Buffer Overflow

Out-of-bounds slab write in the Linux kernel SUNRPC layer (xdr_buf_to_bvec()) lets a remote NFS client corrupt kernel memory via the in-kernel NFS server (nfsd) write path. The function stores a bio_vec into the caller's rq_bvec array before verifying the slot is in range - and the head branch stores with no check at all - so when the exactly-sized rq_maxpages budget is used up, one bio_vec lands past the array into adjacent slab memory, with attacker-influenced bv_len and bv_offset values taken from client-supplied RPC payload sizes. Rated CVSS 9.8 by the source, but with low EPSS (0.21%), no CISA KEV listing, and no public exploit identified at time of analysis.

Out-of-bounds read in the Linux kernel's NTFS driver (ntfs_mapping_pairs_decompress) lets a crafted NTFS attribute record trigger a one-byte read past the attribute boundary. It stems from off-by-one bounds checks that use strict greater-than instead of >=, so mapping-pair data extending exactly to attr_end passes validation and buf[b] reads one byte too far. No public exploit is identified at time of analysis, EPSS is low (0.20%), and it is not on CISA KEV; exploitation requires the kernel to parse an attacker-controlled NTFS volume.

Out-of-bounds kernel memory read in the legacy NTFS filesystem driver of the Linux kernel (affecting builds derived from commit 6ceb4cc8 up to the 7.1.x and 7.2-rc series) occurs when the driver parses a crafted NTFS image whose $FILE_NAME attribute declares a small resident value_length but an oversized file_name_length. Callers trust file_name_length and read past the resident attribute value during name conversion/comparison, producing a slab-out-of-bounds read confirmed under KASAN from the kmalloc-1k MFT record copy. There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and despite the source-assigned 9.8 CVSS this is a local filesystem-parsing bug rather than a remote-unauthenticated flaw.

Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).

Slab-out-of-bounds write in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) is triggered during the log_replay() analysis pass when mounting a malformed NTFS3 volume. The copy_lcns loop lacks bounds enforcement against dp->lcns_follow, so a crafted LRH entry with target_vcn set to dp->vcn + dp->lcns_follow - 1 and lcns_follow greater than 1 overflows the heap-allocated page_lcns[] array, corrupting kernel memory. Confirmed by KASAN on mainline kernel 8d90b09e6741 with a slab-out-of-bounds write of size 8 at log_replay+0x68d4; no public exploit exists and EPSS stands at 0.21%, though the CVSS score of 8.4 reflects the full confidentiality, integrity, and availability impact of kernel heap corruption.

Denial-of-service in the Linux kernel ntfs3 driver lets an attacker with the ability to mount a crafted NTFS image panic the system via unbounded recursion. indx_find_buffer() descends the NTFS B+ tree index with no depth limit, so a circular index-node reference overflows the kernel stack when a file deletion hits the index rebalancing fallback path. No public exploit is identified and it is not in CISA KEV; EPSS is low at 0.23%. Note that the supplied CVSS 9.8/AV:N vector is inconsistent with the description, which requires local access to attach a malicious filesystem.

Heap out-of-bounds write in the Linux kernel's ntfs3 filesystem driver lets a local user corrupt kernel slab memory by mounting and accessing a crafted NTFS image. When indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION, hdr_insert_head() copies resident entry bytes ('to_move') sized from on-disk data into a destination buffer sized from an attacker-shrunk root->index_block_size, writing 120-136 bytes of attacker-controlled data past a kmalloc allocation. The flaw is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS is low (0.21%), and despite the NVD CVSS of 9.8 the described trigger is local rather than network-reachable.

Memory corruption in the Linux kernel's MIPS scheduler corrupts kernel pointer state when CONFIG_CPUMASK_OFFSTACK is enabled, enabling local privilege escalation to root. Two compounding flaws exist: sizeof(new_mask) resolves to the pointer width (4-8 bytes on MIPS) rather than the actual cpumask buffer size, causing copy_from_user() to overwrite the mask pointer with user-controlled bytes; and the original code invoked copy_from_user() prior to allocating the mask buffer, creating a write-before-allocation primitive. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N reflects straightforward local exploitation on affected MIPS systems, though EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit code indicate limited real-world exploitation activity at time of analysis.

Race condition in the Linux kernel's HugeTLB page table protection code allows a local low-privileged user to corrupt page tracking state or leak memory access metadata. Specifically, make_uffd_wp_huge_pte() in fs/proc/task_mmu.c invokes huge_ptep_modify_prot_commit() on a PTE snapshot captured without the preceding huge_ptep_modify_prot_start() atomic clear, creating a window where hardware can set Dirty or Accessed bits between the read and commit, which are then silently overwritten with stale values. EPSS is 0.21% (11th percentile) and no active exploitation has been confirmed - this is a correctness/integrity fix in the kernel stable queue, not a commonly weaponized class of vulnerability.

Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.

Memory corruption in the Linux kernel's ThunderboltIP receive path allows an adjacent unauthenticated attacker to overflow the skb frags[] array by sending a crafted multi-frame packet with 19 or more small frames. The insufficient frame_count bound in tbnet_check_frame() (capped at TBNET_RING_SIZE/4 = 64) far exceeds MAX_SKB_FRAGS (17), causing skb_add_rx_frag() to write past the frags[] array and corrupt kernel memory. EPSS is low (0.21%, 11th percentile), no public exploit exists, and CISA KEV confirmation is absent, but CVSS 8.8 reflects the severity of kernel memory corruption once Thunderbolt physical access is achieved.

