Buffer Overflow

Null-pointer dereference in the Linux kernel's btrfs LZO decompression path can crash the kernel when reading a crafted compressed extent, causing a denial-of-service. Kernels in the range starting at commit a6e66e6f8c1b685e11b778bef614480a9c1a5278 through the two fix commits are affected across multiple stable branches (5.15 and later). No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.15% (5th percentile) confirms this is not yet being exploited at scale. Exploitation requires the attacker to introduce a malformed btrfs filesystem image with LZO-compressed extents that the kernel then reads.

Heap buffer overflow in the Linux kernel's Airoha (airoha_eth) network driver allows the packet-processing engine (PPE) flow-offload logic to write past an undersized allocation, corrupting kernel heap memory and crashing affected systems. The bug affects Linux 6.18.x through 6.18.39 and 6.19/7.x pre-release trees on hardware using the Airoha PPE flow-offload driver, and is triggered when airoha_ppe_foe_verify_entry() processes a flow hash at or above half the entry count. It is not in CISA KEV and has a low EPSS (0.18%), with no public exploit identified at time of analysis; impact is primarily denial of service.

Kernel memory corruption path in Linux's tunnel metadata subsystem (`tun_dst_unclone`) triggers a FORTIFY_SOURCE memcpy overflow warning when the kernel is built with clang, due to the `__counted_by` annotation on a flexible array member being evaluated as zero at copy time. Systems using GENEVE tunneling on clang-built kernels with source fortification enabled may experience kernel availability disruption if the warning escalates to a panic. No public exploit has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability, and the vulnerability is not listed in CISA KEV.

Out-of-bounds memory access in the Linux kernel's qede network driver (QLogic FastLinQ/QL4xxx Ethernet) occurs because the driver reads into cqe->len_list[] before validating the index, allowing a crafted or malformed completion-queue entry to trigger reads past the array bounds. The flaw affects multiple stable branches (5.15, 6.1, 6.6, 6.12, 6.17/6.18) on systems that load the qede driver, with a vendor fix that reorders the bounds check before element access. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).

Out-of-bounds read in the Linux kernel HID subsystem (hid_get_report) allows an adjacent, unauthenticated attacker to trigger a kernel panic or leak kernel memory by submitting a zero-length numbered HID report via a crafted Bluetooth or USB device. The vulnerability affects multiple stable kernel branches from 5.10.x through 7.1.x, with patches backported across all supported trees. No public exploit has been identified at time of analysis, and EPSS remains very low at 0.18% (7th percentile), indicating limited threat actor awareness thus far.

Out-of-bounds read in the Linux kernel's netfilter nf_conntrack_irc connection-tracking helper (parse_dcc) allows a one-byte stale read past the IRC DCC parse buffer, potentially producing an incorrect DCC IP or port in the resulting conntrack expectation. The flaw stems from parse_dcc() treating data_end as an inclusive pointer while its caller passes an exclusive one-past-the-end limit; the read currently cannot fault because irc_buffer is over-allocated by one byte and datalen is capped at MAX_SEARCH_SIZE. It affects only systems with the nf_conntrack_irc helper active, and there is no public exploit identified at time of analysis (not in CISA KEV; EPSS 0.18%).

Out-of-bounds read in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking subsystem exposes adjacent-network attackers to kernel memory disclosure and system crash. The vulnerability exists in batadv_dat_get_vid() within the Distributed ARP Table (DAT) component, which calls batadv_get_vid() to access the proto field of an ethernet header without first verifying that the underlying data is accessible - an obligation other call sites fulfill but this path omits. A network-adjacent unauthenticated attacker can send a crafted Layer 2 frame to trigger the flaw, yielding High confidentiality impact (kernel memory disclosure) and High availability impact (kernel panic). EPSS is 0.18% (7th percentile) and the flaw is not in CISA KEV, indicating no public exploitation at time of analysis.

Out-of-bounds read in the Linux kernel's ntfs3 LZNT decompression handler allows a local attacker with low privileges to trigger kernel memory access violations by mounting a specially crafted NTFS3 filesystem image. Affected stable branches span 5.15 through 7.x, with patched releases available across all branches. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low predicted exploitation probability despite the high CVSS score of 7.8.

Out-of-bounds read in the Linux kernel's asus_atk0110 hardware monitoring driver allows a malformed ACPI GGRP firmware package to trigger kernel memory corruption. Systems running ASUS ATK0110-equipped hardware with a BIOS that returns zero-count sub-packages in its GGRP management group response are affected across a wide range of Long-Term Support and mainline kernel versions from 2.6.32 onward. Exploitation is contingent on a specific hardware/firmware defect condition rather than a direct user action, but the resulting out-of-bounds read in kernel space carries high potential impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche hardware prerequisite.

