Buffer Overflow

Privilege escalation via heap-based buffer overflow in Windows Display Enhancement Service allows a local low-privileged attacker to gain SYSTEM-level control across a broad swath of Windows desktop and server releases. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes patching a meaningful operational priority.

Remote code memory disclosure in the Windows Remote Desktop Client (CWE-125) exposes sensitive process memory to an attacker operating a malicious or compromised RDP server. All major Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025 are affected, representing essentially the entire active Windows install base running an RDP client. Microsoft has released patches via the MSRC advisory; no public exploit code or CISA KEV listing exists at time of analysis, and SSVC rates exploitation status as none.

Remote code execution in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on a connecting client system by exploiting a heap-based buffer overflow triggered when the client processes a maliciously crafted RDP server response. All major Windows 10, Windows 11, and Windows Server editions from 2012 through 2025 are affected across x86, x64, and ARM64 architectures. No public exploit has been identified at time of analysis and CISA SSVC confirms no current exploitation; a vendor patch is available through the Microsoft Security Response Center.

Privilege escalation via heap-based buffer overflow in the Windows Storage subsystem affects a wide range of Windows 11 and Windows Server 2022/2025 builds. An attacker already holding a standard (low-privileged) local user account can exploit the memory corruption flaw to gain full SYSTEM-level control - no user interaction or elevated starting privileges required beyond basic logon. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this a credible post-access escalation primitive.

Heap-based buffer overflow in the Windows Sensor Data Service enables a locally authenticated, low-privileged attacker to fully compromise a target Windows system by escalating to SYSTEM-level privileges. Affecting Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across dozens of specific build ranges, exploitation requires no user interaction and low complexity once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, but SSVC classifies technical impact as total; Microsoft has released patches across all affected product lines.

Heap-based buffer overflow in the Windows Telephony Service (TAPISRV) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases spanning Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability carries a CVSS 7.8 score with low attack complexity, meaning exploitation is straightforward once local access is established, making it an effective second-stage tool in a broader attack chain. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected build lines.

Remote code execution in the Windows Remote Desktop Client exposes client machines across Windows 10, 11, and multiple Windows Server generations when connecting to an attacker-controlled RDP server. The heap-based buffer overflow (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) allows a remote unauthenticated attacker to gain full control over a vulnerable client machine, though the AC:H rating reflects non-trivial exploitation preconditions. Microsoft has released patches across all affected product lines; no active exploitation is confirmed per SSVC and the absence of a CISA KEV listing, with EPSS at 0.64% (47th percentile) indicating low near-term exploitation probability.

Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.

Heap-based buffer overflow in Microsoft Office Word enables local code execution with full user-level impact when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 (both Windows and Mac), and Office 365 for Mac. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.8 score and complete C/I/A impact triad reflect the severity of arbitrary code execution achievable through a standard phishing or malicious file delivery scenario.

Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.

Heap-based buffer overflow in Windows Imaging Component (WIC), Microsoft's built-in image processing framework, enables local code execution across virtually every supported Windows client and server release from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. The flaw is triggered when a user opens or previews a specially crafted image file, requiring no prior authentication or elevated privileges, and yields full confidentiality, integrity, and availability impact on the compromised system. Vendor-released patches are available via Microsoft's July 2026 update cycle; no public exploit code or active exploitation has been identified at time of analysis.

Heap-based buffer overflow in the Windows LUAFV (Layered User Access Filter Volume) kernel driver enables a locally authenticated, low-privileged user to escalate to full SYSTEM-level privileges across a wide range of Windows desktop and server releases. Microsoft has released patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with exact fix builds published via MSRC and ENISA EUVD-2026-56287. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H constraint limits opportunistic exploitation rather than eliminating risk from determined actors who already hold a foothold.

Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.

Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.

Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.

Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from improper buffer restrictions (CWE-119) in the Ring 2 device driver layer, exploitable by an adjacent network attacker without authentication or user interaction. An attacker within Wi-Fi range or on the same network segment can trigger a driver-level crash by sending crafted wireless input, resulting in high availability impact on the target system and low availability impact on subsequent systems, with no confidentiality or integrity consequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.

Out-of-bounds read in the kernel-mode (Ring 0) component of Intel PROSet/Wireless WiFi Software for Windows enables a denial-of-service condition against affected Windows hosts. An unauthenticated attacker with adjacent network access and the ability to satisfy specific attack requirements can trigger a kernel-level crash, resulting in high availability impact to both the vulnerable system and any subsequent system processes. No public exploit code has been identified at time of analysis, and this CVE has not been listed in the CISA Known Exploited Vulnerabilities catalog.

Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.

Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.

Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.

Heap buffer overflow in Vim's spell file parser prior to version 9.2.0846 enables arbitrary code execution when a user opens a maliciously crafted spell file. The flaw lies in set_sofo() reusing the sl_sal_first[] array without resetting values written by set_sal_first(), so a spell file ordering an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-controlled out-of-bounds heap writes (CWE-122). No public exploit has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; a vendor-released patch exists at version 9.2.0846.

Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence.

Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when processing maliciously crafted NTFS images. Specifically affects deployments using the dead disk forensics workflow where Velociraptor ingests untrusted NTFS image files rather than live filesystems. An attacker who can supply a corrupted NTFS volume to a Velociraptor analyst can crash the tool, disrupting forensic investigations. No public exploit identified at time of analysis; patch available in version 0.77.2 and later.

Out-of-bounds read in Siemens Parasolid V38.0 and V38.1 allows code execution when a user opens a specially crafted X_T geometry file. The flaw (CWE-125) resides in the X_T file parser and can result in arbitrary code executing within the context of the host process - typically a CAD or PLM application embedding the Parasolid kernel. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 7.3 reflects the local attack vector and passive user interaction requirement that constrain opportunistic exploitation.

Out-of-bounds read during BMP file parsing in Siemens Simcenter Femap (all versions prior to V2606.0001) enables code execution within the context of the running process. An attacker must deliver a specially crafted BMP file and induce a local user to open it with the application. No public exploit or active exploitation has been identified at time of analysis, but the high CIA impact scores in the CVSS 4.0 vector confirm that successful exploitation achieves full process compromise.

Out-of-bounds read in Siemens Simcenter Femap's BMP file parser exposes all versions prior to V2606.0001 to code execution in the context of the running process. The flaw is triggered when a user opens a specially crafted BMP file, making it a classic file-format attack against a CAE/FEA desktop application. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality/integrity/availability impact and the availability of a vendor-confirmed patch make prompt upgrading advisable.

Stack-based code execution in Simcenter Nastran allows an attacker who can supply maliciously crafted string arguments to an affected application binary to overflow a stack buffer and execute arbitrary code within the running process context. All versions of Siemens' finite-element analysis solver prior to V2606 are affected, as confirmed by Siemens ProductCERT advisory SSA-069220. No public exploit code has been identified and this vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Out-of-bounds read code execution in Siemens Solid Edge SE2025 and SE2026 allows an attacker to execute arbitrary code in the context of the current user process by convincing a target to open a specially crafted PAR (part file) document. The flaw resides in the application's PAR file parser, where insufficient bounds checking on read operations enables memory corruption leading to code execution. No public exploit code and no CISA KEV listing are present at time of analysis; patches are available for both affected release trains.

Out-of-bounds read in Siemens Solid Edge's PAR file parser enables code execution within the running process when a victim opens a specially crafted part file. Both active product branches are affected: SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7. No public exploit code or CISA KEV listing exists at time of analysis, but the vendor-confirmed code-execution primitive elevates this beyond a typical information-disclosure finding tagged under CWE-125.

Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 allows code execution within the application process when a user opens a specially crafted DFT file. The vulnerability resides in the DFT file parser and can deliver full confidentiality, integrity, and availability impact on the vulnerable system if a victim is induced to open a malicious file. No public exploit identified at time of analysis, and the product is not listed in CISA KEV; however, Siemens has released patched versions and published advisory SSA-621657.

Out-of-bounds read in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application process when a victim opens a specially crafted DFT (Draft) drawing file. Siemens confirmed and patched the vulnerability via Product CERT advisory SSA-621657, with fixes delivered in SE2025 V225.0 Update 15 and SE2026 V226.0 Update 7. No public exploit code or active exploitation has been identified at time of analysis, but the file-parsing attack vector is consistent with targeted document-delivery threats directed at engineering and manufacturing organizations.

