Buffer Overflow

Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attackers to crash the server by crafting an HTTP password-change request with a non-INI target file of excessive size. The handler activates solely on the presence of the string "(editini)" in the request path with no further validation, triggering a buffer overflow that terminates the server process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trigger mechanism is fully detailed in the InfoGuard coordinated disclosure.

Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserialization payloads to trigger information disclosure or denial of service. The flaw resides specifically in the tagged integer fast-path deserializer and only manifests when the application processes structs with tagged integer fields. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available in version 1.5.0.

Out-of-bounds write in Autodesk Revit's PDF parser allows arbitrary code execution in the context of the current user process when a maliciously crafted PDF file is opened. The CVSS vector (AV:L/UI:R) confirms exploitation requires local user interaction - a victim must be socially engineered into opening a weaponized PDF. Impact scope covers full confidentiality, integrity, and availability of the running process (C:H/I:H/A:H), consistent with classic memory-corruption RCE chains. No public exploit identified at time of analysis and no CISA KEV listing, but the vendor-confirmed write primitive and RCE potential make this a credible threat for targeted attacks against AEC professionals.

Integer overflow in the llama.cpp LLaMA-Android JNI wrapper (builds b1886 through b7445) allows heap corruption through a crafted n_seq_max parameter, enabling denial of service or arbitrary code execution within Android applications that load untrusted GGUF model files. The flaw exists in the new_1batch() function, which multiplies sizeof(llama_seq_id) by an attacker-controlled value without bounds checking, causing heap allocation to wrap and undersize the buffer. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV; a patched release (b7446) is confirmed available from the upstream ggml-org repository.

Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.

Out-of-bounds read in TimescaleDB's Dictionary compression reverse row iterator (versions through 2.29.1) allows an authenticated database user with DML privileges on a compressed hypertable to exfiltrate backend process memory-including the PostgreSQL shared buffer pool-as ordinary column values that bypass SQL access controls. The vulnerability arises because the forward decompression path validates the Simple8b-encoded dictionary index while the reverse path relied solely on a debug assertion stripped from release builds, leaving the read offset fully attacker-controlled. No public exploit has been identified at time of analysis, and a fix is available upstream via commit 517c13e and PR #10360, though a tagged release version has not been independently confirmed from the available data.

Denial of service in TimescaleDB through 2.29.1 allows authenticated database users holding DML privileges on a compressed hypertable to permanently crash the PostgreSQL backend on any reverse-order scan. The root cause is an unsigned integer underflow in the Gorilla compression reverse row iterator's bucket index computation when decompressing a crafted BitArray with zero elements, triggering a SIGSEGV that recurs on every subsequent reverse scan of the affected chunk until the malicious datum is removed or the database is patched. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the persistence of the malicious datum and low attack complexity make this a high-priority patch for any TimescaleDB deployment exposing DML access to untrusted users.

Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.

Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.

Out-of-bounds write in the Contiki-NG MQTT client (os/net/app-layer/mqtt/mqtt.c) lets a malicious or compromised MQTT broker overflow a 65-byte topic[] buffer and corrupt the adjacent payload_chunk pointer, producing an arbitrary-pointer-write primitive that can escalate to remote code execution on embedded targets lacking memory protection. The flaw stems from parse_publish_vhdr() setting topic_len_received=1 before enforcing the 64-byte topic length limit, so an over-length topic split across TCP segments bypasses the guard on parser re-entry and reaches a memcpy() that trusts the unvalidated 16-bit topic_len. Because the stack has no TLS, the plaintext channel also exposes devices to network man-in-the-middle injection; there is no public exploit identified at time of analysis and it is not in CISA KEV.

Out-of-bounds memory read in Contiki-NG's DNS/mDNS resolver exposes adjacent device memory and can crash the resolver on constrained IoT hardware. The root defect is in `skip_name()` within `os/services/resolv/resolv.c`, which traverses DNS wire-format name labels with no packet-boundary guard; the caller `newdata()` drives iteration using an attacker-controlled `nquestions` field from the DNS header before the transaction ID is validated, enabling an attacker to force the function past the end of `uip_buf`. On mDNS-enabled builds, any local-segment peer can trigger this unauthenticated with a single multicast UDP packet to port 5353 and no outstanding query required; on standard DNS builds, an attacker able to inject a spoofed DNS response during an active query achieves the same effect. No public exploit has been identified at time of analysis.

