Buffer Overflow

Remote code execution is possible in Contec RP-WAH-SR Series wireless access point devices via a classic buffer overflow in the product's web service. A low-privileged remote attacker can send a specially crafted HTTP request to trigger the overflow and execute arbitrary code on the device. All four model variants (SR1, SR2, SR12, SR22) are confirmed affected per CPE data; the vulnerability was disclosed via JPCERT and a Contec security advisory with no KEV listing or public POC at time of analysis.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.61068_1546_841_CN_TDC allows authenticated remote attackers to corrupt stack memory by supplying an oversized value to the webAuthWhiteUserIndex argument in the formDelWebAuthWhiteUser function, potentially enabling arbitrary code execution in the web server process. The vulnerability is network-exploitable with low-privilege credentials (PR:L per CVSS 4.0), and the CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability. No public exploit has been confirmed and the vulnerability is not in CISA KEV, but a researcher-published GitHub advisory documents the attack surface.

Stack-based buffer overflow in the Tenda W20E router firmware (version 15.11.0.61068_1546_841_CN_TDC) allows a low-privileged remote attacker to crash the device by sending a crafted HTTP request with an oversized IPMacBindRule argument to the formIPMacBindAdd handler. A public researcher advisory exists on GitHub from Amalll-Sec, indicating the vulnerability has been analyzed and documented with reproduction steps. Impact is assessed as high availability loss; remote code execution has not been independently confirmed from available data but cannot be excluded given the CWE-121 class.

Stack-based buffer overflow in the D-Link DIR-823G router (firmware 1.0.2B05_20181207) lets a remote attacker corrupt stack memory via the HNAP1 SetStaticRouteSettings handler. The vulnerable strcpy call copies attacker-supplied PAddress, SubnetMask, and Gateway values without bounds checking, enabling denial of service and potential code execution on the device. Publicly available exploit code exists (VulDB and a GitHub advisory), though it is not listed in CISA KEV; EPSS was not provided.

Stack-based buffer overflow in the camera driver of Samsung Exynos mobile processors (1330, 1380, 1480, 1580, 1680, 2400, 2500, 2600) allows a local low-privileged attacker to crash the camera subsystem or corrupt adjacent kernel memory by sending a malformed message to the driver. The vendor's CVSS vector (S:C, I:H, A:H) indicates that impact extends beyond a simple denial of service to potential kernel-level integrity corruption, though the advisory text describes only DoS - this discrepancy suggests the stack overflow may be exploitable beyond a crash. No public exploit code or active exploitation (KEV) has been identified at time of analysis.

Remote buffer overflow in the Totolink A3002MU router's boa web server allows authenticated network attackers to overflow a fixed-size buffer in the formIpv6Setup handler by supplying an oversized `static_ipv6` argument, potentially enabling arbitrary code execution with root privileges on the device. The vulnerability affects firmware version Hh-B20211125.1046 and a proof-of-concept exploit has been publicly disclosed to GitHub. No vendor-released patch has been identified in available references at time of analysis.

Buffer overflow in the Totolink A3002MU router's boa web server allows network-adjacent authenticated attackers to potentially execute arbitrary code by sending a crafted request with an oversized ip6addr argument to the /boafrm/formFilter endpoint. The affected firmware version is Hh-B20211125.1046, and a public proof-of-concept exploit has been published on GitHub. No patch is available at time of analysis; the vulnerability carries a CVSS 4.0 score of 8.6 with subsequent-system impact metrics elevated due to the router's central network position.

Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.

Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.

An out-of-bounds read in Suricata's MIME quoted-printable decoder affects versions 7.0.13 through 7.0.16 and lets remote, unauthenticated attackers crash a sensor that inspects crafted MIME-bearing traffic, most plausibly SMTP email. Because Suricata parses passively, no credentials or user interaction are required, but exploitation only matters where MIME/SMTP app-layer inspection is actually running on an attacker-reachable path; the realistic outcome is a denial-of-service sensor crash, with only limited potential for exposing adjacent memory (the assessed Confidentiality impact is Low, not High). Patch status: Vendor-released patch - Suricata 7.0.17; EPSS is low (0.56%, 46th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis.

Heap buffer overflow in MKVToolNix through 101.0 allows code execution when a victim processes a crafted AVI file with mkvmerge. The bundled avilib 0.6.10 library's ODML superindex parser performs 32-bit size arithmetic on attacker-controlled entry counts, producing an integer wraparound (CWE-680) that causes an undersized heap allocation; subsequent data writes overflow the buffer. An attacker who delivers a malicious AVI file and induces a user or automated pipeline to process it with mkvmerge can achieve arbitrary code execution with user-level privileges. No public exploit has been identified and no KEV listing exists, but a patch commit is available on Codeberg.

SIPp's get_header() parser function in versions through 3.7.7 is vulnerable to a classic CWE-120 stack buffer overflow triggered by SIP messages containing header content exceeding approximately 20,490 bytes. Any unauthenticated network peer reaching the SIPp listener can crash the process with a single crafted SIP packet; the CVSS 4.0 vector (VA:H, no C/I impact) and source code evidence confirm this is an availability-only impact with no confirmed code-execution path. The upstream fix (commit 8ddfb43, PR #881) replaces unbounded sprintf() calls with snprintf() bounds enforcement, but no official tagged release incorporating the fix has been confirmed at time of analysis.

Stack-based buffer overflow in SIPp through 3.7.7 allows a malicious SIP server to crash the client process by sending a crafted 401 or 407 authentication challenge containing an oversized algorithm parameter. The flaw originates in createAuthHeader() at src/auth.cpp:183-192, where the original code uses strncpy bounded by end-start (an attacker-controlled length derived from the algorithm field) rather than the fixed size of the stack-allocated algo buffer. No public exploit has been identified at time of analysis, but upstream fix code is publicly available via GitHub PR #880.