Heap-based buffer overflow in openNDS before 11.0.0 allows an unauthenticated attacker positioned on the captive portal network to crash the openNDS daemon and potentially execute arbitrary code remotely. The flaw is in the redirect_to_splashpage function in http_microhttpd.c, where the query string buffer is under-allocated at QUERYMAXLEN bytes despite URL encoding expanding input by up to 1.5x - when a crafted request triggers the redirect path, the encoded data overflows the heap allocation. No public exploit identified at time of analysis, though the upstream fix commit is publicly available and exposes the exact vulnerable code path.

Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to the appliance's VPN listener. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the pre-authentication RCE profile on an internet-facing firewall makes this high priority.

Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthenticated attackers to crash VPN processing by sending specially crafted network traffic, resulting in a Denial of Service condition. All Fireware OS versions appear affected per the wildcard CPE, and the vulnerability is reachable without authentication from any network path to the iked listener. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a realistic target for disrupting VPN availability on WatchGuard appliances.

Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.

Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.

Remote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key management) process, letting a remote unauthenticated attacker run arbitrary code by sending specially crafted network traffic to an affected Firebox firewall. The vendor-assigned CVSS 4.0 base score is 9.3 (critical), reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the pre-authentication nature and the perimeter role of the affected device make this a high-priority patching item.

Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to disrupt VPN operations by sending specially crafted network packets. The flaw resides in VPN processing logic and can crash or destabilize the IKE service, cutting off IPsec/IKEv2 tunnels for connected clients and sites. No public exploit has been identified at time of analysis and CISA KEV listing is not confirmed; however, the unauthenticated network attack vector and CVSS 4.0 score of 8.7 place this in the priority triage tier for organizations relying on WatchGuard Firebox VPN connectivity.

Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.

Buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to trigger a denial-of-service condition or potentially execute arbitrary code by submitting specially crafted traffic to the management interface. The root cause is CWE-787 (out-of-bounds write) in the web-based management component, and the CVSS 4.0 vector confirms network reachability with high-privilege authentication as prerequisites. No public exploit code or active exploitation has been identified at time of analysis, though the RCE potential on a network perimeter device elevates the severity beyond what the privilege requirement alone might suggest.

Out-of-bounds read in V8, Chrome's JavaScript engine, enables remote code execution confined within the renderer sandbox on all platforms running Chrome prior to 151.0.7922.72. The flaw is triggered by a specially crafted HTML page, requiring only that a user visit a malicious site - no authentication or elevated privileges are needed from the attacker. No public exploit code has been identified and no active exploitation is confirmed; EPSS probability stands at 0.30%, aligning with SSVC's 'exploitation: none' classification despite the high CVSS score.

Stack-based buffer overflow in the Bendix EC80ESP brake ECU family enables adjacent-network attackers to crash the ECU or achieve remote code execution and arbitrary CAN bus traffic injection via a crafted payload. All known variants across both EC80ESP and EC80ESP+ product lines are affected, including J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, and 4S/4M configurations deployed on commercial vehicles. Successful exploitation could disable safety-critical functions including ABS, steering assist, speedometer, and automatic gear shifting. No public exploit has been identified at time of analysis; the flaw was disclosed by CISA ICS-CERT.

Out-of-bounds write across all Bendix EC80ESP Brake ECU variants enables an unauthenticated attacker with adjacent vehicle-network access to deliver a crafted payload that establishes an arbitrary write primitive, crashing the safety-critical brake Electronic Control Unit. Reported by ICS-CERT and documented in CISA advisory ICSA-26-237-05, all ten identified EC80ESP hardware configurations are affected with no version constraint specified in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the safety implications of a crashed brake ECU demand prioritized attention by fleet operators beyond what the base score alone conveys.

Root code execution in Unitree G1 EDU robot firmware through version 1.5.2 is achievable by proximate unauthenticated attackers via a chained BLE GATT and WiFi provisioning exploit requiring no pairing or credentials. Crafted BLE writes overflow a fixed BSS buffer in the SSID chunk accumulator, corrupting an adjacent mainloop function pointer dispatch entry; the cleanup path subsequently invokes this corrupted pointer, passing attacker-controlled data to system() as uid 0. A public proof-of-concept (UniBLEed) is available, and the CVSS 4.0 score of 7.7 reflects the adjacent attack vector and high complexity of the exploit chain.

Heap buffer overflow in rsyslog's RainerScript `replace()` function allows unauthenticated remote attackers to crash affected systems by sending crafted syslog messages. The root cause is an incorrect buffer size calculation (CWE-131) during string replacement, leading to heap memory corruption and reliable denial of service. This affects rsyslog as shipped across Red Hat Enterprise Linux versions 6 through 10; no public exploit or CISA KEV confirmation exists at time of analysis.

Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.

Stack buffer overflow in Greenbone's OpenVAS Scanner and Greenbone OS allows a remote attacker holding user-level privileges to achieve full system compromise by supplying a malicious or compromised NASL vulnerability test (VT). Both the Greenbone OS platform and the openvas-scanner engine are confirmed affected, making this a meaningful risk in any multi-user GVM deployment or environment where user accounts may be compromised. No public exploit code has been identified at time of analysis, but the network-accessible, low-complexity attack vector and high-impact outcome place this in the immediate patching tier for production scanner infrastructure.

WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains.

Heap-based buffer overflow in FFmpeg's libswscale library enables unauthenticated remote attackers to crash media-processing applications via a crafted input file. The vulnerable function ff_sws_alphablendaway, invoked during alpha channel compositing in git-master commit 722a217, mishandles attacker-controlled input and corrupts heap memory, producing a Denial of Service. No active exploitation is confirmed - EPSS stands at 0.15% (5th percentile) with no CISA KEV listing - indicating this is currently a crash risk rather than a weaponized threat.

Denial-of-service via segmentation fault in ccoap's option parsing logic allows unauthenticated remote attackers to crash any service built on the library by sending a single malformed CoAP message. The vulnerability exists at commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 of the ipflavors/ccoap C library, where the option parser does not adequately validate that sufficient data is present before accessing option fields, triggering an out-of-bounds write (CWE-787). No public exploit code or CISA KEV listing is present, and EPSS probability is very low at 0.17%, though the trivial trigger condition - a single malformed UDP packet - makes opportunistic scanning straightforward against any exposed CoAP endpoint.

CVE-2026-19499 has been reported by Ubuntu but contains no available description, CVSS score, vector, or CWE data at time of analysis. The vulnerability's nature, affected component, and impact are entirely unknown from the provided intelligence. No meaningful characterization of this CVE is possible without additional data from the vendor advisory or NVD.

Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process crash when a user opens a crafted WPG file. The WPG color palette buffer is allocated for exactly 256 entries (768 bytes), but the COLORMAP record parser fails to validate that the supplied start index (i16) or total entry count (iNum16) stay within that bound, allowing a malicious file to drive fread() to write beyond the heap allocation. Affecting all Dia versions on the upstream master branch through at least 2026-08-21, no public exploit or patch version has been confirmed at time of analysis, though the description provides sufficient detail to construct proof-of-concept input.

Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.

Out-of-bounds memory write in the Linux kernel's ASoC lpass-tx-macro audio codec driver allows a local low-privileged user to corrupt kernel memory via misconfigured ALSA enum kcontrol access, with potential for privilege escalation. The driver's get and put handlers for DEC0-DEC7 MODE controls incorrectly access the 8-byte integer union field instead of the 4-byte enumerated union field, writing 4 bytes beyond the intended boundary on 64-bit systems. No public exploit code has been identified at time of analysis, but the pattern mirrors two previously fixed sibling drivers (rx-macro, va-macro), confirming the root cause is well-understood.

Out-of-bounds hardware I/O reads in the Linux kernel's fbdev framebuffer subsystem allow low-privileged local users to read memory beyond valid hardware bounds, with high confidentiality and availability impact. The flaw in fb_io_read() stems from pointer desynchronization after a partial copy_to_user() transfer: the hardware source pointer advances by the full original chunk size while count is only decremented by successfully copied bytes, causing subsequent loop iterations to read from incorrect, over-advanced offsets. No public exploit or CISA KEV listing exists at time of analysis; patches are available across multiple stable kernel branches.

Out-of-bounds kernel heap write in the Linux kernel's Focaltech touchpad input driver allows local attackers to corrupt kernel memory through a signed integer underflow in the finger index variable. The `focaltech_process_rel_packet` function incorrectly handles a packet reporting finger index 0: subtracting 1 from a signed variable produces -1 rather than wrapping to a large unsigned value, bypassing the FOC_MAX_FINGERS bounds check and writing to `state->fingers[-1]`. Affected kernel versions span multiple stable branches from Linux 4.0 through the pre-patch revisions of 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2; no CISA KEV listing and no public proof-of-concept exploit exist at time of analysis.

Heap buffer overflow in the Linux kernel synaptics-rmi4 driver allows local low-privileged users to overwrite kernel heap memory by exploiting stale state in the F54 diagnostics function. Affected systems must have Synaptics RMI4 touchpad hardware present and the driver loaded; exploitation involves manipulating V4L2 buffer sizes to trigger the overflow after an error condition leaves f54->report_size containing a stale value from a prior successful operation. Patches are available across all supported stable branches; no public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Heap buffer overflow in the Linux kernel's synaptics-rmi4 driver allows a local low-privileged user to trigger memory corruption by issuing VIDIOC_S_INPUT while the V4L2 diagnostic queue is actively streaming. The F54 function allocates V4L2 buffers sized to the report type at stream start; switching the input mid-stream to a larger report type overflows those buffers, enabling potential privilege escalation to root. Patches have been released across all active stable kernel branches; no public exploit code or CISA KEV listing has been identified at time of analysis.

