Buffer Overflow

Out-of-bounds read in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive memory contents and enables denial of service against affected systems. The flaw is reachable by remote attackers according to the vendor description, enabling both unauthorized information disclosure and availability disruption without authentication. No public exploit code or active exploitation has been identified at time of analysis, though the high CVSS score and dual-impact (C:H, A:H) profile elevate priority for affected IBM UNIX and virtualization environments.

Local privilege escalation via buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an attacker with low-privileged local access to execute arbitrary code with a changed scope, meaning impact can extend beyond the vulnerable component - particularly significant in VIOS hypervisor environments where guest-to-host or cross-partition compromise may be achievable. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) reflects low-friction exploitation once local access is established, with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and EPSS is very low at 0.18% (8th percentile), but SSVC rates technical impact as total, warranting prioritization in Power Systems environments.

Remote code execution is possible in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 via a stack-based buffer overflow exploitable by a remote attacker holding low-privilege credentials. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with a network attack vector and no user interaction required beyond authentication. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS of 0.56% (44th percentile) indicates limited current exploitation activity despite high potential impact.

Remote code execution in IBM AIX 7.2 and 7.3 (and IBM PowerVM VIOS 4.1) stems from a stack-based buffer overflow that lets a remote attacker overwrite memory and run arbitrary code on the host. IBM PSIRT rated it CVSS 9.8, and the vector indicates network-reachable, unauthenticated exploitation requiring no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE on an enterprise Unix platform makes it a high-priority patch.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code on affected IBM Power-based Unix systems. The flaw was reported by IBM's own PSIRT and carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and privileged role of these platforms make it a high-priority patching item.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger without authentication or user interaction, yielding full compromise of the affected system. IBM PSIRT rates it CVSS 9.8, reflecting complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 arises from a stack-based buffer overflow (CWE-121) that a remote attacker can trigger without authentication or user interaction, yielding total compromise of these Power-based enterprise Unix and virtualization-management systems. The CVSS 9.8 rating reflects a fully remote, low-complexity path to arbitrary code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low (0.61%, 47th percentile), indicating no observed widespread exploitation yet despite the critical severity.

Local arbitrary code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from an out-of-bounds read (CWE-125) exploitable by a low-privileged local user with no user interaction required. A successful attacker achieves full confidentiality, integrity, and availability compromise of the affected system, as reflected in the CVSS 3.1 score of 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity makes this a credible local privilege escalation path on POWER-architecture infrastructure.

Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-787) that a remote attacker can trigger to run arbitrary code with no authentication or user interaction, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 Critical. IBM PSIRT is the reporting source. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patching target for AIX and VIOS operators.

Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a classic buffer overflow (CWE-120). The flaw carries a CVSS 9.8 with a network, no-authentication, no-interaction vector, meaning a successful exploit yields full compromise of the affected Unix host. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but a vendor patch is available.

Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787, out-of-bounds write). The CVSS 3.1 base score is 9.8 with a network vector and no privileges or user interaction required, but there is no public exploit identified at time of analysis and EPSS estimates only a 0.32% 30-day exploitation probability. IBM has published an advisory and a patch is available from the vendor.

Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.

Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.

Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total; Microsoft has released a patch via MSRC.

Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.

Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.

Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.

Heap buffer overflow in Capstone's SuperH (SH) architecture floating-point disassembler affects all releases through 6.0.0-Alpha9, allowing a four-byte out-of-bounds write into heap memory when processing crafted SH instructions. The root cause is that opFADD, opFMUL, opFSUB, and related SH FPU decoders in arch/SH/SHDisassembler.c increment op_count as an array index into the fixed-size operands[] array without bounds checking, overflowing the 176-byte sh_info heap allocation. A process that disassembles attacker-controlled SH binary data with the affected mode flags can be crashed; code execution is possible but depends on heap layout. No public exploit has been identified at time of analysis, though a proof-of-concept test case is included in the upstream fix PR. The vendor-released patch is version 6.0.0-Alpha10.

Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.

Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.

Integer overflow in libvips prior to 8.18.3 allows an attacker who can supply a crafted many-band TIFF image to evade scanline validation in VipsForeignLoadTiff, producing heap-region miscalculations that enable reads or writes at attacker-controlled negative offsets within mmap-resident allocations. Affected deployments include any pipeline - web applications, batch processors, or CLI tools - that pass untrusted TIFF input through libvips, with confirmed impacts of data disclosure via uncompressed .v output and near-certain process crashes; remote code execution has not been demonstrated but is explicitly not ruled out by the vendor. No public exploit or CISA KEV listing exists at time of analysis; the upstream fix is confirmed in v8.18.3.

Remote unauthenticated code execution is possible in swift-nio-ssh, Apple's Swift implementation of the SSH2 protocol built on SwiftNIO, where a single crafted SSH message triggers an out-of-bounds stack write of attacker-controlled length and content. Any server or client application built on swift-nio-ssh before 0.14.1 is affected, and an attacker can corrupt stack memory pre-authentication to potentially achieve arbitrary code execution. No public exploit identified at time of analysis, and despite the maximal 9.8 CVSS the EPSS probability is currently low (0.14%, 4th percentile).

Out-of-bounds write in The Tor Project's tor daemon (0.2.8.2-alpha through versions before 0.4.9.9) can be triggered when the software parses a consensus document or detached signature containing an unexpected signature digest type (TROVE-2026-019, CWE-787). The flaw is minor for most Tor roles but potentially severe for directory authorities, which routinely exchange detached signatures. Fixed in 0.4.9.9; EPSS is low (0.19%, 9th percentile) and no public exploit identified at time of analysis.

Remote code execution outside Chrome's sandbox via a heap-based buffer overflow in the Network component affects Google Chrome prior to 151.0.7922.173. An unauthenticated remote attacker can trigger the flaw by directing a target user to a crafted HTML page, achieving arbitrary code execution that escapes Chrome's sandbox boundary with full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit has been identified at time of analysis, and EPSS signals low current exploitation probability (0.39%, 32nd percentile); however, the sandbox-escape characteristic elevates the strategic patching priority beyond what the EPSS alone would suggest.

Heap buffer overflow in hank-ai/darknet's convolutional layer initialization corrupts process memory when a crafted .cfg model configuration is loaded, because layer weight and output buffer sizes are derived from unchecked 32-bit integer multiplication of configuration-supplied fields, allowing the product to wrap to zero or a small value. Darknet versions through 6.0 are affected, and no valid .weights file is required to trigger the flaw - the .cfg alone is sufficient. A publicly available proof of concept demonstrates both an out-of-bounds read under AddressSanitizer and glibc allocator metadata corruption in a release build, confirming that exploitation does not require deep reverse engineering.

Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege web management credentials to achieve arbitrary code execution on the device. The vulnerable function sub_44B50C, reachable via the CGI endpoint `/cgi-bin/mbox-config?method=SET&section=ptest_channel`, fails to bounds-check user-supplied input before copying it onto the stack. A public proof-of-concept exploit is available on GitHub (https://github.com/AdminSafe/CVE/issues/7), significantly lowering the barrier to exploitation; no CISA KEV listing has been identified at the time of analysis.

Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables remote attackers to crash or corrupt processes that use the library's DNS handling functions. The dnsname_to_labels() function in evdns.c mishandles the boundary check when writing DNS labels into a 64KB stack buffer - the terminating null byte is written one position past the allocated buffer to buf[buf_len] whenever a name-bearing record aligns precisely at the boundary. Any application embedding libevent's evdns module and querying an attacker-influenced DNS server is in scope; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Out-of-bounds read in libevent's tagged RPC decoder crashes any application that decodes attacker-controlled tag data using the evbuffer API, affecting all 2.1.x releases prior to 2.1.13 and all 2.2.x alpha releases prior to 2.2.2-alpha. The flaw in decode_tag_internal causes the byte-iteration loop to walk the full logical buffer length while only a smaller pullup window is physically contiguous, allowing a crafted 6-byte fragmented tag to drive reads past valid memory and abort the process. No active exploitation is confirmed and no public proof-of-concept exists; fixed releases are available on GitHub and should be applied promptly given libevent's broad embedding across network-facing software.

Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener to corrupt heap memory, achieving full confidentiality, integrity, and availability impact. Release builds compiled with -DNDEBUG silently remove the EVUTIL_ASSERT length guard, causing memcpy to write a kernel-supplied 110-byte sockaddr_un into the 28-byte conn_address union field and overwriting the adjacent dns_request heap pointer. No public exploit has been identified at time of analysis, but the absence of privilege requirements and low attack complexity make this accessible to any local process with filesystem access to the socket path.

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parses attacker-controlled XML with external entity resolution enabled. The flaw - introduced as a regression by the CVE-2026-66046 fix - causes dtdCopy() to allocate hash entries with the smaller sizeof(NAMED) instead of sizeof(NAME_AND_DEFAULT_ATTRIBUTE), so storeAtts() subsequently reads the attIndex member past the end of the allocated block when handling external entity parsers created via XML_ExternalEntityParserCreate. No public exploit code or CISA KEV listing is identified at time of analysis; an upstream patch commit is available but a tagged release version has not been confirmed.

Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitrary code by supplying an oversized SSID value to the device's CGI configuration endpoint. The vulnerable function sub_44B438, reachable via /cgi-bin/mbox-config?method=SET&section=ptest_ssid, performs no bounds checking on the ssid argument before copying it onto the stack. A public proof-of-concept exploit has been released on GitHub, and no vendor patch has been identified at time of analysis.

Heap-based buffer overflow in GIMP's TIF file parser enables remote code execution when a user opens a crafted TIFF image, affecting GIMP 3.2.2. The flaw stems from missing length validation before copying attacker-controlled data into a heap buffer (CWE-122), granting full code execution in the context of the GIMP process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a fix commit is available on the GNOME GitLab repository.

Stack-based buffer overflow in GIMP 3.2.2's TIF file parser enables remote attackers to execute arbitrary code in the context of the current user process. Exploitation requires the target to open a specially crafted TIF image file, making this a socially-engineered attack delivered via malicious webpage or email attachment. Reported by the Zero Day Initiative (ZDI-26-456/ZDI-CAN-29399), a fix commit has been pushed to the upstream GNOME GitLab repository, though no independently confirmed patched release version is available at time of analysis.

Heap-based buffer overflow in GIMP's TIF file parser (CWE-122) enables remote code execution on affected installations when a user opens a crafted TIFF image. Confirmed affected version is GIMP 3.2.2 per EUVD-2026-63451, with the flaw originating from missing length validation before copying attacker-controlled data to a heap buffer. Discovered and reported by Zero Day Initiative (ZDI-26-455 / ZDI-CAN-29398); no public exploit or CISA KEV listing has been identified at time of analysis, though an upstream patch commit exists on GNOME GitLab.

Heap-based buffer overflow in GStreamer's PNG file parsing allows remote code execution in the context of the affected process. Affects GStreamer installations where a user can be induced to open or process a maliciously crafted PNG file - via a web page or file download. The flaw stems from missing length validation before copying attacker-controlled data into a heap buffer (CWE-122). No public exploit or CISA KEV listing is identified at time of analysis; however, ZDI disclosed the issue under ZDI-26-466 following coordinated disclosure, and GStreamer has issued security advisory sa-2026-0052.

