Buffer Overflow

Denial of service in the tftp-hpa in.tftpd remap engine allows a remote, unauthenticated attacker to crash the TFTP daemon with a single crafted request: when an inverse remap rule also aborts with a non-empty custom error message, invalid regex match offsets are passed into genmatchstring(), producing out-of-bounds reads and writes. The flaw affects tftp-hpa as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, but is only reachable when the daemon is launched with a remap (map-file) configuration containing such a rule, so default installations with no remap file do not exercise the vulnerable code path. At time of analysis there was no public exploit identified and no CISA KEV listing; CVSS rates the issue 7.5 with availability-only impact.

A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delivered by a malicious or compromised queue manager, or by an attacker positioned to man-in-the-middle the client-to-manager channel. Successful exploitation can crash the client for a denial-of-service condition or, more seriously, allow arbitrary code execution in the context of the client process. IBM has released a vendor fix via support bulletin 7284943; there is no public exploit code or CISA KEV entry identified at time of analysis, and the elevated complexity (the attacker must control the server side of the connection) keeps real-world risk below its 8.1 CVSS base score for most deployments.

An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus both container editions) lets an attacker reach the vulnerability over the network without credentials or user interaction, with the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full loss of confidentiality, integrity, and availability if the memory-corruption primitive is successfully converted into code execution or a crash. Affected builds are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001, Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, and the matching Verify Identity Access Container and Security Verify Access Container releases; patched or newer installs are not affected. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE), and EPSS is low at 0.14 percent (4th percentile), so the practical near-term risk is driven by the product's position on the security perimeter rather than by observed attack activity.

Denial of service with possible disclosure of memory contents in IBM MQ (all LTS and CD releases from 9.1.0.0 through 9.4.5.1 and 10.0.0.0) is reachable by a remote attacker who already holds a TLS client certificate the queue manager trusts. Improper validation of deeply nested certificate data during TLS certificate processing produces a stack-based buffer overflow (CWE-121) that can crash the queue manager and potentially expose fragments of process memory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has released fixes via its support advisory.

Heap-based buffer overflow in FreeRDP client versions before 3.31.0 allows a malicious or compromised RDP server to corrupt client memory by sending a Server Redirection PDU whose LoadBalanceInfo field is longer than the fixed 512-byte heap buffer used in nego_send_negotiation_request. Successful exploitation crashes the client and, when chained with a memory-disclosure primitive, could lead to code execution on the connecting workstation. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record, so current exploitation appears opportunistic rather than confirmed in the wild.

FreeRDP clients prior to 3.31.0 leak uninitialized heap memory through the urbdrc USB-redirection channel when a malicious RDP server forces USB transfers to fail, handing the attacker reliable client-side memory contents. The disclosure is a high-severity confidentiality weakness (CWE-457) that defeats ASLR and becomes remote code execution only when chained with a separate memory-corruption flaw in the client. Publicly available exploit code exists per CISA's SSVC assessment (Exploitation: poc), and SSVC rates technical impact as partial and automatable as no, meaning exploitation is feasible but requires an attacker-controlled RDP server plus a victim who initiates the connection.

Let me synthesize. CVE-2026-91959: FreeRDP buffer over-read in rts_read_result (RPC gateway transport parser), truncated BIND_ACK PDU result entry → OOB read → process abort (DoS). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H — network, no privileges, passive UI (UI:P means user must perform... in CVSS 4.0, UI:P = Passive, meaning the user just needs to interact minimally, like a client connecting), high availability impact only. So no confidentiality/integrity impact despite the "Information Disclosure" tag — actually the tag "Information Disclosure" seems mislabeled since VC:N. Hmm — buffer over-read could disclose memory, but the CVSS says VC:N. The description says process abort (DoS). So the tag "Information Disclosure" is arguably mislabeled — but do I want to emit a data_quality_flag? The tags list: "Buffer Overflow, Information Disclosure, Freerdp". "Buffer Overflow" is arguably wrong too — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag on an over-read is a mislabel... The instructions say only emit a flag when the input metadata is clearly wrong and verifiable. Information Disclosure: an OOB read technically can leak memory, but CVSS says VC:N and description says process abort. I'd say low confidence. Buffer Overflow mislabel — CWE-125 is "Out-of-bounds Read", which is distinct from buffer overflow (CWE-787/CWE-120). Hmm, but many tag taxonomies lump them. I'll emit one flag with medium confidence for "Information Disclosure"? Actually the guidance says flags should be high-confidence and verifiable. Maybe emit a flag for "Buffer Overflow" as mislabeled_tag with suggested "out-of-bounds-read"... but 'suggested' is "the correct/canonical slug if you know it". Hmm. I think I can include one flag with medium confidence. Risk: noise. The instructions say empty array is common and correct. Given CWE-125 ≠ buffer overflow and CVSS shows VC:N (no info disclosure), I think two tags are arguably mislabeled. But

Client-side denial of service in FreeRDP before 3.31.0: the URBDRC (USB redirection) channel's func_get_ep_desc function indexes interface arrays by positional offset instead of the protocol's InterfaceNumber field, so a malicious or compromised RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values and trigger an out-of-bounds heap read that crashes the connecting client. The flaw only degrades availability (no confidentiality or integrity impact per the CVSS 4.0 vector), requires the victim to initiate a session against the hostile server, and no public exploit code or active exploitation has been reported at time of analysis. It is a targeted-attacker nuisance rather than a mass-exploitation risk, but patching to 3.31.0 is straightforward.

FreeRDP versions before 3.31.0 contain a heap buffer overflow in the client-side negotiation routine nego_send_negotiation_request(), which writes the server-supplied LB_LOAD_BALANCE_INFO field into a fixed 512-byte buffer without checking its length. A malicious RDP server — or an attacker positioned as a man-in-the-middle — can trigger the overflow by replying to a client's connection attempt with a Server Redirection PDU carrying an oversized LB_LOAD_BALANCE_INFO value, corrupting heap memory before authentication even completes. The confirmed impact is denial of service or heap corruption (CVSS 7.1, availability-only); no public exploit code and no CISA KEV listing were identified at time of analysis.