Out-of-bounds heap read and write in the Linux kernel TPM character device driver exposes kernel heap memory to local low-privileged users with access to /dev/tpm0 or /dev/tpmrm0. The TPM char device open handlers fail to call nonseekable_open(), leaving FMODE_PREAD and FMODE_PWRITE enabled on a device that only supports sequential command/response I/O; a pread() call with a large offset (e.g., 0x1400) passes that offset unchecked into tpm_common_read(), causing an out-of-bounds heap read via copy_to_user() and a subsequent out-of-bounds zero-write via memset(). No public exploit is identified at time of analysis, EPSS sits at 0.22% (13th percentile), and patches are available across all active Linux stable branches.

Heap out-of-bounds write in the Linux kernel NVMe-oF target (nvmet) DH-HMAC-CHAP authentication handler lets a remote NVMe-oF initiator corrupt kernel heap memory when in-band authentication is enabled. nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length after only checking it is nonzero, so the SUCCESS1 and FAILURE1 response builders write a fixed-size DH-HMAC-CHAP message into an undersized kmalloc() buffer, producing a 16-byte OOB write from a one-byte allocation length. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.25%, 17th percentile).

Out-of-bounds memory access in the Linux kernel dm-era (device mapper era) subsystem allows a local privileged attacker to trigger a vmalloc out-of-bounds read by configuring a dm-era table with a non-zero start sector. The era_map() function fails to apply the target offset before calculating the writeset block, passing an absolute block number to writeset_marked() that may exceed the allocated bitset size. No public exploit exists and EPSS probability is 0.22%, but patches are backported across all major stable kernel branches. The provided CVSS score of 8.8 (AV:N/PR:L) materially overstates real-world risk for a flaw requiring CAP_SYS_ADMIN and a specifically misconfigured dm-era table.

Integer wraparound in the Linux kernel's dm-log subsystem on 32-bit architectures allows a local attacker to trigger a bitset_size overflow, potentially causing kernel memory corruption. Specifically, when region_size is close to UINT_MAX and bitset_size is rounded up to a multiple of BITS_PER_LONG, a 32-bit size_t wraps around to zero, leading to an incorrect zero-byte bitmap allocation and subsequent out-of-bounds write conditions. No public exploit is identified at time of analysis, and EPSS probability is low (0.22%, percentile 13%), but the CVSS 7.8 local score reflects the potential for full system compromise once the specific conditions are met.

An out-of-bounds kernel write in the Linux kernel's dm-verity Forward Error Correction (FEC) code allows corruption of adjacent kernel memory when Reed-Solomon erasure recovery is triggered. An off-by-one in the erasure-counting logic lets the erasure count reach roots+1, which is then passed to decode_rs8() and overruns the lambda[] locator polynomial by one element, clobbering the syndrome buffer (syn[0]). It affects Linux systems using dm-verity with FEC enabled; there is no CISA KEV listing, no public exploit identified, and EPSS is low (0.22%, 13th percentile), indicating this is a memory-safety defect rather than an actively exploited threat.

Kernel out-of-bounds read in the Linux SCSI target (LIO/TCM) subsystem lets a SCSI initiator crash the host by sending a malformed PERSISTENT RESERVE OUT command. The iSCSI TransportID parser (target_parse_pr_out_transport_id / iscsi_parse_pr_out_transport_id) scans for the ',i,0x' ISID separator with an unbounded strstr(), so a TransportID whose iSCSI name has no separator and no NUL terminator runs the scan off the end of a multi-page vmap buffer into the vmalloc guard page, oopsing the kernel (KASAN: vmalloc-out-of-bounds). It is reachable by any fabric delivering PR OUT to an iSCSI-exported device, including a guest via vhost-scsi. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not in CISA KEV.

Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.

Out-of-bounds memory read and infinite-loop denial of service in the Linux kernel's iosm WWAN driver (net/wwan/iosm) allow a rogue or compromised modem to corrupt kernel memory and exhaust system resources by supplying crafted MUX downlink packets with malicious offsets and circular table references. Affected systems are those running Linux 5.18 and later with Intel WWAN hardware using the iosm driver, where the mux_dl_adb_decode() function failed to validate any of the device-supplied offsets and lengths (first_table_index, next_table_index, table_length, datagram_index, datagram_length) against the received socket buffer boundary. No public exploit exists and EPSS probability is very low at 0.21% (12th percentile); however, the CVSS 8.8 rating with Full C/I/A impact and reproduction confirmed under KASAN make this a credible risk for cellular-enabled Linux deployments awaiting patch application.

Heap out-of-bounds read in the Linux kernel MACsec subsystem (`macsec_encrypt()`) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at `macsec_start_xmit()` with `skb->mac_header` unset, resolving `eth_hdr(skb)` to `skb->head + 65535` - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.

Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.

Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in `brcmf_notify_auth_frame_rx()` causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives `memcpy` far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.

Integer underflow and overflow flaws in the Linux kernel's Realtek Bluetooth driver (btrtl) corrupt kernel memory during firmware loading, enabling a local attacker with low privileges to achieve full kernel-level compromise. The vulnerability exists in rtlbt_parse_firmware(), where a malformed firmware patch with a length field smaller than 4 causes a subtraction underflow that transforms a subsequent memcpy into an oversized kernel memory write; a separate addition overflow on 32-bit architectures compounds the exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.21% (12th percentile), consistent with the local-only attack vector.

Out-of-bounds memory access in the Linux kernel's spufs (SPU filesystem) subsystem on PowerPC Cell Broadband Engine architectures allows a local low-privileged user to read or write beyond the SPU local store buffer via a flawed bounds check in `spufs_mem_mmap_access()`. The function computes the mmap offset correctly but validates it against `vma->vm_end` rather than `LS_SIZE`, causing the guard to never fire on 64-bit systems and leaving the length parameter unconstrained relative to the actual local store buffer. Vendor-released patches are confirmed across multiple stable kernel branches; no public exploit has been identified and EPSS is 0.21% at the 12th percentile.

Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. No public exploit has been identified, EPSS sits at 0.18% (8th percentile), and the kernel maintainers resolved the issue by removing the entire dead code block rather than patching individual bugs.

Memory corruption and use-after-free in the Linux kernel's AF_RXRPC subsystem (rxrpc) let a local process trigger a double-free and connection refcount underflow by reading an out-of-band challenge message with MSG_PEEK. Because rxrpc_recvmsg_oob() guards only the unlink from recvmsg_oobq under MSG_PEEK but always moves the skb onto pending_oobq, the same singly-referenced skb becomes linked into both a list and an rbtree that share storage, corrupting linkage and freeing the skb and its connection reference twice on socket close. The NVD-assigned CVSS is 9.8, but EPSS is only 0.15% (5th percentile) and there is no public exploit identified at time of analysis; the fix is upstream in the stable trees.

Integer overflow in the Linux kernel's legacy DRM radeon driver exposes systems with older ATI/AMD Radeon GPUs to kernel memory corruption via crafted dumb-buffer allocation requests from a low-privileged local user. The flaw resides in radeon_align_pitch(), where both the alignment round-up addition and the final width-times-bytes-per-pixel multiplication can overflow signed 32-bit integers, causing radeon_mode_dumb_create() to return an invalid pitch or allocate a zero-sized kernel buffer - a condition that can be leveraged for heap corruption. EPSS sits at 0.16% (5th percentile) with no CISA KEV listing and no public proof-of-concept, indicating active exploitation has not been confirmed; however, the low-privilege local vector and straightforward arithmetic overflow make this notable for shared Linux systems with this legacy hardware.

Out-of-bounds read in the Linux kernel's rtw88 PCIe WiFi driver allows an adjacent-network attacker to trigger kernel memory disclosure or a system crash via crafted WiFi RX descriptor values. Systems running unpatched kernels with Realtek RTW88-series WiFi chipsets attached over PCIe are affected; the USB transport path was already protected by an equivalent check. The vulnerability arises because the PCIe receive path in rtw_pci_rx_napi() does not validate that the firmware-derived new_len value stays within the pre-allocated DMA buffer before calling skb_put_data. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.

Heap buffer overflow in the Linux kernel CCP driver's snp_filter_reserved_mem_regions() function enables a low-privileged local attacker to corrupt kernel memory on AMD SEV-SNP-enabled systems. The off-by-one error in the boundary check permits a 4-byte write past a PAGE_SIZE kzalloc buffer when 255 or more IOMEM reserved memory regions are present, yielding full High impact on confidentiality, integrity, and availability per CVSS 7.8. No public exploit has been identified and EPSS stands at 0.19% (8th percentile), indicating no current widespread exploitation activity despite the severity score.

Kernel-level memory corruption in the Linux RDMA SCSI RDMA Protocol target driver (ib_srpt) lets a malicious SRP initiator on the RDMA fabric overflow an integer length calculation and drive a ~4GB out-of-bounds scatter-gather mapping. The flaw stems from adding an attacker-controlled 32-bit immediate-data length to an offset without overflow checking, wrapping req_size below its bounds check. It carries a CVSS 9.8 rating, but there is no public exploit identified at time of analysis and EPSS is low (0.19%, 8th percentile); a vendor patch is available across current stable kernel trees.

Out-of-bounds write in the Linux kernel's RDMA irdma driver allows a local low-privileged user to overflow a fixed-size kernel array and corrupt heap memory, potentially escalating privileges or crashing the system. The flaw exists in irdma_copy_user_pgaddrs, where the loop guard based on palloc->total_cnt is inert when set to zero (the lvl==0 path), allowing a user-supplied umem with more than 4 DMA blocks to write beyond the 4-entry iwmr->pgaddrmem array. Patch-confirmed fixes are available across multiple stable kernel branches; no public exploit code exists and EPSS sits at 0.17%, but the High C/I/A impact of a kernel heap write warrants prompt patching on affected configurations.

Out-of-bounds slab write in the Linux kernel's NVMe-multipath driver (nvme_mpath_revalidate_paths) affects hosts whose NUMA node IDs are sparse rather than densely packed from zero, notably some powerpc/POWER9 systems. The nvme_ns_head.current_path[] flexible array is sized with num_possible_nodes() but indexed with the raw numa_node_id(), so on non-contiguous topologies the driver writes a pointer past the end of the allocation during namespace scanning, producing the KASAN slab-out-of-bounds splat shown in the report. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and it is not on CISA KEV, despite an inflated NVD score of 9.8.

Out-of-bounds array access in the Linux kernel's nvme-pci driver crashes the kernel and prevents NVMe namespaces from appearing as /dev nodes on systems built without NUMA support (CONFIG_NUMA=n). The root cause is a signed-to-unsigned type mismatch: NUMA_NO_NODE (-1) is cast to UINT_MAX when passed through a parameter declared 'unsigned', causing nvme_setup_descriptor_pools() to index far beyond the bounds of the descriptor pool array (sized to nr_node_ids). No active exploitation has been identified (not in CISA KEV), and EPSS of 0.17% reflects negligible real-world exploitation probability, though the CONFIG_NUMA=n precondition significantly limits the exposed population to non-enterprise kernel builds.

