Buffer Overflow

Heap-based buffer overflows and related memory-safety flaws in HPLIP (HP Linux Imaging and Printing Software) let remote attackers corrupt memory in the print, scan, and device-discovery stack, potentially yielding remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Only Linux hosts with HPLIP installed and actively processing attacker-influenced input - a crafted print job, a rogue printer/scanner response, or a file handled by the HPLIP stack - are affected, and exploitation is gated on active user interaction (initiating or accepting the malicious print/scan operation) rather than being a fully autonomous remote exploit. The flaws are unauthenticated per the vendor CVSS vector (PR:N), impact varies depending on which bundled sub-vulnerability is triggered, and no public exploit identified at time of analysis.

Out-of-bounds write flaws in HPLIP (HP Linux Imaging and Printing Software) can corrupt memory when a user processes attacker-influenced input such as a crafted print job, a malicious device or network response, or a handled file, with the affected product confirmed by HP and documented in advisory HPSBPI04151. No authentication is required to reach the vulnerable components, but exploitation depends on mandatory user interaction and on hosts that actually have HPLIP installed and in active printing or scanning use. Worst-case impact spans remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification; no public exploit code or confirmed active exploitation was identified at time of analysis.

Stack-based buffer overflow in the Dell Update Package (DUP) Framework, affecting versions prior to 26.07.03, allows an unauthenticated attacker on the same local network segment (AV:A) to corrupt stack memory and achieve arbitrary code execution on the affected host with full confidentiality, integrity, and availability impact. Exploitation requires no credentials or user interaction and is low-complexity once the attacker has L2 adjacency to a system running the vulnerable framework, though it is not reachable from the internet and CISA SSVC rates it non-automatable with only partial technical impact. No public exploit code has been identified at time of analysis and EPSS is low (0.30%, 22nd percentile); Dell has released a fixed version.

Heap memory corruption in the userspace SMB daemon of MikroTik RouterOS before 7.24 lets remote, unauthenticated attackers crash or destabilize the service by sending a crafted SMB1 SessionSetupAndX request whose uniPwdLen field triggers an integer underflow and an oversized copy into a smaller heap buffer (CWE-122). The independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as an availability-only impact - adjacent heap corruption in a userspace daemon, not a confirmed path to code execution - and the primary limiting factor is that the SMB service is not enabled by default on RouterOS. No public exploit code has been identified at time of analysis, and exploitation requires the SMB service to be enabled and network-reachable with legacy SMB1 dialect handling active; a vendor fix shipped in RouterOS 7.24.

Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overflow is reachable through the login process before authentication completes. Because the flaw is triggered during the pre-authentication login path, a remote attacker with network reachability to the management server's login/administration service needs no credentials, no user interaction, and no non-default configuration, and the resulting code execution is described as running with root privileges - consistent with the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV), but the pre-auth, root-level impact and the criticality of the management plane make this a top-priority patch target; CPE data lists the product with a wildcard version, indicating the affected version range is not bounded in the available feed data.

An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. No public exploit code has been identified at time of analysis; the impact is bounded to a temporary availability loss, with no code execution or data compromise demonstrated.

Heap out-of-bounds write in the Linux kernel's ntfs3 driver lets a local attacker who can mount a crafted NTFS image corrupt kernel heap memory, producing a 4-byte write past the end of a kmalloc-1k allocation in ni_create_attr_list() (assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - integrity and availability high, confidentiality unaffected). Any kernel shipping the ntfs3 driver without the fix is affected; exploitation requires mounting an attacker-supplied image (privileged loop-mount or an automount daemon that mounts removable media) and then performing an attribute-inserting operation such as setxattr/setfattr, so the widely circulated 9.8 network vector materially overstates real-world exposure. No public exploit code or confirmed in-the-wild activity was identified at time of analysis, though vendor patches are available in the stable branches listed in the references.

A stack buffer overflow in the Linux kernel's staging rtl8723bs Wi-Fi driver allows an unauthenticated attacker within radio range to corrupt kernel memory by sending a crafted WPS information element in a beacon or probe-response frame that the target parses while scanning. Because the driver trusts an attacker-controlled 2-byte WPS attribute length as a memcpy() size without comparing it against the remaining bytes of the IE, the copy overruns single-byte stack variables such as the selected-registrar flag at call sites in ioctl_cfg80211.c and rtw_mlme_ext.c, yielding a kernel crash and, depending on build hardening, possible code execution; the independent assessment rates this AV:A/AC:L/PR:N/UI:N with high integrity and availability impact (confidentiality rated none). No public exploit code or confirmed active exploitation has been identified at time of analysis, and exposure is confined to systems with this niche driver loaded and an adversary physically close enough to inject 802.11 management frames.

A 1-2 byte out-of-bounds read in the Linux kernel's rtl8723bs staging Wi-Fi driver (rtw_action_frame_parse) lets a local attacker who can inject 802.11 management action frames cause a kernel fault, with practical impact typically limited to a crash when the read crosses a page boundary. The vendor assigned CVSS 7.1 (AV:A/AC:L/PR:N), but our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L because exploitation requires the rtl8723bs driver to be loaded and bound to Realtek RTL8723BS hardware plus local interface access (typically CAP_NET_ADMIN) to reach the cfg80211 mgmt_tx path or a monitor-mode interface. No public exploit code identified at time of analysis, and this is not confirmed actively exploited (CISA KEV); vendor-released patches exist for the affected stable branches.

A one-byte out-of-bounds read in the rtl8723bs staging WiFi driver lets an unauthenticated attacker within radio range (adjacent network) trigger a kernel memory overread while the driver parses scan or association Information Element data, with realistic worst-case impact of a kernel crash or denial of service rather than leaked data. The flaw affects Linux kernels that carry the rtl8723bs staging driver from v4.12 onward through the fixed releases 6.18.52, 7.2.5 and 7.3-rc2 (plus mainline commit 4420cc71841b50e31a7868ef7acb011c0e08d294), and the vendor scores it 7.1 while our independent assessment places it lower (AV:A, PR:N, UI:N, availability-only, low). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor-released patches are available.

Local privilege escalation in the Linux kernel's SCSI bsg io_uring passthrough path (bsg_uring_cmd) allows an authenticated low-privileged local user (PR:L) to corrupt kernel memory via an out-of-bounds write, potentially escalating privileges or crashing the host. The handler validates fields read directly out of the user-shared, mmap'd io_uring SQE, so a racing thread can enlarge request_len after the bound check but before copy_from_user(), overflowing the fixed-size scmd->cmnd buffer inside the kernel. Affected are kernels built with bsg io_uring passthrough support (EUVD lists Linux 7.1 in the affected commit range), with exploitation requiring local access to a /dev/bsg device node plus a multi-threaded racer that wins a narrow check-to-use window; the vendor rates it 7.8 while the independent assessment agrees it is a genuinely serious bug but raises attack complexity to AC:H because success is probabilistic per attempt. No publicly available exploit code was identified at the time of analysis, and no KEV listing was provided.