Slab-out-of-bounds reads in the Linux kernel's libceph client (cls_lock_client.c decode_locker()) allow a malicious or compromised Ceph OSD to read kernel memory past a validated buffer when a client parses lock information. Any kernel Ceph/RBD client that issues the lock.get_info class method - for example during RBD exclusive lock acquisition - is affected across a wide range of stable branches. The input assigns CVSS 9.8, but no public exploit identified at time of analysis and the flaw is an out-of-bounds read (information disclosure / crash) rather than confirmed code execution, so the practical impact is narrower than the score suggests.

Out-of-bounds memory access in the Linux kernel's libceph client (net/ceph) allows a malicious or corrupted Ceph osdmap to steer requests toward a non-existent OSD index. The flaw stems from an unvalidated osd index taken from the osdmap's primary_temp mapping, which is used to index the fixed-size osd_state, osd_weight, and osd_addr arrays. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed across multiple stable trees.

Integer overflow and missing input validation flaws in the Linux kernel's s390/zcrypt subsystem allow a local low-privileged user to trigger kernel buffer overflows and uninitialized memory reads, yielding full confidentiality, integrity, and availability impact. The vulnerable function `xcrb_msg_to_type6cprb_msgx()` fails to validate CPRBX structure sizes before copying from userspace, performs signed integer arithmetic subject to overflow during alignment, and does not detect overflow when summing control and data block sizes. Upstream patches are confirmed in stable branches 7.1.10 and 7.2; no public exploit or CISA KEV listing is confirmed at time of analysis.

Multiple input validation failures in the Linux kernel s390/zcrypt driver's `xcrb_msg_to_type6_ep11cprb_msgx()` function allow a local unprivileged user on IBM Z/s390 systems with EP11 cryptographic coprocessors to trigger kernel-level buffer overflows. Three compounding weaknesses exist: missing minimum size validation before copying ep11_cprb structures from userspace, arithmetic overflow in CEIL4 alignment that can wrap around and bypass size checks, and unsafe C struct overlay on ASN.1-encoded payload without proper parsing. The official CVSS score of 7.8 (AV:L/AC:L/PR:L) reflects a realistic local privilege escalation path with full C/I/A impact. No public exploit has been identified at time of analysis, and patches are available in Linux 7.1.10 and 7.2.

Integer overflow in the amdgpu DRM subsystem's UVD (Unified Video Decoder) component exposes systems running AMD GPUs to local privilege escalation. The minimum image size calculation incorrectly references the image width rather than the pitch value, and fails to reject pitch values exceeding 4096, allowing arithmetic overflow that produces an artificially small size bound. A low-privileged local user can submit a crafted UVD decode request to corrupt kernel memory and achieve full system compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Slab-out-of-bounds write in the Linux kernel XFS real-time refcount B-tree (rtrefcountbt) subsystem allows a local attacker to trigger a kernel panic or potentially escalate privileges by mounting a crafted XFS filesystem image with the rtreflink feature set. The flaw is an off-by-one in on-disk root level validation - two check paths use '>' instead of '>=' - permitting an illegal bb_level that causes the cursor's bc_nlevels to exceed bc_maxlevels by one, indexing a 2-byte write 8 bytes past the end of a 216-byte slab object during the first B-tree operation. No public exploit or CISA KEV listing exists, but the guaranteed kernel panic and kernel heap write primitive make this a meaningful local risk on affected configurations.

Heap out-of-bounds write in the Linux kernel's XFS log recovery path allows an attacker supplying a crafted XFS filesystem image to corrupt adjacent kernel slab memory during mount-time log replay. The flaw resides in xlog_recover_do_reg_buffer(), where a memcpy() copying dirty buffer regions is bounded solely by an ASSERT() that compiles away on production kernels (CONFIG_XFS_DEBUG=n), leaving attacker-controlled offset and length values from the logged dirty bitmap completely unchecked against the buffer's actual allocated size. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, though KASAN-confirmed slab-out-of-bounds writes demonstrate the primitive is real and reliable on unpatched kernels.

Out-of-bounds array access in the Linux kernel's ASoC tas2562 audio driver allows local, low-privileged users to trigger kernel memory corruption by supplying unvalidated volume control values via the ALSA interface. The tas2562_volume_control_put() function accepts arbitrary userspace-supplied integers and uses them as unchecked array indices to look up a fixed-size table, potentially reading out-of-bounds kernel memory and writing that value to the TAS2562 hardware device over I2C. No public exploit code has been identified and the vulnerability is absent from CISA KEV; patched stable kernel releases are available across all affected branches.