Heap-based out-of-bounds read and write in FreeRDP before 3.30.0 can be triggered by a malicious peer during CredSSP/NLA Kerberos authentication, allowing information disclosure, heap memory corruption, or denial of service. The flaw exists in kerberos_DecryptMessage() where the peer-supplied 16-bit EC field of a GSS Wrap token is used directly in pointer arithmetic without bounds validation, enabling any RDP peer - rogue server or malicious client - to shift decrypt pointers up to 65535 bytes past the end of a ~60-byte token buffer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Unauthenticated remote memory exhaustion in Undertow's WebSocket subsystem enables denial of service against any deployed application exposing a Jakarta @ServerEndpoint with an @OnMessage handler. An attacker needs only a standard WebSocket handshake - no credentials, no special tooling - to trigger unbounded Out of Memory conditions on the server. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the zero-prerequisite attack vector (CVSS AV:N/AC:L/PR:N/UI:N) makes exploitation trivially automatable against any reachable Undertow instance.

Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.

Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.

Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-controlled data before a destination buffer in S-EL1 memory via RSA NOPAD encrypt and decrypt operations. The flaw exists in both the mbedTLS software cryptographic backend and the NXP SE050 hardware driver: when the caller supplies an input length exceeding the RSA modulus size, an unsigned integer underflow in the size subtraction produces a huge value, causing a subsequent memcpy to write well before the intended destination buffer in the secure-world heap. No public exploit has been identified at time of analysis; the upstream fix is available at commit 7b8b494 in the OP-TEE GitHub repository.

Stack-out-of-bounds read in the Linux kernel's XFRM/IPsec subsystem allows a local user with network policy configuration privileges to read out-of-bounds kernel stack memory and potentially crash the system by crafting an outbound XFRM policy using an optional IPTFS-mode template. The flaw is an incomplete fix: commit 3d776e31c841 blocked optional tunnel and BEET templates in outbound policies to prevent this exact class of bug, but the later-added IPTFS mode was never covered by that restriction. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.15%, and a functional reproducer is embedded in the upstream fix commit, lowering the barrier for any local attacker who discovers the configuration.

Slab-out-of-bounds read in the Linux kernel's wifi cfg80211 subsystem exposes systems with WiFi interfaces to kernel crash or minor memory disclosure when parsing crafted 802.11 frames from a rogue access point. The flaw, located in cfg80211_is_element_inherited() within net/wireless/scan.c, is triggered during Multi-Link Element (MLE) per-STA profile parsing when a zero-length WLAN_EID_EXTENSION element is present in a (re)association response or non-transmitted BSS profile - causing the parser to read one byte past the end of the element buffer. No public exploit or KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) reflects low current exploitation probability, though the adjacent-network attack vector and zero-privilege requirement keep real-world risk elevated for WiFi-attached Linux endpoints.

Client-side data-integrity failure and bounded out-of-bounds read in the Linux kernel SMB/CIFS client (smb3_simple_fallocate_range) allows a malicious or compromised SMB server to cause the client to skip zero-filling holes during fallocate, so a range the client reports as successfully allocated is left as an un-zeroed hole and a later write can fail with ENOSPC; a malformed server-supplied range length can additionally trigger an out-of-bounds read of the zero buffer. Affected systems are Linux hosts that mount SMB3 shares and call fallocate on them; the fix is merged upstream and backported to stable trees. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.17% (6th percentile).

Stack-based buffer overflow in the Linux kernel's SCTP subsystem corrupts adjacent kernel memory when SCTP authentication is configured with four HMAC identifiers, enabling a remote unauthenticated attacker to achieve high-impact memory corruption via a crafted SCTP packet exchange. Affected kernels span from 2.6.24 through current stable branches, with patches backported to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.17% reflects the high exploitation complexity imposed by the required SCTP authentication configuration.

Out-of-bounds kernel memory read in the at76c50x-usb WiFi driver affects Linux systems equipped with Atmel AT76C50x USB wireless adapters. When the kernel scans for networks, a truncated beacon or probe response frame between 24 and 35 bytes triggers an integer underflow in at76_guess_freq(): subtracting the fixed management-body offset (el_off = 36) from a shorter frame length wraps the unsigned value to near UINT_MAX, which is then passed to cfg80211_find_elem_match(), causing a walk far beyond the RX socket buffer boundary with consequences ranging from kernel memory disclosure to system crash. With an EPSS of 0.17% (6th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the AV:A/PR:N vector means any adjacent attacker can trigger the condition without authentication during routine scanning.

