Buffer Overflow

Stack buffer overflow in PJSIP's GnuTLS TLS backend allows a network-positioned attacker to corrupt memory or hijack control flow by presenting a crafted X.509 certificate with an oversized Subject Alternative Name entry during TLS handshake. Only builds compiled with GnuTLS (--with-gnutls) are affected; OpenSSL and Apple SecureTransport/Network.framework builds are explicitly unaffected. The vulnerability triggers before any SIP-level authentication, making it exploitable against both clients (connecting to a malicious server) and servers that request client certificates, with impact ranging from application termination to potential arbitrary code execution. No public exploit has been identified at time of analysis; upstream fix is available via commit c4a151a.

Stack-based buffer overflow in PJSIP's SRTP/SDES media transport allows a remote unauthenticated attacker to crash or potentially hijack control flow in any pjproject-based application with SRTP/SDES keying enabled. The flaw in `sdes_encode_sdp()` (transport_srtp_sdes.c) collects `a=crypto` attributes from a remote SDP offer into a fixed-size stack array without bounding the count, so a malicious SIP peer can overflow that array by including more attributes than it can hold. The vulnerability is reachable from an incoming SIP INVITE before application-level authentication, and a fix is available as upstream commit a1b707c; no public exploit or CISA KEV listing has been identified at time of analysis.

Stack buffer overflow in PJSIP's PJSUA library allows a malicious or compromised SIP registrar to crash applications - or potentially corrupt memory - by returning an excessive number of Service-Route headers in a 2xx registration response. The vulnerability affects all applications using the PJSUA/PJSUA2 account API (the default registration path) prior to commit acc03b5 in pjproject. The most likely outcome is denial of service via unexpected termination; however, because the overflow writes internal stack pointers rather than attacker-controlled bytes, arbitrary code execution is considered less probable though not excluded. No public exploit code or CISA KEV listing is present at time of analysis.

Out-of-bounds memory corruption in PJSIP pjproject's SDP negotiator allows a remote unauthenticated attacker to trigger memory corruption and denial of service by sending a crafted SDP offer or answer containing out-of-range payload-type numbers. The root defect is in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c, where PT numbers from remote SDP are used as fixed-size array indices with only a lower-bound check, not an upper-bound check. Exploitation requires the non-default compile-time flag PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP to be enabled; default builds are entirely unaffected, no public exploit has been identified, and code execution has not been demonstrated.

Remote denial of service and integrity compromise in IBM i 7.3, 7.4, 7.5, and 7.6 arises from an out-of-bounds write (buffer overflow) reachable by a remote attacker. Per IBM's CVSS 3.1 vector the flaw is network-reachable with no privileges or user interaction, corrupting memory to crash affected services and tamper with data integrity (C:N/I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.32%), and the CISA SSVC framework records exploitation status as none.

Denial-of-service in IBM i 7.3 through 7.6 allows an unauthenticated network-adjacent attacker to crash the ICMPv6 stack by sending a malformed Router Advertisement packet with an invalid prefix length. The underlying flaw is an out-of-bounds write (CWE-787) triggered by absent validation of the RA prefix length field, resulting in limited availability impact without confidentiality or integrity loss. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor patch is available.

Denial of service in IBM i versions 7.3, 7.4, 7.5, and 7.6 is exploitable remotely by unauthenticated network attackers via a buffer overflow (CWE-787, out-of-bounds write), degrading service availability without requiring credentials or user interaction. IBM has released a patch via their support portal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 5.3 score reflects limited practical impact - no confidentiality or integrity compromise.

Integer underflow leading to heap-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privilege authenticated access to corrupt memory, potentially achieving arbitrary code execution or full system compromise. IBM has released patches for all four affected major versions; no active exploitation is recorded in CISA KEV and EPSS sits at 0.20% (10th percentile), placing real-world exploitation probability low despite the high CVSS score. SSVC rates this non-automatable with partial technical impact, suggesting the authentication barrier and service specificity meaningfully constrain mass exploitation.

Out-of-bounds write in Hugging Face tokenizers v0.23.1 allows any actor who can supply a crafted tokenizer.json file to abort the loading process immediately, causing denial of service in Rust applications and FFI embeddings before any inference occurs. The defect in BpeBuilder::build (tokenizers/src/models/bpe/model.rs) allocates a scratch buffer sized to the longest vocabulary key, then writes concatenated BPE merge pairs into it without bounding the write to the buffer size; a merge whose result exceeds that length triggers a Rust panic and process abort (CWE-787). A secondary usize underflow at the same code site, activated when continuing_subword_prefix is set and a merge token is shorter than the prefix, produces a panic in debug builds and potential memory corruption in release builds, elevating the secondary impact beyond availability alone. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix appears in the v0.23.2 source.

Heap buffer overflow in Corosync's Totem Process Group (totempg) message reassembly exposes high-availability clusters to network-adjacent unauthenticated attack. When processing fragmented multicast messages, the reassembly buffer lacks runtime bounds checking in release builds, allowing an attacker on the same cluster network to trigger heap corruption with attacker-controlled data. The confirmed impact is a daemon crash causing full cluster denial-of-service; the description explicitly acknowledges the potential for further exploitation - including possible code execution - contingent on heap layout control, though RCE remains unconfirmed at time of analysis. No public exploit or KEV listing identified.

