Buffer Overflow

Opening a crafted legacy Excel (.xls) file in libxls 1.6.3, or in any application that embeds it, can corrupt the heap and potentially execute arbitrary code because xls_getCSS() trusts a file-controlled font index without validating it against the workbook's font count. The same code path also permits use-after-free/out-of-bounds access to the font array while generating CSS from XF formatting records. Exploitation requires a victim to open a malicious file (CVSS AV:L/UI:R); no public exploit code has been confirmed and CISA KEV does not list this CVE, with EPSS very low at 0.15% (5th percentile), indicating limited real-world targeting at time of analysis.

Integer overflow leading to heap buffer overflow in GPAC's JPEG 2000 decoder filter allows arbitrary code execution when a user opens a crafted media file. The vulnerable computation in j2kdec_process() multiplies width, height, and component count without overflow checking, producing a truncated out_size that causes an undersized buffer allocation followed by an out-of-bounds write. SSVC exploitation status is 'poc' (proof-of-concept exists), though EPSS is low at 0.18%, indicating no widespread in-the-wild exploitation at time of analysis.

A stack buffer overflow in GPAC's NHNT demuxer (nhntdmx_process() in src/filters/dmx_nhnt.c) allows an attacker to execute arbitrary code when the affected build processes a crafted NHNT media file, because an unbounded strcpy/strcat writes a file-supplied media string into a fixed-size stack buffer. The flaw is rated 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects GPAC at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3; it is fixed upstream in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6, which replaces the unsafe calls with gf_strlcpy/gf_strlcat. Exploitation likelihood appears limited: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.

Remote heap information disclosure in eProsima Fast DDS lets unauthenticated attackers leak adjacent heap memory by sending a crafted RTPS DATA_FRAG submessage. Affected versions before 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fail to validate that the received datagram is large enough before a memcpy() in the last-fragment reassembly path, so bytes past the UDP buffer (potentially pointers useful for ASLR bypass) are copied into the reassembly buffer and, in Discovery Server deployments, relayed to other participants. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.

Out-of-bounds memory access in zstd-jni versions 1.3.3-1 through 1.5.7-13 enables unauthenticated network-accessible attackers to crash the JVM by supplying crafted sample-size arrays to the Zstd.trainFromBufferDirect dictionary-training API. The native C implementation (jni_zdict.c) failed to sum caller-supplied sample lengths against the DirectBuffer's actual capacity before iterating, allowing the native code to walk past the buffer allocation boundary and trigger a hard JVM termination. A patched release (v1.5.7-14) is available; no public exploit has been identified at time of analysis.

Out-of-bounds memory reads in zstd-jni versions 1.1.1 through 1.5.7-13 allow unauthenticated remote attackers to crash the JVM or extract arbitrary frame-size data from unintended memory regions by supplying crafted Zstandard-compressed input with negative or integer-overflowing offset values. Three JNI native methods - findDirectByteBufferFrame, decompressedDirectByteBuffer, and getDirectByteBufferFrame - perform 32-bit signed bounds checks without first validating that src_offset or src_size are non-negative, allowing values near Integer.MIN_VALUE to pass the comparison and drive native code to read unmapped memory. The CVSS 4.0 score of 8.8 reflects a high availability impact (JVM termination) and limited confidentiality impact; no public exploit or KEV listing has been identified at time of analysis.

Heap out-of-bounds write in VLC Media Player 3.0.0 through 3.0.23 allows a local attacker to corrupt memory by tricking a user into opening a crafted PNG file with attacker-controlled dimensions. The root cause is a 32-bit integer overflow in AllocatePicture() where plane pitch-times-lines multiplication wraps before widening to the size_t accumulator, causing both overflow guards to pass on the already-corrupted value; aligned_alloc then reserves a small wrapped buffer while the PNG decoder writes full-dimension scanlines past its end. No public exploit has been identified at time of analysis, and EPSS indicates 0.30% exploitation probability over the next 30 days.

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based buffer overflow in the ASN.1 decoder that parses VPN certificates, reachable by unauthenticated remote attackers. Because the flaw sits in the certificate-handling path of the internet-facing VPN service, a single crafted certificate or handshake can overflow heap memory and execute attacker-controlled code on security appliances that sit at the network perimeter. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, but the pre-auth network-reachable RCE profile makes it a top-tier patching priority.

Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 allows attackers who can supply dictionary constructor parameters to crash the JVM and potentially read limited native heap memory. The ZstdDictCompress constructor passed unvalidated offset and length values directly to the C JNI layer, where out-of-range values cause the native code to read beyond the allocated Java heap array. No CISA KEV listing or public exploit has been identified; the CVSS 4.0 score of 8.8 reflects high availability impact via reliable JVM crash and limited confidentiality exposure from native heap reads.

Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR Sep-2026 Release 1 enables local privileged attackers to execute arbitrary code within the Trusted Execution Environment. The CVSS 4.0 score of 7.1 with AV:L/AC:H/PR:H reflects a high technical bar: exploitation demands pre-existing high-privilege local access plus significant exploit engineering to achieve reliable heap corruption. Samsung confirmed the fix in the September 2026 Monthly Security Release; no public exploit or active exploitation has been identified.

Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of libimagecodec.quram.so (the proprietary Quram/Qmage image codec) on builds prior to SMR Sep-2026 Release 1. A remote attacker who delivers a maliciously crafted JPEG image to a vulnerable device can corrupt heap memory and execute arbitrary code in the context of the image-processing component. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV; Samsung rates it CVSS 4.0 9.2 (critical).

Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimagecodec.quram.so) affects Samsung mobile devices on Android 14, 15, 16, and 17 prior to the SMR Sep-2026 Release 1 patch. A crafted DNG image parsed by the library triggers a heap-based buffer overflow, letting a remote attacker run arbitrary code in the context of the process handling the image. No public exploit identified at time of analysis, and it is not on the CISA KEV list, but Quram image-parsing flaws have a strong historical track record of weaponization on Samsung/Android.

Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to execute arbitrary code with system server privilege. The flaw resides in Samsung's proprietary Mobile Display Image Enhancement (mdnie) library, which is accessible from low-privilege application contexts with no special Android permissions required. No public exploit has been identified at time of analysis, and Samsung addressed this in the September 2026 Monthly Security Release (SMR Sep-2026 Release 1).

Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM TrustZone that handles cryptographic key operations - allows local attackers with high privileges to corrupt memory within the secure world, potentially compromising key material or TEE integrity. Affected devices run Android 14 through 17, with a fix delivered in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds write in HarmonyOS 6.1.0's rendering and composition module allows a locally executing process to corrupt adjacent memory, with vendor-stated impact to availability and a CVSS vector also indicating potential confidentiality exposure. Affected devices are those running Huawei HarmonyOS version 6.1.0 as confirmed by EUVD-2026-74596. No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.

Heap buffer overflow in OpenIDC/cjose versions prior to 0.6.2.5 allows a remote unauthenticated attacker to corrupt process heap memory by submitting a crafted JWE token with an oversized `encrypted_key` segment targeting the AES Key Wrap decryption path. The `cjose_jwe_import()` and `cjose_jwe_decrypt()` functions are pre-authentication entry points that accept fully attacker-controlled input, making every application that decrypts AES-KW JWEs with this library directly reachable. Impact ranges from a reliable denial of service (process crash) to potential memory-corruption-based code execution depending on heap layout and allocator behavior. No public exploit has been identified at time of analysis, but the patch commit confirms the exact boundary condition and includes a regression test demonstrating the overflow trigger.

Heap-based buffer overflow in Google Chrome's WebRTC component (all versions prior to 153.0.8010.36) enables a remote unauthenticated attacker to potentially execute arbitrary code within the Chrome renderer sandbox by luring a target to a crafted HTML page. The vulnerability is classified CWE-122 and carries a CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); however, Chromium's own internal severity rating is 'Low,' which is notably discordant and implies that exploitation is constrained to within-sandbox code execution rather than full OS compromise. No public exploit code and no CISA KEV listing have been identified at the time of analysis.

Memory corruption in V8, Chrome's JavaScript engine, allows an attacker who can get a user to install a crafted Chrome extension to execute arbitrary code confined within the Chrome sandbox, affecting all Chrome versions prior to 153.0.8010.36. Despite the CVSS 8.8 base score, Chromium's own security team rates this 'Low' severity, reflecting that exploitation is bounded by Chrome's sandbox and does not constitute a full OS-level compromise without a separate sandbox escape primitive. No public exploit code or active exploitation has been identified at time of analysis. Vendor-released patch is available.