Stack buffer overflow in SIPp through 3.7.7 allows unauthenticated remote attackers to crash the process by sending a crafted SIP message whose To header tag parameter is 2049 bytes or longer. The get_peer_tag() function in sip_parser.cpp copies the tag value into a fixed-size static buffer without a bounds check, enabling the overflow and resulting in a process crash. No public exploit has been identified at time of analysis, but the trigger condition is trivial to reproduce given the precise byte threshold documented by VulnCheck, and an upstream fix has been committed.

Out-of-bounds read in FFmpeg's WMA audio encoder (libavcodec/wmaenc.c) before version 9.0 allows a process crash when encoding WMA audio with crafted extradata parameters. The root cause is missing required padding bytes in the extradata buffer allocation path, permitting a read operation to extend past the buffer boundary (CWE-125). With a CVSS score of 2.9 and impact limited to availability, no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-severity issue with narrow real-world exposure.

Out-of-bounds write in snappy-java through 1.1.10.8 allows unauthenticated remote attackers to crash the JVM by supplying valid compressed data whose decompressed size exceeds the caller-provided destination ByteBuffer capacity. The `Snappy.uncompress(ByteBuffer, ByteBuffer)` method passes the destination buffer directly to the native Snappy decompressor via JNI without first asserting that its capacity can accommodate the full decompressed output, causing native-layer writes past the buffer boundary and abrupt JVM process termination. No public exploit code or active exploitation has been identified at time of analysis, but the attack is trivially constructible by any attacker familiar with the Snappy wire format against applications that process untrusted compressed input through this specific API overload.

Stack buffer overflows in sngrep through 1.8.4 allow unauthenticated remote attackers to crash or execute arbitrary code on any host running sngrep while actively capturing SIP traffic. The flaws reside in `call_get_attribute()` (src/sip_call.c) and `msg_get_attribute()` (src/sip_msg.c), where unbounded `sprintf` calls copy SIP header values - including Call-ID, X-Call-ID, Reason, From, To, Contact, and request/response strings - into a fixed 255-byte stack buffer without length enforcement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the upstream fix commit is publicly accessible, making independent weaponization feasible.

Heap buffer overflow in Freeciv's worklist_load() function allows memory corruption when a crafted savegame file declares a worklist length exceeding the fixed MAX_LEN_WORKLIST bound of 64 entries. Both savegame format v2 (savegame2.c) and v3 (savegame3.c) code paths are vulnerable in all releases before 3.2.6, meaning any user or server operator who loads a malicious .sav file may have heap-adjacent struct fields overwritten, potentially enabling arbitrary code execution. No public exploit has been identified at time of analysis, but the patch diff is publicly available on GitHub, lowering the bar for future weaponization.

Heap buffer overflow in stb_vorbis through 1.22 allows remote attackers to crash or corrupt the heap of any application that parses attacker-supplied Ogg Vorbis audio. The root cause is an integer truncation bug in start_decoder() where the codebook multiplicands allocation size is computed as a size_t but narrowed to int before being passed to the allocator, enabling a heap undersizing condition triggerable by crafting codebook entries and dimensions values that overflow the int range. No public exploit code or active exploitation is confirmed, but the no-interaction network vector makes this impactful for any service that accepts Ogg Vorbis input from untrusted sources.

Out-of-bounds write in the Linux kernel AppArmor LSM label parser allows any local user on an AppArmor-loaded system to corrupt kernel heap or stack memory by writing a crafted multi-component label string to /proc/self/attr/apparmor/current or to the world-writable (mode 0666) securityfs .access file, the latter path applying no privilege check whatsoever. The bug is a deterministic off-by-one: aa_vec_unique() writes a NULL terminator at vec[n] when no duplicates are found, but vec_setup() and DEFINE_VEC() allocate only n slots, so the write lands one entry past the end of either the local stack array or the kzalloc'd buffer. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.

Stale walk->action state in the Linux kernel mm/pagewalk subsystem causes walk_pud_range() to spuriously retry PUD traversal and invoke page-walk callbacks twice, resulting in a slab-out-of-bounds write reachable by unprivileged local users via the mincore(2) syscall. Affected kernels in the 6.18.21-6.18.49 and 7.0-7.2.3 ranges contain the latent logic error activated by commit 3b89863c3fa4; the bug was confirmed by KASAN output and a local fuzzer producing an OOB write into a sigqueue slab object. No public exploit is available and no active exploitation has been identified; vendor-released patches are available in 6.18.50, 7.2.4, and 7.3-rc1.

Out-of-bounds stack write in `sensor_hub_get_feature()` within the Linux kernel HID sensor-hub subsystem allows an attacker controlling a malicious HID device to corrupt kernel memory. A crafted HID descriptor that advertises an oversized feature field size exploits a mismatch between the function's return-value clamping logic and its unclamped per-value copy loop: when IIO subsystem callers (e.g., pressure or ambient-light sensor drivers) pass a small stack buffer such as a single s32, the copy loop writes beyond the buffer boundary by the full `field->report_size / 8` bytes per value. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), indicating low observed exploitation probability.

Out-of-bounds write in the STM32 CEC driver (media/cec/platform/stm32) allows an adjacent attacker on the same HDMI CEC bus to corrupt kernel memory by sending an overlong CEC frame. The stm32_rx_done() IRQ handler appends each received byte to a fixed 16-byte rx_msg.msg[] buffer using rx_msg.len as an unsanitized write index; a peer device that withholds the EOM signal drives RXBR interrupts indefinitely, writing attacker-controlled bytes past the end of the array into adjacent kernel structures. This vulnerability is reachable as soon as the STM32 CEC driver has probed and reception is enabled, with no local privilege or prior authentication on the CEC bus. No public exploit is identified at time of analysis; the fix is available in stable releases.

Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. No public exploit has been identified at time of analysis; the EPSS score of 0.20% reflects the niche status of the vicodec driver in production deployments.

Slab-out-of-bounds memory corruption in the Linux kernel's nilfs2 log-structured filesystem allows a local low-privileged user to corrupt kernel slab memory by truncating a file whose block mapping collapses from B-tree to direct form. When this collapse occurs, an orphaned intermediate B-tree node block remains dirty in the kernel cache; the nilfs2 log writer subsequently misclassifies it as a direct-mapping data block and calls nilfs_direct_propagate() on it, causing a KASAN-detected out-of-bounds access that can lead to privilege escalation or kernel panic. No public exploit exists and EPSS is 0.20%, but the low-complexity local trigger limits the risk primarily to systems actively using nilfs2 mounts.

Out-of-bounds kernel read in Linux UBIFS's superblock signature verifier allows mounting a crafted NAND filesystem image to disclose kernel memory or crash the system. Linux kernels from v5.3 with UBIFS authentication support compiled in are affected - the flaw is exercised before any cryptographic check occurs, so no valid signing key is required. No public exploit has been identified at time of analysis and EPSS stands at 0.20%, but the C:H/A:H impact is real on embedded or desktop Linux deployments using UBIFS.

Out-of-bounds write and kernel memory disclosure in the Linux kernel NFS server (nfsd) affect deployments exporting pNFS flexfiles layouts. The XDR length calculation in nfsd4_ff_encode_layoutget() miscomputes the reservation for the encoded layout, so with certain string/file-handle sizes the server writes up to 5 bytes past the reserved XDR buffer, and with 4-byte-aligned lengths it over-reserves and transmits uninitialized (stale) kernel buffer contents to the client. It is fixed in stable releases 6.12.109, 6.18.50, and 7.2.4 (and 7.3-rc1); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).

Slab out-of-bounds write in the Linux kernel's CephFS client (ceph_get_name() and __get_snap_name()) lets a malicious or compromised Ceph MDS overflow a NAME_MAX-sized name buffer during NFS-export name resolution. The code copies the MDS-supplied dentry name (rinfo->dname / rde->name) via memcpy and writes a NUL terminator at dname_len without ever checking dname_len against NAME_MAX, so a LOOKUPNAME reply with an oversized name corrupts adjacent slab memory (flagged by KASAN). It is only reachable when a CephFS mount is re-exported over NFS; fixed by the new ceph_export_copy_name() helper that rejects over-length names with -ENAMETOOLONG. No public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).

Remote denial of service in the Linux kernel's CephFS client (ceph module) allows a malicious or compromised Ceph MDS (Metadata Server) to crash a mounting client during session setup. In handle_session(), the MDSCapAuth match.path and match.fs_name fields of a CEPH_SESSION_OPEN message (msg_version >= 6) are copied with a bare ceph_decode_copy() after decoding an attacker-controlled 32-bit length, with no preceding bounds check, letting the copy read up to 4 GiB past the message front allocation and trigger a slab-out-of-bounds read. No public exploit is identified at time of analysis and EPSS is low (0.20%); exploitation requires a hostile server on the first post-connect message with no client-side user interaction.

Out-of-bounds read in the Linux kernel CephFS client (fs/ceph/mdsmap.c) lets a malicious or compromised Ceph monitor crash a client that has a CephFS mount. ceph_mdsmap_decode() advances its decode cursor by num_export_targets*4 bytes for each per-MDS info record without verifying enough bytes remain, and the only runaway-cursor guard is skipped for info versions 2 and 3, so an oversized count walks the cursor past the message front buffer and a later ceph_decode_32() reads slab memory out of bounds. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).

Out-of-bounds heap read and write in the Linux kernel's CIFS/SMB client (coalesce_t2() in fs/smb/client) allows a malicious or MITM SMB server to corrupt kernel memory or leak data by supplying a crafted Transaction2 DataOffset field. The function computes source and target data pointers directly from the server-controlled DataOffset with no bounds validation before a memcpy, so a small value overwrites header fields while a large value pushes the pointer past the buffer end. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the fix adds lower- and upper-bound checks for both pointers.

Out-of-bounds read in the Linux kernel's SMB/CIFS client allows a malicious or compromised SMB server to trigger memory over-reads while the client processes oplock-break responses. A refactor (commit 83bfbd0bb902 removing the RFC1002 header from smb_hdr) mechanically rewrote a DataOffset bounds check in is_valid_oplock_break() into an expression that is identically zero, silently disabling the guard that commit 097f5863b1a0 originally added - so an attacker-supplied 32-bit DataOffset again escapes validation. No public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).

Heap buffer overflow in the Linux kernel's Intel THC HID QuickSPI driver allows a local low-privileged user to corrupt kernel memory via the hidraw interface. The driver's write_cmd_to_txdma() function performs an unbounded memcpy from a caller-supplied HID report into a device-descriptor-derived heap buffer of only a few hundred bytes, while the HID core permits reports up to 16,384 bytes through SET_REPORT/SET_FEATURE ioctls - a size mismatch that lets an attacker overflow the buffer with attacker-controlled length and content, enabling potential local privilege escalation to root. Vendor-released patches are available in Linux 7.2.4, 7.3-rc1, and 6.18.50; no public exploit or active exploitation has been identified at time of analysis.