An out-of-bounds write in FreeRDP's urbdrc (USB redirection) client channel allows a malicious or compromised RDP server to crash the connecting client. When the client loads the urbdrc channel, a crafted 28-byte USB redirection message drives urb_send_current_frame_number_result() to write 4 bytes past a 16-byte heap buffer, which trips an assertion (CWE-617) and terminates the process on builds with verbose asserts enabled. The flaw affects FreeRDP 3.14.0 through 3.30.0 and is fixed in 3.31.0; impact is availability only, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Let me produce the JSON. Key facts: - CVE-2026-91950, FreeRDP before 3.31.0 - OOB read in rdpdr_dump_packet due to 32-bit unsigned integer wraparound in buffer bounds validation - computerNameLen = 0xFFFFFFF0 bypasses bounds check → OOB read → client crash or heap disclosure in logs - CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CWE-125 - VulnCheck reported - CPE: freerdp:freerdp all versions (up to before 3.31.0) - Tags: Buffer Overflow, Information Disclosure, Freerdp - References: GitHub security advisory GHSA-c5gr-hmqp-pwj4, VulnCheck advisory No EPSS, no KEV, no POC mentioned. Attack requires the client to connect to a malicious RDP server — UI:P (passive user interaction: the user connects to the server). PR:N. No privileges. AV:N because the malicious server is remote. Exploitation conditions: attacker must control/operate the RDP server the client connects to; requires the RDPDR (device redirection) virtual channel to be enabled/active — in FreeRDP, rdpdr is used for drive/printer/port redirection and is typically negotiated when the client has redirection enabled. Also the dump/log path (rdpdr_dump_packet is a debug dump function) — so triggering the crash likely requires the rdpdr debug logging/dump enabled? Hmm. The function rdpdr_dump_packet is a dumping function, likely compiled when WITH_DEBUG_RDPDR or verbose logging is enabled. Actually in FreeRDP, rdpdr_dump_packet exists in rdpdr_main.c guarded by... let's be careful. I'd say the OOB read occurs during packet dump/parsing on logging, so higher log verbosity may be required. I should state this as an inference and flag uncertainty. Remediation: upgrade to FreeRDP 3.31.0 or later; advisory link. Workarounds: disable device redirection (rdpdr), avoid connecting to untrusted RDP servers, reduce log verbosity, remove /drive /printer flags. Trade-offs. Prevalence: FreeRDP is widely deployed as the RDP client in Linux distros, ThinLinc, etc. — high (widely depl

Heap memory corruption in FreeRDP's server-side static virtual channel handling (all versions before 3.31.0) allows an authenticated RDP client to send channel messages larger than the expected chunk size, triggering an integer underflow that corrupts heap memory and can overwrite live pointers, potentially yielding code execution on the RDP server. Reachability is gated on the server enabling CHANNEL_OPTION_SHOW_PROTOCOL for the channel, and on the attacker already holding a valid session, so this is a post-authentication, configuration-dependent flaw rather than a pre-auth RCE. A vendor fix is available in 3.31.0 via upstream commit 40d9202, and no public exploit code or confirmed active exploitation was identified at time of analysis.

The user wants a JSON analysis. Let me note the details. CVE-2026-91945: FreeRDP before 3.31.0, OOB read in smartcard response decoders failing to validate ATR length fields. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses. CVSS 7.1, CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. CWE-125. Patch available from vendor, commit 9626564421df72c84f891afdbc0b20bf702f369f. Reported by VulnCheck. Note: the commit diff shown appears unrelated to the actual fix (CMakeLists.txt winpr change) — that's a data quality flag potentially. Actually the diff snippet seems to be CMake version check — not the actual security fix. Hmm. Could mention in confidence notes as suspicious/mismatched patch reference. But careful — the diff is truncated; only showing part. I could flag it. Tags: Buffer Overflow, Information Disclosure, Freerdp. "Buffer Overflow" is arguably a mislabel — CWE-125 is out-of-bounds read, not a buffer overflow (write). Hmm, "Buffer Overflow" tag could be considered mislabeled. That's a plausible data_quality_flag: mislabeled_tag target "Buffer Overflow", suggested "out-of-bounds-read". Confidence medium. Actually the instructions say only emit flag when clearly wrong and verifiable from references. CWE-125 out-of-bounds read is a memory read, not a classic buffer overflow (CWE-120/787 write). Description explicitly says "out-of-bounds read" causing process termination. So the "Buffer Overflow" tag is misleading. I'd emit a medium-confidence flag. Also "freerdp" tag present as "Freerdp" — it's lowercase normalized presumably fine. Missing tags? Possibly "smartcard"? Not a standard tag. Maybe "cwe-125"? Not necessarily. I'll skip missing tags. Prevalence: FreeRDP is a widely used open-source RDP client library — high? It's used in many Linux distributions, thin clients, etc. I'd say "high" or "medium". FreeRDP is the de facto open source RDP implementation, bundled in distros, used by ma

Heap-based buffer overflow in Ghostscript's JPEG 2000 (JPX) stream decoder (base/sjpx_openjpeg.c) allows unauthenticated remote attackers to corrupt memory, and potentially achieve code execution, by supplying a crafted PDF containing a JPEG 2000 image whose components declare mismatched subsampling factors. All Ghostscript/GhostPDL releases before 10.08.0 are affected; exploitation requires only that the target render the malicious file, which is effectively automatic in server-side pipelines such as CUPS/print spoolers, ImageMagick/GhostPDL conversion services and web PDF renderers, while desktop use requires a victim to open the document. Vendor-released patch: Ghostscript 10.08.0; no public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV), though the CVSS 4.0 base score of 9.3 reflects the trivial attack complexity and the high confidentiality, integrity and availability impact of a heap allocator corruption primitive.

Memory corruption in Mozilla Firefox's Networking component can be triggered when the browser processes crafted or malformed network data, giving an attacker who controls the data path a possible route to code execution inside the content process. All Firefox builds before 156 and Firefox ESR builds before 153.3 are affected; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3. Reaching the bug requires the victim to actively browse to an attacker-controlled site or route traffic through a malicious or MITM'd endpoint, and exploitation further depends on winning a heap-layout/memory-corruption primitive, with any resulting execution initially confined to the sandboxed content process; no public exploit code is identified at time of analysis and EPSS is low at 0.15% (5th percentile). Note that the two CVSS vectors in circulation disagree - the NVD-supplied vector (8.8, AV:L/AC:L/PR:L) implies prior local low-privilege access, whereas the independent reassessment (AV:N/AC:H/PR:N/UI:R) describes the more plausible remote-web-content path, and that discrepancy should be resolved with Mozilla before finalising exposure decisions.