Stack-based buffer overflow in GStreamer's OGG file parsing component allows remote attackers to execute arbitrary code in the context of the current process. Affected installations of GStreamer fail to validate the length of user-supplied data before copying it to a stack-based buffer during OGG container parsing, enabling full code execution (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, though it was discovered and disclosed by the Zero Day Initiative (ZDI-CAN-29584), which typically indicates a reliable, well-researched finding.

Heap-based buffer overflow in GStreamer's MRF file parser enables remote code execution when a user opens a crafted media file or visits a page that triggers parsing. The root cause is absent length validation before copying attacker-supplied data into a heap buffer (CWE-122), granting full confidentiality, integrity, and availability impact within the target process. Reported by ZDI as ZDI-CAN-29608 and addressed in GStreamer security advisory SA-2026-0050; no public exploit code or CISA KEV listing is confirmed at time of analysis.

Remote code execution via malicious MRF media files affects GStreamer across all versions tracked under CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The MRF file parser fails to validate user-supplied input bounds, allowing a heap out-of-bounds write (CWE-787) that corrupts memory and redirects execution to attacker-controlled code within the victim process. Exploitation requires user interaction - opening a crafted file or visiting a page that triggers GStreamer parsing - and no public exploit or CISA KEV listing has been identified at time of analysis, though ZDI coordinated disclosure (ZDI-CAN-29510) and an upstream vendor advisory (sa-2026-0050) are both present.

Remote code execution is possible in OriginLab Origin Viewer through a memory corruption flaw triggered during OGW file parsing. An attacker can exploit this by enticing a target user to open a maliciously crafted OGW file or visit a page that delivers one, executing arbitrary code in the context of the current user process. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29338), indicating structured third-party research.

Remote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted OPJ project file, triggering an out-of-bounds write in the file parser that corrupts memory and redirects execution to attacker-controlled code. The vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29336) and carries a CVSS 7.8 score with full confidentiality, integrity, and availability impact scoped to the user process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Remote code execution in OriginLab OriginPro allows attackers to execute arbitrary code within the victim's process context by supplying a crafted OGG file. The root cause is a CWE-119 memory corruption condition in the OGG file parser, where user-supplied data is not properly validated before use, enabling a buffer overflow. Exploitation requires user interaction - the victim must open a malicious file or visit a page that triggers OriginPro's parser - and no public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution in OriginLab OriginPro 2026 SR1 is triggered when a victim opens a specially crafted OGW workspace file, exploiting a memory corruption flaw in the file parser. The vulnerability, reported by Zero Day Initiative (ZDI-26-550/ZDI-CAN-29334), allows an attacker to execute arbitrary code in the context of the current user process without requiring any privileges on the target system. No active exploitation has been confirmed in CISA KEV at time of analysis, and EPSS data was not provided, but the ZDI public advisory and vendor CVE page are both live.

Out-of-bounds write in OriginPro's OGG file parsing component enables arbitrary code execution in the context of the current user's process when a crafted OGG file is opened. Affected installations include OriginPro 2026 SR1, as confirmed by ZDI (ZDI-CAN-29333 / ZDI-26-549) and EUVD-2026-63438. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though user interaction is the sole barrier to exploitation once a malicious file is delivered.

Out-of-bounds write in OriginPro's OPJ project file parser enables remote attackers to execute arbitrary code when a user opens a specially crafted OPJ file. The flaw, disclosed by Zero Day Initiative as ZDI-CAN-29332, results from insufficient validation of user-supplied data during file parsing - allowing a write past the end of an allocated data structure and full compromise of the target process. No public exploit code and no active exploitation (CISA KEV) has been identified at time of analysis, but ZDI coordinated disclosure typically reduces the time-to-exploit development once advisories publish.

Remote code execution is achievable in OriginLab OriginPro through a maliciously crafted OPJU project file, exploiting an out-of-bounds write (CWE-787) in the application's file parser. OriginPro 2026 SR1 is confirmed affected per EUVD-2026-63436, with the CPE string suggesting broader version coverage may apply. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; however, ZDI discovery (ZDI-CAN-29331) indicates coordinated research disclosure, and the low attack complexity once the file is delivered makes this a meaningful risk to research and scientific computing environments.