Out-of-bounds kernel memory read in the Linux kernel ath6kl WiFi driver affects systems using Qualcomm Atheros AR6xxx chipsets from kernel 3.2 onward. The firmware-supplied `num_msg` field (a u8 value, range 0-255) governs a loop in `ath6kl_wmi_tx_complete_event_rx()` without any validation against the actual WMI event buffer length, enabling reads of up to 1020 bytes past the buffer boundary. An adjacent-network attacker with no privileges can potentially exploit this to leak sensitive kernel memory contents or trigger a kernel panic - neither CISA KEV listing nor public exploit code has been identified at time of analysis, and EPSS at 0.18% (7th percentile) corroborates low current exploitation activity.

Out-of-bounds kernel memory read in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros AR600x chipsets to kernel memory disclosure and availability impact via a malicious adjacent-network access point. The ath6kl_wmi_connect_event_rx() function fails to validate firmware-supplied beacon_ie_len, assoc_req_len, and assoc_resp_len fields against the actual WMI event buffer size before parsing 802.11 Information Elements, allowing combined lengths of up to 765 bytes to exceed the buffer boundary and corrupt the wmi->is_wmm_enabled state flag. No public exploit has been identified and the vulnerability is not listed in CISA KEV; EPSS at 0.21% (11th percentile) reflects minimal opportunistic exploitation activity consistent with the niche hardware footprint.

Slab-out-of-bounds read and integer underflow in the Linux kernel mwifiex wifi driver's uAP event handler allow a malicious or malfunctioning Marvell WiFi device (USB/SDIO/PCIe) to leak kernel slab memory or trigger a kernel panic on a host running in AP mode. The firmware-supplied event->len field in EVENT_UAP_STA_ASSOC is never validated before being used to compute assoc_req_ies_len, enabling an attacker who controls device firmware to walk cfg80211_find_ie() past the fixed event_body buffer into adjacent slab objects, or to produce a massive size_t that copies stale kernel bytes into NL80211_CMD_NEW_STATION notifications. No active exploitation has been confirmed (not in CISA KEV) and EPSS places exploitation probability at the 6th percentile, though the CVSS 8.8 base score reflects potential for complete confidentiality and availability compromise against affected configurations.

Heap buffer overflow in the Linux kernel's SCTP authentication subsystem allows a local low-privileged user to corrupt kernel memory by adding more than 16 authentication chunk types to an SCTP endpoint. The capacity mismatch between sctp_auth_ep_add_chunkid()'s limit of SCTP_NUM_CHUNK_TYPES (20 entries) and the destination struct sctp_cookie's SCTP_AUTH_MAX_CHUNKS (16 entries) causes sctp_association_init() to memcpy up to 4 bytes past the auth_chunks buffer boundary. No public exploit has been identified at time of analysis and EPSS sits at the 6th percentile, but the kernel-space memory corruption potential and CVSS score of 7.3 warrant timely patching on any system where untrusted local users have shell access.

Kernel panic via integer overflow in the SCTP stream-reset path allows an unauthenticated remote peer to crash Linux systems running SCTP on interfaces with MTU exceeding 65535 bytes. sctp_process_strreset_inreq() fails to validate that the RESET_OUT_REQUEST constructed in response to a peer's RESET_IN_REQUEST would stay within SCTP_MAX_CHUNK_LEN, causing a __u16 overflow in sctp_make_strreset_req() that produces an undersized socket buffer and a fatal kernel BUG. No public exploit has been identified and EPSS is 0.17% (6th percentile), but the impact is total denial of service on affected hosts.

Buffer overflow in the Linux kernel's mlx5 network driver allows a local low-privileged attacker to crash the kernel or read out-of-bounds kernel memory when querying module EEPROM data via ethtool on systems equipped with Mellanox/NVIDIA ConnectX adapters that advertise the mcia_32dwords capability. The root cause is a struct size mismatch: mlx5_ifc_mcia_reg_bits defines only 12 dwords (48 bytes) of MCIA register storage while the hardware can return up to 32 dwords (128 bytes), causing mlx5_query_mcia() to memcpy beyond the allocated buffer. No public exploit has been identified at time of analysis and EPSS remains low at 0.18%, but the kernel BUG triggered by FORTIFY_SOURCE on patched builds confirms the overflow is reliably reproducible.