Memory-safety corruption in Mozilla Firefox's Safe Browsing component can be triggered when a victim loads attacker-controlled web content on any Firefox build before 156 or Firefox ESR before 153.3. The assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.0) shows the vulnerability is network-reachable with low complexity, but exploitation is gated by mandatory user interaction - the victim must visit or load content that the Safe Browsing component processes. No public exploit code has been identified at time of analysis and EPSS is low (0.14%, 4th percentile), but a browser memory-corruption bug with high C/I/A impact warrants prompt patching; Mozilla fixed it in Firefox 156 and Firefox ESR 153.3.

Sandbox escape in Mozilla Firefox on Windows allows attacker-supplied web content to break out of the content-process sandbox through the browser's 'Widget: Win32' native window-handling code, stemming from incorrect boundary conditions that produce an out-of-bounds memory condition. It affects Firefox versions before 156 and Firefox ESR versions before 153.3 running on Windows, and although the vendor rates it 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), our independent reassessment applies AC:H because a successful escape also requires chaining this flaw with a separate content-process memory-corruption bug to first achieve code execution inside the renderer - the escape alone grants no execution. Exploitation is unauthenticated at the network vector but requires the victim to load attacker-controlled content (UI:R), no public exploit code has been identified at time of analysis, and the EPSS score is low at 0.14% (4th percentile).

Sandbox escape in Mozilla Firefox on Windows stems from an incorrect boundary condition (CWE-119) in the Win32 Widget component, allowing an attacker who already has code execution inside a content/child sandbox to escape and gain high-impact code execution, data access, and availability impact. It affects Firefox before 156 and Firefox ESR before 153.3, with patched builds available as Firefox 156 and Firefox ESR 153.3. No public exploit or active exploitation is identified, and EPSS is low at 0.14% (4th percentile), but the CVSS score is 8.8 and exploitation is chain-dependent, typically requiring a separate content-process memory-safety bug to reach this escape stage.

Sandbox escape in Mozilla Firefox on Windows, in the Widget: Win32 component, lets an attacker who already holds low-privileged code execution inside a Firefox content/child process corrupt memory via an incorrect boundary condition (CWE-119) and break out of the browser sandbox into full user-level code execution. The flaw is Windows-only - the Win32 widget code path does not exist on macOS or Linux - and patched builds (Firefox 156 and Firefox ESR 153.3) are not exploitable; there is no public exploit identified at time of analysis and EPSS is low at 0.14% (4th percentile). Because this is a second-stage sandbox-escape primitive rather than a standalone remote bug, it is not independently exploitable against a default install without a preceding content-process compromise.

Memory corruption in Mozilla Firefox's Process Sandboxing component, caused by incorrect boundary conditions, can be triggered when a victim browses attacker-controlled web content on any Firefox version prior to 156. Although the input feed carries a nominal CVSS of 9.8 and a CWE-119 (buffer bounds) classification, our assessment reduces the practical severity to AV:N/AC:H/PR:N/UI:R because successful exploitation requires the user to render malicious content and then reach and corrupt the targeted sandbox code path, which realistically implies chaining with a content-process compromise. No public exploit code has been identified and the flaw is not in CISA KEV, with an EPSS score of just 0.14% (4th percentile), indicating low near-term exploitation likelihood despite the high theoretical impact. The issue is unauthenticated from a network standpoint (PR:N) but is not zero-interaction.

Improper boundary conditions in the DOM Editor component of Mozilla Firefox can corrupt memory when a user renders crafted web content, allowing an attacker to potentially execute code inside the browser's content process. All Firefox builds before 156 and Firefox ESR builds before 153.3 are affected; the CVSS vector sets PR:N, so unauthenticated remote delivery is possible, but the assessed exploitation path requires the victim to load attacker-controlled page content (UI:R) and reliable exploitation of a memory-corruption bug typically needs heap grooming and a sandbox escape to affect the host. No public exploit code has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), so despite the 9.3 base score the practical real-world priority is moderate, driven mainly by the browser's ubiquity and the fact that the fix is already shipped.

Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.

Sandbox escape in Mozilla Firefox's Widget:Win32 component on Windows allows code that is already running inside the browser's content/renderer sandbox to break out and execute on the host with the user's privileges, escalating a limited renderer compromise into full desktop compromise. It does not stand alone: an attacker must first obtain code execution in the content process via a separate bug, then trigger the boundary-condition memory corruption, and a victim must load attacker-controlled web content (CVSS 9.0, PR:L, UI:R, S:C). Vendor fixes are Firefox 156 and Firefox ESR 153.3; EPSS is only 0.15% (5th percentile) and no public exploit code or confirmed active exploitation has been identified, so the high base score should be weighed against the multi-stage, Windows-only prerequisites.

Sandbox escape in Mozilla Firefox (all versions before 156) and Firefox ESR (before 153.3) allows an attacker who gets malicious web content processed by the browser's WebRTC stack to break out of the sandboxed content process and run code with the privileges of the parent/broker process, yielding high confidentiality, integrity and availability impact. Exploitation is not trivial: the victim must load attacker-controlled content and, because the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, the bug realistically functions as a chain component on top of a renderer-level compromise rather than a single-shot webpage exploit. There is no public exploit identified at time of analysis, CISA KEV does not list it, and EPSS is only 0.15% (5th percentile), so the practical near-term risk sits below the 9.6 base score headline; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3.

A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.

Incorrect boundary conditions in the Firefox DOM Animation component (CWE-119) allow remote attackers to corrupt memory in the browser process of any default Firefox build prior to version 156, with Mozilla scoring the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) - the profile of a potential remote code execution issue. Exploitation requires the victim to load attacker-controlled web content (or attacker-supplied markup such as malvertising) that exercises the affected animation code path, so practical delivery is gated by victim interaction even though the vendor vector lists UI:N; our independent assessment therefore scores it UI:R while keeping confidentiality, integrity, and availability impact High. There is no KEV listing and no public exploit code identified at time of analysis, and EPSS is only 0.15% (5th percentile), indicating low observed exploitation likelihood measured against the high theoretical severity. No authentication or special target configuration is needed - any unpatched Firefox install is exposed.