An out-of-bounds read in the Linux kernel's Wacom Bluetooth HID driver (wacom_intuos_pro2_bt_irq) allows an attacker in Bluetooth range who controls, spoofs, or merely operates a malfunctioning paired peripheral advertising a Wacom Intuos Pro/Intuos BT VID/PID to make the kernel parse a report shorter than the branch's fixed offsets, reading past the end of the received buffer. Because the driver force-registers pen, pad and touch input nodes for the matched device type via wacom_setup_device_quirks(), the leaked bytes are forwarded to userspace through evdev (MSC_SERIAL, ABS_MISC, ABS_WHEEL), giving a concrete confidentiality channel in addition to the immediate availability impact of a kernel OOB access on short descriptors. The reported CVSS is 8.1 (AV:A/AC:L/PR:N/UI:N), while our independent assessment rates it CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - still adjacent and unauthenticated from a credential standpoint, but requiring the victim to pair/trust the hostile peripheral and, for any real confidentiality payoff, a local process consuming the evdev stream. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not CISA KEV); vendor patches are available in current stable trees.

An out-of-bounds write in the Linux kernel's NVMe-over-Fabrics TCP target (nvmet-tcp) allows a network-reachable initiator to write four attacker-controlled bytes past a 128-byte receive buffer by sending a duplicate ICReq PDU after a header digest has been negotiated, corrupting adjacent queue state. The bug is reachable before authentication (CVSS PR:N), and the assessed impact is high availability (target crash or teardown) with a limited integrity effect and no confidentiality impact. Vendor patches exist for all supported stable trees, and no public exploit code or confirmed active exploitation was identified at time of analysis; practical exposure is confined to hosts that actually export an NVMe/TCP target subsystem, typically on port 4420.

An out-of-bounds write in the Linux kernel's device-memory migration helpers (mm/migrate_device) allows a local user who holds a file descriptor to a ZONE_DEVICE/HMM-capable device to corrupt kernel memory. When a compound (transparent huge) folio is migrated into device memory and its page-granular span extends past the end of the caller-supplied npages PFN array, migrate_device_range() and migrate_device_pfns() clear folio entries past the array boundary; the path is exercised in practice by dmirror_fops_release() on /dev/hmm_dmirror0 and by GPU shared-virtual-memory drivers such as nouveau or amdgpu SVM. Exploitation is local only and conditional, requiring a device-memory migration-capable kernel build and a specific huge-page-versus-range boundary condition (assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, integrity and availability impact with no confidentiality impact); no public exploit identified at time of analysis.

Out-of-bounds write in the Linux kernel's nvdimm BTT (Block Translation Table) driver allows a privileged local attacker who can supply a crafted or foreign BTT arena to corrupt kernel memory, primarily degrading availability and potentially altering data. The flaw is triggered when the BTT info block's unvalidated nfree field is set below the host's per-lane count (ND_MAX_LANES), so the I/O path indexes freelist[]/rtt[] arrays past their allocations; exploitation requires local root/CAP_SYS_ADMIN or physical control over the persistent-memory medium being probed, making it a low-real-risk issue despite a high base score. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); EPSS data was not supplied.

An out-of-bounds read in the Amlogic Meson GXBB clock controller driver causes a kernel global-out-of-bounds report (KASAN: read of size 8 in gxbb_32k_clk_parents) during clock registration at boot on GXBB-based boards such as the WeTek Hub. The defect comes from a mux parent count that was left hard-coded after a stale parent entry was removed, so the driver walks one slot past the end of its parent array; affected code shipped in stable kernels including 5.4.292+, 5.10.236-5.10.269, 5.15.180-5.15.220, 6.1.134-6.1.187, 6.6.87-6.6.156, 6.12.23-6.12.109, 6.13.11-6.13.x, 6.14.2-6.14.x and the 6.15 mainline series, and is fixed in newer stable releases (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, 7.3-rc1). There is no public exploit identified at time of analysis and no CISA KEV listing, and nothing more than a local unauthenticated vector exists in the CVSS data (AV:L, PR:N); our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, far below the vendor's 8.0 vector, because the read is triggered solely by the driver's own probe and is not controllable by any user, network input, or configuration toggle.

Memory corruption on IBM Z (s390) KVM hosts running the Linux kernel is triggered when a channel-subsystem damage machine check (the CK bit) is reinjected into a guest, causing the host kernel to kfree() a stack variable. Exploitation requires an authenticated local actor with existing privileges on an s390 host that runs KVM guests (CVSS AV:L/PR:L) and depends on a hardware/host error condition that cannot be summoned on demand, which is reflected in the assessed AC:H and a scope-changed impact profile of low integrity and high availability impact rather than full host compromise. Vendor-released patches exist (stable 6.18.51, 7.2.5 and 7.3-rc1/mainline commits); no public exploit code and no confirmed active exploitation were identified at time of analysis.

A race condition in the Linux kernel's KVM s390 (IBM Z) keyop path lets a local user who already holds a KVM VM file descriptor cause gmap->asce to be read without the mmu_lock, potentially using a stale address-space-control element and corrupting memory. Exploitation requires s390 hardware, VM-fd access, and issuing KVM_S390_KEYOP concurrently with KVM_S390_VM_MEM_LIMIT_SIZE so that keyop reads asce while gmap_set_limit() mutates it under the write lock; it is timing-dependent, not remotely reachable, and no public exploit has been identified at time of analysis. The upstream fix has been merged and shipped in stable Linux 7.2.5 and 7.3-rc1, though an independent assessment rates real-world impact lower than the 7.8 base score by downgrading attack complexity to High and scope/confidentiality impact to None/low integrity, high availability.

Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range because the decode_range_tlbi() helper omitted the required virtual-address sign-extension when it was reused for stage-1 TLBI handling, and the same helper can overflow physical-address bits when invoked for stage-2 invalidation. Only arm64 hosts running KVM are affected, and the attacker must already control a guest VM/vCPU able to issue range-based TLBI operations (low-privilege guest context, no user interaction, no network reachability); kernels from the 6.16 introduction through the fixes in 6.18.51, 7.2.5 and 7.3-rc1 are in scope. Exploitation results in stale or incorrectly scoped TLB entries on the host, with the assessed impact being availability loss (A:H) plus limited integrity impact (I:L) and no confidentiality impact; no public exploit identified at time of analysis.

Host denial of service (with potential low integrity impact) in the Linux kernel's KVM/arm64 hypervisor allows a local attacker with guest execution privileges to trigger a TLB invalidation range overflow, corrupting hypervisor state. The flaw affects kernels approximately from 6.16 until the fixes in 6.18.51, 7.2.5, and 7.3-rc1, and requires the guest to issue TLB Invalidation by Range operations with an attacker-chosen virtual address. No public exploit code is identified at time of analysis.

LoongArch Linux kernels overflow the fixed-size acpi_package_ids[] array while parsing the ACPI PPTT table, so a system whose firmware or hypervisor advertises more CPU packages (sockets) than the array can hold crashes during topology setup - the concrete case in the description being a LoongArch virt VM configured with one core per socket for up to 256 sockets. Affected builds are those before the fixed 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1 kernels; the flaw is reachable only on LoongArch, and the assessed precondition (per our independent analysis: AV:L/AC:H/PR:H, C:N/I:L/A:H) is control over the guest's ACPI topology rather than an ordinary unprivileged runtime action, with the practical outcome being a boot-time crash and memory corruption rather than remote code execution. No public exploit code was identified at the time of analysis and there is no CISA KEV record, so this is not confirmed as actively exploited; the vendor has released patches and the relevant upstream commits are public.