Out-of-bounds write in the Media component of Google Chrome before 153.0.8010.36 allows a remote attacker to potentially execute arbitrary code outside the browser's renderer sandbox by luring a victim to a crafted HTML page. The scope-changing memory-corruption bug carries a CVSS of 9.6 despite Chromium's own 'Medium' severity rating, and a vendor patch is available. There is no public exploit identified at time of analysis.

Heap-based buffer overflow in the WebRTC component of Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. The RCE is sandbox-confined (CVSS S:U), meaning a chained sandbox-escape exploit would be needed for full host-level compromise. No public exploit or active exploitation has been identified at time of analysis, and EPSS sits at a low 0.24% (15th percentile), consistent with Chromium's own 'Medium' severity designation despite the 8.8 CVSS base score.

Out-of-bounds write in Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the renderer sandbox by directing a user to a crafted HTML page. All Google Chrome versions prior to 153.0.8010.36 are affected across desktop platforms. Impact is bounded by Chrome's renderer sandbox - an attacker achieves control over the renderer process and can access browser-stored data such as session cookies and saved credentials, but reaching the host OS would require a separately chained sandbox escape exploit. No public exploit identified at time of analysis.

Remote code execution in Google Chrome's ANGLE graphics component on Windows (versions prior to 153.0.8010.36) allows a remote attacker to trigger an out-of-bounds write and potentially execute arbitrary code outside the browser sandbox via a crafted HTML page. Rated Chromium 'High' with a CVSS of 9.6 reflecting a scope-changing sandbox escape, though exploitation requires the victim to load malicious web content. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with CISA SSVC scoring exploitation as 'none'.

Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a heap buffer overflow in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can corrupt heap memory and execute arbitrary code outside the renderer sandbox, gaining full compromise of the host. No public exploit is identified at time of analysis and EPSS is low (0.33%), but the sandbox-escape scope and Chrome's near-universal footprint make prompt patching essential.

Out-of-bounds read in the WebGL component of Google Chrome before 153.0.8010.36 lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates the security severity as High, and a vendor patch is available; no public exploit has been identified and CISA SSVC records exploitation as none, with EPSS at a low 0.28% (20th percentile).

Memory corruption in the Codecs component of Google Chrome prior to 153.0.8010.36 enables remote unauthenticated attackers to execute arbitrary code inside the browser sandbox by delivering a crafted HTML page containing malformed media content. The flaw is classified CWE-119 (improper bounds restriction), rated 'High' by Chromium Security, and carries a CVSS 8.8 base score with a network attack vector requiring only passive user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS stands at a low 0.35% (29th percentile), indicating theoretical rather than observed exploitation.

Remote code execution in Google Chrome prior to 153.0.8010.36 allows a remote attacker to escape the renderer sandbox and run arbitrary code on the host by luring a victim to a crafted HTML page that triggers a heap buffer overflow in the WebGL implementation. Chromium rates this Critical and the CVSS 9.6 score reflects a scope-changing sandbox escape; no public exploit is identified at time of analysis, and EPSS is low at 0.29% (21st percentile). Patched in the September 2026 stable-channel desktop release.

Remote code execution in Google Chrome for Android prior to 153.0.8010.36 arises from an out-of-bounds write in the WebGL graphics subsystem, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the renderer sandbox. Rated Critical by Chromium and CVSS 9.6, the scope-changed vector reflects a full sandbox escape. No public exploit is identified at time of analysis and EPSS is low (0.39%), but WebGL memory-corruption bugs are historically high-value targets.

Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution at current-user privilege level when a victim opens a crafted PDF or supported file format. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383 across all supported platforms, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation in the wild has been identified at the time of this analysis, but Adobe Acrobat's ubiquity in enterprise document workflows makes this a credible phishing or spear-phishing vehicle.

Out-of-bounds write in Adobe Acrobat Reader and Acrobat allows arbitrary code execution in the context of the opening user when a victim opens a specially crafted malicious file. All versions of Acrobat Reader and Adobe Acrobat through 26.002.21900, and Acrobat 2024 through 24.001.30383, are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-based delivery mechanism and full C:H/I:H/A:H impact make this a material risk for organizations with unpatched deployments.

Out-of-bounds write in Adobe Acrobat and Acrobat Reader allows arbitrary code execution in the current user's context when a victim opens a specially crafted file. Affected are Acrobat 2024 versions through 24.001.30383 and Adobe Acrobat/Acrobat Reader through 26.002.21900, per Adobe APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the ubiquity of Acrobat as an attack surface and the RCE-grade impact make this a priority patch.