The host1x GPU driver in the Linux kernel mishandles the return value of iommu_map_sgtable() after an upstream API change switched its return type from size_t (unsigned, zero on error) to ssize_t (signed, negative on error), leaving pin_job() blind to failures. Compounded by pin_job() assigning the result to a plain int - risking overflow on large sizes - an IOMMU mapping failure can be silently treated as success, potentially allowing a low-privileged local user on Tegra hardware to trigger kernel memory corruption and escalate privileges. No public exploit identified at time of analysis; the CVSS 8.8 score with Scope:Changed reflects the theoretical kernel-level blast radius, while the 0.17% EPSS and absence of CISA KEV listing indicate low current exploitation activity.

Heap buffer overflow in the Linux kernel's RDMA/rxe (Soft-RoCE) subsystem exposes local low-privileged users to a TOCTOU race condition in get_srq_wqe(), where a concurrent userspace thread can corrupt the num_sge field in a kernel-userspace shared SRQ buffer between its validation and use, bypassing bounds checks on the memcpy into qp->resp.srq_wqe. Affected kernels span from the rxe SRQ introduction at commit 8700e3e7c485 (circa Linux 4.8) through multiple stable branches, with fixes backported to 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit has been identified at time of analysis, and EPSS at 0.19% reflects limited real-world exploitation activity despite the 7.8 CVSS score.

Out-of-bounds memory access in the Linux kernel RDMA/rxe (Soft RoCE) subsystem enables a local low-privileged attacker to corrupt kernel heap data or leak sensitive memory, potentially achieving local privilege escalation. The non-SRQ receive path in rxe_resp_check_length() and copy_data() reads WQE fields directly from a userspace-mapped shared buffer without snapshotting them first, creating a TOCTOU race window exploitable by any local user controlling a non-SRQ queue pair. Patches are confirmed available across multiple stable kernel branches; no public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.17% indicates low current exploitation probability consistent with the niche RDMA prerequisite.

Out-of-bounds write in the Linux kernel BPF subsystem allows a local low-privileged user to corrupt memory by issuing a BPF_PROG_QUERY syscall with an undersized bpf_attr buffer that omits the query.revision field introduced in v6.6. The cgroup attach-type code path is the primary hazard: BPF_PROG_QUERY on cgroup types shipped in 2017, and the revision write-back was added years later, creating a real population of legacy callers whose smaller buffers trigger the unconditional OOB write. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the CVSS 7.8 high-impact rating reflects that successful kernel memory corruption can yield full system compromise.

Heap out-of-bounds write in the Linux kernel amdgpu DRM driver's `amdgpu_coredump()` function allows a local attacker with GPU access to corrupt kernel heap memory during a GPU reset event. The vulnerability affects Linux kernel versions containing commit eea85914d15b up to the fix commits, specifically Linux 7.1 stable and prior, on systems with AMD GPU hardware. A local user who can trigger or time a GPU ring timeout during an active GPU reset could exploit this heap corruption for potential privilege escalation; however, no public exploit exists and EPSS probability is 0.15% (5th percentile), indicating limited real-world exploitation activity at time of analysis.

Heap buffer overflow in the Linux kernel wcn36xx WiFi driver allows an adjacent-network attacker without authentication to corrupt kernel heap memory with firmware-controlled content. The vulnerability exists in the synchronous HAL response dispatcher for Qualcomm WCN36xx chipsets, which copies all firmware responses into a fixed 4096-byte buffer without first validating response length. Successful exploitation from an adjacent network position yields high confidentiality, integrity, and availability impact - consistent with potential kernel code execution. EPSS is low at 0.19% and no active exploitation is confirmed, but the lack of authentication requirement and network-adjacent reachability elevate real-world concern for affected embedded and mobile platforms. Patches are available across multiple stable kernel branches.

Out-of-bounds slab read in the Linux kernel's ASoC AMD ACP SoundWire legacy machine driver allows a local attacker - or a hardware-triggered probe path - to read beyond an allocated array in create_sdw_dailinks(), potentially causing kernel memory disclosure or denial of service. The vulnerability is introduced when all DAI link entries are initialized, causing the boundary-unchecked loop to walk past the end of the soc_dais allocation. KASAN confirmed the read-of-size-1 in mc_probe(). EPSS is at 0.17% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit has been identified at time of analysis. Fixes are available for Linux stable branches 6.18.40 and 7.1.5, as well as the 7.2-rc1 mainline.

Linux kernel ixgbe driver on Intel E610 adapters triggers a KASAN slab-out-of-bounds write when an XDP program is loaded on hosts with 64 or more logical CPUs. The root cause is a queue-count mismatch: MSI-X constraints cap the netdev at 63 queue pairs on E610, but XDP allocates 64 queues on ≥64-CPU systems, causing netif_set_xps_queue() to write 4 bytes beyond the allocated slab at queue index 63. With EPSS at 0.15% (5th percentile), no KEV listing, and hardware-specific trigger conditions, real-world exploitation is low-probability but not negligible in high-CPU-count data center environments running this Intel hardware.

Undefined behavior from a signed integer overflow in the Linux kernel's RDMA/mlx5 driver exposes systems with Mellanox ConnectX RDMA hardware to local privilege escalation or kernel crash. The flaw in set_rq_size() accepts user-supplied rq_wqe_shift values up to and including 32, causing signed 32-bit integer overflow when computing '1 << rq_wqe_shift' - undefined behavior under the C standard that can corrupt kernel memory structures. The vulnerability carries a CVSS 7.8 High score but EPSS of just 0.18% (7th percentile) and is absent from CISA KEV, indicating no public exploit or active exploitation at time of analysis.