Done. The analysis is above as the JSON object. Key points of the synthesis: - **Same FreeIPMI 1.6.19 cluster** as CVEs 85504/85507/85508 already tracked — all client-side stack overflows (CWE-121) triggered by a malicious/compromised BMC returning oversized responses. - **CVSS 9.8 is overstated**: this is a client-side/rogue-BMC flaw, not an internet-facing service. I assessed it down to `AC:H/UI:R` (needs attacker control of a BMC plus an operator/job initiating the FRU read). - **Metadata is clean** — vendor tag, CPE, and CWE all correct, and no embedded injection note this time — so `data_quality_flags` is `[]`. - Fix confirmed as 1.6.19; no EPSS/KEV/POC signal, so exploitation status is unknown. Memory updated with the new CVE note and index entry.

Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.

Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (all versions before 1.6.19) can corrupt memory in the client host when the 'dell get-system-info cmc-info' subcommand parses a CMC info response, potentially leading to code execution in the context of the operator running the tool. The flaw lives in the response-handling routine _output_dell_system_info_cmc_info (ipmi-oem/ipmi-oem-dell.c), so it is triggered by the data returned from the queried BMC/CMC rather than by an inbound network request. No public exploit identified at time of analysis, and it is not in CISA KEV; EPSS data was not provided.

Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (versions before 1.6.19) lets a malicious or compromised Dell iDRAC BMC corrupt the memory of the client host running the 'dell get-system-info idrac-info' subcommand, potentially achieving code execution in the context of the operator (often root). The flaw sits in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c, which copies attacker-influenced OEM response data into a fixed-size stack buffer without bounds checking. No public exploit identified at time of analysis; disclosed via oss-security and fixed in FreeIPMI 1.6.19.

Stack-based buffer over-read in FreeIPMI's ipmi-oem Fujitsu OEM module crashes the client process when a Fujitsu BMC returns a shorter-than-expected response to a System Event Log query. All FreeIPMI versions before 1.6.19 are affected; this is a distinct vulnerability from CVE-2026-50031, which covers different version ranges. No public exploit code or active exploitation has been identified at time of analysis.

Stack-based buffer overflow in GNU FreeIPMI before 1.6.19 lets a malicious or compromised Fujitsu iRMC BMC corrupt client memory when the FreeIPMI tooling parses malformed Fujitsu SEL 'long text' responses in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text. Successful exploitation can crash the client or execute arbitrary code in the context of the process reading the System Event Log (typically ipmi-sel or libfreeipmi consumers). No public exploit is identified at time of analysis, and the flaw is fixed in FreeIPMI 1.6.19.

Remote unauthenticated denial-of-service against Open5GS v2.7.7 is possible by sending a crafted HTTP/2 SBI request containing an overlong timestamp string to the Session Management Function. The `ogs_sbi_time_from_string()` function in `lib/sbi/conv.c` copies characters into a fixed-size buffer using loop counters `j` and `k` without checking bounds, triggering a buffer overflow that crashes the SMF process and disrupts all active and new PDU sessions. Public proof-of-concept exploit code is available via the hackeryounow/5GCVulDB repository; no active exploitation is confirmed in CISA KEV.

Heap-based buffer overflow in libheif before 1.23.2 allows remote attackers to corrupt memory and potentially achieve code execution when a crafted HEIF/HEIC image is decoded. The flaw is reached through nested `iden`/`auxl` item references that cause a duplicate Alpha plane to be attached to an image on top of an existing, differently-sized plane; the second plane is invisible to size queries but is still written to by `scale_nearest_neighbor()`, producing an out-of-bounds heap write (CWE-787). The independent assessment rates this as UI:R (interactive viewers require the victim to open the file), while purely automated decode pipelines such as upload/thumbnail services are effectively UI:N; there is confirmed vendor patching (v1.23.2) but no public exploit identified at time of analysis.

Stack buffer overflow in the uMS graphical operator tool of MOOS ui-moos through commit 50b9c6c allows an unauthenticated network attacker to achieve code execution on an operator workstation by injecting excessively long client or variable names into the MOOSDB pub-sub middleware. When the operator subsequently selects a malicious process list entry or pokes an oversized variable through the uMS interface, unchecked sprintf calls in ScopeTabPane.cpp and ScopeGrid.cpp overflow fixed 1024-byte stack buffers, enabling memory corruption and control-flow hijack. The upstream fix (PR #5, commit a6ebc0bc) is confirmed by direct patch diff evidence replacing all three vulnerable sprintf calls with snprintf; no public exploit code or KEV listing has been identified at time of analysis.

Remote code execution risk in MOOS core-moos through 10.4.0 arises from a pre-authentication heap overflow in MOOSCommPkt packet handling, where a remote attacker declares a negative packet length to write arbitrary data into a four-byte heap buffer during the connection HandShake, before any authentication occurs. Any exposed MOOSDB robotics-middleware instance is affected, and because the flaw is triggered by an attacker-controlled length read straight off the wire, it can be reached with a single crafted packet. No public exploit identified at time of analysis, though the issue was reported and detailed by VulnCheck and a fix is available.

Out-of-bounds write in MOOS-IvP through 24.8.1 allows remote attackers to corrupt memory and potentially execute code by supplying a crafted encoded BHV_IPF payload. The StringToIvPFunction() decoder reads dimension, piece, and degree counts directly from the payload and uses them as allocation sizes and loop bounds without any ceiling check, so mismatched dimension values let an attacker write attacker-controlled doubles past the end of the IvPBox weight array. A vendor patch exists (PR #126); no public exploit and no CISA KEV listing have been identified at time of analysis.