Heap buffer overflow in the Linux kernel's Intel Xe GPU DRM driver (drm/xe/guc) corrupts kernel slab memory during device unbind, creating a local privilege escalation path on systems hosting Intel Xe/Arc discrete GPUs with compute-only DSS hardware units. The root cause is a mismatch between the steered register extarray allocation size - derived solely from the geometry DSS mask - and the fill loop, which iterates over the union of geometry and compute DSS masks, writing past the allocated region on affected hardware configurations. Vendor-released patches are available in kernel versions 6.18.44, 7.1.6, and 7.2-rc1; no public exploit code or CISA KEV listing exists at time of analysis.

Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.

Out-of-bounds write and use-after-free in the Intel Xe GPU DRM driver (drm/xe/pt) allows a local low-privileged attacker to corrupt kernel heap memory and crash or potentially escalate privileges on systems running affected Linux kernel versions. The flaw exists in xe_pt_update_ops_init(), which fails to reset current_op, needs_svm_lock, and needs_invalidation before each pass, causing unbounded counter growth across drm_exec retry loops triggered by lock contention or OOM eviction. No public exploit code exists and EPSS is extremely low (0.18%), though the memory corruption primitive is structurally serious.

Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user on systems with multi-die AMD GPUs to trigger an undersized CWSR save-area allocation that AMD firmware subsequently overruns, enabling kernel heap corruption with full confidentiality, integrity, and availability impact. Affected stable branches include all kernel versions before 6.12.101, 6.18.42, and 7.1.6, with patches released across all trees. No public exploit code or active exploitation has been identified; EPSS at 0.18% (7th percentile) reflects very low near-term exploitation probability.

Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the `data->streams[]` array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.

Buffer overflow in the Linux kernel's Amlogic C3 ISP driver allows a local low-privileged attacker to trigger out-of-bounds memory access via crafted camera parameter configurations, with potential for kernel memory disclosure and system crash. Affected functions c3_isp_params_awb_wt() and c3_isp_params_ae_wt() in drivers/media/platform/amlogic/c3/isp/c3-isp-params.c fail to validate zones_num against the fixed-size zone_weight array bounds (768 entries for AWB, 255 for AE). Patched upstream in kernel versions 6.18.42, 7.1.6, and 7.2-rc1; EPSS is 0.21% with no public exploit or CISA KEV listing, indicating low active exploitation pressure.

Out-of-bounds read in the Linux kernel Cedrus V4L2 stateless H.264 video decoder driver exposes kernel memory and can cause system instability when a local low-privileged user submits crafted H.264 decode requests with invalid DPB reference indices. The flaw exists in `_cedrus_write_ref_list()`, which uses userspace-supplied ref_pic_list0/ref_pic_list1 index values to index into the fixed `decode->dpb[]` array without bounds validation, accepting out-of-range sentinel values that are technically legal in the stateless H.264 API but were never guarded at the driver use site. No public exploit identified at time of analysis; EPSS of 0.20% at the 10th percentile reflects the niche hardware platform and local-only access requirement.

Out-of-bounds memory access in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver enables a local low-privileged attacker to corrupt kernel memory or freeze the system, with CVSS-assessed high impact across confidentiality, integrity, and availability. The flaw stems from missing minimum-value validation on the hardware downscaling factor - the ISI supports up to 16x downscaling, but no floor check is enforced before writing values to hardware registers, resulting in invalid hardware state and a kernel-level process freeze that survives Ctrl+C. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting the hardware-specific nature of the attack surface.

Out-of-bounds kernel heap access in the Linux kernel's ath6kl WiFi driver allows an adjacent unauthenticated attacker to trigger zero-size or integer-overflowed kernel allocations by transmitting a malformed ADDBA (Block Acknowledgment) WiFi management frame with an out-of-range window size. Affected are Linux kernel versions from the introduction of the vulnerable code in commit bdcd81707973, with patches confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc5). No public exploit code has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.

Out-of-bounds read in the Linux kernel wilc1000 WiFi driver exposes devices with Microchip ATWILC1000 chipsets to memory disclosure and potential denial of service when a rogue access point sends a malformed association response shorter than 6 bytes. The driver's wilc_parse_assoc_resp_info() function performs an integer underflow when computing IE length without first validating the frame meets the minimum fixed-header size, causing kmemdup() to attempt copying up to 65534 bytes of out-of-bounds kernel memory. No public exploit code is identified at time of analysis, and EPSS probability sits at 0.21%, though the adjacent-network vector and no-authentication requirement make this exploitable by any attacker within WiFi range acting as a rogue AP.