An out-of-bounds write in the Linux kernel's HDMI-CEC driver for the Extron DA HD 4K Plus adapter (media: cec: extron-da-hd-4k-plus) lets a malicious or malfunctioning CEC device overflow the fixed-size msg.msg[] buffer, crashing the kernel and potentially corrupting kernel memory. Only hosts that have the extron-da-hd-4k-plus driver built and bound to an actual Extron DA HD 4K Plus CEC adapter are affected, and the malformed CEC message must arrive over the physically or adjacently attached CEC/serial link - there is no remote, over-the-network attack path against a default configuration. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and the vendor's CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) materially overstates real-world risk; our independent assessment is AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, since the hardware is rare, the input channel is adjacent-only, and reliable escalation beyond a kernel crash is not demonstrated.

A heap out-of-bounds write in the Linux kernel's cx231xx USB video-capture driver allows a local, authenticated user (CVSS PR:L) who can open the device's V4L2 video and VBI nodes to corrupt kernel heap memory by resizing the device-wide frame geometry while a VBI stream is already running. The driver latches the VBI plane size at buffer-allocation time but recomputes the destination offset from the live dev->width and dev->norm on every URB completion, so an attacker can allocate a small VBI plane (small width or the NTSC standard), start VBI streaming, then enlarge dev->width via VIDIOC_S_FMT or switch dev->norm to PAL via VIDIOC_S_STD through the video node - the pre-patch code only checks the video queue (dev->vidq), not the VBI queue (dev->vbiq) - and have the device deliver a field-2 payload, causing cx231xx_do_vbi_copy() to memcpy() past the end of the smaller plane with an attacker-chosen offset and device-controlled contents. Vendor patches exist for Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51 and 7.2.5 (mainline 7.3-rc1); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical impact is bounded by the requirement for physical or emulated cx231xx hardware plus a race against live URB completion (the independent assessment scores this AV:L/AC:H with C:L, below the vendor's 7.8 High).

Use-after-free in the Linux kernel's TI VPE/VIP media capture driver (media: ti: vpe) allows a locally authenticated attacker who can open and stream from a VIP /dev/videoN node to trigger memory corruption by racing stream teardown against outstanding interrupt work. The driver's VIP overflow recovery worker - armed from the hardirq handler when a FIFO overflow is detected - and the VPDMA list-complete path both continue to dereference stream, port, and device state after vip_release_stream() or free_stream() has freed those resources, because vip_stop_streaming() masks the per-list IRQs without synchronizing the hardirq handler or disabling recovery_work. Exploitation requires local access plus the ability to induce a FIFO overflow and win a tight timing window against file release or unbind/remove, so our independent assessment rates this AC:H with limited confidentiality and integrity impact but high availability impact (NVD scores it 7.8 AV:L/AC:L/PR:L). No public exploit code was identified at time of analysis, and the flaw is hardware-specific to TI Davinci/OMAP/AM-class SoCs with VIP capture hardware.

Local low-privilege users on systems running the F2FS filesystem can trigger an integer overflow in the F2FS_IOC_MOVE_RANGE ioctl, extending a destination file's size without proper bounds checking and potentially corrupting filesystem integrity. The flaw affects Linux kernel versions from 4.8 up to the fix commits, including distributions using F2FS on Android and embedded flash storage; exploitation requires a crafted source file with a hole and the ability to issue the ioctl, and no public exploit has been identified. This is a local integrity and availability issue, not remotely exploitable.

The Linux kernel's Panthor DRM driver for ARM Mali CSF-based GPUs (Mali-G310/G510/G610/G710/G720 class hardware) fails to safely validate the build-info metadata block it parses out of the loaded firmware image: panthor_fw_read_build_info() adds the u32 header fields hdr.meta_start and hdr.meta_size without overflow protection, reads the "git_sha: " prefix without first confirming the metadata is long enough, and can underflow the trailing NULL terminator index when meta_size is zero. An attacker who can supply or influence the firmware blob can therefore make malformed metadata pass validation and drive out-of-bounds reads, yielding information disclosure and potential availability impact on the GPU/driver. Exploitation is local and privileged (CVSS PR:H, i.e. authenticated with high privileges) and requires a system with Panthor active and Mali CSF hardware; default vendor-signed firmware is unaffected, and the independent assessment rates the realistic severity far below the vendor's 7.1 as CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV; vendor fixes are shipped in Linux 6.18.51, 7.2.5 and 7.3-rc1.

Missing validation of the plane degamma LUT size in the Linux kernel's AMD display driver (amdgpu/DC) lets a local, authenticated user who can submit DRM atomic commits supply a malformed AMD_PLANE_DEGAMMA_LUT blob - for example a single-entry LUT - and drive the kernel into a divide-by-zero in __is_lut_linear() or an out-of-bounds read in __drm_lut_to_dc_gamma(). The practical consequence is a kernel crash or denial of service and, via the out-of-bounds read, potential disclosure of kernel memory contents; there is no evidence of memory corruption leading to code execution, and this is a local-only issue. Reachability is narrow: the vulnerable property is exposed only on kernels built with AMD_PRIVATE_COLOR (not enabled in mainstream distribution kernels) and only on systems with an AMD GPU using the amdgpu/DC display path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in the stable trees (6.12.110, 6.18.51, 7.2.5) and in mainline 7.3-rc1.

Integer overflow in the Linux kernel's amdgpu VCN decode-message parser lets an authenticated local user with access to the AMD GPU device node bypass a buffer-count bounds check and drive the parser loop far past the end of a message buffer object, producing out-of-bounds kernel reads that crash the system (availability) and can disclose kernel memory (confidentiality). Exploitation is not remote or unauthenticated: the attacker must be a local principal able to submit VCN decode messages and must additionally allocate a roughly 4 GiB GPU-accessible mapping so msg[1] passes the earlier 'header does not fit in BO' check, a substantial resource precondition that our assessment scores as high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H). No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); this is a genuine but modest-priority local vulnerability.

Signed integer overflow in the Linux kernel ofdrm (Open Firmware framebuffer) driver allows the framebuffer size computation fb_size = linebytes * height to wrap when both geometry values are large, resulting in an undersized framebuffer allocation and subsequent out-of-bounds memory handling inside the drm/sysfb subsystem. Exposure is confined to systems that actually bind the ofdrm driver, effectively Open Firmware/PowerPC-class platforms whose linebytes and height come from firmware or the boot device tree rather than from runtime user input, and the assessed vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H) reflects that a privileged actor able to influence platform firmware or the device tree is required, which is considerably more restrictive than the published 8.4/PR:N rating. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.