Buffer overflow in the Linux kernel's Intel Touch Host Controller QuickSPI HID driver allows a local user with hidraw device access to corrupt kernel memory using device-controlled content. The function `quickspi_get_report()` copies the full device-supplied response length into the caller's buffer without checking the caller-provided size bound, so a touch controller returning more bytes than allocated overflows the kernel buffer. No public exploit exists (EPSS 0.17%, no KEV), but the sibling intel-quicki2c driver already carried the correct fix, confirming the root cause is a missing bounds-check port.

Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver during log replay allows a local attacker who can mount a crafted NTFS image to corrupt kernel memory, potentially achieving privilege escalation. The root cause is that check_rstbl() validates DIR_PAGE_ENTRY table bookkeeping but never verifies that the trailing page_lcns[] array actually fits within the entry's declared size, so a crafted lcns_follow field drives a memmove and subsequent replay passes past the entry boundary. No public exploit or CISA KEV listing exists; EPSS is 0.18%, consistent with the local mount-gated attack surface shared by sibling ntfs3 CVEs (CVE-2026-89610 through CVE-2026-89614).

Out-of-bounds array access in the Linux kernel ntfs3 filesystem driver allows an attacker who can cause a crafted NTFS image to be mounted to trigger kernel memory corruption via an overflow of the page_lcns[] array. The copy_lcns and redo-shorten loops index page_lcns[] at j+i where i is bounded by the log record's lcns_follow field rather than the target dirty-page entry's field, and because check_dp_table() validates the entry but not the copy_lcns record, and find_dp() bounds j but not i, a crafted record can overflow the array of an otherwise structurally valid entry. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but siblings CVE-2026-89610 through CVE-2026-89613 affect the same ntfs3 code path in the same kernel fix wave.

Out-of-bounds slab read in the Linux kernel NTFS driver's cluster allocator lets a crafted NTFS image trigger a KASAN-detected memory read when a file on the volume is extended. The free-cluster bitmap array (vol->lcn_empty_bits_per_page) is sized from the volume's nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan by the on-disk $Bitmap size instead; an image whose $Bitmap advertises more clusters than the volume actually has drives the allocator past the array. Reported through the Linux stable tree with an upstream fix; no public exploit identified at time of analysis and EPSS is low (0.16%).

Out-of-bounds memory access in the Linux kernel ntfs3 filesystem driver occurs because parse_ntfs_boot_sector() decodes the boot sector's unsigned 64-bit MFT and MFTMirr Logical Cluster Numbers (LCNs) into a signed s64. A crafted NTFS image with a high-bit-set LCN wraps to a negative value that slips past the existing upper-bound check and propagates into the MFT zone allocator, driving an out-of-bounds access to lcn_empty_bits_per_page. Exploitation requires mounting an attacker-supplied NTFS volume; there is no public exploit identified at time of analysis and EPSS is low (0.20%).

Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. No public exploit has been identified and EPSS is low (0.20%), indicating this is a hardening/DoS-leaning fix rather than an imminent mass-exploitation threat.

Two heap out-of-bounds writes in Linux kernel eCryptfs allow a local low-privileged user to corrupt kernel memory structures by supplying a crafted Tag 3 passphrase-encrypted session key packet with an oversized encrypted_key_size field. The vulnerability is exclusively triggered when AES-192 (cipher code 0x08) is used because that cipher sets crypt_stat->key_size=24 independently, permitting crypto_skcipher_setkey() to succeed while encrypted_key_size still exceeds the 64-byte ECRYPTFS_MAX_KEY_BYTES bound - overflowing into ecryptfs_auth_tok and corrupting root_iv, keysig_list, and mutexes in ecryptfs_crypt_stat. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile.

Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.

Stack buffer overflow in the Linux kernel's ACPI Platform Firmware Runtime Update (pfr_update) driver allows a local low-privileged attacker to corrupt kernel stack memory via oversized ACPI DSM buffer responses. The flaw exists in query_capability() where memcpy uses firmware-supplied buffer.length without bounds checking against fixed-size u8[16] destination fields in the stack-allocated struct pfru_update_cap_info, enabling writes up to 44 bytes past the end of the structure. KASAN confirmed exploitation on 7.2-rc6 producing three distinct stack-out-of-bounds reports; vendor-released patches are available in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. No public exploit code exists and EPSS probability is low at 0.18%, but successful exploitation could yield arbitrary kernel code execution on affected systems.

Out-of-bounds kernel memory write in Linux kernel BPF stack unwinding (`__bpf_get_stack`) exposes CONFIG_PREEMPT systems to local privilege escalation. On fully preemptible kernels, a non-sleepable BPF raw tracepoint program runs under `migrate_disable()` but not `preempt_disable()`, creating a scheduler preemption window between per-CPU callchain buffer release and consumer memcpy; a concurrent task can overwrite `trace->nr`, inflating `copy_len` past the caller's buffer boundary. The vulnerability affects Linux 4.18 through stable branches preceding 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit exists and EPSS is 0.17%, but the C:H/I:H/A:H impact ratings reflect kernel memory corruption potential.

Out-of-bounds heap read in the Linux kernel CXL fwctl driver allows a local low-privileged user to leak kernel memory to a CXL device mailbox and crash the kernel. The root cause is cxlctl_fw_rpc() ignoring the in_len bound established by fwctl_cmd_rpc(), letting a user-controlled op_size value drive memcpy reads beyond the kvzalloc(in_len) allocation. With a sufficiently large op_size the read walks into unmapped memory, causing a kernel oops. No public exploit code has been identified and EPSS stands at 0.17%, indicating limited active exploitation interest.