Pre-authentication out-of-bounds kernel memory read in the Linux kernel's CephFS client (ceph_handle_caps) allows a malicious or compromised Ceph Metadata Server (MDS) to read beyond the message front buffer. By sending a CEPH_CAP_OP_IMPORT caps message with hdr.version set to 1 and an oversized snap_trace_len (e.g. 0xFFFFFFFF), the server bypasses all version-gated decoders and drives ceph_update_snap_trace() to decode a fake snap realm past the buffer, cascading into further OOB reads via attacker-controlled num_snaps/num_prior_parent_snaps counts. The flaw is present in every kernel since ceph_handle_caps() was introduced; it carries a CVSS 9.8 but currently has no public exploit and a low EPSS score (0.22%), and it is not on CISA KEV.

Stack out-of-bounds write in the Linux kernel's libceph client (net/ceph/osdmap.c) allows a malicious or compromised Ceph monitor to corrupt kernel stack memory on any client that mounts cephfs or maps RBD storage. The __decode_pg_temp() and __decode_pg_upmap_items() helpers accepted an attacker-controlled OSD-set length without bounding it to CEPH_PG_MAX_SIZE (32), so an oversized pg_temp/pg_upmap entry in an OSDMap is copied into the fixed-size on-stack ceph_osds.osds[32] array, triggering a KASAN-confirmed stack overflow that can panic the kernel and potentially enable privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not on the CISA KEV list.

Out-of-bounds memory read in the Linux kernel's in-kernel Ceph client (libceph) allows a malicious or compromised Ceph monitor/OSD to crash or potentially leak kernel memory from any host mounting CephFS or RBD. The flaw lives in decode_new_up_state_weight() when parsing a CEPH_MSG_OSD_MAP message: an attacker-controlled length field feeds a multiplication used for a bounds check, and the overflow makes the check pass so the decoder reads past the buffer. EPSS is low (0.20%, 10th percentile) with no public exploit identified at time of analysis; the CVSS 9.8 appears inflated for what is fundamentally an OOB read reachable only from the Ceph messaging path.

Use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver allows a local attacker to trigger kernel memory corruption or a system crash through a race condition introduced during AMT device removal. The flaw arises because amt_dev_stop() uses cancel_delayed_work_sync() to cancel req_wq and discovery_wq, but event_wq can re-schedule req_wq after that cancellation completes yet before the netdev is freed - leaving delayed work items that dereference the already-released amt_dev structure. Upstream patches are confirmed available in stable kernel releases 6.12.101, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.

Out-of-bounds kernel heap write in the Linux kernel iomap subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw resides in ifs_set_range_dirty() and ifs_set_range_uptodate(), where an unsigned integer underflow on a zero-length range argument produces a near-SIZE_MAX block count, causing bitmap_set() to write arbitrarily far beyond the ifs->state allocation. The reachable code path through __iomap_write_end() requires no special configuration and affects all iomap-backed filesystems (ext4, XFS, etc.). EPSS is low at 0.18% (7th percentile), no KEV listing, and no public exploit has been identified; however, the C:H/I:H/A:H CVSS impact profile reflects the severity of uncontrolled kernel heap corruption.

Race condition in the Linux kernel's SLIP (Serial Line Internet Protocol) driver allows a local attacker with low privileges to trigger an out-of-bounds write or use-after-free in kernel memory, potentially enabling privilege escalation. The `slip_receive_buf()` callback reads and writes the receive buffer `rbuff` without holding `sl->lock`, while `sl_realloc_bufs()` replaces that buffer under the lock during MTU changes - creating a classic TOCTOU window where an MTU shrink can cause writes beyond the new smaller buffer or into a freed allocation. No confirmed active exploitation exists (not in CISA KEV) and the EPSS score of 0.18% places this in the 7th percentile, though kernel memory corruption of this class carries inherent privilege escalation potential.

Kernel heap out-of-bounds write in the Linux MCTP serial driver (drivers/net/mctp/mctp-serial.c) lets an attacker on the serial/tty channel corrupt memory adjacent to the netdev private area on any host where an mctpserialN interface has been configured. The receive state machine accepts a zero-length frame, sets rxlen=0, and enters STATE_DATA, so the 'rxpos == rxlen' terminator never fires and every subsequent inbound byte becomes a 1-byte attacker-controlled OOB heap write past the fixed 74-byte rxbuf, continuing effectively unbounded until a frame or escape byte resets the parser. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the flaw was reproduced with KASAN/UBSAN and carries high memory-corruption impact.