Kernel memory corruption in the Linux SCTP stack allows a forged COOKIE_ECHO chunk to bypass validation of AUTH parameters when cookie authentication is disabled, letting an attacker who controls the echoed cookie bytes supply unchecked RANDOM lengths, HMAC identifiers, and CHUNKS lists. A forged RANDOM length yields out-of-bounds reads during key-vector construction, and a forged HMAC identifier drives a 32-byte write past a zero-length AUTH chunk - described by the reporter as a primitive for a local privilege escalation chain. No public exploit identified at time of analysis; the issue is fixed upstream in the mainline SCTP code.

Out-of-bounds memory access in the Linux kernel's IPVS subsystem allows a low-privileged local process to trigger kernel memory corruption via ip_vs_nat_icmp(). The flaw arises because the embedded IP header length field (ihl) is not revalidated after skb_ensure_writable() is called on ICMP packets processed through IPVS NAT, enabling a local process to supply a larger ihl value than was originally validated, causing ip_send_check() to access memory beyond intended bounds. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N), this represents a credible local privilege escalation path on any Linux system running IPVS in NAT mode. No public exploit code has been identified at time of analysis.

Slab-out-of-bounds read in the Linux kernel's cls_u32 traffic classifier allows a local user with networking privileges to corrupt kernel heap memory and escalate to root. The flaw exists in u32_bind_class(), which unconditionally casts all objects enumerated by u32_walk() as tc_u_knode structures, even when the object is a tc_u_hnode (hash table), which lacks the tcf_result member - causing an out-of-bounds access to res->classid. Patches have been released across multiple stable kernel branches (6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, 7.2), and no public exploit code or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in GNOME Dia diagram editor (0.98.0 and earlier) permits stack exhaustion and potential return-address corruption when a victim opens a crafted .dia XML file containing a Bus object with an attacker-controlled bus_handles value and then moves a handle in the diagram. The root cause - an unbounded g_alloca() call driven by an unvalidated file attribute - is also present in objects/Misc/tree.c via Tree objects, widening the attack surface. No public exploit or CISA KEV listing exists at time of analysis, but the GitLab issue provides sufficient technical detail for proof-of-concept development.

Unauthenticated remote code execution is possible on Ubiquiti EdgeMAX EdgeSwitch devices that have DHCPv6 enabled, triggered by a heap-based buffer overflow (CWE-122) reachable from the local Layer-2 segment. Only switches running firmware below 1.12.2 with DHCPv6 active in the configuration are exposed, and the attacker must already be positioned on an adjacent network (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rather than reaching the device over the internet. Vendor patch is available in EdgeMAX EdgeSwitch 1.12.2; no public exploit code has been identified at time of analysis and EPSS is low at 0.27% (19th percentile), consistent with CISA SSVC reporting no observed exploitation and a non-automatable attack path.

Buffer overflow in FreeBSD's ppp(8) PPP daemon enables a local user with access to the ppp(8) command interface to crash the process or execute arbitrary code as root by supplying an oversized PSN endpoint value to the mp_SetEnddisc() function, which copies the input without length validation. FreeBSD 15.1-RELEASE (before p3), 15.0-RELEASE (before p13), and 14.4-RELEASE (before p9) are all confirmed affected per EUVD-2026-66248 and FreeBSD Security Advisory SA-26:60. No public exploit has been identified at time of analysis, and the low EPSS score (0.27%, 19th percentile) indicates limited exploitation interest despite the High CVSS rating.

Out-of-bounds write in FreeBSD's userspace ppp(8) daemon allows a malicious PPP peer to crash the process or execute arbitrary code as root. The flaw is in LcpDecodeConfig(), which fails to validate endpoint discriminator option lengths against the RFC 1717 minimum, enabling memory corruption during LCP negotiation. Affected releases are FreeBSD 15.1-RELEASE prior to p3, 15.0-RELEASE prior to p13, and 14.4-RELEASE prior to p9; no active exploitation or public proof-of-concept has been identified at time of analysis.

Heap-based buffer overflow in FreeBSD's ppp(8) daemon allows a malicious PPP peer to crash the daemon or execute arbitrary code as root. The flaw resides in mp_Enddisc(), which miscalculates buffer lengths when formatting Multilink PPP endpoint discriminator addresses, overflowing a global result buffer. Affected releases are FreeBSD 14.4-RELEASE prior to p9, 15.0-RELEASE prior to p13, and 15.1-RELEASE prior to p3; no active exploitation is confirmed (not in CISA KEV), but SSVC rates the technical impact as total and the attack as automatable.

Stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack, allows any unauthenticated attacker within Bluetooth radio range to crash the bluetoothd service and potentially execute arbitrary code. The flaw is triggered when a target device with Bluetooth discovery enabled processes a malicious Extended Inquiry Response (EIR) packet. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept is identified at time of analysis.

Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact.

Buffer overflow in GPAC's SVG parsing function `svgNameToImplementationName()` allows a local attacker with low privileges to execute arbitrary code with full confidentiality, integrity, and availability impact. The vulnerability is tied to a specific upstream commit (31becc9e08b88e525a4a62013a4000de1c0f8fd9) and is consistent with CWE-120 (classic buffer overflow, no bounds checking). EPSS is very low at 0.19% (8th percentile), no KEV listing exists, and no public exploit is confirmed at time of analysis, though a GitHub gist referenced in the NVD entry may contain reproduction details.

Out-of-bounds read in OpenEXRUtil's SampleCountChannel::row() API allows an attacker to crash applications or leak adjacent heap memory by supplying a crafted deep EXR file with a non-zero dataWindow origin. Affected are OpenEXR releases through 3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13 - the complete release history prior to the coordinated January 2026 patch. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects that exploitation requires no authentication but does require a user or automated pipeline to open an attacker-controlled file; no public exploit code and no CISA KEV listing exist at time of analysis.

Integer overflow (CWE-190) in Chromium's file-processing code exposes all desktop Google Chrome versions prior to 152.0.7977.65 to in-sandbox memory disclosure when a user opens a specially crafted file, requiring no authentication (PR:N) but requiring user interaction (UI:R). A critical data conflict across sources warrants attention: the NVD CVSS score is 8.8 with C:H/I:H/A:H, yet Google's Chromium team rates this Low severity, and the EPSS is 0.16% (5th percentile) with SSVC Exploitation:none - collectively suggesting the attack impact is bounded to memory readable within the sandboxed renderer, without sandbox escape. No public exploit identified at time of analysis.

Out-of-bounds read in Google Chrome's ANGLE graphics engine on Windows prior to version 152.0.7977.65 enables remote attackers to potentially execute arbitrary code outside the browser sandbox. Exploitation requires no authentication and only that a victim navigate to a crafted HTML page, yielding a CVSS 8.8 score with high impact across confidentiality, integrity, and availability. A vendor-released patch is available; no public exploit or confirmed active exploitation has been identified at time of analysis.

Out-of-bounds write in ANGLE (Chrome's graphics abstraction layer) prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox by serving a crafted HTML page. The vulnerability carries a CVSS score of 8.8 and targets Chrome's Almost Native Graphics Layer Engine, a critical rendering subsystem, making exploitation viable against any unpatched Chrome user who visits a malicious page. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is low at 0.30%, and SSVC assesses exploitation as 'none', suggesting real-world exploitation remains limited despite the high theoretical severity.

Out-of-bounds read in Chrome's Skia graphics library, affecting all versions prior to 152.0.7977.65, allows a remote unauthenticated attacker to leak sandbox-contained memory by delivering a crafted media file to a victim. The CVSS 8.1 score reflects high confidentiality and availability impact, though exploitation is bounded by Chrome's renderer sandbox. No public exploit or CISA KEV listing exists at time of analysis; a vendor patch is available and should be deployed via Chrome's standard update channel.

Remote code execution within the Chrome sandbox is possible in Google Chrome prior to 152.0.7977.65 via a stack-based buffer overflow in the V8 JavaScript engine, triggered by a crafted HTML page visited by an unpatched user. The vulnerability requires no authentication or elevated privileges from the victim - only that they visit an attacker-controlled page - and achieves arbitrary code execution within Chrome's renderer sandbox. No public exploit has been identified at time of analysis, and EPSS at 0.39% (31st percentile) indicates low current exploitation probability despite the 8.8 CVSS score; notably, Google's own internal severity rating is Medium, reflecting the sandbox containment.

Heap buffer overflow in Google Chrome's Media component prior to version 152.0.7977.65 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) reflects low attack complexity and no authentication requirement, but the unchanged scope (S:U) confirms execution is sandboxed - a full system compromise would require a separate sandbox escape not described in this CVE. No public exploit code has been identified and no CISA KEV listing exists; EPSS of 0.28% (20th percentile) indicates low observed exploitation activity, which is consistent with a patch-and-monitor posture rather than emergency response.

Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 152.0.7977.65) enables a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by delivering a crafted HTML page to a victim user. The CVSS score of 8.8 reflects broad impact (C:H/I:H/A:H) with no authentication prerequisite, though code execution is initially sandboxed and scope is unchanged (S:U). No public exploit code has been identified at time of analysis; SSVC records exploitation status as none and EPSS probability is low at 0.28% (20th percentile), suggesting this has not yet been leveraged at scale despite the high-severity rating.