Remote code execution in MOOS-IvP through 24.8.1 arises from multiple heap and stack buffer overflows in the IvP function string decoders (FunctionEncoder.cpp / FunctionEncoderMK.cpp), which copy attacker-controlled encoded strings into fixed buffers while trusting declared length fields and scanning for delimiters without any bounds or end-of-string checks. Any actor able to publish a crafted value to a MOOS variable (via the typically unauthenticated MOOSDB) or supply a malicious .alog file can overflow these buffers, potentially achieving code execution on the autonomy stack of a marine vehicle. Publicly available exploit code exists per the VulnCheck advisory; there is no public exploit identified in CISA KEV, so it is not confirmed as actively exploited.

Heap corruption in MOOS essential-moos through 10.0.1 allows unauthenticated remote attackers to crash the pMOOSBridge process by sending a single crafted UDP datagram containing a negative declared packet length. The root cause is a signed-to-unsigned type confusion in CMOOSUDPLink::ReadPktFromArray(): a negative nRqd value passes a signed bounds check unchanged, then is silently cast to a near-SIZE_MAX size_t when passed to memcpy, writing far beyond the destination heap buffer. No public exploit has been identified at time of analysis, but the attack primitive requires only network access to the UDP listen port and a small crafted payload; the upstream fix is available as a GitHub patch commit.

Stack-based buffer overflow in the EasyMesh daemon of the TP-Link Archer AX55 v4 allows a LAN-adjacent unauthenticated attacker to crash the easymesh process and potentially achieve remote code execution on the router, provided Mesh mode is enabled. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N) correctly constrains the attack to the local network segment with high complexity due to the Mesh mode prerequisite. TP-Link has released a patched firmware; no public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds heap read during .DSB file parsing in DASYLab (all versions prior to 2026.0.0) allows an attacker who can persuade a user to open a specially crafted data file to potentially disclose heap memory contents and crash the application. The root cause is CWE-125: insufficient validation of user-supplied length or offset fields during file-handling routines, causing reads a few bytes past an allocated heap buffer boundary. No public exploit code or active exploitation has been identified at time of analysis; vendor-released patch is version 2026.0.0.

Out-of-bounds write in DASYLab (all versions before 2026.0.0) enables arbitrary code execution when a victim opens a specially crafted .DSB worksheet file. The flaw, CWE-787, stems from improper validation of user-supplied data within the .DSB file parser, permitting writes past the end of an allocated data structure and corrupting adjacent memory. No public exploit or active exploitation has been identified at time of analysis; successful exploitation requires social-engineering the target into opening a malicious file.

Out-of-bounds heap write in DASYLab before version 2026.0.0 enables arbitrary code execution on the victim's system when a user opens a maliciously crafted .DSB worksheet file. The flaw stems from insufficient validation of user-supplied data during .DSB file parsing, allowing an attacker to write past the end of an allocated heap buffer (CWE-787). All versions of DASYLab prior to 2026.0.0 are affected, and exploitation relies entirely on convincing a user to open a weaponized file; no public exploit or active exploitation has been identified at time of analysis.

Out-of-bounds write in DASYLab's .DSB worksheet file parser allows an attacker to achieve code execution with full confidentiality, integrity, and availability impact by convincing a user to open a crafted file. All versions of DASYLab prior to 2026.0.0, as published by MeasX (formerly National Instruments), are affected. No public exploit code exists and no active exploitation has been confirmed at time of analysis.

Remote code execution in Google Chrome for Android before 152.0.7977.82 stems from an out-of-bounds write in the WebGL implementation, letting a remote attacker escape the browser sandbox and run arbitrary code simply by luring a victim to a crafted HTML page. Rated Chromium severity High and CVSS 9.6, the flaw is notable because exploitation breaks out of the renderer sandbox rather than being contained by it. There is no public exploit identified at time of analysis, and CISA SSVC lists exploitation status as none.

Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution within the current user's security context when a victim opens a specially crafted malicious file. The vulnerability resides in file-parsing logic (CWE-122), and successful exploitation grants full C:H/I:H/A:H impact without requiring elevated privileges on the victim's system. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has released a security advisory (APSB26-121) addressing the issue.

Buffer overflow in Tenda HG10 router firmware version 300001138 enables network-accessible authenticated attackers to overflow memory in the Boa embedded web server's WLAN configuration handler, potentially achieving arbitrary code execution. The vulnerable parameter is `ssid` within the `/boaform/formWlanSetup` endpoint, which lacks input length validation per CWE-120. A public proof-of-concept is hosted on GitHub, concretely lowering the exploitation bar; no vendor patch has been identified at time of analysis.

Pre-authentication remote buffer overflow in Tenda HG10 router firmware version 300001138 allows unauthenticated network attackers to execute arbitrary code by sending an oversized Username value to the Boa Web Server's /boaform/formLogin endpoint. The formLogin function performs no bounds checking on the supplied credential field, enabling stack or heap corruption reachable directly from the WAN or LAN interface without any prior authentication. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the bar for exploitation. No public exploit identified at time of analysis is overridden here: publicly available exploit code exists.

Remote code execution in Rockwell Automation Arena's DOE file parser allows a network-reachable attacker to write beyond the boundary of an allocated object and execute arbitrary code within the context of the running Arena process. Affected users must be socially engineered into opening a maliciously crafted Design of Experiments (DOE) file or visiting a page that triggers the parse. The CVSS 4.0 score of 7.5 reflects high attack complexity and mandatory active user interaction, reducing real-world exploitability despite the high-severity memory corruption impact. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stack buffer overflow in gfs2-utils' savemeta function allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The vulnerability stems from using an attacker-controlled `height` field from on-disk inode metadata as a loop bound without validation, overwriting stack memory beyond the buffer's allocated region. Exploitation requires convincing a privileged or standard user to run gfs2-utils tooling against a malicious image, with successful exploitation granting code execution at the privilege level of the running process. No public exploit code or active exploitation has been identified at time of analysis.

