Buffer Overflow

Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the victim user when a malicious file is opened. The vulnerability carries a CVSS 7.8 (High) rating with full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis; however, the file-open trigger and broad version coverage (all versions per CPE) make this a credible threat to creative professionals using the software.

Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted file. All versions covered by CPE cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:* are listed as affected, with Adobe addressing the issue via advisory APSB26-121. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, though the file-open delivery mechanism fits common phishing and supply-chain vectors targeting creative professionals.

Out-of-bounds write in Adobe Substance 3D Sampler (all versions per CPE) enables arbitrary code execution under the victim's user account. Exploitation is contingent on a victim opening a specially crafted malicious file, introducing a mandatory social engineering dependency. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

Out-of-bounds write (CWE-787) in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the authenticated local user when a victim opens a specially crafted file. All versions of the product are flagged as potentially affected per the CPE string cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:*, with exact version ranges detailed in Adobe advisory APSB26-121. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit code has been identified in the provided intelligence data.

Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious file. The vulnerability carries a CVSS 3.1 score of 7.8 (High), with full confidentiality, integrity, and availability impact on the affected system. No public exploit code or active exploitation has been identified at time of analysis, though the file-parsing attack surface is a well-understood target for threat actors.

Stack-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-in user. Exploitation is triggered by opening a specially crafted file, making this a file-parsing attack delivered through phishing or malicious asset distribution targeting 3D artists and designers. No public exploit code or active exploitation has been identified at time of analysis, though full confidentiality, integrity, and availability impact makes this a meaningful risk for affected users.

Heap-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution under the privileges of the current user when a victim opens a crafted malicious file. The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow), a memory corruption class that reliably yields code execution primitives in native applications. No public exploit code or active exploitation has been identified at time of analysis; however, the high CVSS score (7.8) and confirmed arbitrary code execution impact make this a meaningful risk for users in creative and 3D content production pipelines.

Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. The vulnerability is rooted in CWE-787 memory corruption during file parsing, a classic attack surface in creative content tools where complex format parsers frequently handle untrusted input. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the full CIA triad impact and straightforward delivery mechanism (malicious asset file) make this a credible risk for creative professionals targeted via spearphishing or poisoned asset repositories.

Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted malicious file. The flaw (CWE-122) resides in the application's file parsing subsystem, where insufficient bounds validation permits heap memory corruption that an attacker can leverage to redirect execution flow. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the full confidentiality, integrity, and availability impact paired with low attack complexity post-file-open reflects meaningful severity for creative professionals operating in shared-asset workflows.

Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution in the context of the current user when a malicious file is opened. The flaw (CWE-122) resides in the application's file parsing logic, allowing an attacker who can deliver a crafted Designer file to achieve full code execution without requiring any elevated privileges on the target system. No public exploit has been identified at time of analysis, and Adobe has issued a remediation advisory under APSB26-115.

Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution in the context of the current user when a specially crafted file is opened. The flaw is a CWE-787 memory corruption in the application's file-parsing pipeline - a class that reliably yields code execution primitives when exploited. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the file-delivery attack surface makes it a credible vector for spear-phishing campaigns targeting game developers, VFX artists, and product designers who routinely exchange project files.

Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted project or material file. The vulnerability carries a CVSS 7.8 score with high confidentiality, integrity, and availability impact, and the CPE wildcard indicates all tracked versions may be affected. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Heap-based buffer overflow in Adobe Substance 3D Designer allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability, tracked under CWE-122, resides in the application's file-parsing logic and affects all versions per Adobe's advisory APSB26-115. No public exploit or KEV listing has been identified at time of analysis, but the file-delivery vector makes this highly suitable for spear-phishing campaigns targeting creative professionals.

Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution in the context of the authenticated local user when a malicious file is opened. The vulnerability is rooted in a memory corruption flaw (CWE-787) triggered during file parsing, giving an attacker full control over code flow within the victim's user session. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution in the context of the victim user when a malicious project or asset file is opened. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms local file-based exploitation with no privileges required on the attacker side, but requiring the victim to actively open a crafted file. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has issued advisory APSB26-115 addressing this issue.