Out-of-bounds reads in the Linux kernel's ksmbd in-kernel SMB3 server can leak kernel memory or crash the system when a local low-privileged attacker can influence the netlink IPC share-configuration response produced by the userspace ksmbd.mountd daemon. The flaw lies in unvalidated variable-length share-config fields - an over-long veto list and a path length that fails to account for the separator byte - and affects kernel series where the fix boundaries listed by EUVD are 5.16, 6.2, 6.7, and 6.9, plus the 7.2.6/7.3-rc2 lines. It is not confirmed actively exploited, no public exploit code has been identified at time of analysis, and EPSS is low at 0.19% (9th percentile); a vendor patch is available. Impact is bounded by the fact that ksmbd is non-default on most distributions (which ship userspace Samba) and the vector is local (AV:L) with low privileges (PR:L) and no user interaction.

Out-of-bounds heap reads in the Linux kernel's ext4 inline-directory code (ext4_read_inline_dir()) let a local actor who can present a crafted inline-data ext4 directory - by creating one on a writable ext4 volume with the inline_data feature enabled, or by mounting a malicious ext4 image (e.g. via removable-media automount) - leak kernel heap memory and crash the kernel through an ordinary getdents64()/iterate_dir() call. The kernel emits a KASAN slab-out-of-bounds report in __ext4_check_dir_entry when the size-2 rec_len probe is dereferenced past the end of the kmalloc(inline_size) buffer. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.21% (11th percentile), indicating low predicted exploitation activity; the supplied CVSS of 9.1 (AV:N/PR:N) is inconsistent with the flaw's local-only reachability and should be treated as mis-scored, with the assessed vector being AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (High).

IPv6 IPsec receive processing in the Linux kernel writes one element past the end of the six-slot xfrm_state pointer array in xfrm6_input_addr(), because the depth guard tests '1 + sp->len == XFRM_MAX_DEPTH' instead of '>=', so a secpath already stacked to XFRM_MAX_DEPTH by xfrm_input() and preserved across xfrm_trans_reinject() bypasses the check and stores into sp->xvec[sp->len++]. The attacker must control an inner packet carrying a Mobile IPv6 destination-options Home Address option or a type-2 routing header, and because the write stays inside the larger sec_path allocation it is invisible to KASAN - it is only flagged by UBSAN_BOUNDS and only fatal when the non-default panic_on_warn sysctl is enabled, otherwise it is a logged warning with no functional effect. This means the input CVSS 3.1 vector of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is the generic maximal score auto-assigned to Linux kernel CVEs and is not credible for this bug: the authoritative independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, availability-only, high attack complexity), since exploitation requires IPsec transport mode with six nested SA transforms, a Mobile IPv6 header, and a UBSAN_BOUNDS kernel with panic_on_warn enabled. Exploitation status: no public exploit identified at time of analysis; EPSS is only 0.21% (11th percentile) and the flaw is not listed in CISA KEV, consistent with the layered prerequisites. Authentication requirements: unauthenticated remote attackers (CVSS vector contains PR:N).

Mounting a crafted NTFS filesystem image can corrupt Linux kernel memory through the in-kernel fs/ntfs3 driver, where an integer truncation in restart-table growth (a u32 'used + add' cast to the u16 __le16 count of struct RESTART_TABLE) produces an undersized allocation that is subsequently written past its bounds during $LogFile replay. The issue is local and requires an attacker-supplied image to actually be mounted: on default configurations this needs mount privileges (CAP_SYS_ADMIN/root), while the unprivileged path depends on a USB-automount daemon plus physical insertion of the media, so it is not remotely reachable. Kernels carrying the vulnerable ntfs3 log-replay code before the listed stable fixes are affected; vendor patches are available (Linux 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 and 7.2.6, plus 7.3-rc1 in mainline), no public exploit was identified at time of analysis, and EPSS is low at 0.21% (11th percentile).

Mounting a crafted NTFS image on a Linux system with the ntfs3 driver loaded triggers an out-of-bounds read in read_log_rec_buf(), causing a kernel crash and possible disclosure of adjacent slab memory into the log replay buffer. This is a local-only issue that requires the attacker to get the malicious volume mounted, either through physical media with an active automount daemon or a process/user holding mount privileges such as CAP_SYS_ADMIN, and no public exploit was identified at the time of analysis. Vendor patches are available in stable releases 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1, and the independent assessment (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) is lower than the provided 8.4 vector because impact is limited to crash and potential disclosure rather than code execution.

An out-of-bounds read in the Linux kernel's ISO9660/zisofs decompression code allows a local attacker to read memory past the end of a page-pointer array (kmalloc-8 slab) by simply read()ing a compressed file from a crafted ISO9660 image. The flaw is reachable only when the image's Rock Ridge 'ZF' record specifies a zisofs block-size shift below PAGE_SHIFT (a value rock.c does not reject) and a sub-page block leaves poffset partway into a page followed by an empty block, so the mount prerequisite and local trigger make this a local availability/limited-disclosure bug rather than a remote one. No public exploit code was identified at time of analysis, and EPSS is low (0.21%, 11th percentile); exploitation is not confirmed in the wild and the vendor's AV:N/PR:N CVSS 9.8 score is not credible for a bug that requires mounting a malicious image on the target - our assessment is AV:L/PR:L with high availability impact and low confidentiality impact.

Heap-based memory corruption in NLnet Labs Unbound up to and including 1.26.0 lets a remote, unauthenticated attacker who controls or spoofs the upstream DNS response (PR:N/UI:N) gradually overwrite heap memory, with the reliable outcome being a crash and remote code execution possible only on certain systems and compilation options that lack hardening. The flaw is scored CVSS 8.4 (CVSS:4.0) and by the independent assessment as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with the high attack complexity reflecting heavy dependence on heap layout and non-deterministic results. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no KEV listing or EPSS signal is present, so this is a genuine but not-yet-urgent priority for internet-facing recursive resolvers.

A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.

Heap buffer overflow in NLnet Labs Unbound 1.26.0 and earlier can be triggered when a resolver processing a large TCP-framed DNS response encounters an RRSet whose owner name reaches the 255-byte maximum, crashing the resolver process and yielding a denial of service (availability-only impact, C:N/I:N/A:H). An attacker must either operate an authoritative name server that the victim resolver queries or hold an on-path position to tamper with an incoming DNS response, and the malicious answer must be delivered over TCP, be large, and carry the maximal-length owner name; crafting and delivering that payload raises practical complexity above the vendor's AC:L rating, which is why our assessment uses AC:H. No public exploit code or confirmed active exploitation has been identified at time of analysis, and because canonicalisation runs before DNSSEC validation, signature validation does not mitigate the issue. NLnet Labs has published an advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81634.txt.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) versions 1.0.0.0 through 153.0.4234.32 allows remote attackers to execute arbitrary code in the browser by getting a victim to load attacker-controlled web content. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or privileges are needed but successful exploitation requires user interaction such as visiting a crafted page or opening malicious content rendered by Edge. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available from Microsoft and the affected range is bounded precisely by the fixed build, so exposure is limited to unpatched or unmanaged installations.