Integer overflow in the Linux kernel's libnvdimm label-validation path allows a local low-privileged attacker with access to NVDIMM configuration commands (or crafted DIMM media) to trigger an out-of-bounds write in nd_label_data_init(). The on-media u32 field nslot, multiplied by sizeof_namespace_label() in 32-bit arithmetic introduced as a regression in Linux 4.13 (commit 564e871aa66f), wraps modulo 2^32 before the bounds check, causing a downstream memset() to overrun the config buffer. No public exploit code has been identified, and EPSS sits at 0.20% (10th percentile), reflecting realistic limited exposure given the niche hardware requirement.

Integer overflow in the Linux kernel's MD (software RAID) subsystem allows a local attacker who can supply or mount a crafted block device superblock to trigger an unchecked bit-shift overflow in super_1_load(), corrupting kernel memory and potentially escalating privileges. The flaw stems from sb->bblog_shift - an 8-bit on-disk value ranging 0-255 - being applied as a left-shift to a 64-bit sector variable without any upper-bound validation, allowing sector and count variables to wrap around and corrupt downstream badblocks API state. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), placing this in the low-probability-of-exploitation tier despite a CVSS score of 7.8.

Out-of-bounds reads in the Linux kernel SUNRPC RPCSEC_GSS privacy (krb5p) receive path allow a malicious or compromised NFS server to crash or leak memory from a connecting client. The function gss_unwrap_resp_priv() validated the opaque token length with a single u32 addition (offset + opaque_len) and no lower bound, so a crafted reply with opaque_len near 0xffffffff wraps the sum below rcv_buf->len and passes the check, while any length below GSS_KRB5_TOK_HDR_LEN is forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4/ptr+6 then run past the token. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a config-gated, DoS-leaning memory-safety bug rather than a broadly weaponizable RCE.

Remote out-of-bounds read and general protection fault in the Linux kernel's svcrdma (RPC-over-RDMA server) code allows a connected RDMA client to crash the kernel by advertising a Write or Reply chunk with zero segments. The pcl_for_each_segment iteration macro computed an inclusive upper bound of &ch_segments[ch_segcount - 1]; with a u32 ch_segcount of 0 this underflows to 0xFFFFFFFF, walking far past the flex array until it faults when svc_rdma_get_inv_rkey() dereferences segment->rs_handle. Fixed upstream; EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis.

Out-of-bounds heap write in the Linux kernel's server-side RPC-over-RDMA transport (svcrdma), used by the in-kernel NFS server, allows a malicious RPC-over-RDMA client to corrupt slab memory. When a client requests a reply (such as an NFS READ payload) without supplying a Write list or Reply chunk, and that reply needs more scatter/gather entries than the RDMA device's Send Queue supports, svc_rdma_pull_up_reply_msg() linearizes the entire reply into the fixed sc_max_req_size buffer; because the reply size is bounded only by the client request, the copy runs past the buffer and the oversized length is also posted to the device. There is no public exploit identified at time of analysis, and EPSS is low (0.17%).

Integer overflow in RISC-V KVM's SBI PMU EVENT_GET_INFO handler allows a guest VM to trigger out-of-bounds heap reads and writes on the host kernel, with scope-changed impact (C:H/I:H/A:H). A malicious or compromised guest on a RISC-V host running KVM can supply a crafted num_events value (e.g., 0x10000001 on RV64) that overflows a 32-bit multiplication, causing under-allocation of the event-info array while the subsequent loop iterates over the original large count - resulting in slab-out-of-bounds memory corruption confirmed by KASAN traces. No public exploit code exists and EPSS is 0.15%, but the scope change to the host kernel makes this a VM-escape class finding for RISC-V KVM deployments.

Heap out-of-bounds write in the Linux kernel's ocfs2 o2dlm (distributed lock manager) allows a malicious cluster member to corrupt or panic peer nodes. The dlm_migrate_request_handler() accepts a peer-supplied name-length field (migrate->namelen) from a DLM_MIGRATE_REQUEST message without bounds-checking and passes it to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes past the 32-byte mname[] field of an o2dlm_mle slab object. Any node that has joined the DLM domain can trigger it; there is no public exploit and it is not in CISA KEV, with EPSS at just 0.20%.

Kernel memory corruption in the Linux kernel's OCFS2 cluster filesystem distributed lock manager (o2dlm) allows any node in a DLM domain to crash or corrupt the heap of a peer node. The dlm_mig_lockres_handler for DLM_MIG_LOCKRES recovery messages trusts the peer-supplied num_locks and lockname_len fields without validation, producing an out-of-bounds read that ends in a BUG_ON panic and a heap out-of-bounds write into a fixed 32-byte lockname slab object. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile), and the fix is available across multiple stable kernel branches.

Out-of-bounds read and write in the Linux kernel's ocfs2 refcount block validator allows a local privileged attacker to corrupt kernel memory via a crafted or corrupted filesystem image. The `ocfs2_validate_refcount_block()` function fails to validate `rl_used` and `rl_count` fields against the actual fixed per-block capacity before refcount/reflink/CoW operations walk the record array, allowing a crafted `rl_used == 0xffff` to drive the loop 65534 iterations past the end of the 4096-byte metadata block. A subsequent `memmove()` of up to ~1 MiB from an already out-of-bounds offset in `ocfs2_insert_refcount_rec()` can corrupt arbitrary kernel memory. No public exploit and no KEV listing; EPSS is 0.20% reflecting realistic low exploitation probability.

Slab out-of-bounds read in the Linux kernel's ocfs2 filesystem lets a crafted on-disk image trigger memory disclosure once mounted. The indexed-directory validators ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check ECC and signature but never bound the ocfs2_dx_entry_list de_num_used/de_count counts against the 4KB metadata block capacity, so ocfs2_dx_dir_search() walks up to 0xffff entries far past the block. Any path lookup, stat(), or open() on an indexed directory in a malicious image reads adjacent slab memory. EPSS is low (0.20%, 10th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.