Out-of-bounds heap read in Contiki-NG's LwM2M TLV parser discloses adjacent heap memory - including cryptographic key material and peer IP addresses - to any unauthenticated network attacker. The flaw in `lwm2m_tlv_read()` (os/services/lwm2m/lwm2m-tlv.c) is triggered by a single crafted CoAP WRITE request whose final TLV supplies exactly one byte, causing the parser to read up to five bytes beyond the buffer boundary. Because LwM2M NoSec mode is the default for constrained IoT devices, no authentication is required, and the upstream fix is confirmed in commit f1673b5766d4d4d514cefb8a0350f43653574997 (PR #3165) but a tagged release has not been independently confirmed. No public exploit or CISA KEV listing has been identified at time of analysis.

Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.

Integer underflow and heap out-of-bounds read in llama.cpp's DRY sampler (builds b3978 through b9058) allows remote unauthenticated attackers to crash the inference server or corrupt token sampling probabilities by sending a single crafted HTTP request. Setting the `dry_allowed_length` parameter to INT32_MIN triggers arithmetic wrap-around in the sampler, causing it to read memory before the allocated heap buffer and producing a SIGSEGV that terminates service for all connected users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially reproducible single-parameter trigger makes this a high-priority issue for any deployment exposing the llama.cpp HTTP API on a network.

Out-of-bounds write in Skia enables sandbox escape in Google Chrome prior to 151.0.7922.109, allowing a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is explicitly a second-stage chaining vulnerability - it does not independently achieve initial code execution but elevates a renderer-level compromise to full OS-level access. No public exploit code or active exploitation has been identified at time of analysis, though the scope-changing nature of this vulnerability makes it a high-value target for chained browser exploit chains.

Remote code execution within the Chrome renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.109 through an out-of-bounds write flaw in the V8 JavaScript engine, triggerable by a crafted HTML page. An unauthenticated remote attacker needs only to lure a victim to a malicious page, achieving code execution confined to the sandboxed renderer process. No public exploit or active exploitation has been identified at time of analysis; however, the CVSS 8.8 score and SSVC total technical impact classification indicate significant potential consequences if exploitation is developed.

Sandbox escape in Google Chrome for Android before 151.0.7922.109 stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/GPU translation layer, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt GPU-process memory and potentially break out of the renderer sandbox. Chromium rates the issue Critical and a vendor patch is available, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. The high CVSS 9.6 reflects the scope-changing sandbox-escape potential rather than confirmed in-the-wild use.

Heap buffer overflow in Google Chrome's Base component (versions prior to 151.0.7922.109) enables potential heap corruption and arbitrary code execution when a user installs a malicious Chrome Extension crafted by an attacker. Exploitation requires social engineering to achieve extension installation, reflected in the AC:H/UI:R CVSS metrics, which meaningfully constrains real-world attack scale compared to the raw 7.5 score. No public exploit identified at time of analysis, and a vendor-released patch is available in 151.0.7922.109.

Out-of-bounds write in the GPU process of Google Chrome on Linux enables sandbox escape when an attacker has already compromised the renderer process. Specifically, an attacker controlling the renderer can deliver a crafted HTML page that triggers CWE-787 memory corruption in the GPU process, which operates with higher OS-level privileges than the sandboxed renderer, allowing full sandbox escape. Versions prior to 151.0.7922.109 on Linux are affected; no public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of no public exploit identified at time of analysis.

Heap buffer overflow in the CrashReporting component of Google Chrome prior to 151.0.7922.109 enables sandbox escape when an attacker has already compromised the renderer process and can deliver a crafted HTML page. The CVSS scope change (S:C) and total technical impact rating confirm full host system compromise is achievable as the second stage of a chained exploit. No public exploit code or active exploitation has been identified at time of analysis, per SSVC exploitation status of 'none' and absence from CISA KEV.