Out-of-bounds read in the Linux kernel's SCTP protocol implementation allows a malicious SCTP peer to trigger memory over-reads during INIT or ASCONF chunk processing. The flaw stems from insufficient validation of an embedded address parameter's declared length inside ADD_IP, DEL_IP, and SET_PRIMARY ASCONF parameters, letting a crafted peer advertise a length exceeding the enclosing parameter's bounds. No public exploit has been identified at time of analysis, EPSS is low (0.18%), and it is not on CISA KEV, but the CVSS 9.1 score reflects remote unauthenticated reachability against SCTP-enabled hosts.

Out-of-bounds kernel memory access in the Linux kernel CXL (Compute Express Link) region driver allows a local attacker on systems equipped with CXL memory hardware to corrupt kernel memory by causing cxl_cancel_auto_attach() to use a negative errno value as an array index into p->targets[]. The flaw originates when cxl_region_sort_targets() fails - setting cxled->pos to a negative errno - and that invalid index is later used directly without validation. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.15% at the 5th percentile, reflecting very low real-world exploitation probability consistent with the niche CXL hardware requirement.

Integer overflow in the Linux kernel's BPF sockmap helper `bpf_msg_pop_data()` enables a local privileged attacker to bypass scatterlist bounds checks, causing an out-of-bounds traversal that dereferences a null or non-canonical page pointer and crashes the kernel. Affected are all kernel stable series from 5.10 through pre-7.2, with patches confirmed across eight stable branches. No public exploit has been identified at time of analysis and the EPSS score of 0.21% (12th percentile) indicates negligible current exploitation activity, though the confirmed kernel crash impact and High CVSS score warrant prompt patching on systems using BPF sockmap.

Out-of-bounds memory access in the Linux kernel's SoundWire audio subsystem exposes local low-privilege users on affected kernel versions to potential privilege escalation to root. The off-by-one loop error in sdw_add_element_group_count, discovered via Google's syzkaller fuzzer, allows iteration to read beyond valid array bounds when the iterator equals the element count, potentially corrupting adjacent kernel memory. No active exploitation is confirmed (no CISA KEV entry), and an EPSS of 0.21% at the 11th percentile reflects minimal real-world exploitation activity at time of analysis, though the local vector and low privilege requirement mean any authenticated user on a SoundWire-equipped system is theoretically within scope.

Shift-out-of-bounds undefined behavior in the Linux kernel's MAX3421E USB host controller driver (`max3421-hcd`) allows a local low-privileged user with access to the raw USB device node to corrupt kernel hub state. The `max3421_hub_control()` function blindly shifts the integer constant 1 left by an attacker-controlled `wValue` field without bounds-checking, so any value ≥ 32 invokes undefined behavior that arbitrarily corrupts `max3421_hcd->port_status`, including immutable change bits that gate internal state transitions. No public exploit exists and this CVE is not in the CISA KEV catalog; EPSS at 0.25% (16th percentile) reflects low exploitation likelihood, but the CVSS 7.8 is grounded in a genuine local privilege-escalation primitive within the kernel USB subsystem.

Out-of-bounds memory access in the Linux kernel's xilinx-ams IIO ADC driver allows a local low-privileged user to corrupt kernel memory through malformed event handling in ams_handle_event(). Affected versions span multiple stable kernel branches beginning with the commit that introduced the xilinx-ams driver, with the flaw present from Linux 5.17 onward across the 6.1, 6.6, 6.12, 6.18, and 7.1 stable series. No public exploit exists and EPSS sits at 0.18% (8th percentile), though vendor-released patches are confirmed across six stable branches and the CVSS 7.8 score reflects genuine kernel memory corruption potential on affected Xilinx hardware platforms.

Slab-out-of-bounds read in the Linux kernel ntfs3 filesystem driver exposes kernel heap memory and can cause a denial of service when a crafted NTFS volume is mounted. The flaw resides in `run_get_highest_vcn()`, which iterates over NTFS mapping-pairs buffers with no length bound, trusting a 0x00 terminator that a crafted $LogFile UpdateMappingPairs record can omit; the bug fires unconditionally during `ntfs_fill_super` on mount of the malicious image. Affected stable series span Linux 6.1.x through 7.0.x; the EPSS score is 0.18% (8th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.

Heap buffer overflow in the Linux kernel ntfs3 filesystem driver's log_replay() function allows a local authenticated user to corrupt kernel heap memory by mounting a dirty NTFS volume whose on-disk log page size exceeds the host PAGE_SIZE. The one_page_buf scratch buffer is allocated using the host page size but never resized when a larger on-disk page size is adopted from the restart area, causing read_log_page() to write beyond the allocation boundary. No public exploit code exists, EPSS is 0.18% (7th percentile), and this is not listed in the CISA KEV catalog, placing current exploitation probability very low despite a CVSS 7.8 base score.

Shift-out-of-bounds in the Linux kernel's XFRM subsystem allows a local low-privileged attacker to corrupt kernel memory by crafting an AF_UNSPEC selector with an oversized prefixlen (e.g., 128) and triggering a match against an IPv4 flow when XFRM_STATE_AF_UNSPEC is set. Affected systems span multiple long-term stable kernel branches from 4.19 through 6.12.x, with patched versions available across all impacted series. No public exploit has been identified and the vulnerability is not in CISA KEV; EPSS at 0.22% confirms minimal observed exploitation activity.

Out-of-bounds kernel memory corruption in the QCOM USB audio ALSA driver (`sound/usb/qcom/`) allows a local unprivileged user to corrupt kernel slab memory or trigger a kernel oops by sending a crafted stream-disable request over AF_QIPCRTR. The disable path in `handle_uaudio_stream_req()` fails to guard against a negative index returned by `info_idx_from_ifnum()`, an invariant violation that the enable path already handles - resulting in a wild-pointer dereference when the card has never been enabled, or an out-of-bounds 4-byte slab write when it has. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low-complexity local exploit path on QCOM-equipped systems warrants prompt patching.