Out-of-bounds write in Adobe Acrobat Reader and Acrobat (Continuous track through 26.002.21900; Classic 2024 track through 24.001.30383) enables arbitrary code execution in the context of the victim user. The CWE-787 memory corruption flaw is triggered when a specially crafted document is opened, placing this squarely in the document-weaponization threat category common to PDF toolchains. Adobe PSIRT has issued advisory APSB26-141; no public exploit code or CISA KEV listing has been identified at time of analysis.

Out-of-bounds write (CWE-787) in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a crafted malicious PDF or document file. Affected versions span Acrobat 2024 up to 24.001.30383 and both Acrobat and Acrobat Reader through 26.002.21900, per Adobe PSIRT advisory APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the C:H/I:H/A:H CVSS impact and prevalence of Adobe Reader in enterprise environments make this a meaningful patching priority.

Out-of-bounds write (CWE-787) in Adobe Acrobat and Acrobat Reader enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. All continuous-track versions through 26.002.21900 and Acrobat 2024 versions through 24.001.30383 are affected, per Adobe PSIRT and EUVD-2026-74193. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction to deliver and open a malicious document.

Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap memory during RTP encoding, with potential for arbitrary code execution. The root cause is in nal_send() within libavformat/rtpenc_h264_hevc.c, where a negative size value (-3) is passed directly to memcpy, producing an out-of-bounds write. A public proof-of-concept exploit is available, though EPSS probability remains low at 0.17% and no active exploitation has been confirmed by CISA.

Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. Affected versions span both the Photoshop 2025 line (≤26.11.6) and Photoshop 2026 line (≤27.6), covering a broad install base of creative and enterprise users. No public exploit has been identified at time of analysis, though the file-based delivery mechanism makes phishing or watering-hole distribution a natural attack path.

Out-of-bounds write in Adobe Photoshop Desktop allows arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted malicious file. Affected versions span both the Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6) release lines. Adobe's PSIRT has released advisory APSB26-130 addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.

Out-of-bounds write (CWE-787) in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) enables arbitrary code execution in the context of the logged-in user. The attack is triggered by opening a specially crafted document, making phishing attachments and compromised file-sharing platforms viable delivery mechanisms against creative and design professionals. No public exploit identified at time of analysis, but the low attack complexity and full CIA impact across affected versions represent a meaningful and realistic risk.

Out-of-bounds write in Adobe Photoshop Desktop enables arbitrary code execution in the context of the victim's user account when a malicious file is opened. Both the 2025 branch (through version 26.11.6) and the 2026 branch (through version 27.6) are confirmed affected per Adobe's EUVD entry and APSB26-130 advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open trigger and high CVSS C/I/A ratings make this a credible phishing-delivery vector in creative and design environments.

Stack-based buffer overflow in the TP-Link RE210 AC750 range extender's httpd component enables authenticated, adjacent-network attackers to achieve remote code execution by uploading a specially crafted configuration file that exceeds bounds in the `splitString` function. Affected firmware spans US builds through 3.14.2 Build 171205 Rel.71984n and EU builds through 3.14.2 Build 141218 Rel.36430n, per EUVD-2026-73942. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact triplet (C:H/I:H/A:H) indicates full device compromise upon successful exploitation.

Local privilege escalation in the Android kernel's IOMMU subsystem (iommu.c) allows any process with basic user-level execution to gain full kernel privileges through out-of-bounds memory read/write triggered by improper input validation across multiple functions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required, making this a reliable local privilege escalation primitive for post-compromise chains or malicious apps. Google patched this in the Android Security Bulletin for September 2026 with two upstream kernel commits; no public exploit has been identified at time of analysis.

Local privilege escalation in Android's MountRegistry component across Android 14, 15, 16, and 16-qpr2 allows a low-privileged process to achieve full device compromise via a buffer overflow in the forEachLine function of MountRegistry.cpp. The flaw triggers an out-of-bounds read that can corrupt adjacent memory, enabling an attacker to elevate from a sandboxed app or low-privilege process to a higher system privilege level without any user interaction. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total.

Local privilege escalation in Android 17's STMicroelectronics NCI (NFC Controller Interface) driver allows a low-privileged local process to gain full system-level control via a missing bounds check in `stpropnci_process_std()` of `stpropnci_std.cc`. The missing input validation triggers a CWE-120 buffer overflow, achieving C:H/I:H/A:H impact with no user interaction required. No public exploit has been identified at time of analysis per SSVC exploitation status 'none,' though the SSVC Technical Impact is rated 'total.'