Memory corruption in Mozilla Firefox's HTTP networking component (CWE-119) allows an attacker who controls the content of an HTTP response - for example via a malicious or compromised web server, or by man-in-the-middle position - to corrupt Firefox's memory and potentially achieve code execution in the browser process on a victim running Firefox before 156. The issue is a client-side networking-stack flaw rather than a remotely reachable server service: exploitation requires the user to initiate and complete the malicious HTTP exchange, which is why the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H while the vendor/NVD vector lists UI:N at 9.8. No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.15%, 5th percentile), and the flaw is closed by the regular Firefox 156 update, which sharply limits the exposure window.

Mozilla Firefox versions prior to 156 (and Firefox ESR prior to 153.3) contain a buffer-boundary flaw in the Graphics component that can be leveraged to escape the browser's content-process sandbox and reach the host, explaining the vendor's critical 9.6 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) - the scope change reflects a crossing from the constrained renderer process into the host, with full confidentiality, integrity and availability impact. Exploitation is not standalone: it requires a victim to load attacker-controlled web content (UI:R is mandatory) and, in practice, must be chained after an attacker has already achieved code execution inside the Firefox content process, which is why the independent assessment raises attack complexity to AC:H while leaving the 9.6-level impact intact. There is no KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.15% (5th percentile), but the vendor-released fixes - Firefox 156 and Firefox ESR 153.3 - should be applied promptly given the sandbox-escape nature of the flaw.

Sandbox escape in Mozilla Firefox's Graphics component, rooted in an invalid-pointer memory-safety flaw (CWE-119), allows attacker-controlled content loaded by a victim to cross the browser's process-sandbox boundary and reach the privileges of the parent/broker process. Default configurations of Firefox before 156 and Firefox ESR before 140.16 / 153.3 are affected; the vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) indicates no authentication or privileges are required, but the victim must load attacker-controlled content (UI:R). No public exploit code has been identified at time of analysis and EPSS is low (0.16%, 5th percentile); the real-world bar is further raised because a sandbox escape of this class generally has to be chained with a separate content-process memory-corruption primitive to be exploited end-to-end.

An incorrect-bounds condition in Firefox's WebRender graphics component lets crafted web content corrupt memory inside the browser, giving the attacker a path to code execution and privilege escalation on the affected system. All Firefox releases before 156 are affected, along with the ESR branches before 115.41, 140.16, and 153.3; exploitation requires the victim to load attacker-influenced content (CVSS UI:R), and no public exploit code or CISA KEV entry has been recorded at time of analysis. With a CVSS base of 8.8 across full confidentiality, integrity, and availability impact, this is a high-severity browser flaw that should be patched on a normal browser-update cadence.

Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.

Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a crafted web page corrupt memory and gain privileges beyond those normally granted to web content. Exploitation requires the victim to open a malicious page in an affected Firefox build (network vector, no authentication, user interaction required), after which an attacker can achieve high confidentiality, integrity and availability impact. Mozilla fixed the flaw in Firefox 156, Firefox ESR 115.41, ESR 140.16 and ESR 153.3; CISA SSVC records no known exploitation and the issue is not considered automatable, and no public exploit code has been identified at time of analysis.

A boundary-condition error in Firefox's Graphics: CanvasWebGL component allows an attacker who lures a victim to a crafted web page to corrupt memory and escalate privileges, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact. The flaw is a classic buffer overflow (CWE-120) in the WebGL/Canvas rendering path, reachable over the network with no authentication but requiring user interaction (UI:R) in the form of visiting attacker-controlled content. Mozilla has shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3, and no public exploit code or active exploitation has been identified at time of analysis.

A memory-corruption flaw in Mozilla Firefox's CanvasWebGL graphics component (incorrect boundary conditions, CWE-120) allows a remote attacker to crash or corrupt the browser's heap and potentially escalate privileges beyond the normal content-process security boundary. Every Firefox release before 156 and every ESR branch before 115.41, 140.16, and 153.3 is affected, and exploitation requires the victim to load attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code and no active exploitation are reported at time of analysis — CISA's SSVC records Exploitation: none and Automatable: no, so this is a patch-priority issue rather than an emergency.

Memory corruption in Mozilla Firefox's Graphics: CanvasWebGL component lets a web page that renders attacker-crafted WebGL content corrupt memory and escalate out of the browser's restricted process, yielding code execution at higher privilege. All Firefox builds before 156 are affected, with ESR branches fixed in 115.41, 140.16, and 153.3. No public exploit code exists and CISA SSVC records exploitation as 'none', so this is a high-severity patch-now bug rather than an active campaign.

An out-of-bounds write in Firefox's Graphics: CanvasWebGL component lets a malicious web page corrupt memory and gain elevated privileges on the host, affecting Firefox builds prior to 156 and the ESR branches prior to 115.41, 140.16, and 153.3. Exploitation is remote but requires the victim to load attacker-controlled WebGL/Canvas content (CVSS UI:R), so it is not automatable and no public exploit code or active exploitation has been identified at time of analysis. Mozilla rated it High (CVSS 8.8) with total technical impact under CISA's SSVC framework.

Incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allow a remote attacker who convinces a user to open a crafted page to corrupt memory and achieve code execution with the privileges of the browser. The flaw is a classic buffer overflow (CWE-120) rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), meaning no authentication is needed but the victim must load attacker-controlled content. Mozilla fixed it in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3; no public exploit code has been identified and CISA's SSVC assessment records no active exploitation.

Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a remote, unauthenticated attacker corrupt memory via malformed WebGL content and gain elevated code execution inside the browser process, provided the victim loads an attacker-controlled page. Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3 (mfsa2026-90 through mfsa2026-93). CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CISA SSVC records Exploitation: none and Automatable: no, no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.

A memory-safety flaw in the Graphics: CanvasWebGL component of Mozilla Firefox allows a crafted web page to corrupt memory and escalate privileges beyond the browser's normal security boundary. Because exploitation only requires the victim to load attacker-controlled WebGL/Canvas content in an unpatched Firefox build, the issue affects all mainstream, ESR 115, ESR 140, and ESR 153 release trains prior to the fixed versions. Mozilla has released Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the CWE-120 buffer-condition root cause and CVSS 8.8 rating make prompt patching important.