Invalid pointer dereference in the Linux kernel netfilter NAT subsystem exposes local attackers with CAP_NET_ADMIN to kernel slab-out-of-bounds memory access via nf_nat_register_fn(). When nf_nat_init() fails during module initialization, the nat_net pointer is left in an invalid state; subsequent calls to nf_nat_register_fn() dereference it without validation, producing a KASAN-confirmed out-of-bounds read that can escalate to full kernel memory corruption. No public exploit code exists and EPSS at 0.21% (12th percentile) reflects negligible observed exploitation activity, though the local-privilege attack surface in containerized environments warrants timely patching.

Out-of-bounds memory access in the Linux kernel netfilter flowtable subsystem allows malformed IPv4 packets to overrun header-size calculations in nf_flow_ip4_tunnel_proto(), affecting systems that use nftables flowtable offload with IP tunnel processing. The bug stems from consuming the untrusted iph->ihl field without validation before computing header size. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; despite the CNA's 9.8 rating, real-world impact is most consistent with a denial-of-service kernel crash on a non-default configuration.

Out-of-bounds kernel memory read in the Linux kernel's GENEVE tunnel GRO path (drivers/net/geneve.c) affects tunnels that have not enabled the IFLA_GENEVE_GRO_HINT feature - which is the default. geneve_gro_complete() honours an attacker-supplied GRO hint option unconditionally while geneve_gro_receive() ignores it, so the two paths disagree and dispatch the inner gro_complete handler at an unvalidated offset (nhoff + gh_len), reading past the skb head. Confirmed via a KASAN slab-out-of-bounds report in ipv6_gro_complete; there is no public exploit identified at time of analysis and EPSS is low (0.16%).

Out-of-bounds access in the Linux kernel's GENEVE tunnel GRO (Generic Receive Offload) path affects systems using GENEVE overlay networking, where geneve_gro_complete() can re-derive an inner dispatch offset that disagrees with what geneve_gro_receive() recorded - either through a race with geneve_quiesce()/geneve_unquiesce() flipping gs->gro_hint, or through re-read option bytes differing from the parsed ones - and complete GRO past the validated inner network header. Successful triggering leads to memory-safety corruption in softirq packet processing, most plausibly a kernel crash (denial of service). This is fixed upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Out-of-bounds kernel heap write in the Linux kernel Xen PV Calls (pvcalls) frontend allows a malicious or compromised Xen backend domain to corrupt guest kernel memory by supplying a ring response with req_id set beyond PVCALLS_NR_RSP_PER_RING, potentially enabling privilege escalation or denial of service within the affected guest. A compounding int vs. u32 type confusion means req_id=0xffffffff is cast to -1, bypasses a signed comparison, and indexes bedata->rsp[-1] - making the missing bounds check exploitable via two independent paths. Fixes are confirmed in Linux 7.1.5 and 7.2-rc2; no public exploit exists at time of analysis and EPSS is 0.20% at the 10th percentile.

Integer overflow in the Linux kernel minix filesystem driver allows a local low-privileged user to crash the kernel by mounting a crafted Minix v3 image. The minix_blocks_needed() helper uses DIV_ROUND_UP() in unsigned int arithmetic; an image with s_ninodes or s_zones set near UINT_MAX causes the addition to wrap to zero, tricking minix_check_superblock() into accepting an invalid zero bitmap-block count, after which minix_fill_super() dereferences the unallocated s_imap[0] or s_zmap[0] pointer and panics the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (11th percentile), reflecting very low exploitation probability consistent with a legacy, rarely-used filesystem driver.

Integer wraparound in the Linux kernel HID-BPF subsystem's hid_bpf_get_data() helper allows a local low-privileged user to bypass a buffer range check and obtain an out-of-bounds pointer into kernel memory, potentially enabling privilege escalation or memory corruption. Affected kernels span from Linux 6.3 (commit 658ee5a64fcfbbf) through versions prior to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3, where upstream fix commits have landed. No public exploit has been identified at time of analysis and EPSS remains at 0.21%, but the CVSS 7.8 local-privilege score reflects a high-impact, low-complexity code path once local access is established.

Undefined-behavior shift in the Linux kernel's netfilter xt_u32 match module allows a local attacker with CAP_NET_ADMIN to supply malformed packet-filter rules containing shift counts of 32 or more, triggering out-of-bounds shift operations on 32-bit values in u32_match_it() during live packet evaluation. The vulnerability affects all kernel versions from 2.6.23 (when xt_u32 was introduced) through the stable-branch fix commits, with patched versions confirmed across six stable trees. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at the 13th percentile, reflecting currently limited exploitation probability.

Heap out-of-bounds write in the Linux kernel's act_pedit TC offload path allows a local attacker holding CAP_NET_ADMIN to corrupt kernel slab memory with attacker-controlled content, potentially leading to privilege escalation or denial of service. The flaw affects Linux kernel versions from approximately 4.11 through the stable branches patched in 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. Trend Micro ZDI researchers confirmed exploitability via KASAN trace using a targeted POC; no public exploit has been released and this CVE is not listed in the CISA KEV catalog.

Integer overflow in the Linux kernel SMB client's smb2_ioctl_query_info() function enables a malicious SMB server to bypass bounds checking during PASSTHRU_FSCTL response processing, leading to an out-of-bounds kernel memory read disclosed to userspace. Affected systems are Linux kernels across multiple stable branches where OutputOffset and qi.input_buffer_length are summed without overflow protection, allowing a server-controlled 32-bit wrap to defeat the bounds check and cause copy_to_user() to read beyond the response buffer. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects low current exploitation probability, but the network-reachable attack surface and high confidentiality impact (CVSS 8.1) make patching a near-term priority for any Linux host using SMB client connectivity.