Integer overflow in the Linux kernel's drm/amdgpu VCE (Video Codec Engine) driver enables local low-privileged users on systems with AMD GPU hardware to corrupt GPU memory. Crafted VCE command streams containing extreme image dimensions such as 65536×65536 pixels trigger a 32-bit arithmetic overflow, collapsing the computed buffer size to zero, which bypasses bounds validation and permits the GPU firmware to perform out-of-bounds memory access with scope-change implications rated CVSS 8.8. No public exploit code has been identified and EPSS stands at 0.18% (7th percentile), indicating low real-world exploitation activity; the high score reflects the full-impact scope change to GPU firmware memory rather than immediate internet-facing risk.

Out-of-bounds heap read in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated network attacker to disclose approximately 1 KB of kernel heap memory at an attacker-controlled offset and potentially crash the ksmbd service or host kernel. The flaw resides in set_ntacl_dacl(), which copies ACEs from a previously stored attacker-controlled security descriptor without validating sid.num_subauth against the fixed SID_MAX_SUB_AUTHORITIES (15) array bound, enabling a crafted num_subauth value of up to 255 to drive a sub_auth[] array overread. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Kernel memory corruption via out-of-bounds ACE dedup walk in the Linux kernel's ksmbd SMB server subsystem exposes any network-reachable Linux host running ksmbd to high-impact compromise with only low-privilege SMB authentication. When set_ntacl_dacl() terminates ACE copying early due to a size-accounting overflow, set_posix_acl_entries_dacl() continues iterating using the original inflated nt_num_aces count rather than the count of ACEs actually copied, causing the dedup walk to scan into uninitialized buffer tail memory. No public exploit or CISA KEV entry exists at time of analysis, and EPSS remains low at 0.17%, but the patch is available across multiple stable kernel branches and should be applied promptly on any ksmbd-enabled deployment.

Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.

Out-of-bounds read in Redis Cluster Bus PING message parsing affects Redis through version 8.8.1, enabling adjacent unauthenticated attackers to trigger denial of service or extract limited heap memory contents. The root cause is in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size, allowing a crafted gossip-protocol PING packet to drive the parser past the allocated buffer boundary. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed in the CISA KEV catalog.

Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local attackers to execute arbitrary code on affected Samsung Mobile Devices prior to SMR Aug-2026 Release 1. The CVSS 4.0 vector (AV:L/PR:H) confirms exploitation requires established local access with high privileges, limiting the realistic attacker pool to already-compromised or insider-threat scenarios. No public exploit code or CISA KEV listing has been identified at time of analysis.

Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.

Stack-based buffer overflow in UTT HiPER 1200GW firmware (versions up to 2.5.3-170306) enables authenticated remote attackers to corrupt stack memory via the EncryptionMode parameter in the PPTP VPN configuration endpoint, potentially achieving arbitrary code execution on the device. The root cause is unsafe use of strcpy() without bounds validation in the /goform/pptpSrvGlobalConfig handler. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis. No public exploit identified at time of analysis as KEV, but POC lowers the practical exploitation barrier significantly.

Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow stack/heap buffers in the quicksetup.cgi handler by submitting oversized test4, ssid2, and username field values, gaining arbitrary command execution or crashing the device. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow a stack/heap buffer via an overly long netAcc.addlist[].name value sent to the app.cgi interface, achieving arbitrary command execution or a device crash. Reported by VulnCheck with a CVSS 4.0 base of 9.3, the flaw is remotely reachable with no authentication or user interaction; no public exploit code has been identified at time of analysis. A vendor patch is available via D-Link advisory SAP10512.

Out-of-bounds kernel memory reads in the Linux kernel's libceph client (decode_lockers() in net/ceph/cls_lock_client.c) let a malicious or compromised Ceph OSD trigger slab-out-of-bounds reads on any kernel client that issues the lock.get_info RADOS class method, such as during RBD exclusive-lock acquisition. A crafted reply with struct_len=0 causes a bare ceph_decode_32() to read 4 bytes past the validated buffer (feeding a garbage locker count into allocation), and a crafted num_lockers lets a subsequent bare ceph_decode_8() read one byte past the end, giving the OSD direct influence over the returned lock-type discriminator. There is no public exploit identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile); the issue is a memory-safety information-leak/DoS rather than the remote code execution implied by the CNA's 9.8 rating.