Heap-based buffer overflow (CWE-122) in Blink, Chrome's rendering engine, grants native code execution within the renderer sandbox to attackers who have already achieved renderer process compromise, affecting all Chrome versions prior to 152.0.7977.65 across all platforms. The fix is confirmed in stable channel release 152.0.7977.65. No public exploit identified at time of analysis; EPSS at 0.28% (20th percentile) and Chromium's own Medium severity rating both reflect the high attack complexity imposed by the mandatory prior-renderer-compromise precondition.

Out-of-bounds write in Chrome's Crashpad crash-reporting library on Windows, versions prior to 152.0.7977.65, enables sandbox escape and arbitrary code execution when chained with a separate renderer compromise. The flaw (CWE-787) is the second stage of a two-stage exploit: an attacker who has already gained code execution inside the sandboxed renderer can trigger the memory corruption in Crashpad to break the sandbox boundary and execute arbitrary code at Chrome process privilege on the host. No public exploit has been identified at time of analysis and SSVC rates current exploitation as none, though the total technical impact and Windows-wide scope make this a high-priority patch item.

Sandbox-escaping remote code execution in Google Chrome on Windows (versions before 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Rated High by Chromium with a CVSS of 9.6; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.25%, 16th percentile).

Sandbox-escaping remote code execution in Google Chrome (desktop, versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/Direct3D graphics translation layer. A remote attacker who lures a user to a crafted HTML page can execute arbitrary code outside the renderer sandbox, giving native code execution on the host. Rated CVSS 9.6 with a scope change; no public exploit is identified at time of analysis and EPSS is low (0.30%, 22nd percentile), though ANGLE/GPU bugs are historically attractive to attackers.

Out-of-bounds write in Chrome's ANGLE graphics layer on Windows allows remote attackers to execute arbitrary code inside the browser's renderer sandbox by directing a user to a crafted HTML page. All Google Chrome releases on Windows prior to 152.0.7977.65 are affected. No public exploit code has been identified at time of analysis, and the EPSS probability of 0.25% (16th percentile) indicates limited current exploitation activity despite the high CVSS score of 8.8.

Out-of-bounds write in ANGLE, Chrome's GPU abstraction layer, affects Google Chrome on Windows prior to 152.0.7977.65 and can be triggered by a remote, unauthenticated attacker via a crafted HTML page, potentially achieving arbitrary code execution within the Chrome sandbox. The CVSS score of 8.8 reflects high theoretical severity, though sandbox containment (S:U) limits immediate blast radius to the GPU process. No public exploit code or CISA KEV listing exists at time of analysis, and the low EPSS of 0.42% (35th percentile) signals limited near-term exploitation probability despite the high CVSS rating.

Out-of-bounds write in Google Chrome's ANGLE graphics layer allows a remote attacker who lures a victim to a crafted HTML page to potentially execute arbitrary code outside the browser sandbox, affecting all Chrome builds prior to 152.0.7977.65. The CVSS:3.1 score of 9.6 reflects a scope-changing sandbox escape requiring only user interaction (visiting a page). No public exploit is identified at time of analysis and the EPSS probability is low (0.25%, 16th percentile), and it is not on CISA KEV.

Sandbox-escaping remote code execution in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 152.0.7977.65. A remote attacker who lures a victim to a crafted HTML page can trigger an out-of-bounds write and potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.30%, 22th percentile).

Out-of-bounds write in Chrome's ANGLE graphics layer (versions before 152.0.7977.65) lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates it High severity; the CVSS 9.6 reflects a scope-changing sandbox escape whose only gating factor is that the user opens a malicious page. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), but the memory-corruption-to-sandbox-escape impact makes it a priority patch for desktop fleets.

Remote code execution in Google Chrome desktop before 152.0.7977.65 stems from a heap buffer overflow in the WebGL component, and critically allows an attacker to execute code OUTSIDE the renderer sandbox (scope change) via a single crafted HTML page. Any user who browses to a malicious or compromised site is at risk, requiring only that the page load and render WebGL content. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.39%), but the sandbox-escape impact and network reachability make this a high-priority patch.

Heap-based buffer overflow in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome for Android prior to 152.0.7977.65 enables remote code execution outside the renderer sandbox via a crafted HTML page, meaning a successful attacker escapes Chrome's process isolation boundary with full C/I/A impact. Exploitation requires no authentication and only that a victim navigate to an attacker-controlled page, making drive-by compromise via phishing or malvertising a realistic delivery path. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the sandbox-escape capability significantly elevates real-world priority beyond what the raw CVSS score alone conveys.