Remote code execution in the Sony XAV-9500ES automotive multimedia head unit is achievable by a network-adjacent attacker who can induce a victim to pair a malicious Bluetooth device. The root cause is a heap-based buffer overflow (CWE-122) in the AVRCP_Br_Response_Parser function, which fails to validate the length of attacker-controlled data before copying it into a heap allocation. Successful exploitation yields arbitrary code execution at the device level; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enables network-adjacent attackers to execute arbitrary code on the device. The flaw in `l2_reassemble_sdu` stems from missing length validation before copying attacker-controlled data to a heap buffer, granting full code execution in the device context once a malicious Bluetooth device has been paired by the victim. No public exploit or CISA KEV listing has been identified at time of analysis, but the ZDI advisory (ZDI-26-474) and a Sony firmware update advisory are both publicly available.

Remote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's RTSP server, exploitable by unauthenticated network-adjacent attackers without user interaction. Sending a crafted RTSP SETUP packet with an oversized field overflows a fixed-length buffer, corrupting memory and enabling arbitrary code execution in the device's context. Discovered and reported by Zero Day Initiative (ZDI-CAN-29042 / ZDI-26-472), a Sony vendor advisory and firmware update are available for affected firmware version 3.02.00; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a user opens a crafted archive, affecting all stable releases from 1.0.88.0 through 6.0.1697.x and all preview releases through 6.5.1741.x on Windows. The flaw stems from a sign-conversion bug that causes the decompressor to trust an attacker-inflated block size, allowing a controlled memcpy to read beyond the allocated heap buffer and place internal heap data into the extracted file output, or crash the process entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the memory disclosure primitive is meaningful for targeted attacks.

Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.

Heap out-of-bounds write in GraphicsMagick's Photo CD (PCD) decoder enables heap memory corruption when processing a maliciously crafted PCD image. The DecodeImage() function in coders/pcd.c unconditionally advances its output pointer (q++) on every decoded Huffman delta without validating it against the end of the heap-allocated luma or chroma plane buffers, so an attacker-controlled PCD file can drive the pointer arbitrarily past the allocation boundary and overwrite adjacent heap memory. Any application invoking gm convert, gm identify, or linking against libGraphicsMagick while processing untrusted PCD files is at risk; no public exploit is identified at time of analysis.

Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.

Stack buffer overflow in GNU binutils 2.46.1 and earlier allows arbitrary code execution when a victim opens a crafted PE (Portable Executable) file using any binutils tool such as objdump or readelf. The out-of-bounds stack write (CWE-787) can corrupt return addresses, enabling attacker-controlled code execution in the victim's user context. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.8 High rating reflects full confidentiality, integrity, and availability impact if successfully exploited.

Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.

Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.

Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.

Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).

Stack-based buffer overflow in TRENDnet TEW-755AP firmware (up to build 20260702) allows remote low-privileged attackers to corrupt stack memory via the cameo.wan.wan_pppoe_password_00 parameter in /cgi-bin/wan.cgi. A public proof-of-concept exploit script is confirmed on GitHub, materially lowering the bar for exploitation. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability on both the device and downstream network systems, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.

Stack-based buffer overflow in TRENDnet TEW-755AP firmware (versions up to 20260702) allows remote low-privileged attackers to corrupt the stack in the /sbin/mycli binary by supplying an oversized ssid argument to function FUN_401000, potentially enabling arbitrary code execution on the device. A public Python proof-of-concept (poc-mycli-overflow.py) is available on GitHub, materially elevating practical risk beyond the theoretical score. No vendor-released patch has been identified at time of analysis, leaving affected devices without an official remediation path.