Local privilege escalation affects Android versions 16, 16-qpr2, and 17 via heap-based buffer overflow triggered by integer overflow in multiple framework locations. An attacker with basic local code execution (low-privileged app or shell) can exploit the memory safety flaw - requiring no additional privileges or user interaction - to gain full control of the device, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is identified at time of analysis; EPSS of 0.12% (2nd percentile) indicates low probability of near-term observed exploitation.

Heap buffer overflow in Android's HEVC decoder (`ihevcd_get_tu_data_size` in `ihevcd_utils.c`) enables local privilege escalation across Android 14 through Android 17 with no additional execution privileges or user interaction required. A low-privileged attacker - such as a malicious application - can craft HEVC video input that triggers an out-of-bounds write on the heap, corrupting adjacent memory structures and ultimately gaining elevated device privileges. No public exploit code has been identified at time of analysis, and SSVC currently rates active exploitation as none, though the technical impact is classified as total.

Out-of-bounds write in Android's openLogicalChannel function across multiple telephony-related files enables local privilege escalation on Android 16 and 17 without requiring elevated permissions or user interaction. An attacker running as a low-privileged app can supply oversized input to a missing bounds check, corrupting adjacent memory and achieving full C:H/I:H/A:H system impact per CVSS. No public exploit has been identified at time of analysis; SSVC rates technical impact as total while exploitation status remains none.

Out-of-bounds write in Android's NFC RoutingManager (checkUikcListenConfigNeeded in RoutingManager.cpp) enables remote code execution from adjacent NFC proximity on Android 16-QPR2 and Android 17 without requiring user interaction. The missing bounds check in UICC listen configuration handling allows a proximal attacker to corrupt memory in the NFC daemon, leading to full code execution in that process context. No public exploit has been identified at time of analysis; SSVC rates technical impact as total but exploitation status as none.

Heap-based buffer overflow in parseParts of PduParser.java enables local privilege escalation across Android 14 through 17 (including Android 16-QPR2). A low-privileged process on the device can trigger an out-of-bounds read via a malformed PDU, corrupting heap memory to achieve full confidentiality, integrity, and availability compromise without requiring user interaction. No public exploit code or KEV listing has been identified at time of analysis.

Local privilege escalation in Android 17 and Android 16-qpr2 stems from integer overflow vulnerabilities across multiple code locations, enabling out-of-bounds writes. A low-privileged local process or application can exploit these flaws without additional execution privileges or user interaction to gain full control over the device. No public exploit has been identified at time of analysis, and SSVC signals no current exploitation activity, but technical impact is rated total.

Remote code execution in Google Android (versions 14 through 17, including 16-qpr2) arises from a heap buffer overflow (CWE-122) present in multiple system code paths, per the September 2026 Android Security Bulletin. The flaw is reported by Google's Android security team as exploitable with no additional execution privileges and no user interaction, giving a remote attacker full compromise of the affected process context. SSVC rates exploitation as 'none' and there is no public exploit identified at time of analysis, but CISA's automatable=yes / technical-impact=total assessment marks it as a high-priority patch target.

Out-of-bounds write vulnerabilities in multiple Android system functions allow a local, low-privileged attacker to escalate to root on Android 16-QPR2 and Android 17 without requiring any user interaction. The root cause is integer overflow (CWE-787) that underestimates buffer allocation size, enabling memory writes beyond allocated regions and corruption of privilege-sensitive data structures. The September 2026 Android Security Bulletin addresses these issues, and no public exploit has been identified at time of analysis.

Out-of-bounds write in Android's NFC MIFARE Classic read handler (`rw_mfc_handle_read_op` in `rw_mfc.cc`) enables a local low-privileged process to escalate to higher execution privileges with no user interaction. The flaw spans Android 14, 15, 16, 16-QPR2, and 17, covering the full range of currently supported Android releases. Google addressed this in the September 2026 Android Security Bulletin; no public exploit code has been identified at time of analysis.

Remote code execution is achievable in Android's NFC subsystem across Android 14 through 17, including Android 16-QPR2, via a heap buffer overflow in the MIFARE Classic tag reader function rw_mfc_handle_read_op() within rw_mfc.cc. An attacker within NFC proximity can present a crafted MIFARE Classic tag that overflows a heap-allocated buffer in the NFC daemon, yielding full device control with no victim interaction required and no privileges needed on the target. No public exploit has been identified at time of analysis, though the SSVC framework rates the technical impact as total given the unauthenticated RCE capability.