Remote denial of service in gopacket through version 1.7.0 can crash any Go application that processes untrusted network packets via DecodingLayerParser or direct DecodeFromBytes calls. Eleven protocol decoders - including TLS, DHCPv4, GTPv1U, IPSec AH, Diameter, and RadioTap - consume attacker-controlled length, count, or offset fields from raw packet headers before verifying them against the actual buffer size, causing an unrecovered Go runtime panic that terminates the processing goroutine or application. No active exploitation has been confirmed (not listed in CISA KEV), but the zero-privilege network attack surface makes this a credible operational risk for Go-based network monitoring, packet capture, and security tooling.

Heap memory disclosure in Imager for Perl (versions 0.45_02 through < 1.034) exposes adjacent heap bytes to any application that processes attacker-supplied JPEG or WEBP images and surfaces EXIF tag values. The root cause is a signed integer underflow in copy_string_tags() that causes strlen() to scan past a zero-count ASCII EXIF entry, copying arbitrary heap contents into the exif_* tag returned to the caller. Publicly available exploit code exists (confirmed by the exifattack.bin fixture in the upstream patch commit), and SSVC rates exploitation as automatable; no CISA KEV listing indicates active mass exploitation has not yet been confirmed.

Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning process by submitting a specially crafted XAR archive to any service fronted by ClamAV, including Cisco Secure Endpoint deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. Cisco's own description hedges the impact beyond DoS - noting 'possibly other expanded impacts as a result of memory corruption' - which, given the CWE-120 root cause, means RCE potential cannot be ruled out pending deeper analysis. No public exploit identified at time of analysis.

Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially corrupt memory on affected Cisco Secure Endpoint deployments. The root cause is a faulty endian conversion in the GPT parser that writes out-of-bounds on the stack (CWE-121), reachable by any attacker who can submit a file for scanning - a condition met by default in mail gateway, web proxy, and endpoint deployments. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means exploitation requires no special access and is trivially automatable.

Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.

Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.

Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.

ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted zip file, resulting in a denial-of-service condition. The flaw stems from an out-of-bounds write (CWE-120) caused by missing boundary validation on zip file content during parsing. No public exploit code or active exploitation has been identified at time of analysis, but the fully remote, zero-authentication CVSS vector (AV:N/AC:L/PR:N/UI:N) means any attacker able to route malicious files through a ClamAV-enabled scanner can reliably trigger the crash.

Heap buffer overflow in stb_truetype.h (nothings stb, up to version 1.26) allows a local attacker to trigger out-of-bounds heap reads by supplying a crafted TTF font file with an inflated endPtsOfContours value and truncated glyph data. Any application statically embedding this library - including game engines and graphics software - that loads attacker-controlled fonts via stbtt_GetGlyphShape() is exposed to potential heap memory disclosure and application crash. No public exploit code has been identified and EPSS at 0.16% (5th percentile) indicates low current exploitation probability; no CISA KEV listing confirms no confirmed active exploitation at time of analysis.

Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupware through Rollout 524, where an unauthenticated attacker can crash the server by sending a specially crafted JSON body to a vulnerable API endpoint - a payload as small as 8 characters beginning with a number triggers an out-of-bounds stack write. The reliably reachable impact is a server crash, but the underlying buffer overflow could escalate to full server compromise if a stack canary is disclosed via a separate vulnerability. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the high CVSS 4.0 base score (9.5) reflects the worst-case RCE potential rather than confirmed code execution.

Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware through Rollout 524, where the Webbox endpoint "//serverClient_close.html" fails to bounds-check multiple form-data parameters. An attacker submitting over-long parameter values triggers an out-of-bounds write (CWE-787) that crashes the server; if a stack canary can be leaked via a separate flaw, the memory corruption could escalate to full server compromise. No public exploit identified at time of analysis, and this CVE is one of 22 reported in the David platform by researchers at InfoGuard/NCSC.ch.

Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration suite affects all releases through Rollout 524. Multiple file-upload handlers fail to bounds-check the supplied filename, so an unauthenticated attacker who sends an upload request with an excessively long filename triggers an out-of-bounds stack write (CWE-787) that reliably crashes the server; where the stack layout is favorable or a stack canary can be leaked via a separate flaw, the same overflow may yield code execution and full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Switzerland's NCSC and detailed by InfoGuard Labs as one of 22 CVEs in David.