Remote code execution outside the browser sandbox affects Google Chrome desktop builds prior to 152.0.7977.65, stemming from a heap buffer overflow in the ANGLE graphics translation layer. A remote attacker who lures a victim into loading a crafted HTML page can execute arbitrary code that escapes the renderer sandbox (CVSS 9.6, scope-changed). No public exploit identified at time of analysis, and EPSS is low (0.28%, 20th percentile), but the sandbox-escape impact and universal Chrome deployment make patching urgent.

Remote code execution in Google Chrome on Windows (versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES abstraction layer used for GPU rendering. A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU process and potentially execute arbitrary code outside the browser sandbox, giving control of the underlying host. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape; there is no public exploit identified and EPSS is low (0.30%), indicating no confirmed active exploitation yet.

Memory corruption in Chrome's Tint graphics library on macOS allows remote attackers to potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. All Google Chrome versions prior to 152.0.7977.65 on Mac are affected. No public exploit identified at time of analysis; despite the high CVSS score of 8.8, EPSS sits at 0.25% (16th percentile), indicating low observed exploitation activity, though the explicit sandbox-escape outcome elevates real-world severity above the raw score suggests.

Out-of-bounds read in Chrome's ANGLE graphics component (Windows builds prior to 152.0.7977.65) lets a remote attacker escape the renderer sandbox and potentially run arbitrary code after a victim opens a crafted HTML page. Google rates the Chromium severity High, and the CVSS is 9.6 driven by the sandbox-escape scope change; there is no public exploit identified at time of analysis and EPSS is low (0.42%).

Heap out-of-bounds write in OpenEXR's exrmultiview utility allows an attacker who can supply crafted EXR files to corrupt heap memory when the tool combines two individually valid scanline EXR files whose union dataWindow is misaligned to one view's channel subsampling. Affected are OpenEXR versions across three maintained branches (pre-3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13), all fixed in their respective patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack is achievable via normal command-line invocation with attacker-supplied files in VFX pipeline contexts.

Heap buffer overflow in PyOpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker to corrupt process memory by supplying a crafted EXR image file containing conflicting literal and prefixed RGB channel names. When the Python wrapper decodes such a file under the default separate_channels=False mode, a channel-name key collision causes the coalescing logic to reuse an undersized NumPy array and write pixel data out of bounds on the heap, producing high integrity and availability impact with no confidentiality exposure. No public exploit code has been identified and no active exploitation is confirmed; patched releases 3.3.13 and 3.4.14 are available from the Academy Software Foundation.

Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution under the logged-in user's context when a victim opens a specially crafted malicious file. The vulnerability (CWE-122) affects all tracked versions per the wildcard CPE, with Adobe acknowledging the issue via advisory APSB26-129. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution within the context of the current user when a victim opens a specially crafted malicious file. The CVSS 7.8 (High) score reflects local attack vector with no required privileges but mandatory user interaction, making social engineering the primary delivery mechanism for exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high-impact C:H/I:H/A:H triad and RCE potential make patching a priority for affected creative industry environments.

Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution in the context of the current user when a victim opens a specially crafted file. The flaw (CWE-122) arises during malicious file parsing, covering all versions per the wildcard CPE. Adobe has published advisory APSB26-129. No public exploit or CISA KEV listing has been identified at time of analysis, but the High CVSS score and full CIA triad impact make this a meaningful risk for creative and game-development environments.

Heap-based buffer overflow in Adobe Substance 3D Painter enables arbitrary code execution at the privilege level of the victim user when a maliciously crafted file is opened. All versions are affected per the wildcard CPE, and Adobe has published advisory APSB26-129 addressing this issue. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the file-open attack vector makes this highly amenable to phishing and supply-chain-style delivery.

Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution within the current user's security context via a maliciously crafted file. The flaw (CWE-787) is triggered during file parsing, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution under the privileges of the current user when a victim opens a specially crafted malicious file. The flaw (CWE-787) resides in file-parsing logic and delivers full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing is identified at time of analysis, but the file-delivery vector makes this a credible threat for spear-phishing campaigns targeting creative and game-development professionals.

Adobe XD's file parser contains a classic buffer overflow (CWE-120) that enables arbitrary code execution at the privilege level of the current user when a victim opens a maliciously crafted XD file. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact offset by a local attack vector and mandatory user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a serious but not imminently weaponized code-execution vulnerability.

Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted malicious file. The attack surface is local - an attacker must deliver and persuade a target to open a weaponized file, a pattern consistent with spear-phishing or watering-hole distribution targeting creative professionals. No public exploit code or CISA KEV listing has been identified at time of analysis.

Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the current user when a victim opens a specially crafted file. All versions are listed as affected per the wildcard CPE string, and the CVSS 7.8 High score reflects low-complexity exploitation once the file is opened, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.