Slab out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows a malfunctioning, malicious, or compromised Chrome Embedded Controller (EC) to corrupt kernel heap memory during device probe. The driver accepts EC-reported USB PD port counts as loop bounds without validating them against EC_USB_PD_MAX_PORTS (8), so an EC returning any count N > 8 - up to the u8 maximum of 255 - writes N pointers into an 8-entry slab-allocated array, overflowing by up to 247 entries (~1976 bytes). No public exploit exists and EPSS is 0.17%, reflecting the high-complexity attack path that requires prior EC firmware compromise.

Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. No public exploit exists (EPSS 0.17%, 6th percentile), and patches have been released in 6.12.109, 6.18.50, and 7.2.4.

Out-of-bounds read in the Linux kernel's Intel Speed Select Technology (ISST) platform driver allows a local low-privileged user to disclose sensitive kernel memory or crash the system via malformed ioctl input. The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() accept a user-controlled level value and pass it as an array index into perf_levels[] without validating it against max_level bounds, unlike adjacent helper functions that perform this check. No public exploit is identified at time of analysis, and patches have been released for stable kernel branches 6.12.109, 6.18.50, and 7.2.4.

Heap buffer overflow in the Linux kernel's panasonic-laptop platform driver allows a local low-privileged user on affected Panasonic hardware to corrupt kernel heap memory, potentially escalating privileges. The flaw resides in acpi_pcc_retrieve_biosdata(), which writes a trailing sentinel one element past the end of the allocated pcc->sinf[] array when num_sifr equals hkey->package.count - a condition that arises specifically on Panasonic hardware where the BIOS SQTY field reports one fewer SINF entries than the actual package, triggering the driver's existing off-by-one workaround. Vendor-released patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit code or active exploitation has been identified.

Out-of-bounds read and write in the Linux kernel's Chrome EC sensorhub driver exposes Chromebook-class systems to kernel heap corruption via an unvalidated 8-bit sensor number in EC FIFO events. The cros_ec_sensor_ring_process_event() function indexes batch_state[] using the sensor_num field from embedded-controller events without checking it against the allocated array size, allowing any event carrying sensor_num >= sensorhub->sensor_num to access arbitrary adjacent kernel heap memory. No public exploit or CISA KEV listing exists; EPSS is 0.20%, but the C:H/I:H/A:H CIA impact reflects the potential for kernel memory corruption on affected Chrome EC hardware.

Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.

Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).

Out-of-bounds heap write in the Linux kernel's XDP subsystem allows memory corruption when an AF_XDP zero-copy packet is redirected through cpumap. The xdp_convert_zc_to_xdp_frame() routine copies an XSK packet into an order-0 page but advertises the full PAGE_SIZE as usable and records zero headroom, letting the frame overrun the page tail reserved for skb_shared_info and triggering a KASAN slab-out-of-bounds write in skb_gro_receive during GRO processing. No public exploit identified at time of analysis and EPSS is low (0.17%); the vendor has released fixes across stable branches.

Out-of-bounds read in the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) LLC handling occurs in smc_llc_save_add_link_rkeys(), where the peer rkey count is read from offset 94 of a 72-byte 'ADD LINK' message allocation whenever the RDMA device reports max_recv_sge == 1 and no shared v2 receive buffer exists. Any peer that initiates an SMC-Rv2 link addition triggers the over-read on every link addition, regardless of message contents, as demonstrated by a reproducible KASAN slab-out-of-bounds report. The flaw is fixed in stable kernels; no public exploit code or active exploitation has been identified, and EPSS is low at 0.20%.

Out-of-bounds kernel memory read in the Linux kernel's IPv6 Segment Routing (SRv6/seg6) local processing allows a local unprivileged user to leak adjacent slab memory and potentially crash the host. After decap_and_validate() strips outer SRv6 headers for End.DX6/End.DT6 behaviors, the IPv6 control block (IP6CB) retains a stale nhoff from the outer packet, causing ip6_protocol_deliver_rcu() to read beyond the skb head on the inner packet (KASAN slab-out-of-bounds). There is no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a locally-reachable kernel bug rather than a mass-exploitable remote flaw.

Out-of-bounds read and write in the Linux kernel's dm-pcache (device mapper persistent cache) module allow a local attacker with CAP_SYS_ADMIN to corrupt kernel memory by loading a device mapper table backed by a crafted cache device containing malformed geometry metadata. The root cause is that cache_segs_init() and get_seg_id() consume on-disk cache_info fields - specifically n_segs and per-segment next_seg link IDs - without range validation before indexing into kernel-allocated arrays, and the only integrity protection on this metadata is a CRC computed with a fixed, public seed that offers no adversarial resistance. No public exploit or active exploitation has been identified; EPSS is 0.20% at the 10th percentile, consistent with the constrained attack prerequisites.

Out-of-bounds memory reads in the Linux kernel dm-pcache device-mapper subsystem allow a CAP_SYS_ADMIN-privileged local attacker to disclose adjacent persistent memory contents to userspace and corrupt the cache replay tree, with potential for kernel panic. Two input-validation gaps exist: kset key_num is not bounded against PCACHE_KSET_KEYS_MAX before buffer iteration, and per-key intra-segment offset+length pairs are accepted verbatim, allowing crafted on-media cache device images to trigger OOB reads that surface into caller bio buffers. No public exploit exists and EPSS sits at 0.20% (10th percentile), consistent with the elevated privilege requirement gating this attack surface.