Stack buffer overflow in the gfs2_edit utility within gfs2-utils allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The di_height field from on-disk inode metadata is used as an array index with no bounds validation, enabling a stack overwrite with fully controlled data from an untrusted image. Affected systems include all supported Red Hat Enterprise Linux 7, 8, and 9 installations that ship gfs2-utils; no public exploit or active exploitation has been identified at time of analysis.

Out-of-bounds buffer access in the Linux kernel's synaptics-rmi4 driver exposes systems with Synaptics RMI4 touchpad hardware to kernel memory corruption triggered by a copy-paste typo in F55 electrode initialization. On affected hardware where the receiver (RX) electrode count exceeds the transmitter (TX) count, the incorrectly propagated TX value causes F54 diagnostic routines to calculate an inflated report buffer size, enabling potential OOB reads or writes in kernel space. Patched stable releases are available across all maintained kernel branches; no public exploit code or active exploitation (CISA KEV) has been identified, and EPSS remains at 0.21%.

Out-of-bounds memory access in the Linux kernel's Loongson2 MMC driver allows a local authenticated user to corrupt kernel memory through incorrect scatterlist indexing in the mmc: loongson2 subsystem. The functions `ls2k0500_mmc_reorder_cmd_data()` and `ls2k2000_mmc_reorder_cmd_data()` use `for_each_sg()` to iterate a scatterlist but then incorrectly re-index the current `sg` pointer as if it were an array base (using `&sg[i]`), causing access to wrong or out-of-bounds scatterlist entries. This memory corruption can lead to full kernel compromise - confidentiality, integrity, and availability loss - on systems using Loongson LS2K0500 or LS2K2000 SoCs equipped with MMC storage. No public exploit has been identified at time of analysis.

Out-of-bounds memory reads in the Linux kernel's drm/amdkfd CRAT table parser allow a local attacker to leak kernel memory and potentially crash the system on AMD GPU/APU-equipped hosts. The CRAT (Component Resource Affinity Table) subtype parser validates that a subtype header fits within the image buffer but fails to verify that the advertised subtype length field also stays within bounds, enabling kfd_parse_subtype() to cast the header pointer beyond valid memory when a malformed CRAT table is supplied. No public exploit has been identified at time of analysis; EPSS is 0.19%, placing this in the 9th percentile.

Out-of-bounds table access in the Linux kernel fp9931 regulator driver exposes kernel memory to corruption via a malformed VPOS/VNEG voltage selector lookup table. The fp9931 driver's VPOSNEG_table[] contains two defects: a duplicate 7.04V entry that shifts all subsequent selector mappings by one, and a truncated table of only 41 entries instead of the required 64, meaning any selector value above 0x28 triggers an out-of-bounds access in kernel memory. Devices incorporating the FP9931 PMIC (a display-panel power regulator) running affected kernel versions are vulnerable; exploitation probability is very low (EPSS 0.20%, 10th percentile) with no public exploit and no confirmed active exploitation.

Out-of-bounds kernel memory read in the Linux kernel DRM log subsystem allows a local low-privileged user to potentially disclose kernel memory contents or crash the system. The flaw resides in drm_log_draw_kmsg_record(), where an unsigned integer underflow on a zero-length message causes an array access at offset UINT_MAX (0xFFFFFFFF) rather than a valid buffer position. No public exploit exists and EPSS sits at 0.20% (10th percentile), indicating low observed exploitation interest, though the kernel DRM panic-display path is reachable on any system with a GPU using the DRM framework.

Out-of-bounds write in the Linux kernel's `dev_validate_header()` network function allows a local process holding `CAP_SYS_RAWIO` to corrupt kernel memory by sending a raw packet with a short link-layer header while the target network device is concurrently reconfigured to increase `hard_header_len`. The `memset` zero-padding operation writes past the skb headroom reserved at allocation time, producing a silent memory corruption that is worse than the pre-existing `skb_under_panic()` it masks. Patches are available across multiple stable kernel branches; EPSS stands at 0.24% with no public exploit or CISA KEV listing.

Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and below enables attackers to potentially achieve full system compromise, including code execution. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) indicates local access with low privileges, while the vendor description separately references a 'high privileged remote attacker' - a direct conflict in both attack vector and privilege level requiring vendor clarification. No public exploit or CISA KEV listing exists at time of analysis.

Buffer overflow in TOTOLINK CP450 4.1.0's web CGI handler allows low-privileged remote attackers to corrupt memory and likely execute arbitrary code by supplying an oversized value to the `topicurl` argument in `/cgi-bin/cstecgi.cgi`. The CVSS 4.0 threat metric E:P confirms proof-of-concept exploit code exists, elevating this beyond a theoretical concern. No vendor patch or advisory has been published, leaving affected devices exposed with only compensating controls available.

Heap buffer overflow in zlib 1.3.1.2 through 1.3.2 allows remote attackers to corrupt memory via crafted input to applications using the non-blocking gzwrite API. The gz_vacate() function fails to bounds-check a memmove() when stale external buffer pointers are present after a write stall, reachable by calling gzprintf() or gzvprintf() in that state. A publicly available proof-of-concept exploit exists; no vendor-released patch has been identified at time of analysis.

Verifier bypass in PREVAIL, the polynomial-runtime eBPF verifier (used notably as the abstract-interpretation verifier in ebpf-for-windows), affects all versions prior to 0.2.4. When a destination register carries a non-singleton typeset - two or more simultaneously possible pointer types, e.g. {ctx, shared} or a {number, pointer} union - EbpfTransformer::add() silently skips updating the pointer offset variable, leaving a stale pre-add offset. Subsequent bounds checks reason from that stale offset and accept out-of-bounds memory accesses, so a crafted BPF program that would corrupt memory at runtime is incorrectly accepted as safe; the fix landed in 0.2.4 and no public exploit has been identified.

Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.

Heap buffer overflow in PX4 Autopilot's sd_bench command allows adjacent unauthenticated attackers to crash the flight controller or potentially execute arbitrary code by supplying a block size parameter smaller than four bytes. The overflow occurs because a fixed four-byte block number is written into a heap allocation sized by the user-supplied block_size value - when that value is 1, 2, or 3 bytes, the write extends beyond the allocated region. No active exploitation has been confirmed (not in CISA KEV) and no EPSS score is available, but the adjacent network attack vector means exploitation is constrained to operators with direct access to the drone's MAVLink control network.

Stack-based buffer overflow in the GPU component of Google Chrome on Windows (prior to 152.0.7977.75) enables full sandbox escape and arbitrary code execution on the host operating system. Exploitation is a two-stage chained attack: an attacker must first compromise the renderer process (via a separate vulnerability or exploit), then leverage this GPU flaw to break out of Chrome's sandbox and execute code with elevated host privileges. Google has released a patch in the stable channel update for desktop; no public exploit code or CISA KEV listing has been identified at time of analysis.

Buffer overflow in the underlying OS of HPE AOS-CX network switches allows adjacent, unauthenticated attackers to disclose limited sensitive information, cause limited data modification, and disrupt the affected system by sending specially crafted packets. The CVSS 7.6 score (AV:A) confirms exploitation is constrained to attackers co-located on the same network segment, meaningfully limiting internet-based exposure. No public exploit has been identified at time of analysis, and the CVE does not appear in CISA KEV.

Silent stack-based buffer overflow in Pyramid Solutions' NetStaX EtherNet/IP Stack before v5.6.1 lets a remote attacker send an oversized Class 3 explicit-message request that overruns the application-side receive buffer without any CIP error being returned, causing memory corruption, device crash, or a potential remote code-execution path. Any industrial device embedding the affected stack for EtherNet/IP communication is exposed over the network with no authentication. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp) exposes GNOME desktop users to process-level denial of service or potential arbitrary code execution when connecting to a malicious SFTP server. The read_reply() function trusts the server-supplied response length without validating it against the client's allocated buffer, allowing a rogue server to overflow adjacent heap memory in the gvfsd-sftp daemon. No public exploit or CISA KEV listing is confirmed at time of analysis, but the high CVSS score of 8.8 and the C:H/I:H/A:H triad reflect worst-case RCE potential once a user mounts an attacker-controlled share.

Unauthenticated denial-of-service in Rockwell Automation RSLinx Classic allows a remote attacker to crash the communications service by sending a crafted CIP packet containing an oversized embedded message request. The buffer overflow (CWE-120) causes the RSLinx Classic service to terminate, requiring manual restart to restore industrial device connectivity. In OT/ICS environments where RSLinx Classic bridges engineering workstations to Allen-Bradley PLCs and HMIs, service loss can halt production operations or degrade visibility into live industrial processes. No public exploit or CISA KEV listing confirmed at time of analysis.

Unauthenticated remote denial-of-service in Rockwell Automation CompactLogix 5380 and ControlLogix 5580 industrial controllers allows a network-adjacent attacker to trigger a Major Nonrecoverable Fault (MNRF) by sending a malformed CIP message with an invalid input length, requiring a physical power cycle to restore controller operation. The vulnerability is rooted in CWE-119 (improper buffer bounds restriction) during CIP message processing on EtherNet/IP-accessible PLCs. No public exploit code or active exploitation has been identified at the time of this analysis, but the zero-prerequisite network attack surface on safety-critical industrial hardware makes this a prioritized remediation target for OT security teams.

Memory safety vulnerabilities across multiple internally discovered bugs in Firefox 154 and Firefox ESR 153.1 allow network-based attackers to potentially achieve full browser compromise through memory corruption (CWE-119). Mozilla's own advisory clusters dozens of individual Bugzilla reports - including buffer overflows and related defects - under a single advisory umbrella, noting that sufficiently motivated attackers could likely exploit some of these bugs. Vendor-released patch is available: Firefox 155 and Firefox ESR 153.2. No public exploit identified at time of analysis.

Memory corruption in Mozilla Firefox 154, Firefox ESR 153.1, and Firefox ESR 140.14 stems from a batch of internally discovered memory-safety defects that Mozilla presumes could be exploited to run arbitrary code within the browser process. The flaws were found by Mozilla's own developers and fuzzing efforts (no external report), affect the mainline and both ESR trains, and are resolved in Firefox 155, ESR 140.15, and ESR 153.2. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).

Memory-corruption defects in Mozilla Firefox 154 were discovered internally by Mozilla and bundled under CVE-2026-84142 (advisories MFSA2026-82 and MFSA2026-86), and fixed in Firefox 155. Several of the reported Bugzilla issues showed evidence of memory corruption that Mozilla presumes could have been exploited with sufficient effort to achieve code execution when a user renders malicious web content. There is no public exploit identified at time of analysis and EPSS is low (0.14%), consistent with an internally-found, pre-disclosure fix rather than active abuse.

Memory corruption in the Graphics: ImageLib component of Mozilla Firefox stems from an integer overflow when handling image data, potentially allowing remote attackers to corrupt heap memory and achieve code execution when a victim renders malicious image content. Mozilla fixed the issue in Firefox 155 and Firefox ESR 153.2 (advisories mfsa2026-82/85/86/88). It carries a critical 9.8 CVSS score, but EPSS is only 0.14% (4th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.