Heap-based buffer overflow in GIMP's file-psd import plugin allows a crafted PSD file to corrupt adjacent heap memory, causing an application crash or potentially arbitrary code execution when the user opens the file or when a thumbnail preview is generated for it. The root cause is an integer overflow (CWE-190) in the multiplication of values taken from an embedded JPEG header, which yields an undersized heap allocation that is subsequently overrun during image decoding and can be turned into a controlled memory write. The assessed vector (CVSS 3.1, 7.8 High, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a local, user-interaction-dependent flaw rather than a remotely reachable service bug, so exploitation requires delivering the malicious PSD to a machine where GIMP or an automatic PSD thumbnailer processes it; no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Out-of-bounds read in the Netcore NR255-V router (firmware 1.5.130703) is triggered when an authenticated user uploads a deliberately truncated firmware image through the put_file_cgi.c endpoint. The short buffer is passed into the pre-flash validation path (mtd_write, main.c, check_image_uuid.c, oemMD5Update.c), which reads past the end of the uploaded image, leaking adjacent memory and, per the CVSS availability impact, potentially crashing or bricking the flash-validation routine. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, but a public technical write-up exists and the attack is fully automatable once credentials are held.

Netcore NR255-V firmware 1.5.130703 ships a stack-based buffer overflow in the reboot_timer_set.cgi web endpoint, reachable through the router's HTTP management interface. The flaw stems from improper sscanf token parsing of user-supplied input, allowing a user who already holds administrative credentials on the device to corrupt stack memory and potentially execute code in the router's firmware context or crash/reboot it. No public exploit code or CISA KEV listing was provided at time of analysis, and no vendor-published patched firmware version appears in the supplied references.

A stack-based buffer overflow in the Netcore NR255-V router (firmware 1.5.130703) allows an attacker who can reach the web management interface to smash a fixed-size stack buffer by submitting oversized form values to the ntools_tcpdump_start_set.cgi endpoint, which passes input to an unsized sprintf call. Successful exploitation can corrupt the saved return address and potentially lead to arbitrary code execution with the privileges of the CGI process on the device. The supplied CVSS 4.0 vector (8.7) rates confidentiality, integrity and availability impact as high with a network vector, but PR:L indicates some level of authentication or low-privilege access is required; no EPSS score, CISA KEV listing, or confirmed public exploit code was included in the intelligence feed, and no vendor patch reference was provided.

Stack-based buffer overflow in the wake_up_set.cgi endpoint of Netcore NR255-V firmware version 1.5.130703 lets an attacker who can reach the router's web management interface corrupt memory by submitting oversized MAC and ID parameter values that are tokenized without any length bound. Successful exploitation yields high confidentiality, integrity, and availability impact on the device - potentially full compromise of the router as a network chokepoint - with a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so current risk is driven by exposure of the management interface rather than confirmed in-the-wild activity.

An out-of-bounds write in Google Chrome's ServiceWorker implementation allows remote code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page; exploitation requires the user to visit or be redirected to attacker-controlled content and to have a service worker exercised (UI:R, PR:N), so no credentials or pre-existing privileges are needed. Successful exploitation yields high confidentiality, integrity and availability impact within the sandboxed renderer process (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and host compromise would additionally require a separate sandbox-escape. Only Chrome builds prior to 153.0.8010.47 are affected, a vendor patch is available, and no public exploit code has been identified at time of analysis; because Chrome auto-updates in the background, most installations will remediate themselves quickly, though managed and long-lived sessions should be verified.

An out-of-bounds read in Mozilla Thunderbird's IMAP response parser affects all builds prior to Thunderbird 156 and prior to Thunderbird 140.16 (ESR), allowing a malicious or compromised IMAP server to crash the mail client and potentially expose a limited amount of process memory by sending a crafted untagged '* ID' response. The flaw is reachable before authentication (CVSS vector PR:N/UI:N), so an attacker needs no mailbox credentials and no user click beyond the client connecting to a server they control, have compromised, or can intercept via man-in-the-middle; independent assessment sets confidentiality impact to Low and availability impact to High, which is milder than the 9.1 NVD base score. Exploitation requires the victim's Thunderbird to actually initiate an IMAP session to the attacker-controlled endpoint, and with EPSS at only 0.21% (12th percentile) and no CISA KEV entry or public exploit code identified, the severity signals conflict: a critical-looking base score against low real-world exploitation likelihood, mitigated by the availability of fixed builds in Thunderbird 156 and 140.16.

An out-of-bounds read in Mozilla Thunderbird's IMAP response parsing can disclose process memory or crash the client when the mail client connects to an attacker-controlled or compromised IMAP server, or when an on-path attacker injects crafted IMAP lines into a session. The flaw affects Thunderbird versions before 156 and Thunderbird ESR versions before 140.16, and is fixed in those releases; exploitation requires the victim's client to establish an IMAP session with the malicious endpoint (CVSS UI:R) while requiring no attacker authentication (PR:N). EPSS is 0.18% (8th percentile), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.

A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privilege API credentials to execute arbitrary commands as a privileged operating-system user on the gateway appliance. Affected releases span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, per ENISA EUVD version ranges. The CVSS 3.1 vector requires PR:H, meaning exploitation is not unauthenticated; no public exploit was identified at time of analysis, and the issue is not listed in CISA KEV.

Authenticated attackers who already hold administrative privileges on HPE Aruba EdgeConnect SD-WAN Gateways can supply specially crafted configuration data that overflows a stack buffer in the configuration processing logic, potentially yielding remote code execution as root or crashing the gateway into a denial of service. The flaw affects gateway releases in the 9.4.x (≤9.4.8.2), 9.5.x (≤9.5.8.1), 9.6.x (≤9.6.3.1) and 9.7.0.0 branches per the ENISA EUVD affected-version list, and carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code, CISA KEV listing or EPSS score was included in the supplied intelligence, so the observed exploitation status is unconfirmed at time of analysis.

Unauthenticated remote code execution and denial-of-service in HPE Aruba Networking EdgeConnect SD-WAN Gateways (versions 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0) arise from flawed parsing of malformed or truncated packets in the proxy packet-processing path, where incorrect length arithmetic triggers an integer overflow that can become a memory-corruption (buffer overflow) condition. Successful exploitation can let a network-positioned attacker execute code or crash the gateway, taking down the SD-WAN overlay. The HPE advisory at support.hpe.com confirms affected version ranges, but there is no CISA KEV listing, no EPSS score, and no public exploit code identified at time of analysis, so this is currently a patch-now, watch-for-exploitation item rather than a confirmed active campaign.

A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host, resulting in full operating-system compromise of the appliance. Multiple maintenance trains are affected — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and the 9.7.0.0 release. The vendor's own CVSS rating is 8.1 (AV:N/AC:H/PR:N/UI:N), reflecting that exploitation is unauthenticated but gated by preconditions outside the attacker's control; no public exploit code or CISA KEV listing was identified at time of analysis.

A limited buffer overflow in the network security monitoring component of HPE EdgeConnect SD-WAN Gateways allows an unauthenticated remote attacker to crash the appliance and potentially execute code by driving crafted traffic into the monitoring parser. ENISA EUVD lists four affected release trains: 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0. No CISA KEV entry and no public exploit code were identified at time of analysis, and no EPSS data was supplied with the record.

A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthenticated attacker on an adjacent network segment execute arbitrary code as a privileged OS user, resulting in full compromise of the appliance. Affected branches span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 release trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively). The vendor describes exploitation as conditional on preconditions outside the attacker's control, and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence at time of analysis.

Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x, 9.5.x, 9.6.x, and 9.7.0.0 branches, where a buffer overflow in an underlying operating system service permits a network-reachable attacker to run arbitrary commands and fully compromise the appliance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and the independent assessment agree that no credentials or user interaction are needed, so the practical limiting factor is whether the vulnerable interface is reachable from an untrusted network. No public exploit code has been identified at time of analysis and the issue has not been confirmed actively exploited (CISA KEV), but the severity, the network-edge placement of these devices, and the credential-free attack path make this a top-priority patch item for exposed gateways.

An out-of-bounds write reachable through a race condition in google_mba_recv_msg() in google_mba_poll.c allows a locally installed low-privilege application on an affected Android device to corrupt kernel memory and escalate to system/kernel privileges. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N), the flaw requires no user interaction but does need the attacker to already run code on the device and to win a timing window, which keeps it materially below a remote, unauthenticated severity. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; no EPSS score was supplied in the source data.

Memory corruption in the ARM64 TLB-invalidation path of the Android kernel allows a local attacker holding low privileges to win a race condition and escalate to kernel/root privileges, with no user interaction and no additional execution privileges required. Affected builds are Google Android (CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:*), specifically ARM64 devices; Google's September 2026 Pixel security bulletin is the vendor reference for the fix. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed and no public exploit code has been identified at time of analysis.

Let me synthesize. CVE-2026-58710: DecodeFilmGrainParams in film_grain_dec.cc — Android libavc / media codec film grain decoding. Missing bounds check → OOB write → RCE. CVSS 8.8 with AV:N/AC:L/PR:L/UI:N — note PR:L is odd but that's given. CWE-120 (buffer copy without checking size). Reported by Google Devices, references Android Security Bulletin Pixel 2026-09-01. CPE google:android. EUVD affected versions: "Android Android kernel" — weird. Tags: RCE, Buffer Overflow, Google. Missing tag maybe "android". Product name: "Android" — or "Android Film Grain Decoder"? 1-3 words. "Google Android" maybe. Let's use "Android Media Codecs"? Hmm. The vulnerability is in film_grain_dec.cc which is part of libavc (Android's AVC decoder) or a codec2 component. Probably Android's media framework. Product name should be specific: "Android". Let's pick "Google Android" (2 words). Prevalence: Android is ubiquitous. Assessed CVSS vector: Given description "remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." But CVSS vector says PR:L. Hmm. Media decoding typically happens when processing a media file — remotely delivered via messaging, or via media server. PR:L suggests some level of privilege required — perhaps access to a media-decoding service context, or the requirement to send media to a privileged process. Actually, for Android media codecs, an app can trigger decoding with its own privileges. The vendor assigned PR:L. I should give my own assessment. Given the description says "no additional execution privileges needed" and UI:N, but AV:N with media parsing... Typically media parsing is AV:L or AV:N depending on delivery. Android media codec flaws are usually CVSS AV:N/AC:L/PR:N/UI:R for a crafted file. Here UI:N suggests it's triggered via a network media stream (e.g., RTP, video call) without user opening a file. PR:L — the attacker needs local privileges? Hmm, in Android, media codec processes (media.

A race condition in the trusty_dputc() debug output path of generic-arm64-smcall.c in the Android kernel allows an out-of-bounds write that can be leveraged for local privilege escalation. The flaw is only reachable by a process already running with System execution privileges, and exploitation requires winning a timing window (AC:H, PR:L), with no user interaction. Impact is high across confidentiality, integrity and availability because the corrupted memory is kernel/secure-monitor adjacent, but no public exploit code or in-the-wild exploitation is known from the available intelligence.

An out-of-bounds read in the Android hardware VP9 decode path (Vp9DecEndOfStream in vp9hwd_output.cc) permits a locally installed app that can feed a crafted VP9 bitstream to the platform decoder to read memory beyond the intended buffer, leaking process data. Exploitation requires a local foothold (AV:L) - an app already running on the device - but no additional privileges (PR:N) and no user interaction (UI:N); the flaw is confined to devices using Google/Tensor's hardware VP9 decode implementation and is not remotely exploitable. Independent reassessment of the impact narrows this to information disclosure (C:H/I:N/A:L) rather than the vendor's code-execution framing, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.11% (2nd percentile), indicating very low predicted real-world exploitation activity.

Local privilege escalation in the Pixel-specific kernel PHY power driver, specifically the gmc_phy_lp3_exit_restore_registers routine in phy_power.c, where a missing bounds check permits an out-of-bounds memory write (CWE-120). Reaching the vulnerable code path requires code already executing at Android System privilege level on an affected Pixel device, and no user interaction is needed once that context is held; per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) this is an authenticated/high-privilege local issue rather than an unprivileged-app primitive, making it most useful as a later stage in an exploit chain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available through the September 2026 Pixel security bulletin.

An out-of-bounds write in Android's IP Multimedia Subsystem (IMS) telephony stack allows an attacker positioned on the cellular signaling path to corrupt memory and achieve code execution inside the privileged process that handles VoLTE/VoWiFi traffic. User interaction on the target is not required, and the September 2026 Pixel bulletin identifies the flaw as remotely triggerable via improperly validated input. No public exploit code or CISA KEV entry was identified at the time of analysis, and no EPSS score was supplied with the source data, so real-world exploitation activity is unconfirmed.

Local privilege escalation in Google Android allows an unprivileged app already running on the device to trigger a heap buffer overflow in the gf_ta_test_set_config routine of gf_ta_test.c, potentially gaining elevated code execution within the affected component. The flaw carries CVSS 8.4 (AV:L/AC:L/PR:N/UI:N, C/I/A High), requires on-device execution but no elevated privileges or user interaction, and affects Android builds where the vulnerable fingerprint/trusted-application test/config code is present. EPSS is very low at 0.12% (2nd percentile), no public exploit identified at time of analysis, and the issue is fixed in the 2026-09-01 Pixel security patch level.

An out-of-bounds write in the NXP NFC hardware abstraction layer (phNxpNciHal_ext_process_nfc_init_rsp in phNxpNciHal_ext.cc) lets a local attacker corrupt memory beyond the intended buffer while the HAL processes an NFC initialization response. Affected are Android devices that ship the NXP NFC HAL, which the Android CPE lists without a version bound; the flaw requires no user interaction and, per Google's bulletin wording, no additional execution privileges, so a typical app-level foothold is enough to attempt escalation. There is no CISA KEV listing and no public exploit code reported in the supplied intelligence, so exploitation is assessed as feasible but not yet observed.

An out-of-bounds write in Av1DecodeFrameTag (vp9hwd_headers.cc) in the Android media decoding stack allows crafted AV1/VP9 media content to corrupt memory and potentially achieve remote code execution in the codec process, which runs with elevated system privileges relative to a normal app. Google's Pixel security bulletin dated 2026-09-01 lists the fix, and no user interaction is required, though the provided CVSS vector (PR:L) implies the attacker must already be able to route content into the decoder path. No EPSS score, CISA KEV entry, or public exploit code was supplied with this record, so active exploitation is unconfirmed.