Out-of-bounds array indexing in the Linux kernel's rtl8192du Wi-Fi driver allows network-adjacent unauthenticated attackers to trigger kernel memory corruption or a crash. The driver's `rtl92du_tx_fill_desc()` function passes a raw 802.11 QoS TID value (range 0-15) as an index into `sta_entry->tids[]`, which is only allocated with MAX_TID_COUNT=9 entries; TID values 9-15 index past the array boundary. UBSAN confirms index-10 access on `rtl_tid_data [9]`. No public exploit exists and EPSS is 0.17%, indicating low real-world exploitation pressure at time of analysis.

Unchecked device-controlled address in the mt7915 WiFi driver's EEPROM copy path allows a malicious or compromised MT7915 MCU to trigger a 16-byte out-of-bounds heap write in the host kernel. The driver's mt7915_mcu_get_eeprom() trusts the MCU response field res->addr (a device-supplied __le32) as a destination offset into eeprom.data without validating it against the buffer's bounds, enabling arbitrary kernel heap corruption. No public exploit has been identified at time of analysis, and EPSS probability is 0.20%; however, successful exploitation of the OOB write could yield kernel code execution or denial of service on any Linux host equipped with an MT7915-based adapter.

Out-of-bounds write in the Linux kernel mt76/mt7996 WiFi driver allows a malicious or malfunctioning MediaTek mt7996 chip to corrupt kernel heap memory. The vulnerability exists in mt7996_mcu_get_eeprom(), which derives a destination offset into dev->mt76.eeprom.data from a device-controlled field (event->addr, a __le32 in the MCU response) without bounding that offset before performing the EFUSE/EXT block copy. A compromised or deliberately crafted mt7996 device can trigger an OOB write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes into kernel memory, with potential for privilege escalation or denial of service. No public exploit is identified at time of analysis and EPSS is 0.15%, consistent with the narrow attack surface requiring hardware-level adversarial control.

Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.

Heap out-of-bounds write in Orthanc DICOM Server allows a low-privileged network attacker to corrupt memory by supplying a malformed PNG image, potentially enabling remote code execution or denial-of-service against medical imaging infrastructure. The root cause is a CWE-190 integer overflow in pitch and buffer-size computation during PNG decoding, reported by CISA ICS-CERT under medical advisory ICSMA-26-253-02. No public exploit code has been identified at this time, but the nature of the flaw (heap corruption via attacker-controlled image data) makes it a credible RCE candidate in clinical environments.

An out-of-bounds heap write in PCRE2's pcre2_convert() pattern-conversion API affects releases before 10.48, but only on 32-bit builds where size_t is 32 bits - 64-bit systems are unaffected. Exploitation is remote and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.4), yet it is sharply constrained: the consuming application must actually invoke the comparatively rarely-used convert entry point and pass it a large, attacker-supplied pattern, which is why AC:H applies and the SSVC assessment rates automatic exploitation as not feasible. Publicly available exploit code exists per the SSVC exploitation signal (POC), although there is no confirmed actively exploited (CISA KEV) status; EPSS is low at 0.10% (1st percentile), reflecting the narrow 32-bit-plus-convert-API precondition. Impact is high integrity and availability with no confidentiality loss, consistent with memory corruption via integer overflow leading to under-allocation.

Heap-based buffer overflow in the Sofia IPC daemon's WS-Addressing Action transformation function allows remote unauthenticated attackers to crash Xiongmai XM530 IP cameras or potentially achieve arbitrary code execution by sending a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes. Affected firmware is HMT.CM2005-v220608.1837 and all earlier versions. A public vulnerability research repository exists for this CVE, suggesting exploit code or detailed PoC is available. No public exploit identified as confirmed actively exploited at time of analysis.

Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged local user can send a crafted message to the EPDLP inter-process communication port to trigger a CWE-190 integer overflow, corrupting process memory. The vulnerability is gated behind two explicit non-default conditions - the EPDLP module must be active in the client configuration, and Windows Memory Integrity (HVCI/VBS) must be disabled on the host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Stack-based buffer overflow in the IBM Db2 DRDA client allows full system compromise on any host running an affected Db2 client version when that client connects to an attacker-controlled or impersonated DRDA server endpoint. Affected versions are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. By controlling a rogue or man-in-the-middle DRDA server, an unauthenticated network adversary can cause the client to copy unbounded server-supplied data into a fixed-size stack buffer, yielding arbitrary command execution. No public exploit is identified at time of analysis; vendor patch is available via IBM Support.

Out-of-bounds read in zstd-jni versions 1.5.5-6 through 1.5.7-13 exposes JVM-based applications to memory disclosure or process crashes when processing attacker-controlled Zstd-compressed data. The `Zstd.getFrameContentSize` method and `ZstdInputStreamNoFinalizer` both fail to reject negative `srcPosition` and `len` arguments before marshalling them into the native Zstd frame-header parser, allowing a negative value to bypass Java-side bounds checks and trigger out-of-bounds reads in the underlying C layer. No public exploit code or CISA KEV listing has been identified; the vendor-released fix is version 1.5.7-14.

Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who supplies a crafted .traineddata language file to corrupt heap memory during legacy OCR classifier initialization, with potential for controlled code execution. The flaw is in ReadIntTemplates in src/classify/intproto.cpp, which reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP file component and uses them directly as loop bounds - storing heap pointers into fixed-capacity struct arrays without validating against compile-time maximums. No patched release exists as of this review, though a fix commit is present in the repository; no public exploit has been identified.

Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls the loaded .traineddata model file to corrupt heap memory, crash the process, or potentially achieve code execution. The root cause is in GenericVector::read (src/ccutil/genericvector.h): the serialized `reserved` field allocates the backing buffer while the independent `size_used_` field drives the callback write loop, with no invariant check enforcing size_used_ ≤ reserved. A crafted TESSDATA_INTTEMP component with version_id ≥ 4 exploits this by setting reserved small and size_used_ large, triggering the write overrun through fontinfo_table_.read during legacy classifier initialization. No public exploit and no CISA KEV entry exist at time of analysis; an upstream commit fix exists but no patched release has been published.

Kernel pool memory corruption in Silicon Labs silabser.sys (the Windows kernel driver for CP210x USB-to-serial bridge devices) v11.5.0 and earlier allows a local unprivileged user who physically attaches a malicious CP210x-compatible USB device to escalate privileges to kernel-level code execution. The driver fails to validate USB device-supplied packet data before processing, enabling crafted malformed packets to corrupt Windows kernel pool allocations. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, leading to a crash or potentially controlled code execution. The root cause is an inconsistency between `source_` (sized from deserialized `na_`) and the write count used by `WriteTimeStepPart` and `AddTimeStepPart` (driven by `ns_` from the CI gate WeightMatrix dim1), leaving two functions unbounded after prior hardening patched sibling routines. No fixed release is available at time of analysis; an upstream fix exists only as a commit. No public exploit identified at time of analysis.

Heap out-of-bounds write and read in Tesseract OCR Engine 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, potentially achieving information disclosure, a crash, or controlled heap corruption leading to code execution. The flaw lies in `FullyConnected::DeSerialize`, which loads layer dimension scalars `ni_` and `no_` without cross-validating them against the actual weight matrix dimensions; when `Forward` is subsequently called, `MatrixDotVector` writes into a scratch buffer sized by `no_` but indexed by the actual matrix row count, and reads from a buffer sized by `ni_` but indexed by column count minus one. No fixed release has been issued as of this analysis; an upstream fix commit exists on GitHub.

Stack-based buffer overflow in Tesseract OCR 5.5.3 and earlier corrupts the stack during legacy engine initialization, enabling denial of service and potential control-flow hijacking when a crafted `.traineddata` file is processed. The flaw originates in `Classify::ReadNormProtos` (normmatch.cpp), where unbounded `std::istream::operator>>(char*)` extraction into a fixed 61-byte stack buffer allows a 99-character NORMPROTO token to overwrite up to 39 bytes beyond the buffer boundary during `TessBaseAPI::Init`. No fixed release is available at time of analysis; an upstream fix commit exists but has not been tagged as a release, and no public exploit has been identified at time of analysis.

Heap-based buffer overflow in Bosch Sensortec COINES_SDK versions 2.10 through 2.12.2 allows a malicious or compromised USB or BLE peripheral to corrupt host heap memory, leading to process crash or potential arbitrary code execution on the developer's machine. The root cause is that the PC bridge protocol decoder in bridge_decoder.c unconditionally trusts the packet length field supplied by the connected peripheral, passing it directly to mqueue_add_data without validating it against the fixed 255-byte queue slot - enabling a payload of up to ~3 KB to overwrite adjacent heap metadata via memcpy. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for physical or BLE proximity and user-initiated device pairing.

Stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI C library allows a malicious or compromised sensor or bus participant to corrupt host firmware stack memory, leading to denial of service or arbitrary code execution. The flaw resides in bhi385_parse_debug_message() (bhi385_parse.c), which reads an 8-bit message length directly from the attacker-controlled FIFO event payload and passes it unchecked to memcpy targeting a fixed 17-byte stack buffer - any length byte above 16 overwrites adjacent stack data. No public exploit or CISA KEV listing has been identified at time of analysis, but the vendor has published an advisory under BOSCH-SA-223618.

Unchecked memcpy in the Bosch Sensortec BHI360 SensorAPI C-Library's debug FIFO parser allows a physically-positioned attacker to overflow a 17-byte stack buffer in `bhi360_parse_debug_message()`, corrupting the host microcontroller's saved return address and enabling arbitrary code execution. A compounding format-string flaw - the overflowed buffer is subsequently passed to a printf-style logging sink - provides an additional write-anywhere primitive for `%n`-style exploitation. No public exploit code has been identified and exploitation is constrained to physical or bus-adjacent positions (CVSS AV:P), but the double-primitive nature makes this highly reliable on bare-metal targets lacking stack canaries.

Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.

Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.

Buffer overflow in the XML processing stack of Palo Alto Networks PAN-OS enables unauthenticated remote attackers to cause denial of service on VM-Series virtual firewalls or execute arbitrary code with root privileges on PA-Series physical appliances. The vulnerability is reachable via the management web interface or dataplane interface, and Panorama management platforms are also confirmed in scope. No public exploit has been identified at time of analysis; the CVSS 4.0 supplemental metric E:U corroborates no known active exploitation.

Stack-based buffer overflow (CWE-121) in the Nintendo Switch local wireless networking subsystem allows an adjacent unauthenticated attacker within wireless range to execute arbitrary code via a Return-Oriented Programming (ROP) chain embedded in crafted network traffic. All Nintendo Switch firmware versions prior to 23.0.0 are affected, and Nintendo has released version 23.0.0 as the remediation. No public exploit code or active exploitation has been identified at time of analysis, though SSVC rates technical impact as total.

Buffer overflow in the Apple Notification Center Service (ANCS) event handler of the Pavlok Behavioral Conditioning Wearable allows unauthenticated adjacent-network attackers to achieve full compromise of the wearable device and potentially the paired Apple host. The vulnerability resides in firmware versions up to build 20260707 and is exploitable by any attacker within Bluetooth Low Energy range without credentials. A proof-of-concept has been published (CVSS 4.0 E:P); the vendor did not respond to coordinated disclosure, and no patch has been released.