Heap-based buffer overflow in Adobe Substance 3D Designer enables arbitrary code execution scoped to the victim's user account when a crafted file is opened. The CWE-122 flaw carries a CVSS 7.8 (High) rating with full confidentiality, integrity, and availability impact, making successful exploitation highly damaging despite the required file-open interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity once file delivery is achieved keeps this a credible threat to creative professionals.

Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a victim opens a specially crafted VI (Virtual Instrument) file. The root cause is CWE-787 (Out-of-bounds Write), indicating a write operation beyond the bounds of an allocated buffer during VI file parsing. No public exploit code or active exploitation has been identified at time of analysis, but the file-borne delivery model is realistic in engineering and research environments where LabVIEW projects are routinely shared.

Heap out-of-bounds read in OpenEXRUtil's deep and flat image channel row() API allows an attacker supplying a crafted EXR file with a non-zero dataWindow origin to crash any application that processes the file, with conditional heap memory disclosure dependent on attacker-controlled heap layout. Affected are OpenEXRUtil versions 3.3.0-3.3.12 and 3.4.0-3.4.12; the flaw exists across three channel header implementations (ImfDeepImageChannel.h, ImfFlatImageChannel.h, ImfSampleCountChannel.h). No public exploit identified at time of analysis, and patched releases 3.3.13 and 3.4.13 are available.

Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The root cause is an out-of-bounds read (CWE-125) that, combined with tags indicating buffer overflow behavior, can corrupt memory state sufficient to achieve code execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.5 reflects the high impact potential once a victim opens a malicious VI file.

Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Rooted in CWE-125 (Out-of-bounds Read), the parser reads beyond allocated buffer boundaries, which can expose adjacent memory or - under favorable heap conditions - enable full code execution. No public exploit or CISA KEV listing has been identified at time of analysis, though the RCE potential and broad LabVIEW user base warrant prioritized patching.

Memory corruption in NI LabVIEW (all versions through 26.3.0) enables information disclosure or arbitrary code execution when a user opens a specially crafted VI (Virtual Instrument) file. The CVSS 4.0 base score of 8.5 reflects high impact across confidentiality, integrity, and availability on the vulnerable system, with local file-based delivery requiring passive user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the RCE potential and industrial control / engineering deployment context warrant prompt patching.

Heap out-of-bounds write in OpenEXR 3.3.0-3.3.12 and 3.4.0-3.4.13 allows an attacker who can supply a crafted deep scanline EXR file to crash the exrmetrics utility or potentially execute arbitrary code when pixel conversion options are active. The flaw arises from a HALF/FLOAT element-size mismatch: sample buffers are allocated for 2-byte HALF input while DeepSlice writes 4-byte FLOAT output, overrunning the heap. No public exploit or active exploitation has been identified at time of analysis; fixed releases 3.3.13 and 3.4.14 are available.

Memory corruption in NI LabVIEW 26.3.0 and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Classified under CWE-125 (Out-of-bounds Read), the flaw's buffer-overflow and RCE tags suggest that the out-of-bounds read condition can, under certain memory layout circumstances, corrupt control-flow data and escalate beyond information disclosure to full code execution. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; NI has published a vendor security advisory.

Heap out-of-bounds write in OpenEXR's TiledRgbaInputFile RGBA API affects all three active release lines on 32-bit/ILP32 builds, allowing a remote attacker to deliver a crafted EXR file that crashes or corrupts the heap of any application that opens it. The root cause is a 32-bit integer overflow in the Array2D<Rgba> buffer size calculation when tile dimensions (65537×65537) are encoded in the file header but the actual dataWindow is tiny (40×40), causing the allocator to produce an undersized buffer that tile decode then overflows. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released patches are available across all three affected release branches.