Integer overflow in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control handler allows a local, low-privileged attacker on 32-bit platforms to bypass buffer size validation and trigger out-of-bounds memory access in `snd_sof_update_control`. The flaw exists because `sof_ipc3_control_update()` performs unguarded arithmetic on firmware-supplied `cdata->num_elems`, which wraps on 32-bit integer arithmetic and causes the subsequent header size check to pass with mismatched values. No public exploit code exists and no CISA KEV listing is present; EPSS probability is 0.23% at the 14th percentile, with vendor patches available across multiple stable kernel branches.

Integer overflow in the Linux kernel's QRTR (Qualcomm IPC Router) subsystem on 32-bit platforms allows an out-of-bounds kernel heap write via a crafted incoming packet. On 32-bit builds where size_t is four bytes, passing size >= 0xfffffffd to ALIGN(size, 4) wraps the result to zero, bypassing the packet validation check in qrtr_endpoint_post() and allowing skb_put_data() to write attacker-controlled data far beyond the allocated socket buffer. This is the 32-bit residual of commit ad9d24c9429e2, which fixed only the 64-bit case; 64-bit kernels are structurally unaffected. No public exploit is identified at time of analysis, and EPSS at 0.22% reflects low exploitation probability.

Out-of-bounds read in the Linux kernel ATM networking subsystem (`net/atm`) allows local low-privileged users to disclose kernel memory or crash the system by supplying an out-of-range `traffic_class` value via the `SO_ATMQOS` socket option. The flaw persists because `check_tp()` fails to reject traffic class values above `ATM_ANYCLASS`, leaving the invalid value in `vcc->qos` where it is later used as an unguarded array index in `pvc_info()` when `/proc/net/atm/pvc` is read. EPSS sits at 0.22% (13th percentile) with no CISA KEV listing and no public exploit identified, making real-world exploitation risk considerably lower than the CVSS 7.1 score implies, particularly given that ATM networking is a legacy subsystem absent from most modern deployments.

Remote code execution in Microsoft Edge (Chromium-based) is enabled by a heap-based buffer overflow (CWE-122) that network-accessible, unauthenticated attackers can trigger when a victim interacts with attacker-controlled content. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) reflects high confidentiality and integrity impact with low attack complexity, requiring only that the user visit or open a crafted resource. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unprivileged user-mode threads in Zephyr RTOS can crash the kernel or disclose arbitrary kernel memory by exploiting a missing validation step in the logging subsystem's syscall verifier, directly violating the user/kernel isolation boundary that CONFIG_USERSPACE is designed to enforce. Any Zephyr build compiled with CONFIG_USERSPACE=y is affected, as the __syscall-decorated z_log_msg_static_create() function accepted fully attacker-controlled pointer and length arguments without any K_SYSCALL_* bounds checking in its verifier function z_vrfy_z_log_msg_static_create(). No public exploit identified at time of analysis; an upstream fix has been committed to zephyrproject-rtos/zephyr and documented in GitHub Security Advisory GHSA-h7rf-g9mg-g23f.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required.

Stack-based buffer overflow in TOTOLINK A800R router firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to achieve arbitrary code execution by sending an oversized Comment argument to the setStaticDhcpConfig function via the CGI web interface. Exploit code has been publicly disclosed (CVSS 4.0 E:P), substantially lowering the exploitation barrier. No CISA KEV listing was identified, but the combination of public PoC, network-accessible attack surface, and high C/I/A impact makes this a credible threat for any deployment where the router management interface is reachable by untrusted users.

Stack-based buffer overflow in the TOTOLINK A800R router (firmware 4.1.2cu.5137_B20200730) enables remote code execution via the IPv6 configuration CGI endpoint. The `setRadvdCfg` function in `ipv6.so` fails to validate the length of the `radvdinterfacename` argument before writing it to a stack buffer, allowing an authenticated attacker to overwrite the return address and redirect execution. A public proof-of-concept has been disclosed, and no vendor patch has been identified at time of analysis.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.

Race condition exploitation in KUNBUS piControl 2.6.2 allows a local authenticated attacker to corrupt kernel memory by issuing concurrent crafted requests through the piControl character device, triggering use-after-free and invalid pointer dereferences in kernel configuration objects. The flaw resides in the configuration and process-image management subsystem of this industrial Revolution Pi (RevPi) controller platform component, with potential impact spanning confidentiality, integrity, and availability per the CVSS 4.0 vector, though denial of service is the explicitly confirmed outcome. No public exploit code and no active exploitation have been identified at time of analysis; this was responsibly disclosed by Nozomi Networks Labs.

