code and no confirmed active exploitation were identified at time of analysis; the realistic risk is a genuine but non-critical availability concern rather than a priority-one emergency.

Heap-based buffer overflow (CWE-122) in HP's HPLIP - the HP Linux Imaging and Printing Software stack shipped as the default printer/scanner driver on most Linux distributions - can be triggered when attacker-influenced data is processed by a vulnerable component, potentially leading to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. This is a bundled advisory covering multiple externally reported flaws across several HPLIP components, so the precise prerequisites vary per sub-vulnerability; the vendor assigns CVSS 4.0 score 9.3 (Critical) with a remote, unauthenticated, low-complexity vector, while the independent assessment is more conservative at CVSS 3.1 AV:N/AC:H/PR:N/UI:N, reflecting that the system must be running HPLIP and actually process malicious input. No public exploit code and no confirmed active exploitation were identified at time of analysis.

HPLIP (HP Linux Imaging and Printing Software) is affected by multiple heap-based buffer overflow vulnerabilities (CWE-122) that can lead to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Exploitation requires user interaction, such as a victim performing a print or scan operation or processing attacker-supplied imaging data, but no authentication is needed, and the attack is network-reachable. HP has remediated the issues; no public exploit code has been identified at the time of analysis.

Heap-based buffer overflow and related memory-safety flaws in HP Linux Imaging and Printing (HPLIP) can allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification on Linux hosts where HPLIP is installed and the affected component is active. This is an aggregate HP bulletin (hpsbpi04151) that bundles multiple externally reported issues under one CVE, so the published CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) represents the worst-case component rather than any single flaw, and the assessed CVSS 3.1 score is lower (AV:N/AC:H) because several sub-issues are more likely local than remote and heap exploitation requires reliable memory grooming. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is limited to Linux systems on which HPLIP is deployed rather than being a universal service.