Out-of-bounds and use-after-free memory writes in OpenEXR's FlatImageChannel row() API expose rendering pipelines and image-processing services to denial-of-service and potential memory corruption when handling untrusted EXR files. Affected versions include all releases before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13; the flaw is triggered specifically when an application calls FlatHalfChannel::row() on an EXR image with a nonzero dataWindow.min value. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis.

Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The CWE-787 out-of-bounds write root cause combined with the high-impact CVSS 4.0 score of 8.5 places this in a serious tier for LabVIEW deployments across engineering, scientific, and industrial automation environments. No public exploit code has been identified at time of analysis, but the user-interaction trigger (social engineering via malicious VI file) is a well-understood threat model for desktop engineering tools.

Denial-of-service attack vectors in OpenRGB's unauthenticated TCP network protocol server (listening on 0.0.0.0:6742) allow any network-reachable attacker to crash or resource-exhaust the OpenRGB daemon without authentication. CVE-2026-18794 covers multiple DoS paths rooted in absent input-size validation - the server performs uncapped memory allocations from attacker-controlled length fields and passes raw network data to string constructors without null-termination checks. A Python reproducer script was published alongside coordinated disclosure on 2026-08-25, lowering the exploitation bar significantly. No CISA KEV listing; upstream 1.0rc3-hotfix addresses the worst aspects of the disclosed flaw set.

Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. The CVSS scope-change indicator (S:C) is the critical risk amplifier here - successful exploitation can breach the firmware's security boundary and affect components outside it, including potentially the host OS or hypervisor layer. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to corrupt firmware memory in a way that crosses the firmware's isolation boundary into the broader system. Successful exploitation may yield arbitrary code execution, privilege escalation beyond the initial firmware context, denial of service, information disclosure, and data tampering - all stemming from a single CWE-787 write primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature of the CVSS vector (S:C) elevates the potential blast radius significantly for affected AI compute infrastructure.

Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. No public exploit has been identified at time of analysis, but the CVSS 7.5 rating and SSVC automatable classification indicate this can be reliably triggered at scale against any service that processes externally sourced CMS messages.

Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.

Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute arbitrary code within the process context of the application. Exploitation requires a victim to open a specially crafted FLT (OpenFlight) file, placing this firmly in the file-borne, socially engineered delivery category. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the current process context. The vulnerability is rooted in a classic buffer overflow (CWE-120) in the application's SVG parsing subsystem, triggered when a user opens a specially crafted file. Autodesk PSIRT has issued advisory ADSK-SA-2026-0014; no public exploit code or CISA KEV listing has been identified at time of analysis, though the full C/I/A impact triad warrants prompt remediation.

Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of the current user process when a victim opens a maliciously crafted ABC file. The vulnerability carries a CVSS 7.8 High score with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the combination of low attack complexity and full process-context code execution potential makes this a credible risk for 3ds Max users who routinely open externally sourced scene files.

Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code execution within the 3ds Max process context when a user opens a maliciously crafted SVG file. Affected releases span 3ds Max 2026 prior to 2026.3.4 and 3ds Max 2027 prior to 2027.2.0, as confirmed by EUVD-2026-65150. EPSS stands at 0.25% (16th percentile) with SSVC exploitation status of 'none,' indicating no current active exploitation; however, the RCE-capable impact triad warrants patching in affected professional environments.

Out-of-bounds read in SpaceDot AcubeSAT On-Board Computer software exposes the spacecraft's CAN bus message handler to denial-of-service attacks. An attacker with access to the CAN bus network can send a crafted PerformFunction message to the OBC, triggering an out-of-bounds read in the CAN::Application::parsePerformFunctionMessage component that crashes the on-board computer. No public exploit identified at time of analysis, and EPSS exploitation probability sits at 0.14% (4th percentile), consistent with a highly specialized embedded aerospace target.

Stack-based buffer overflow in the SpaceDot AcubeSAT On-Board Computer (OBC) software allows remote unauthenticated attackers to crash the OBC by sending a crafted ECSS Telecommand (TC) message to the loadRawData function. The vulnerability, traced to commit eaf90ec, results in availability loss only - no confidentiality or integrity impact is indicated. No public exploit code or active exploitation has been confirmed; EPSS sits at 0.14% (4th percentile), consistent with the niche, mission-specific deployment footprint of this software.