Local privilege escalation in Google Android affects Pixel builds addressed by the 2026-09-01 Android/Pixel security bulletin, where an unprivileged app already running on the device can trigger an out-of-bounds read caused by type confusion and potentially gain elevated code execution. The issue is locally reachable with no user interaction and no prior privileges (CVSS:3.1/AV:L/AC:L/PR:N/UI:N), but an attacker must first get malicious code onto the device, so exposure is largely limited to users who sideload apps or run compromised applications. There is no CISA KEV listing and no public exploit code identified at time of analysis, and exploitation risk is low per EPSS at 0.11% (2nd percentile). The flaw was reported by Google Devices and tracked in the EU as EUVD-2026-78985.

Out-of-bounds read in the Android kernel's configuration accessor get_global_config_item_addr() in gc.c allows a local attacker to read memory past the end of an allocation because the routine never validates the requested item index against the bounds of the config region. Google assigns the issue High severity (CVSS 8.4, vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that it can be reached with no additional execution privileges and no user interaction and can be leveraged toward local escalation of privilege on the affected device. Current intelligence does not indicate active exploitation: EPSS is only 0.11% (2nd percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV; fixes shipped in the September 2026 Android/Pixel security bulletin (2026-09-01), making this a genuine but not urgent local privilege-escalation issue.

An out-of-bounds write in Android's audio RTP payload encoder node (AudioRtpPayloadEncoderNode.cpp) lets a remote attacker execute arbitrary code in the media framework process by supplying a crafted audio RTP payload that the node fails to validate. Affected builds are Android/Pixel devices covered by the September 2026 Android Security Bulletin; the vendor description states user interaction is required to trigger the flaw, and an NVD/EUVD record exists alongside the source.android.com advisory. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided at time of analysis.

A heap-based buffer overflow (out-of-bounds write) exists in the Android Cellular Modem component, allowing an attacker within adjacent/proximal radio range to corrupt heap memory and potentially execute code in the modem context without user interaction. The flaw carries a CVSS base score of 8.0 (AV:A/AC:L/PR:L/UI:N) and affects Google Android devices per the Android/Google Devices CPE. No public exploit code or CISA KEV listing was provided at time of analysis, so exploitation status is unconfirmed; the vendor fix is documented in the September 2026 Pixel/Android Security Bulletin.

Local privilege escalation in Google Android's VPU (Video Processing Unit) driver lets an unprivileged app trigger an out-of-bounds write through a confused-deputy path, corrupting kernel memory and gaining root-level code execution on the device. Per the CVSS vector, the attacker must already hold local code execution (PR:L) but needs no user interaction, and the September 2026 Pixel/Android Security Bulletin confirms a vendor fix. No public exploit code or CISA KEV activity has been identified at time of analysis.

An out-of-bounds write in ReadTileInfo of vp9hwd_headers.cc lets a crafted VP9 bitstream corrupt memory inside Android's VP9 hardware-decoder header parser, which Google rates as remote escalation of privilege with no additional execution privileges and no user interaction required. Affected builds are those tracked under the Google Android CPE and addressed by the Android/Pixel security bulletin dated 2026-09-01. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-window issue rather than a confirmed in-the-wild campaign.

Let me synthesize. CVE-2026-56920: Android HEVC decoder, firmware header parsing (fw_hevc_dec_header.c), s_decode_vui_param out-of-bounds write, CWE-787, CVSS 8.8 AV:N/AC:L/PR:L/UI:N. Note: "remote code execution with no additional execution privileges needed" — but CVSS says PR:L. Hmm, this is typical Android bulletin wording: "This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." That's media framework / remote. But CVSS says PR:L which contradicts "no additional execution privileges needed". Actually Android media codecs often run in a sandboxed process (mediaserver), so PR:L reflects the sandbox context. There's a conflict worth noting. Product name: Android (Google Android). Or "Android HEVC Decoder"? 1-3 words. "Google Android" or "Android". Let's use "Android Media Framework"? Hmm — the file is fw_hevc_dec_header.c, HEVC decoder header parsing. Probably part of Android's media codec/firmware. I'll say "Android HEVC Decoder" — 3 words. Actually the CPE says google:android. Product name: "Android HEVC Decoder". Hmm, maybe safer: "Google Android". The field says the specific product or service name affected. CPE is google:android, and it's the HEVC decoder in Android firmware for Pixel devices (bulletin is Pixel). I'll go with "Android HEVC Decoder". Summary: Out-of-bounds write in HEVC VUI parameter decoding. Affected: Android devices with affected firmware (Pixel bulletin 2026-09-01). Remote code execution with no user interaction. No KEV, no POC identified. EPSS: not provided. KEV: not stated → assume not in KEV. POC: not provided → "no public exploit identified at time of analysis". Technical context: HEVC/H.265 VUI (Video Usability Information) parameters in SPS/VPS NAL units; s_decode_vui_param in fw_hevc_dec_header.c; firmware-based HEVC decoder in Android; logic error → insufficient bounds validation → OOB write → memory corruption in media codec process. CWE-787.

An integer overflow in the Android VPU (video processing unit) driver's size handling leads to an out-of-bounds write in kernel memory, allowing a locally installed application to escalate privileges to kernel/system level on affected Pixel devices. Exploitation requires only local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, making it attractive for a malicious or trojanized app. No public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is not provided; the vulnerability is addressed in the September 2026 Android/Pixel security bulletin.

Out-of-bounds write in Android's IMS media audio decoder (decodeAmr() in ImsMediaAudioPlayer.cpp) lets a remote party in an IMS-based media session - such as a VoLTE or VoWiFi call carrying crafted AMR-encoded audio - corrupt memory and potentially achieve remote code execution on the device. Affected are Android devices with an active IMS media stack (CPE cpe:2.3:a:google:android:*), and exploitation requires user interaction because the victim must answer or join the call/media session, which significantly limits mass exploitation. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the EPSS score is low (0.21%, 12th percentile), so this is best treated as a serious but currently latent memory-corruption risk pending the September 2026 Android/Pixel security bulletin fix.

An out-of-bounds write in Android's IP Multimedia Subsystem (IMS) telephony stack, corrected in the September 2026 Android/Pixel security bulletin, can be turned into remote code execution against affected devices. The published vector (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C/I/A all High) indicates network-reachable exploitation with no user interaction, though it assumes low-level privileges while the description claims no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was provided, so active exploitation is not confirmed at time of analysis.

Local privilege escalation in the Android kernel's fingerprint (gf) driver allows a process with access to the fingerprint device interface to corrupt kernel heap memory and gain root-level code execution. The flaw is a heap-based out-of-bounds write in gf_base_update_finger_base() within gf_base.c, exploitable with a low-privileged local context and no user interaction, consistent with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N). Fixes are delivered through the Android/Pixel Security Bulletin dated 2026-09-01; no public exploit code or CISA KEV listing was identified at time of analysis.

An out-of-bounds write in the Wave6 VPU video-decoder driver (Wave6VpuDecFlush in wave6.c) lets an unprivileged local app corrupt kernel memory on affected Android devices, escalating to kernel-level privilege and full device compromise. The flaw requires local code execution - an attacker must already be able to run code on the device and reach the decoder's flush routine - but needs no user interaction and no prior elevated privileges (AV:L, PR:N, UI:N). It is not known to be actively exploited, has no identified public exploit code at time of analysis, and carries a low EPSS score of 0.11% (2nd percentile), making it a serious but locally-scoped privilege-escalation issue rather than an internet-facing emergency.