Memory corruption vulnerabilities internally discovered across multiple Firefox release lines (154, ESR 153.1, ESR 140.14, ESR 115.39) could enable remote code execution when a user visits a specially crafted webpage. Mozilla's security team identified a cluster of memory safety bugs spanning 15+ tracked Bugzilla issues, several of which showed direct evidence of memory corruption sufficient to presume exploitability with sufficient attacker effort. Patches are available across all affected branches (Firefox 155, ESR 115.40, ESR 140.15, ESR 153.2); no public exploit code or CISA KEV listing is associated with this advisory.

Remote code execution in the Tenda A18 Wi-Fi router (firmware v15.13.07.09) arises from an unauthenticated buffer overflow in the fromSetCmdlineRun function, letting a remote attacker corrupt memory and run arbitrary code on the device. The CVSS 9.8 vector indicates network-reachable, no-authentication, no-interaction exploitation, and a public repository (github.com/momo8877847/Tenda-A18) appears to document the flaw, so publicly available exploit code likely exists. There is no CISA KEV listing and EPSS is low (0.30%), indicating no confirmed widespread active exploitation at this time.

Memory corruption via classic buffer overflow in WebKitGTK allows remote attackers to achieve full code execution by delivering malicious web content to a victim user. Affecting Red Hat Enterprise Linux versions 6 through 9, the vulnerability requires no authentication and no special configuration - only that a user process attacker-controlled web content through a WebKitGTK-based application. No public exploit has been identified at time of analysis, but the CVSS 8.8 High rating and full CIA triad impact make this a high-priority patching target across the affected RHEL fleet.

Integer overflow in MSI Dragon Center's NTIOLib_X64.sys kernel-mode driver (versions up to 2.0.155.0) allows local low-privileged users to corrupt kernel memory via crafted count or elementSize arguments passed to the MmioWritePath MMIO Write Path Handler. Exploitation can yield full SYSTEM-level privilege escalation on the target host. A public proof-of-concept is available, the vendor did not respond to coordinated disclosure, and no official patch has been released.

Out-of-bounds heap write in GDB's legacy STABS debug format parser allows arbitrary code execution within the GDB process when a user opens a crafted ELF binary. The root cause is a linked-list removal bug in `read_member_functions()` (gdb/stabsread.c) that retains destructor entries in the main function list after decrementing the length counter, causing the subsequent array copy to write beyond allocated bounds. Confirmed under controlled conditions to achieve command execution within GDB; no inferior process execution is required, and no public exploit code is known at time of analysis.

Out-of-bounds write in D-Link DSM-G600 firmware 1.01 exposes the device to remote memory corruption via a malformed multipart request to the /load_file.cgi endpoint. A low-privileged, network-adjacent or internet-accessible attacker can trigger CWE-787 in the Multipart Handler, potentially achieving arbitrary code execution with full confidentiality, integrity, and availability impact on the device. A public proof-of-concept exploit has been disclosed; no vendor patch has been identified, consistent with D-Link's typical end-of-life posture for legacy NAS hardware.

Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the device's web management CGI interface. The setUploadSetting handler fails to validate the length of the FileName parameter before copying it onto the stack, allowing an attacker with low-privilege access to overwrite control data and execute arbitrary code on the router. A public proof-of-concept has been disclosed on GitHub, materially increasing exploitation risk even in the absence of a confirmed vendor patch.

Stack-based buffer overflow in D-Link DIR-825M firmware 1.1.8 enables remote code execution via the web management interface's disk formatting endpoint. The `partition` argument to the `sub_46725C` function at `/boafrm/formDiskFormat` is not bounds-checked (CWE-119), allowing a low-privileged authenticated attacker to overwrite the stack and achieve arbitrary code execution on the router. A public proof-of-concept exploit exists, substantially elevating practical risk; no CISA KEV listing has been confirmed at time of analysis.

Stack-based buffer overflow in the D-Link DIR-825M 1.1.8 LTE Module Firmware Upgrade handler allows low-privileged remote attackers to achieve remote code execution by supplying an oversized fota_url argument to /boafrm/formLtefotaUpgradeFibocom. The CVSS 4.0 vector scores this at 8.6 with subsequent-system impact (SC:H/SI:H/SA:H), reflecting the potential to compromise the attached Fibocom LTE module as well as the primary router. A public proof-of-concept exploit is available on GitHub, significantly lowering the bar for exploitation; no public patch has been identified at time of analysis.

Out-of-bounds write in Exiv2's RemoteIo::Impl::populateBlocks() affects all versions prior to 0.28.9, exploitable only when Exiv2 is invoked with a remote URL as input rather than a local file path. Memory corruption from the write could theoretically enable code execution in the Exiv2 process context if a user or automated pipeline fetches a specially crafted image from an attacker-controlled server. Fixed in the 0.28.9 release; no public exploit or KEV listing identified at time of analysis.

Remote code execution and device takeover in the Tenda HG10 (firmware build 300001138) is possible through a stack buffer overflow in the Boa web server's formIPv6Routing handler, reachable at /boaform/admin/formIPv6Routing. An oversized destNet parameter overflows a fixed-size buffer (CWE-120), letting a remote attacker crash the device or execute arbitrary code with the web server's privileges. Publicly available exploit code exists (VulDB), though the issue is not listed in CISA KEV and no active exploitation is confirmed; EPSS is not provided.