Stack-based buffer overflow in the rzgl_asp CGI handler of D-Link DI-8300 firmware 16.07 lets a remote attacker who can reach the device's web management interface (and, per the CVSS vector, holds high/admin privileges) crash or execute code on the router by supplying an oversized redirct_url parameter to /rzgl.asp. Publicly available exploit code exists, so the vulnerability is trivially reproducible, although no CISA KEV listing or confirmed in-the-wild campaign is reported. The device is a legacy D-Link gateway, and no vendor patch or advisory was found in the supplied references.

Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overwrite stack memory via oversized input to any of eight parameters - serv, user, host, wild, mx, bmx, cust, or ip - handled by the ddns_asp() function at the /ddns.asp DDNS configuration endpoint. Successful exploitation can yield arbitrary code execution on the device, giving an attacker full control over the router. A public exploit script exists on GitHub (ddns_asp.py), and no vendor-released patch has been identified at time of analysis.

Stack-based buffer overflow in GNU libextractor before 1.15 allows remote, unauthenticated attackers to crash any application that uses libextractor to extract metadata from a crafted StarOffice document. The vulnerability resides in the process_star_office function, which allocates a variable-length stack array sized from attacker-controlled OLE2 stream data - enabling up to 4 MB of forced stack allocation, exhausting stack space and causing a process crash. A publicly available exploit exists (referenced as libextractor-ole2-rce on GitHub), and a vendor patch has been released in version 1.15, though no CISA KEV listing has been identified at time of analysis.

Kernel-level use-after-free in Apple's built-in NFS client allows memory corruption when a device connects to an attacker-operated NFS server, affecting iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires the victim to mount or connect to a malicious NFS share (UI:R) but no credentials or privileges on the target device, making this a remote, unauthenticated-against-the-client attack that terminates in kernel memory corruption with high confidentiality, integrity and availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis; EPSS is low at 0.18% (8th percentile), and CISA SSVC rates exploitation as none and automatable as no, though technical impact is total. Apple has released fixes in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27.

Out-of-bounds write in Apple's file-parsing code affects iOS/iPadOS 27 and earlier, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, allowing a maliciously crafted file to corrupt memory when processed. Apple addressed the flaw with improved bounds checking across all listed platforms, and CVSS 3.1 scores it 7.8 (AV:L/AC:L/PR:L/UI:N) with high confidentiality, integrity, and availability impact, even though the advisory text itself describes only unexpected app termination. No publicly available exploit code and no CISA KEV listing were identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating low near-term exploitation likelihood.

Out-of-bounds memory access in the macOS SMB client kernel component allows a malicious or compromised SMB server to corrupt kernel memory when a victim connects to it, resulting in unexpected system termination or potentially kernel-level code execution. All macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27 are affected. Apple has released fixed versions (support.apple.com advisories 149035, 149042, 149043); no public exploit code has been identified and EPSS is low at 0.17% (6th percentile), though the flaw is unauthenticated from the network perspective and requires only that the victim initiate an SMB connection.

An out-of-bounds write (CWE-787) in the Apple frameworks that parse 3D model files lets a maliciously crafted model corrupt memory when it is opened on an affected device, potentially giving the attacker code execution in the context of the processing application. The flaw affects iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate 27, tvOS before 27, visionOS before 27 and watchOS before 27, and Apple has shipped fixes for all of them. Exploitation likelihood is low: EPSS is 0.17% (7th percentile), CISA SSVC records exploitation as 'none' and the vulnerability is not in KEV — no public exploit code has been identified, and the local attack vector with required user interaction makes mass exploitation unlikely.

Kernel memory corruption in Apple macOS can be triggered when a user mounts a maliciously crafted disk image, causing unexpected system termination or corruption of kernel memory. Apple addressed the CWE-120 buffer overflow with improved bounds checking in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. No public exploit code and no active exploitation have been identified, and the EPSS score is low (0.21%, 12th percentile), so practical exposure is dominated by local file-delivery scenarios rather than remote mass exploitation.

Kernel-level out-of-bounds write (CWE-787) in the macOS SMB client stack allows a malicious SMB server to corrupt kernel memory when a target Mac connects to it, potentially yielding kernel code execution or a system crash. All macOS branches are affected: Sequoia before 15.8, Tahoe before 26.7, and macOS Golden Gate versions before 27. Apple has released patches for all three branches; there is no public exploit code identified, no CISA KEV listing, and EPSS is low (0.17%, 6th percentile), so exploitation is currently assessed as targeted/manual rather than widespread.

An out-of-bounds read in Apple's kernel (CWE-125) lets an app already running on the device read past the end of a kernel buffer, potentially leaking kernel memory or crashing the system. Affected platforms span iOS/iPadOS before 26.6.1, macOS Sequoia before 15.8, macOS Tahoe before 26.6.2, and tvOS, visionOS and watchOS before 27, with a CVSS 3.1 base of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), so this is a local, app-mediated kernel hardening issue rather than a remotely exploitable emergency.

Kernel memory corruption in Apple macOS disk image handling allows an attacker to crash the system or corrupt kernel memory when a user mounts a maliciously crafted disk image; affected versions are all macOS releases before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. Exploitation requires the victim to actively mount the image (UI:R) with no authentication needed (PR:N), and no public exploit code has been identified at time of analysis. Apple has released fixes, and EPSS is low (0.21%, 12th percentile), making this a genuine but not urgent patch priority.

An out-of-bounds read in the macOS kernel NFS client can terminate the system or corrupt kernel memory when the host connects to a malicious NFS server, and it affects macOS releases before Golden Gate 27, Tahoe 26.7, and Sequoia 15.8. The vendor rates it 7.5 (AV:N/AC:L/PR:N/UI:N), while our assessment adjusts to require user interaction (UI:R) because the victim host must mount or auto-mount an attacker-controlled NFS export - this is a client-side, attacker-server-initiated condition, not a remote hit against a listening service. No public exploit code was identified at time of analysis and EPSS is 0.20% (10th percentile); demonstrated impact is availability only, since code execution is not established. Apple has released vendor fixes.

Processing a maliciously crafted disk image on an unpatched Apple macOS system can trigger an out-of-bounds read that terminates the affected application unexpectedly. The issue affects macOS releases before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and requires a local user with no privileges (PR:N) to open or mount the crafted image, meaning user interaction (UI:R) is the trigger rather than remote network access. Apple has shipped fixes in the three affected release trains, and there is no public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile), reflecting the local, interaction-dependent nature of the issue.