Kernel memory corruption in KUNBUS piControl version 2.6.2 allows a local authenticated attacker with device configuration access to write beyond process-image buffer boundaries, corrupting adjacent kernel memory and causing denial of service. The vulnerability resides in process-image management functionality and is triggered by supplying crafted device configuration data and crafted input through the piControl character device. No public exploit code or active exploitation has been confirmed at time of analysis, though the industrial OT context and kernel-level impact elevate operational priority for RevPi deployments.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attackers to corrupt stack memory and potentially execute arbitrary code by sending a crafted value in the IPMacBindRule argument to the /goform/addIpMacBind endpoint. The vulnerable function ipMacBindListStore fails to validate input length before writing to a fixed-size stack buffer (CWE-121). Publicly available exploit code exists, raising active risk for any deployment where the web management interface is reachable and low-privilege credentials are obtainable.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attackers to execute arbitrary code by submitting a malformed qosIndex parameter to the /goform/delQos endpoint. The vulnerable formQOSRuleDel function fails to validate input length before writing to a fixed-size stack buffer in the QoS Rule Deletion component. A public proof-of-concept exploit is confirmed available on GitHub, significantly elevating real-world risk for any deployment with the management interface reachable by untrusted parties.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers to execute arbitrary code by supplying an oversized qosListConnecttedNum argument to the lstAdd function via the /goform/editQos endpoint. The vulnerability affects the QoS Edit component of this SOHO router and carries high impact across confidentiality, integrity, and availability - consistent with full device takeover. A publicly available proof-of-concept exploit exists on GitHub, meaningfully elevating operational urgency despite the absence of CISA KEV confirmation.

Stack/heap buffer overflow in the Tenda AC12 router (firmware 15.03.06.23_multi_TD01) allows remote low-privileged attackers to potentially execute arbitrary code by sending a crafted HTTP request to the `/goform/SetSysAutoRebbotCfg` endpoint with an oversized `rebootTime` argument. All three impact pillars - confidentiality, integrity, and availability - are rated high for the vulnerable system per the CVSS 4.0 vector. Publicly available exploit code exists per a GitHub PoC disclosure; no confirmed CISA KEV listing was identified at time of analysis.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 exposes authenticated remote attackers to potential arbitrary code execution by sending an oversized `Comment` argument to the `setMacFilterRules` CGI function. A public proof-of-concept has been disclosed on GitHub (corroborated by the CVSS 4.0 E:P modifier), elevating real-world risk beyond the base score of 7.4. No vendor advisory or patched firmware version has been identified at time of analysis, leaving affected devices without an official remediation path.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis.

Buffer overflow in the Tenda G0 router's httpd web management interface allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by submitting oversized input to the setPortMapping function via the /goform/module endpoint. All firmware builds up to version 20260625 are confirmed affected per ENISA EUVD-2026-58585. A public proof-of-concept exploit has been released on GitHub, substantially lowering the skill threshold for exploitation; no CISA KEV listing confirming active mass exploitation was present at time of analysis.

Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows low-privileged remote attackers to corrupt stack memory by sending a crafted `staticRouteNet` argument to the `/goform/module` endpoint, potentially enabling arbitrary code execution on the device. All firmware versions up to and including build 20260625 are confirmed affected. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk; however, no CISA KEV listing has been identified, indicating active exploitation is not yet confirmed at scale.

Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows network-adjacent or remote authenticated attackers to corrupt stack memory by supplying an oversized value to the portMirrorMirroredPorts argument of the formSetPortMirror function at the /goform/module endpoint. All G0 firmware builds through 20260625 are confirmed affected per EUVD-2026-58575 and NVD CPE data. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation; no CISA KEV listing has been identified, so active widespread exploitation is not confirmed at time of analysis.

Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interface to remote code execution via a crafted guest WiFi configuration request. The vulnerable function `set_wl_guest_iplist` at the `/goform/WifiGuestSet` endpoint fails to validate the length of the `shareSpeed` argument before copying it onto a fixed-size stack buffer, enabling an attacker with low-privilege router access to overwrite the return address and seize control of the `httpd` process - which typically runs as root on embedded router firmware. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the barrier to exploitation; no CISA KEV listing is present, so confirmed active exploitation in the wild is not established at time of analysis.

Stack-based buffer overflow in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01 allows a remotely authenticated attacker to overflow a fixed-size stack buffer in the `set_device_name` function by sending an excessively long `devName` value to the `/goform/SetOnlineDevName` endpoint of the httpd web management interface. Successful exploitation could yield arbitrary code execution on the device with the privileges of the httpd process. A public proof-of-concept exploit has been published on GitHub, elevating real-world risk despite the absence of a CISA KEV listing.

Remote unauthenticated denial of service in Cesanta Mongoose builds prior to 7.23 that are compiled with the library's built-in TLS stack: an attacker who can reach the TLS listener and send a crafted short TLS record can trigger an out-of-bounds read that crashes the process (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability only). No authentication or user interaction is required, and the only meaningful precondition is that the deployment uses Mongoose's built-in TLS implementation rather than the OpenSSL or mbedTLS backend. No public exploit has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); a vendor patch is available and the upstream fix lands in release 7.23.

Malformed X.509 certificate parsing in Cesanta Mongoose's built-in TLS stack (all versions before 7.23) can push the DER parser past the end of its input buffer, crashing or destabilizing the affected service. The flaw is reachable by unauthenticated remote attackers (PR:N) who can deliver a crafted certificate to a Mongoose TLS endpoint, and the assessed impact is availability only (C:N/I:N/A:H); no public exploit identified at time of analysis. Exposure is bounded to builds compiled with Mongoose's built-in TLS backend rather than the mbedTLS or OpenSSL backends.

Heap-based buffer overflow in Cesanta Mongoose before 7.23, in the built-in TCP/IP stack's PPP link-layer option parser for IPv6CP, allows the remote peer on a PPP link to corrupt heap memory when it sends an IPv6CP option whose declared length is shorter than the structure the parser expects. The bug is reachable only when Mongoose's bare-metal TCP/IP driver (mg_tcpip) is compiled in with the PPP link-layer enabled, so typical deployments that use Mongoose as an HTTP/web server library on top of the operating system's own TCP/IP stack are not exposed. The vendor has released version 7.23 containing the fix; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the adjacent-link attack surface and lack of authentication (CVSS PR:N) keep the issue high priority for embedded/cellular and modem-gateway users.