Memory corruption in TOTOLINK A720R router firmware 4.1.5cu.630_B20250509 allows authenticated remote attackers to trigger a buffer overflow in the MAC filtering subsystem, with potential for arbitrary code execution. The vulnerable path is the `setMacFilterRules` function within `cstecgi.cgi`, exploitable by sending a crafted `desc` argument over the network. A public proof-of-concept is available on GitHub; no CISA KEV listing exists at time of analysis, but the combination of network reachability and published exploit code meaningfully elevates real-world risk.

Out-of-bounds kernel heap write in the Linux kernel's GRO (Generic Receive Offload) BIG TCP path allows corruption of memory before skb->head when aggregating oversized (>64KB) packets. The flaw stems from skb_gro_receive() using a loose headroom check introduced by the IPv4 BIG TCP support commit (b1a78b9b9886); crafted frames - for example injected via AF_PACKET with a MAC header under 8 bytes - pass validation, so ipv6_gro_complete()'s memmove() for the temporary HBH jumbo header writes before skb->head and wraps skb->mac_header. It also let software VLAN and encapsulated flows (SIT/IPv6-in-IPv4) aggregate beyond 64KB. No public exploit is identified at time of analysis and EPSS is low (0.19%), and the issue affects only older stable branches (e.g. 6.18.y), not mainline 7.0+.

Integer overflow in Klever-Go's semi-fungible token (SFT) add-quantity path prior to version 1.7.19 allows a mint-role holder to bypass a finite per-nonce MaxSupply constraint, minting approximately 9.2×10^18 tokens in a single transaction. The SFTAddCirculation function in core/kapp/systemAccount/systemAcount.go increments Circulation before checking the cap, enabling an int64 wraparound that makes the MaxSupply comparison permanently false. A proof-of-concept unit test is included in GHSA-mrpp-v6pg-p54x confirming the bypass; no CISA KEV listing is present at time of analysis.

Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.

Token minting without source debit in klever-go's percentage-transfer royalty path (`processPercentageRoyaltiesTransfer`) allows an asset owner who configures a 100% split royalty to cause the blockchain to credit the full royalty amount to an attacker-controlled address on every subsequent transfer by any holder, while the sender debit is silently skipped due to an early-return guard placed before the collection call. The exploit fires automatically on third-party transfers once the asset is configured, enabling unbounded off-books token inflation. A full Go unit test and on-chain transaction trace confirming the mint are publicly available; no CISA KEV listing exists, but the patch's inclusion of a hardcoded freeze list for six specific Klever mainnet addresses strongly implies active exploitation occurred prior to the fix.

Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.

Ledger value-creation (KLV minting) in Klever's marketplace settlement affects the klever-go node prior to v1.7.19: because referral and royalty cuts are paid in full while a negative seller remainder is silently dropped, any funded account can settle a self-dealt order whose referral% + royalty% exceeds 100% and mint the surplus into attacker-controlled addresses. Exploitation requires only an ordinary account (PR:L) reachable over the public transaction RPC (CVSS 9.6). Committed regression-test exploit code exists, and the vendor advisory (GHSA-p7gw-2pcp-5pf8) and community monitoring document active mainnet exploitation that minted tens of millions of KLV before an emergency guard was deployed, though this CVE is not listed in CISA KEV.

Stack buffer overflow in the PLANET GS-4210-16P2S managed switch web management interface exposes all firmware versions prior to 3.441b260626 to unauthenticated remote denial of service and potential memory corruption. The _readHttpParam function copies attacker-supplied HTTP query string data into a fixed-size stack buffer without enforcing size limits or guaranteeing NUL termination, after which parse_query_string processes the unbounded attacker-controlled content. No public exploit code has been identified at time of analysis and KEV status is not confirmed, but the pre-authentication network vector with no special preconditions makes this straightforwardly reachable; a vendor patch is available.

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve filter with the editheader extension corrupt memory during mail delivery, leaking out-of-bounds buffer contents into the delivered message and potentially crashing or executing code in the delivery process. The flaw is remotely reachable with low-privilege credentials (CVSS 9.1, scope-changed) and combines information disclosure with a denial-of-service and possible RCE. No public exploit is identified at time of analysis and it is not on CISA KEV, so risk is currently theoretical but severe.

Bitmap overflow and incorrect global accounting in the Linux kernel's percpu-km memory allocator (`mm/percpu-km`) allow a local low-privileged attacker on SMP/NUMA systems to corrupt kernel memory, with potential for privilege escalation or kernel crash. Two separate commits introduced the flaws: a63d4ac4ab609 caused `pcpu_create_chunk()` to write beyond the `chunk->populated` bitmap when `nr_units > 1`, and b539b87fed37f introduced the companion `pcpu_nr_empty_pop_pages` accounting error. Fixes have been backported to eight stable kernel branches (5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2); no public exploit has been identified at time of analysis.

Integer truncation in the Linux kernel s390/dasd ECKD driver exposes IBM Z systems to a heap buffer overflow via a caller-controlled track range supplied to dasd_eckd_check_device_format(). The root cause is that fmt_buffer_size is declared as int while the buffer-size expression evaluates at size_t width, causing the result to be silently truncated on assignment; kzalloc() then allocates a buffer far smaller than needed, while the subsequent channel program builder operates on the untruncated track count and writes past the allocation. Systems running unpatched kernels before 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2 on s390 architecture face potential kernel heap corruption with consequences ranging from denial of service to local privilege escalation. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.

Out-of-bounds memory corruption in the Linux kernel's vmwgfx DRM driver (vmw_external_bo_copy()) allows a local attacker with low-privilege DRM access to corrupt kernel memory via a crafted atomic display commit using an imported dma-buf framebuffer. Two distinct code paths are vulnerable: the equal-stride memcpy path suffers unsigned integer underflow when caller-supplied offsets exceed the buffer object size, and the non-equal-stride row-by-row path performs no bounds validation at all, allowing the copy loop to walk arbitrarily past the vmap end. Vendor-released patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis.