Remote code execution is possible in Android's NFC Type 3 Tag processing layer (rw_t3t.cc within libnfc-nci) across Android 14 through 17 via an integer overflow that triggers a heap out-of-bounds write. No user interaction or additional privileges are required per the description, making this exploitable by any attacker within NFC proximity of an unpatched device. Google addressed this in the September 2026 Android Security Bulletin; no public exploit or active exploitation has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation status as 'none'.

Heap buffer overflow in the `read_boot_region` function of Android's filesystem check utility (`fsck.c`) allows a local, low-privileged process to escalate privileges with full system impact. The flaw spans Android 14 through 17 (including QPR2 branches) and was disclosed in Google's September 2026 Android Security Bulletin. No public exploit code has been identified at time of analysis, and EPSS signals a very low current exploitation probability.

Heap buffer overflow in Android's Bluetooth A2DP Opus vendor codec decoder allows a local low-privileged attacker to escalate privileges with no user interaction required. The flaw resides in `a2dp_vendor_opus_decoder_decode_packet` within `a2dp_vendor_opus_decoder.cc`, where a crafted Opus-encoded audio stream can trigger an out-of-bounds write on the heap. Affected versions span Android 14 through Android 17; no public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none.

Heap buffer overflow in Android's Wi-Fi P2P (Wi-Fi Direct) provision discovery handler enables proximal unauthenticated attackers to achieve remote code execution on affected devices without requiring user interaction. The flaw resides in `p2p_process_prov_disc_bootstrap_req()` within `p2p_pd.c`, where a malformed provision discovery bootstrap request triggers an out-of-bounds write on the heap. Android 16, Android 16-QPR2, and Android 17 are confirmed affected per the September 2026 Android Security Bulletin; no public exploit code exists and EPSS at 0.13% (3rd percentile) reflects minimal current exploitation activity.

Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.

Local privilege escalation in Android's NFC stack affects devices running Android 14 through 17 via an out-of-bounds write triggered by a logic error in rw_mfc_handle_read_op, the MiFare Classic card read-operation handler in rw_mfc.cc. An attacker holding low-privilege local code execution can corrupt adjacent memory and escalate to higher system privileges with no additional privileges or user interaction required. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the five-release breadth of affected versions spans the bulk of the active Android install base, making this a meaningful patch target.

Heap buffer overflow in Android's OAPV video codec decoder (oapv.c) enables remote code execution on Android 16 and 17 without requiring user interaction. The flaw resides in dec_frm_prepare(), where insufficient bounds checking during frame decoding preparation allows an attacker to overwrite heap memory via crafted video content. EPSS sits at 0.18% (8th percentile) with SSVC exploitation status rated 'none', but technical impact is classified as 'total' and no public exploit has been identified at time of analysis.

Remote code execution in Android's MatroskaExtractor component (MatroskaExtractor.cpp) affects Android 14, 15, 16, and 16-qpr2 via an improper type cast during Matroska/MKV media container parsing. A low-privileged remote attacker can exploit this flaw without user interaction to achieve full confidentiality, integrity, and availability compromise on the target device. No public exploit has been identified at time of analysis, and EPSS stands at 0.15%, though the zero-interaction requirement and full-impact CVSS 8.8 rating warrant prompt patching.

Out-of-bounds write in Android's camera metadata validation logic (validate_camera_metadata_structure in camera_metadata.c) allows a local low-privileged attacker to escalate privileges to a higher-privileged context with full confidentiality, integrity, and availability impact. Affects Android 14 through 16-qpr2, patched in the September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; EPSS sits at the 2nd percentile and SSVC rates exploitation as none.

Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.

Remote code execution in Windows Print Spooler Components (Windows 11 24H2, build < 10.0.26100.9445) via a heap-based buffer overflow triggered over the network. An unauthenticated remote attacker can exploit this by delivering a maliciously crafted print-related payload that a victim user must interact with, resulting in full C:H/I:H/A:H compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible vector and zero-privilege requirement make this a meaningful patching priority.

Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.

Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.

Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.

Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.

Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.

Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.

Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.

Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.

Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.

Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.

Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.

Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.

Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.

Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.

Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.

Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.

Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.