Remote exploitation of the cellular modem stack in Google Android devices allows an attacker who controls the radio path to trigger a heap-based out-of-bounds write and escalate privileges on the handset, without any user interaction. The supplied CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity and availability impact, but its PR:L metric (low privileges required) conflicts with the vendor description stating that no additional execution privileges are needed. No public exploit code, EPSS score, or CISA KEV entry was included in the intelligence feed, so active exploitation is unconfirmed at the time of analysis.

An out-of-bounds write in the Goodix fingerprint trusted-application test handler (gf_ta_test_set_config in gf_ta_test.c) on Android allows a locally installed application holding low privileges to corrupt memory and escalate to kernel-level privileges without any user interaction. The flaw stems from improper validation of caller-supplied input reaching a memory-write path inside the fingerprint TA interface. Google addressed it in the Pixel security bulletin dated 2026-09-01; no public exploit code or CISA KEV entry was identified at time of analysis.

An out-of-bounds write in the Android kernel, caused by a logic error in multiple code locations, allows code execution in the kernel context with high impact to confidentiality, integrity and availability. The flaw is remotely reachable per the CVSS vector (AV:N/AC:L/PR:L/UI:N) and requires no user interaction, though the vector indicates a low-privileged rather than fully unauthenticated attacker. Google published a fix in the Pixel security bulletin dated 2026-09-01; no public exploit code, EPSS score, or CISA KEV listing was provided in the available intelligence, so active exploitation is not confirmed.

An out-of-bounds write in Android's VP9 hardware decoder (Vp9DecodeFrameTag in vp9hwd_headers.cc) lets a crafted VP9 video stream corrupt memory in the codec context, giving an attacker code execution at the decoder's privilege level. Affected devices are those running Android builds that include the vulnerable VP9 hardware decoding path prior to the September 2026 Pixel security bulletin fix. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation appears to require a motivated actor with a delivery path for malicious media.

An out-of-bounds write in Google's Android Cellular Modem component allows code execution in the baseband when a crafted message is delivered to the modem, with no user interaction required. Google Pixel devices running Android builds prior to the September 2026 patch level are affected, per the Pixel security bulletin. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact); no public exploit code or CISA KEV entry was identified at time of analysis, so the immediate risk is to targeted radio-layer attacks rather than mass exploitation.

An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted PDF or visits a malicious page. The flaw is a user-interaction-dependent memory-safety bug (CWE-125) driven by missing validation of user-supplied data, reported through the Zero Day Initiative as ZDI-CAN-28570. No public exploit code and no CISA KEV listing are present in the available intelligence, and EPSS data was not supplied, so the current risk is driven mainly by the 7.8 CVSS base score and the file-parsing attack surface rather than by observed in-the-wild activity.

Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF parsing logic, allowing a remote attacker to run arbitrary code in the context of the current process. Exploitation is client-side: the victim must open a malicious document or visit a page that delivers one, so an attacker must first convince the user to interact with the file. The flaw carries a CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787) and was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-28673 / ZDI-26-612; no KEV listing or public exploit indicator was present in the supplied intelligence, so no public exploit is identified at time of analysis.

Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the context of the current process when a victim opens a crafted PDF or loads one from a malicious page. The vendor CPE (pdfforge:pdf_architect:*) gives no version boundaries, so all released builds are presumed affected until a fixed release appears. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-28916, advisory ZDI-26-613); at time of analysis there is no CISA KEV entry and no public exploit code identified, and exploitation is gated by the requirement that a user open the malicious document.

Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document in pdfforge PDF Architect, where the PDF parser writes past the end of an allocated buffer (CWE-787). Exploitation requires user interaction - the victim must open the malicious PDF or visit a page that triggers PDF rendering - but needs no prior privileges, and any resulting code runs with the privileges of the PDF Architect process. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-29219 / ZDI-26-614); no public exploit code or CISA KEV listing was present in the supplied intelligence, and no vendor fix version is confirmed in the available data.

Heap-based buffer overflow in Ashlar-Vellum Cobalt during parsing of VS drawing files allows an attacker to execute arbitrary code in the context of the victim's process. Exploitation requires the target to open a crafted VS file (user interaction), and no authentication or server-side access is needed because the flaw sits in the file parser. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor advisory is ZDI-26-587.

Memory corruption in the OGM file parser of OriginLab Origin Viewer (CWE-119) lets an attacker run arbitrary code in the context of the current process when a victim opens a crafted OGM file or is lured to a page that triggers the viewer. Exploitation requires user interaction and executes with the privileges of the logged-on user rather than escalating to SYSTEM, but all three impact metrics (confidentiality, integrity, availability) are rated high, giving a CVSS 3.0 base score of 7.8. Neither public exploit code nor a CISA KEV entry was identified at the time of analysis, so exploitation is currently treated as targeted rather than widespread.

OriginLab Origin Viewer fails to properly validate user-supplied data while parsing OGWU files, resulting in an out-of-bounds write past the end of an allocated buffer. An attacker who convinces a victim to open a crafted OGWU file (or visit a page that loads one) can corrupt memory and execute arbitrary code in the context of the current process, with CVSS 3.0 base score 7.8 (AV:L/AC:L/PR:N/UI:R). No public exploit code or CISA KEV listing was provided in the intelligence feed, so active exploitation is not confirmed, though the local attack vector and required user interaction mean the primary risk is targeted file-delivery attacks such as email attachments or malicious downloads.

Stack-based buffer overflow in the A2DP profile of the BlueZ Linux Bluetooth stack allows a network-adjacent attacker to run arbitrary code as root on a target once a malicious Bluetooth audio device has been paired with it. The flaw lies in stream endpoint (SEP) handling, where attacker-supplied capability strings are copied into fixed-size stack buffers without a length check (CWE-121), so oversized SEP data corrupts the stack in the privileged bluetoothd process. CVSS 7.1 (AV:A/AC:H/PR:N/UI:R) reflects the requirement for a paired device and radio proximity; no public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.

An out-of-bounds heap write in libwebsockets' HTTP/2 HPACK header decoder lets unauthenticated remote attackers corrupt memory on any instance compiled with HTTP/2 support (LWS_WITH_HTTP2) and exposing an HTTP/2 listener. The flaw is a missing bound check in lws_frag_append(), which appends header/path fragments without verifying the write stays within the configured max_http_header_data limit, so a crafted HPACK-encoded request header can overrun the destination buffer and potentially yield code execution in the server process context. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published an upstream fix commit (824151862f37bc72f46d9a3e01d5b9408d313a0b), and while the raw severity is rated 9.8 (CVSS 3.0), the independent assessment scores it CVSS 3.1 AV:N/AC:H, reflecting that the bounded write must still be shaped by heap layout and platform to become reliable arbitrary code execution rather than a crash. Affected: libwebsockets builds with HTTP/2 enabled; HTTP/1.1-only or non-HTTP/2 builds are not reachable through this path.