Out-of-bounds memory access in the Linux kernel's ltc4282 hwmon driver exposes systems with this hardware monitor to kernel memory disclosure or destabilization via the VGPIO minimum alarm voltage sysfs read path. A missing return statement in the driver causes the kernel to access memory beyond intended bounds when a local user reads the VGPIO channel's minimum alarm voltage attribute. Patch versions are available across multiple stable branches; no public exploit exists and EPSS sits at 0.17% (6th percentile), indicating very low current exploitation pressure despite the 7.8 CVSS score.

Out-of-bounds slab write in the Linux kernel idpf network driver lets a malicious or compromised control plane (a PF or a hypervisor's device model) corrupt kernel heap memory during interrupt-vector setup. idpf_get_reg_intr_vecs() fills the reg_vals[] array bounded only by per-chunk num_vectors from a VIRTCHNL2_OP_ALLOC_VECTORS reply, which is never reconciled against the smaller num_allocated_vectors used to size the allocation, so a reply whose chunk counts sum higher writes struct idpf_vec_regs entries past the buffer. It carries a CVSS of 9.3, but EPSS is only 0.15%, it is not on CISA KEV, and there is no public exploit identified at time of analysis.

Out-of-bounds kernel memory reads in the Linux kernel's NTFS driver arise because ntfs_read_locked_inode() copies a resident $ATTRIBUTE_LIST into ni->attr_list via a plain memcpy() with no sanity checking, while only the non-resident path was ever validated by load_attribute_list(). A crafted NTFS volume with a malformed resident attribute list is then trusted by every subsequent walk (ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), ntfs_attrlist_need()), which read fixed-header fields past the buffer. The fix factors per-entry validation into ntfs_attr_list_entry_is_valid()/ntfs_attr_list_is_valid() and applies it on the resident path and inside load_attribute_list() itself; no public exploit identified at time of analysis and EPSS probability is very low (0.15%).

Out-of-bounds slab read in the Linux kernel's legacy in-kernel NTFS driver lets a crafted on-disk $ATTRIBUTE_LIST leak or crash adjacent kernel heap memory when a malicious NTFS volume is mounted and read. The flaw is in ntfs_external_attr_find(), where a look-ahead attribute-list entry is dereferenced past the end of the kvmalloc'd buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.15%, 5th percentile), and it is not listed in CISA KEV.

Out-of-bounds kernel heap read in the Linux kernel's classic in-tree NTFS driver (`fs/ntfs/`) allows a local, low-privileged user to disclose kernel memory - and potentially chain to privilege escalation - by mounting a crafted NTFS image at the filesystem layer. The flaw is a u16 integer truncation in `ntfs_check_restart_area()` that silently defeats a page-size bounds check, causing `ntfs_check_log_client_array()` to dereference up to ~64 KiB beyond an allocated heap buffer using attacker-controlled on-disk values. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.15% (5th percentile), reflecting negligible observed exploitation pressure.

Heap and integer-overflow memory corruption in the Linux kernel's userspace perf tool (perf sched) lets a malicious perf.data file corrupt memory when parsed by register_pid(). An analyst who runs 'perf sched' against an attacker-supplied perf.data trace can trigger out-of-bounds heap writes, an unchecked strcpy into a 20-byte comm buffer, and denial of service, potentially leading to code execution in the context of the user running perf. A vendor fix is available; EPSS is low (0.18%) and there is no public exploit identified at time of analysis.

Out-of-bounds heap read in the Linux kernel's perf userspace tooling (perf tools) lets a crafted perf.data file trigger memory disclosure or a crash when parsed. The flaw sits in machine__resolve(), which trusts an attacker-controlled CPU index (al->cpu) from sample data and indexes env->cpu[] without validating it against env->nr_cpus_avail; a large index reads past the heap allocation, and values like 65536 truncate to int16_t and silently resolve to CPU 0. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile).

Out-of-bounds memory access in the Linux kernel's ARM SCMI firmware subsystem allows a local low-privileged attacker on ARM-based hardware to trigger kernel memory corruption via the scmi_power_name_get() function, which fails to validate the domain number supplied by external callers. Affected kernel versions span from the introduction commit 76a6550990e2 through multiple stable branches, with patches backported to LTS lines 5.15, 6.1, 6.6, 6.12, and 6.18. No public exploit code has been identified at time of analysis, and EPSS probability is very low at 0.17% (7th percentile), indicating no current attacker tooling interest despite the 7.8 CVSS score.

Out-of-bounds write in the Linux kernel's OCFS2 cluster filesystem driver corrupts adjacent kernel memory when a low-privileged user unlinks a refcounted file whose refcount tree contains leaf blocks, triggering a fortify panic on hardened kernels. The root cause is an incorrect memset bound in `ocfs2_remove_refcount_extent()` arising from a union aliasing issue between `rf_records.rl_count` and `rf_list.l_tree_depth`. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile) and the vulnerability does not appear in CISA KEV, reflecting low real-world exploitation risk at time of analysis.

Out-of-bounds heap read in the Linux kernel's wcn36xx WiFi driver allows an adjacent-network attacker to corrupt Block Acknowledgment session state by sending crafted 802.11 frames that elicit a short firmware response. Kernels from 4.7 through pre-patch stable branches on devices equipped with Qualcomm WCN3660/WCN3620/WCN3680 WiFi hardware are affected. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.17% (7th percentile) reflects negligible observed exploitation probability consistent with the hardware-specific attack surface.