Kernel memory corruption in the macOS Apple Filing Protocol client (afpfs) can be triggered when a user connects to a malicious AFP server, for example by following an afp:// link or using 'Connect to Server'; the underlying out-of-bounds write is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8 and macOS Tahoe 26.6. Exploitation is conditional rather than broadly wormable: the attacker is unauthenticated (PR:N) but must still induce the victim to initiate the AFP connection (UI:R), and any host running the patched builds is not affected. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.20% (10th percentile), so this is a genuine but socially mediated client-side kernel flaw rather than a mass-exploitation candidate.

An out-of-bounds read in Apple macOS lets a locally running application read kernel memory or trigger unexpected system termination, and is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation is bounded by the CVSS vector (AV:L/AC:L/PR:L/UI:N) - the attacker must already have code executing as a local app on the host and no user interaction is needed - making this a post-access information-disclosure and denial-of-service primitive rather than a remote entry point. EPSS is only 0.17% (6th percentile) and no public exploit has been identified at time of analysis, consistent with a genuine but non-urgent local privilege issue.

An out-of-bounds read in Apple macOS allows memory disclosure and potential denial-of-service when the system processes a maliciously crafted 3D file, and is addressed by improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, 7.1) confirms the path is local and unauthenticated but requires the victim to open or parse attacker-supplied content, so exploitation depends on social-engineering delivery rather than any remote/network-triggerable route. No public exploit code or confirmed active exploitation was identified at time of analysis, EPSS is a low 0.19% (9th percentile), and this is assessed as a moderate, not urgent, priority for fleets that have not yet patched.

An integer overflow in Apple macOS document processing can trigger an out-of-bounds read when a user opens a maliciously crafted file, resulting in potential disclosure of adjacent memory contents and/or a crash of the affected application. Affected versions are macOS releases below Golden Gate 27, below Tahoe 26.7, and below Sequoia 15.8; exploitation requires local handling of the crafted document plus mandatory user interaction (the victim must open the file), and no privileges are required per the CVSS vector (PR:N), but there is no remote or network-service exposure. Apple has released patched versions (Golden Gate 27, Tahoe 26.7, Sequoia 15.8), and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-likelihood, user-interaction-dependent flaw, and the realistic impact is bounded to memory disclosure or denial of service rather than code execution.

An out-of-bounds memory access in the Apple kernel allows a locally installed app to crash the system or corrupt kernel memory on iOS/iPadOS, macOS, tvOS, visionOS, and watchOS releases prior to the 27-series. The flaw is reachable only by an attacker who already has code executing as an app on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), for example a malicious, sideloaded, enterprise-provisioned, or trojanized application - there is no remote or unauthenticated network path, and no user interaction beyond launching the app is required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile), and the realistic ceiling absent a follow-on kernel exploit chain is a device crash. Vendor patches are available in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.

Memory corruption during 3D model parsing on unpatched Apple platforms (iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8 / Tahoe before 26.7 / Golden Gate 27, and tvOS, visionOS, watchOS before 27) allows an attacker who can get a victim to open or preview a maliciously crafted 3D model file to corrupt memory, potentially leading to code execution in the context of the parsing process with high confidentiality, integrity, and availability impact. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.3), so the practical barrier is user interaction - the target must parse the crafted asset locally; there is no remote unauthenticated network path, and no public exploit code has been identified at time of analysis (EPSS 0.20%, 10th percentile). Apple has shipped fixes; this is a genuine but moderate-priority issue rather than a top-tier emergency, since exploitation depends on social engineering plus a locally delivered file.

Local kernel memory corruption in Apple's 26.x operating-system family (iOS and iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) allows an installed, running application to write to kernel memory or trigger unexpected system termination, with the flaw fixed in the 26.6 releases. The bug requires the victim to install and run a malicious or compromised app - it is not reachable over the network and needs no user interaction beyond launching that app (CVSS 7.8, AV:L/PR:L/UI:N) - and Apple's sandbox, notarization and App Review keep the delivery bar high, though a successful kernel-write primitive carries high confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low near-term exploitation likelihood relative to the severity of the primitive itself.

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate), tvOS, visionOS, and watchOS - lets a remote attacker corrupt memory in an affected process, with the confirmed outcome being an application crash and the potential outcome being arbitrary code execution. Exploitation requires no authentication and no user interaction per the CVSS vector (AV:N/PR:N/UI:N), but the independent assessment rates attack complexity as High and the confirmed technical impact as limited to denial of service, because the specific component or content-processing surface that must be reached has not been documented and reliable code execution is unproven. Apple has released fixed builds for every affected platform, and no public exploit code or active exploitation has been identified at time of analysis; EPSS is a modest 0.99% (61st percentile), which is consistent with a patched, non-weaponized memory-safety defect rather than a top-tier emergency.

Integer overflow in the macOS kernel NFS client can be triggered when an unpatched Mac connects to or mounts a share from a malicious or spoofed NFS server, leading to kernel memory corruption or unexpected system termination. Affected systems are macOS releases below Sequoia 15.8, Tahoe 26.7, and Golden Gate 27 (CPE cpe:2.3:a:apple:macos). The flaw is availability-only (CVSS 3.1 base 7.5; our assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), requires no credentials on the target but does require the victim to initiate an NFS client session, and is best exploited by an attacker positioned to serve or impersonate an NFS endpoint the victim reaches; no public exploit code has been identified at time of analysis, EPSS is low at 0.17% (6th percentile), and the issue is not in CISA KEV. Apple has released fixes, so patching removes the exposure entirely.

An out-of-bounds write in Apple macOS lets a malicious or compromised app running as a normal, unprivileged user corrupt memory and escalate to root privileges on the affected system. The flaw is fixed in macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8; all earlier releases of those branches remain exposed (CWE-787, CVSS 7.8, AV:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and non-automatable, so practical risk is currently confined to local post-compromise privilege escalation rather than mass remote attacks.