Stack-based buffer overflow in TRENDnet TV-IP751WIC firmware 11.03.03 allows remote low-privileged attackers to achieve arbitrary code execution by sending a crafted value in the Currenttime parameter to the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability for both the compromised device and subsequent systems in its network segment. A public proof-of-concept exploit script is confirmed available on GitHub, though this vulnerability is not currently listed in the CISA KEV catalog.

Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.

Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.

Remote authenticated exploitation of IBM i versions 7.3 through 7.6 via an out-of-bounds read (CWE-125) enables attackers to both crash the system and exfiltrate sensitive data from adjacent memory regions. The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) reflects significant dual confidentiality and availability impact achievable over the network without user interaction, though a minimum of low-privilege credentials is required, limiting the attack surface to authenticated accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at a low 0.31% (24th percentile), and SSVC rates the attack as non-automatable.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a remote attacker can trigger without authentication, per IBM PSIRT (CVE-2026-16913). With a CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) and full CIA impact, successful exploitation yields arbitrary code execution on the affected UNIX operating system or virtualization I/O server. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, unauthenticated profile makes this a high-priority patch.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows remote authenticated attackers to execute arbitrary code on affected systems. The flaw (CWE-121) is reachable over the network with low attack complexity and requires only low-privilege credentials, yielding complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.8 CVSS score and confirmed RCE potential make patching urgent for organizations running IBM POWER infrastructure.

Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a network-based attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise (high confidentiality, integrity, and availability impact) of Unix systems that frequently underpin enterprise and mission-critical workloads. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.

IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run arbitrary code by triggering a stack-based buffer overflow, per the vendor-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N. IBM (the reporting party) has published a fix, and no public exploit identified at time of analysis. EPSS and KEV signals were not provided, so the 9.8 CVSS score is currently the strongest available severity indicator.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote authenticated attackers to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 score reflects low-complexity network exploitation requiring only low-privilege authentication (PR:L), making it accessible to any credentialed user on the system. No public exploit identified at time of analysis, but a vendor-released patch is available from IBM.

Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.

Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. Impact is scoped to the actively booting partition - other partitions and the managed system are explicitly unaffected. No public exploit or CISA KEV listing exists at time of analysis; EPSS is notably low at 0.19% (9th percentile), consistent with the narrow exploitation window.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow (CWE-121) that a network attacker can trigger without authentication or user interaction. Because the flaw carries a CVSS 9.8 with an AV:N/AC:L/PR:N/UI:N vector, a successful attack yields full compromise of confidentiality, integrity, and availability on affected enterprise UNIX hosts and virtualization I/O servers. There is no public exploit identified at time of analysis, and IBM (the reporter) has released a fix.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping.

Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service-level access holders to crash the firmware boot stack with possible memory corruption during system initialization, impacting integrity and availability of the managed Power system. Affected firmware spans three release trains: FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283238.

Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.

Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote unauthenticated memory corruption in RDK-B WebUI (build rdkb-2025q4-kirkstone.04.10.26) arises from a heap-based buffer overflow in the multipart/form-data parser in jst_post.c, letting an attacker send a single crafted POST request to corrupt heap memory. Confirmed impact is denial of service via crashing the WebUI service, with potential remote code execution on the broadband gateway if the overflow is weaponized. No public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is low (0.29%, 21st percentile) despite the 9.8 CVSS.

Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. No public exploit code has been identified and no active exploitation is confirmed, but the persistence of the availability impact and the cross-boundary scope change (guest-to-host) make this a meaningful risk in shared multi-tenant OpenPOWER environments.

Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. No public exploit identified at time of analysis; IBM has released a fix and reported the issue itself.

Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP management network protocol. An attacker holding authenticated HMC administrator credentials and adjacent-network access to the management interface can trigger the overflow to execute arbitrary code on the Flexible Service Processor, achieving full out-of-band control over all managed hardware and hosted workloads. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the vendor has released a patch.