Buffer overflow in DrayTek VigorSwitch's mail_mailalert function allows authenticated remote attackers with valid administrative credentials to cause a denial of service or potentially execute arbitrary commands across approximately 28 affected managed switch models. The flaw stems from unbounded concatenation of multiple SMTP receiver email addresses into a fixed-size buffer, reachable via the device's web management interface. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects high potential impact to confidentiality, integrity, and availability.

Buffer overflow in DrayTek VigorSwitch's diag_logmail function allows authenticated administrators to cause denial of service or potentially execute arbitrary commands on affected network switches. The flaw, reported by VulnCheck and acknowledged in DrayTek's August 2026 security advisory, affects a broad range of VigorSwitch models spanning SMB and enterprise product lines. Exploitation requires valid administrative credentials, limiting opportunistic attack surface, but a compromised or rogue admin account can fully compromise device confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing identified at time of analysis.

Buffer overflow in DrayTek VigorSwitch web management interface allows authenticated remote administrators to cause denial of service or potentially execute arbitrary commands on affected managed switches. The flaw resides in the acl_general_setup Edit ACE function, where the name field is copied into a fixed-size stack buffer without length validation (CWE-120). No public exploit code has been identified at time of analysis, and exploitation is gated behind valid administrative credentials, meaningfully reducing the attack surface compared to unauthenticated network flaws.

Buffer overflow in DrayTek VigorSwitch's ACL configuration function exposes authenticated administrators to denial of service or potential arbitrary command execution via the device's web management interface. The root cause - an unbounded strcpy-style copy of a user-supplied name field into a fixed-size stack or heap buffer inside acl_general_setup's Add ACE handler - is a classic CWE-120 defect reachable over the network from any host with management-plane access. Exploitation requires valid administrative credentials (CVSS PR:H), substantially limiting the attack surface; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Buffer overflow in DrayTek VigorSwitch's switch_lan_gvrp function exposes multiple managed switch models to denial of service or potential arbitrary command execution from remote, authenticated attackers. The flaw stems from unsafe copying of a user-supplied portList field into an undersized stack or heap buffer within the GVRP handling code - a classic CWE-120 defect reachable via the device's web management interface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and exploitation is gated behind valid administrative credentials, which meaningfully constrains real-world attacker opportunity.

Buffer overflow in DrayTek VigorSwitch's PoE schedule profile function allows authenticated remote administrators to cause denial of service or execute arbitrary commands on affected network switches. The flaw spans at least 10 CPE-confirmed models and an even wider set per VulnCheck tags, covering much of the VigorSwitch product line. No public exploit code and no CISA KEV listing have been identified at time of analysis, but DrayTek has published a security advisory acknowledging the issue.

Buffer overflow in the sysreboot function of multiple DrayTek VigorSwitch managed switch models allows authenticated remote attackers to cause denial of service or execute arbitrary commands. The root cause (CWE-120) is unsafe concatenation of split valueN attacker-controlled data into a fixed-size buffer in the device's web management firmware, exploitable over the network by any party holding valid administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stack buffer overflow in DrayTek VigorSwitch's webBackupAction function enables authenticated administrators to trigger denial of service or arbitrary code execution by submitting crafted HTTP requests with excessively long pathN, valueN, key, and option parameters. Exploitation is gated behind valid administrative credentials (CVSS PR:H), limiting direct internet exposure but creating meaningful risk via compromised admin accounts or insider threats. No public exploit identified at time of analysis and no CISA KEV listing, though the CWE-120 root cause class is well-understood and device-accessible researchers could feasibly develop working exploits.

Buffer overflow in DrayTek VigorSwitch's pingtrace diagnostic function allows authenticated remote attackers to cause denial of service or achieve arbitrary command execution across a broad range of VigorSwitch hardware models. The flaw arises from absent length validation when user-supplied host, count, and interval parameters are concatenated into a statically allocated buffer in the web management firmware. No public exploit is identified at time of analysis, and exploitation is gated behind valid administrative credentials, but the severity of achievable impact - full device compromise - warrants prompt patching on any network where VigorSwitch units are deployed.

Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with administrative credentials to cause denial of service or potentially execute arbitrary commands across six affected device models. The root cause is CWE-120 (Classic Buffer Overflow) - the CMD6 field undergoes memory copy operations without length validation, enabling controlled heap or stack corruption. No public exploit code has been identified at time of analysis, the vulnerability is absent from CISA KEV, and a vendor-released patch is confirmed available via DrayTek's August 2026 security advisory.

Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote attackers to cause denial of service or execute arbitrary commands on affected devices. Six distinct VigorAP models - 903, 906, 912C, 918R, 960C, and 1060C - are confirmed affected across specific firmware version ranges, all patched by DrayTek in an August 2026 advisory. No public exploit identified at time of analysis, though the vulnerability was independently reported by VulnCheck and the impact class (RCE and DoS) raises operational risk for any organization where VigorAP admin interfaces are reachable from untrusted networks.

Integer overflow in GIMP's file-pcx plugin on 32-bit builds enables a heap-based buffer overflow when a user opens a specially crafted PCX image, potentially leading to arbitrary code execution or denial of service. The flaw is architecturally constrained to 32-bit builds - 64-bit installations are unaffected - and exploitation additionally requires user interaction to open the malicious file. No active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis.

Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.

Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. Publicly available exploit code exists and the flaw was reported by VulnCheck; CVSS 4.0 base is 9.3 (AV:N/AC:L/PR:N/UI:N), but no active exploitation (CISA KEV) is confirmed.

Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks.

Remote code execution in Konami's Metal Gear Online 3 (build 1.1.2.8) arises from an unbounded heap write when parsing the lobby's kicked-player list: the game trusts the attacker-supplied "kick_num" count without checking it against the 16-player buffer limit. A malicious lobby participant can overflow the kicked-ID buffer into adjacent Steam callback handler structures, corrupting function pointers to hijack control flow and potentially execute arbitrary code inside the game process. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-reachable, unauthenticated nature and RCE potential make it high-severity.

Buffer overflow in Zscaler Client Connector on Android and ChromeOS allows local exploitation to trigger a denial-of-service condition against the connector process. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) assigns High confidentiality and integrity impact, creating a notable discrepancy with the vendor description, which characterizes impact as DoS only - this gap suggests the vulnerability may carry latent code-execution potential that the description does not fully disclose. No public exploit code or CISA KEV listing has been identified at time of analysis.

Remote buffer overflow in Zscaler Client Connector on Windows enables a network-accessible attacker with low privileges to crash the local system at the kernel level, producing a denial-of-service condition. The provided CVSS vector (C:H/I:H/A:H) signals potential confidentiality and integrity impact beyond what the vendor description explicitly states, a discrepancy that warrants verification - kernel-level buffer overflows frequently allow code execution, not merely DoS. No public exploit or CISA KEV listing has been identified at time of analysis.

Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.

Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.

Remote buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows network-reachable authenticated attackers to corrupt memory by supplying an oversized SSID value to the /goform/formConfigFastDirectionW endpoint, which calls strcpy without bounds checking on user input. Full confidentiality, integrity, and availability impact on the device is possible, potentially enabling arbitrary code execution and pivoting into the network behind the gateway. A public proof-of-concept exploit is available on GitHub; no active exploitation has been confirmed in CISA KEV at time of analysis.

Stack-based buffer overflow in UTT HiPER 1250GW firmware (≤ 3.2.7-210907-180535) exposes the device to remote code execution via a crafted HTTP request to the `/goform/aspRemoteApConfTempSend` endpoint. The unsafe `strcpy()` call processing the `Profile` parameter allows a low-privileged remote attacker to overwrite stack memory, with full confidentiality, integrity, and availability impact on both the device and downstream network systems per the CVSS 4.0 subsequent-system metrics. A public proof-of-concept is confirmed on GitHub; no public exploitation confirmed in CISA KEV at time of analysis.