Kernel out-of-bounds write in Apple macOS exFAT volume handling lets a local attacker who can get a maliciously crafted exFAT-formatted volume mounted - such as removable USB media or a disk image - trigger unexpected system termination (kernel panic) or disclose kernel memory. Only macOS builds below macOS Golden Gate 27 are affected; Apple fixed the flaw with improved bounds checking in macOS Golden Gate 27. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS is 0.14% (3rd percentile), and the attack is locally gated, requiring physical, removable-media, or delivery-based access rather than network reach.

Memory corruption in Apple's image-handling code across iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27 allows an attacker to achieve arbitrary code execution when a user processes a maliciously crafted image. Apple removed the vulnerable code entirely in the 27-generation releases, which are the only versions containing the fix; all earlier supported builds remain affected. The flaw is rated 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), meaning exploitation needs local positioning plus some user interaction, and there is no public exploit code or CISA KEV entry identified at time of analysis.

Kernel memory corruption in Apple macOS before Sequoia 15.8, Golden Gate 27, and Tahoe 26.7 can be triggered by a remote attacker, leading to unexpected system termination or kernel memory corruption. Exploitation requires network reachability to an unidentified service with no authentication or user interaction, though the assessed attack complexity is high (AC:H) and the exact trigger surface is unconfirmed. Apple has released patched versions, and no public exploit code has been identified; EPSS is low at 0.29%.

Memory corruption in Apple macOS WebDAV client handling allows code execution when a user connects to an attacker-controlled WebDAV server, affecting macOS versions prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. The flaw is an out-of-bounds write (CWE-787) reachable over the network but gated by user interaction, rated 8.8 by Apple/NVD with an unauthenticated network attack vector. Apple has released fixes in three OS updates, and exploitation is not confirmed — no public exploit code and no CISA KEV listing — while EPSS sits at 0.18% (8th percentile), indicating low predicted mass-exploitation activity; this reads as a credible but targeted risk rather than a wormable event.

Kernel memory corruption in Apple's iOS, iPadOS, and macOS allows a local attacker who can already execute code on the device to cause unexpected system termination or corrupt kernel memory, as described by the vendor's improved memory handling fix. Affected builds are iOS and iPadOS before 26.7 (and before 27), plus macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27; all are remediated by the corresponding vendor updates. Exploitation requires a prior on-device foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so this realistically functions as a privilege-escalation or sandbox-escape stage rather than an initial-access vector - no public exploit has been identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.16% (6th percentile). It is a genuine but not top-tier priority: the impact is high if chained, but the barrier of local code execution limits reach.

An out-of-bounds read in Apple macOS versions prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27 can allow a locally executed application to crash a process or disclose its memory contents. The vulnerability requires a local attacker with low privileges (PR:L) and is not remotely exploitable; there is no network exposure. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.19%, indicating limited immediate risk.

An out-of-bounds read in Apple's operating system kernel lets a local user or a malicious/compromised app running on an affected device disclose kernel memory or crash the system, carrying a vendor CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). The flaw affects iOS and iPadOS before 26.7/27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and tvOS, visionOS and watchOS before 27; exploitation requires local code execution (AV:L, PR:L), there is no remote or network-triggerable path and no user-interaction requirement. Vendor-released patches addressing the issue are available in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code has been identified at time of analysis and EPSS is low at 0.20% (10th percentile), so this reads as a boundary/isolation bypass rather than an initial-access vector.

An out-of-bounds write in Apple's 3D model handling code causes memory corruption on unpatched iPhones, iPads, Macs, Apple TVs, Apple Vision Pro and Apple Watches when a maliciously crafted 3D model file is processed by the device. The flaw carries a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was addressed by Apple with improved bounds checking in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, plus tvOS 27, visionOS 27 and watchOS 27; no public exploit code has been identified at time of analysis, and EPSS places the likelihood of exploitation in the near term at only 0.17% (7th percentile). Exploitation is not remote-service based: the attacker must first deliver the crafted model to the victim's device and have it parsed, so it is best treated as a genuine but not urgent patching priority rather than an imminent threat.

An out-of-bounds write in Apple's asset-catalog handling lets a maliciously crafted asset catalog trigger memory corruption that terminates the affected process on unpatched Apple operating systems - iOS and iPadOS before 27, macOS before 15.8, 26.7, and 27, and tvOS, visionOS, and watchOS before 27. Exploitation is local rather than network-based (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and requires the victim to load or open the crafted asset via a downloaded app, bundle, or file, so the realistic outcome is client-side denial of service rather than remote code execution, despite the vendor's 7.8 base score; no public exploit code was identified at time of analysis and EPSS is only 0.20% (10th percentile), indicating low observed exploitation likelihood. Apple has released fixed versions across all affected platforms.

Opening a maliciously crafted file on an unpatched Apple device can crash the component that parses it, because a buffer overflow in Apple's size-validation logic was only corrected in the latest OS releases. Affected platforms are iOS/iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, tvOS before 27, and visionOS before 27; exploitation is local and requires the victim to actively open the attacker-supplied file, with no remote or network trigger available. The demonstrated outcome per Apple's advisory is unexpected process termination (denial of service) rather than code execution or data disclosure, and no public exploit code or confirmed active exploitation was identified at time of analysis, with EPSS at 0.22% (13th percentile).

Kernel memory corruption in Apple macOS versions prior to Golden Gate 27 allows a local attacker who can already execute code on the device to trigger an out-of-bounds buffer write, causing unexpected system termination or corruption of kernel memory. Apple addressed the flaw through improved size validation in macOS Golden Gate 27, and a vendor patch is available; no public exploit code has been identified and EPSS remains very low at 0.14% (4th percentile), suggesting limited near-term exploitation activity. Note that the vendor-supplied CVSS of 9.8 (AV:N/PR:N) conflicts with the advisory text, which explicitly describes a local attacker; the authoritative assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, reflecting that the attacker must already be able to execute code on the target system and that exploitation cannot be launched remotely without a prior foothold.

Kernel memory corruption in Apple's operating systems (iOS/iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS, visionOS and watchOS 27 and earlier) lets an application already running on the device crash the system or corrupt kernel memory, per Apple's advisory the root cause was addressed through improved memory handling. The independent assessment rates this as a local, app-gated issue (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) rather than the vendor's network-reachable AV:N/PR:N vector of 7.5, meaning exploitation requires an attacker to first get code executing as an app on the target device; no elevated privileges or user interaction beyond launching the app are needed once that foothold exists. There is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and no CISA KEV listing applies; the practical outcome in most cases is a device crash or denial of service, with kernel memory corruption that would require additional work to turn into privilege escalation. Vendor-released patches are available across all affected platform lines.