Heap-based buffer overflow in libtiff's rgb2ycbcr command-line utility enables potential arbitrary code execution when a user processes a specially crafted TIFF image. The root cause is a CWE-190 integer overflow in the cvtRaster() function's strip buffer size computation: the arithmetic wraps to an undersized value, and subsequent YCbCr conversion writes spill beyond the allocated heap region. A publicly shared GitHub gist (okyfh) suggests proof-of-concept material may be available; an upstream fix commit exists in the libtiff GitLab repository, though no tagged release version has been independently confirmed at time of analysis.

Heap out-of-bounds write in DBD::Pg 3.21.0, the Perl DBI driver for PostgreSQL, lets an attacker corrupt heap memory by passing special floating-point literals (NaN, Inf, +Inf, -Inf, Infinity, and signed variants) to the quote_float() routine, reachable through the common $dbh->quote(value, DBI::SQL_NUMERIC) path. The bug is a 2-byte overwrite (a single quote plus a NULL terminator) introduced by the 3.21.0 quote.c rewrite and fixed in 3.21.1. No public exploit identified at time of analysis; EPSS is low (0.23%, 14th percentile) and CISA SSVC records exploitation status as none.

Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET&section=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.

Out-of-bounds write in the Linux kernel's IPVS subsystem (`ip_vs_nat_icmp`) allows a local attacker with low privileges to corrupt kernel memory by exploiting a TOCTOU race on the IP header length field (`ihl`), which is read multiple times during ICMP packet NAT processing. Affected systems include any Linux kernel from version 2.6.12 through the pre-patch range across multiple stable branches (fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). An attacker achieving kernel memory corruption via this path could escalate privileges to full kernel control; no public exploit or CISA KEV listing has been identified at time of analysis.

Out-of-bounds read in the Linux kernel btrfs LZO decompression path allows a crafted btrfs filesystem image to trigger a slab-out-of-bounds (and potentially extent-buffer-boundary) read when an inline LZO-compressed file extent is read. The flaw affects the kernel's btrfs module from 2.6.38 onward and is fixed upstream; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%). Despite an input CVSS of 9.8 (network vector), the actual defect requires local mounting/reading of an attacker-crafted image, making it a local availability/disclosure issue rather than remote code execution.

Out-of-bounds kernel slab read in the Linux kernel's mlx5 vDPA driver (vdpa/mlx5) allows a local actor managing vDPA devices to trigger a 16-byte over-read in create_direct_keys(). The flaw stems from a mismatch between the computed input length (which includes the 'out' field) and the pointer passed to cmd_exec() (which skips 'out'), causing mlx5_copy_to_msg() to read past a 4384-byte allocation. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV.

Type confusion in the Linux kernel's PMBus hardware monitor driver (`pmbus_notify()`) enables a slab-out-of-bounds read and potential kernel memory corruption on systems with PMBus-capable power management hardware. The `pmbus_notify()` loop unconditionally casts all attribute pointers to `struct sensor_device_attribute`, but the attribute array also contains `struct pmbus_samples_reg` and `struct pmbus_sensor` objects that only embed a base `struct device_attribute`; reading the `index` field of these miscast pointers accesses memory beyond the allocation or overlaps with unrelated kernel struct fields, producing garbage masks that could spuriously match alert conditions. No public exploit has been identified and EPSS is low (0.21%, 11th percentile), but the theoretical impact is full kernel privilege escalation on affected hardware.

Slab-out-of-bounds read in the Linux kernel's ATM subsystem `vcc_setsockopt()` exposes kernel heap memory and can crash the kernel for local low-privileged users. The defect stems from a short-circuited optlen validation - when the caller passes a mismatched `level` parameter, the length check is bypassed entirely, and a secondary path through cgroup BPF setsockopt filters can shrink optlen after a passing check, both leading to `copy_from_sockptr()` reading beyond the supplied buffer. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, reflecting low real-world exploitation probability against a legacy subsystem.