Unexpected system termination is possible on unpatched Apple macOS hosts because of an out-of-bounds read that a remote attacker can trigger without authentication or user interaction. Apple addressed the flaw with improved bounds checking in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27, but the affected system component is not named in the public advisories. No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' while flagging the issue as automatable with partial technical impact; the CVSS 7.5 score is driven entirely by availability loss, with no confidentiality or integrity impact.

On unpatched Apple platforms, opening a maliciously crafted video file can cause the affected app to terminate unexpectedly or leave process memory corrupted, because the underlying media parsing code fails to handle memory correctly. Affected are iOS/iPadOS before 26.6 or 26.7, macOS Sequoia before 15.8, macOS Tahoe before 26.6 or 26.7, tvOS before 26.6, and watchOS before 26.6; the vector is local (AV:L) with user interaction required (UI:R) and no authentication (PR:N), meaning an attacker must deliver the file and convince the user to open or preview it. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), but the flaw is serious: the description substantiates only app crashes and in-process memory corruption, with no confirmed confidentiality disclosure or code-execution primitive, which is narrower than the vendor's 7.8 high-severity rating implies. Vendor patches are available.

Memory corruption during file parsing on Apple iOS/iPadOS (before version 27) and macOS (before Golden Gate 27) can cause the handling application to terminate unexpectedly when a user opens a maliciously crafted file; the flaw was addressed by strengthening input validation. Because the attack vector is local (the file must be delivered to and opened on the device) and user interaction is required, exploitation is not remote or unattended, and no special privileges are needed (PR:N, unauthenticated). The vendor rates this 7.8 High, but the independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects availability-only impact, and combined with a very low EPSS of 0.19% (8th percentile) and no public exploit identified at time of analysis, real-world risk is LOW-to-MODERATE rather than critical.

An out-of-bounds write in Apple's media-handling code can corrupt memory and terminate the affected app when a user opens or previews a maliciously crafted video file on an unpatched Apple OS. The flaw affects iOS/iPadOS before 26.7 and before 27, macOS before Sequoia 15.8, before Tahoe 26.7, and before Golden Gate 27, plus tvOS before 27 and visionOS before 27, and Apple resolved it with improved bounds checking in those releases. Exploitation requires local delivery of the crafted file plus user interaction (CVSS AV:L/UI:R/PR:N), no public exploit code has been identified at time of analysis, and EPSS is low at 0.18% (7th percentile), so the practical risk is bounded by the demonstrated outcome of app termination rather than confirmed remote or zero-click compromise.

Parsing a maliciously crafted file on an unpatched Mac can crash the affected application or leak contents of process memory, caused by an out-of-bounds read (CWE-125) in Apple's file-handling code. Apple has fixed the flaw in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, with advisories published at support.apple.com. There is no public exploit code identified at time of analysis and no CISA KEV listing, and the EPSS probability is low at 0.19% (9th percentile), so this rates as a patch-on-schedule issue rather than an emergency.

An out-of-bounds write in Apple's WebKit engine — reachable by processing maliciously crafted web content — can corrupt memory and potentially lead to arbitrary code execution on affected Apple platforms. The flaw stems from an integer-overflow class defect (CWE-190) where a size calculation overflows and the subsequent bounds check fails, allowing an OOB write. It is fixed in Safari 26.6.1, iOS/iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27 and watchOS 27; exploitation requires the victim to load attacker-controlled web content (UI:R), and no public exploit or active exploitation has been identified at time of analysis, with EPSS at just 0.17% (6th percentile).

Memory corruption in Apple Safari and the shared WebKit engine used across iOS, iPadOS, macOS Tahoe, tvOS, visionOS and watchOS can be triggered when a victim views maliciously crafted web content, rooted in an integer overflow (CWE-190) that was corrected through improved input validation. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates an unauthenticated network-delivered attack that requires user interaction but yields high confidentiality, integrity and availability impact, consistent with out-of-bounds memory effects rather than a confirmed code-execution chain. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, while the EPSS score of 0.17% (6th percentile) signals a real but low-priority, non-urgent risk that is best addressed through routine patching. Patches are available from the vendor in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27 and watchOS 27.

Memory corruption in Apple's 3D model parsing pipeline allows a local attacker with low privileges to trigger a classic buffer overflow (CWE-120) on iOS/iPadOS, macOS, tvOS, visionOS and watchOS when a victim opens a maliciously crafted 3D model file. Apple addressed the flaw with improved memory handling in iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27 and watchOS 27. Exploitation requires local access and user interaction, no public exploit code has been identified at time of analysis, and the EPSS score is very low at 0.17% (7th percentile), so this is a credible patching priority for Apple fleets rather than a mass-exploitation emergency.

Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk.

Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.

An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.

Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.

Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Stack-based buffer overflow in the D-Link DIR-878 router (firmware 120B05) lets an authenticated attacker corrupt the stack by supplying an oversized IPv6Address/Hostname argument to the SetDynamicDNSIPv6Settings handler of the Dynamic DNS IPv6 Settings component. Because the flaw is reachable remotely over the web management interface and the CVSS 4.0 vector indicates full compromise of confidentiality, integrity and availability, successful exploitation can plausibly yield arbitrary code execution on the device. A public advisory exists on GitHub (Amalll-Sec router-vulnerability-research) and VulDB, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Stack-based buffer overflow in the D-Link DIR-878 wireless router (firmware 120B05) lets an attacker corrupt the stack through the SetWan3Settings handler of the WAN Settings component by supplying an oversized Primary/Secondary argument (typically DNS/gateway fields). Successful exploitation can crash the device or achieve arbitrary code execution on the router. Reported by VulDB; a third-party technical advisory is published on GitHub, but there is no public exploit identified at time of analysis and it is not in CISA KEV.

Remote code execution affects the Contec EC1000 series (ECE1000, ECE1020, ECS1020) industrial devices, where a classic buffer overflow in the embedded web service allows a network-authenticated attacker to send a specially crafted HTTP request and execute arbitrary programs on the device. Reported by JPCERT/CC via JVN advisory JVNVU99009004, this is an embedded industrial controller flaw with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.