Stack out-of-bounds write in the Linux kernel IPVS (IP Virtual Server) subsystem lets a remote attacker corrupt the __icmp_send() stack when a director rebases ICMP errors for tunneled traffic. In ip_vs_in_icmp() the skb is rebased from the outer ICMP packet to the quoted original request, but IPCB(skb)->opt still describes the outer IPv4 header, so a stale timestamp-option offset points into the quoted transport header and __ip_options_echo() copies an attacker-influenced byte as an option length into fixed-size stack storage. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), consistent with a subsystem-specific memory-corruption bug rather than a mass-exploitation candidate.

Out-of-bounds memory access in the Linux kernel's packet socket subsystem (net/packet) allows a local attacker with CAP_NET_RAW or equivalent network namespace privileges to trigger kernel memory corruption via the PACKET_QDISC_BYPASS transmit path. The flaw exists because packet_parse_headers() fails to reset skb->mac_header for SOCK_DGRAM, SOCK_PACKET, and protocol-bound SOCK_RAW sockets, causing any driver that reads eth_hdr(skb) during transmit to dereference an address approximately 64 KiB past the socket buffer head. No public exploit has been identified and no CISA KEV listing exists; patches are available across at least eight stable kernel branches.

Out-of-bounds read in the Linux kernel's staging RTL8723BS WiFi driver allows adjacent-network unauthenticated attackers to leak kernel heap memory or crash the affected system by transmitting a crafted 802.11 management frame. The flaw lives in rtw_get_wpa_ie(), which accesses fixed byte offsets within a vendor-specific information element without verifying the IE body is at least 6 bytes long, enabling reads past the end of a kmemdup'd allocation when a short trailing IE is present. No active exploitation is confirmed (absent from CISA KEV) and EPSS sits at 0.22% (13th percentile), but the adjacent-network, no-authentication attack vector represents a meaningful risk for embedded and single-board systems carrying RTL8723BS hardware.

Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%, 18th percentile), but the adjacent-network unauthenticated attack vector and High impact across confidentiality, integrity, and availability make this a notable risk for any deployment relying on WEP shared-key authentication with this chipset.

Out-of-bounds reads in the staging rtl8723bs WiFi driver's monitor mode transmit path expose Linux kernel systems equipped with Realtek RTL8723BS hardware to memory disclosure, corruption, and denial of service. The driver function rtw_cfg80211_monitor_if_xmit_entry() strips the variable-length radiotap header and then reads the 802.11 frame control field without verifying the socket buffer still contains a minimum MAC header; for data frames it additionally pulls the full calculated 802.11/QoS/SNAP span before confirming the skb holds that much data. A local attacker with low privileges can inject a truncated 802.11 frame to trigger the flaw; no public exploit has been identified at time of analysis and EPSS stands at 0.22%, indicating low automated exploitation probability.

Out-of-bounds slab write in the Linux kernel ALSA FCP (FireWire Control Protocol) driver allows local unprivileged processes to corrupt up to 888 bytes of adjacent kernel heap memory by reading audio controls on /dev/snd/controlC0, once a privileged actor has installed an oversized Level Meter map. The mismatch between the driver's 255-entry map limit and the 128-entry ABI array in struct snd_ctl_elem_value creates a persistent, exploitable write primitive reachable by any process with device read access. No public exploit has been identified and no active exploitation is confirmed; vendor-released patches are available in Linux 7.2, 7.1.9, and 6.18.45.

Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.

Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.

Heap out-of-bounds write in LibVNCClient 0.9.12-0.9.15 allows a malicious or man-in-the-middle VNC server to corrupt client heap memory with attacker-controlled data, leading to unconditional denial of service or demonstrated remote code execution via callback pointer overwrite. The flaw fires from a single FramebufferUpdate message the moment a victim connects, requires no authentication, and works against default builds with default settings. No public exploit has been identified at time of analysis, though the GitHub Security Advisory explicitly demonstrates code execution under default configuration.

Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.

Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.

Stack-based buffer overflow in TP-Link TL-MR6400 v7 firmware update functionality enables an authenticated, adjacent-network attacker to achieve arbitrary code execution on the affected device. The flaw (CWE-121) arises from unsafe parsing of attacker-controlled metadata embedded in a firmware image, leading to memory corruption at the stack level. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is further constrained by requirements for high-privilege access (PR:H) and network adjacency (AV:A).

Out-of-bounds kernel memory write in the Linux kernel packet socket implementation allows a local low-privilege attacker to corrupt kernel memory by exploiting a race condition between `packet_snd()` reads of `dev->hard_header_len` and concurrent device reconfiguration. When the race is won - for example during a bonding device type change - `skb->data` is positioned before `skb->head`, and the subsequent userspace copy writes beyond the allocated socket buffer, creating a kernel memory corruption primitive suitable for local privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.16% reflects very low current exploitation probability, though the primitive is powerful and patch availability across multiple stable branches makes remediation straightforward.

Out-of-bounds read and one-byte out-of-bounds write in mod_auth_openidc's state-cookie parser (all versions prior to 2.4.19.4) allow unauthenticated remote attackers to crash Apache worker processes by sending a malformed Cookie header. The root cause is a loop termination condition in src/state.c that checked whether a pointer was NULL — a condition that could never fire since the pointer is only ever incremented — rather than checking for the string terminator, causing state-prefixed cookie tokens lacking '=' to scan and write past the end of the token buffer. No CISA KEV listing or confirmed public exploit exists at time of analysis, but the CVSS AV:N/AC:L/PR:N profile and the fully transparent fix commit make this trivially automatable for denial-of-service once widely known.

Kernel-stack out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local attacker with low-privilege shell access to corrupt kernel memory by causing the kernel to parse a crafted filesystem image during directory reads. Successful exploitation can crash the system or escalate privileges to root, yielding full system compromise. No public exploit code has been identified and EPSS remains very low at 0.16% (6th percentile), though SSVC rates technical impact as total, reflecting the severity of a successful local privilege escalation on IBM Power infrastructure.

Stack memory corruption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote denial of service by crashing the host kernel through a crafted IPsec ESP packet. The flaw (CWE-908: Use of Uninitialized Resource) resides in the ESP decapsulation handler, where uninitialized stack memory can be corrupted before proper validation, causing a system panic. No active exploitation is confirmed (absent from CISA KEV) and EPSS stands at 0.32%, but the PowerVM VIOS attack surface carries an amplified blast radius: a VIOS crash disrupts I/O services for all co-hosted logical partitions simultaneously.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated exploitation, and IBM PSIRT has published a support advisory. There is no public exploit identified at time of analysis, EPSS is modest (0.61%, 47th percentile), and CISA SSVC rates exploitation as 'none' with technical impact 'total'.

Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated privileges by exploiting an out-of-bounds write (CWE-787) memory corruption flaw. The vulnerability affects IBM's enterprise Unix operating system and its virtualization platform, with full confidentiality, integrity, and availability impact confirmed by the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, and EPSS rates the exploitation probability at just 0.17% (6th percentile), consistent with the SSVC assessment of exploitation status as none.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise of the affected Unix host or virtualization I/O server. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.41%, 35th percentile), with CISA SSVC recording no observed exploitation.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.

Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stem from an out-of-bounds read (CWE-125) reachable over the network, letting a remote attacker read sensitive memory contents or crash the affected service. The vulnerability carries a CVSS 9.1 rating driven by high confidentiality and availability impact, though EPSS places exploitation probability very low (0.19%, 10th percentile) and CISA's SSVC framework records no known exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger over the network without authentication or user interaction. Per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the flaw is critical (9.8) with total confidentiality, integrity, and availability impact, though the description does not name the specific network service or daemon that parses the malformed input. There is no public exploit identified at time of analysis, and EPSS is low (0.41%, 35th percentile), consistent with CISA SSVC scoring exploitation as 'none'.

Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.