Out-of-bounds read in Autodesk Revit's PDF parsing engine exposes users to crashes, sensitive memory disclosure, and arbitrary code execution within the Revit process when opening a maliciously crafted PDF file. Affected are users of Autodesk Revit across versions covered by advisory ADSK-SA-2026-0011, with the attack requiring only that a target be socially engineered into opening a weaponized PDF - a realistic threat vector for AEC-industry professionals who routinely exchange PDF documents. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the high C/I/A impact profile makes this a meaningful risk for targeted attacks against Revit users.

Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated attackers to crash applications that use the library, resulting in a denial of service. Affected versions span APR-util 1.6.0 through 1.6.3; version 1.6.4 resolves the issue per Apache's advisory on the oss-security mailing list. No public exploit code and no CISA KEV listing have been identified at time of analysis, though SSVC classifies the flaw as automatable with partial technical impact, indicating it could be scripted for broad scanning.

Heap-based buffer overflow in Apache Portable Runtime Utility's memcached client component (versions 1.3.0 through 1.6.3) allows remote unauthenticated attackers to crash affected applications, causing denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms full availability impact with no confidentiality or integrity exposure. No public exploit identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning is feasible once attack primitives are established.

Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a complete denial of service with Changed scope (S:C), potentially cascading disruption to downstream network segments that depend on the affected routing or switching infrastructure. Affecting an extremely broad range of IOS XE release trains from 16.6.x through 26.1.x across hundreds of specific builds, this vulnerability was discovered and self-reported by Cisco's own engineering team during a proactive internal security hardening review - not in response to observed attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, which moderates near-term opportunistic exploitation risk despite the high CVSS score of 8.6.

Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attacker-influenced names longer than 99 characters. The mtar_write_file_header() and mtar_write_dir_header() functions use an unbounded strcpy() into a fixed 100-byte stack buffer, so any calling program that feeds externally-controlled filenames into these APIs is exposed to potential code execution or crash. No public exploit identified at time of analysis, and the library is not listed in CISA KEV, but the missing length check is trivially reachable in code that tars user-supplied paths.

Stack-based buffer overflow in tinyobjloader-c's MTL material file parser allows an attacker who can supply a crafted 3D asset to corrupt the call stack of any application that loads it, potentially achieving arbitrary code execution. All versions of syoyo/tinyobjloader-c are affected because the only bounds guard in tinyobj_parse_and_index_mtl_file() is an assert() call that compiles to a no-op under -DNDEBUG - the standard flag for release builds - leaving memcpy(linebuf, p, p_len) completely unchecked. The identical vulnerable pattern is duplicated in a second function in the same header file, and no vendor-released patch has been identified at time of analysis. No public exploit code and no CISA KEV listing have been identified.

Stack-based buffer overflow in Domoticz's MochadTCP component allows an unauthenticated attacker on the local network to corrupt the Domoticz worker thread's stack and potentially achieve arbitrary code execution. The MochadTCP::MatchLine() handler in hardware/MochadTCP.cpp uses strcpy() to copy up to 1028 bytes of network-received data into a fixed 50-byte stack buffer (tempRFSECbuf) across three separate device-type branches, with no length validation whatsoever. No CISA KEV listing and no public exploit code have been identified at time of analysis; exploitation requires adjacency to the Domoticz host's network and benefits from the complete absence of authentication on port 1099.

Out-of-bounds write in the LINUXTCP demo port of FreeModbus (cwalter-at fork) lets a remote, unauthenticated attacker overflow the static aucTCPBuf receive buffer by sending a single crafted Modbus TCP (MBAP) frame. Because the xMBPortTCPPool() length validation uses a strict '>' instead of '>=' against the 263-byte MB_TCP_BUF_SIZE, a frame declaring Length 264 passes the check and recv() writes 7 bytes past the buffer into the adjacent usTCPBufPos variable, corrupting parser state. CVSS is 9.1 (I:H/A:H); there is no public exploit identified at time of analysis and it is not on CISA KEV.

Heap buffer overflow in dr_libs dr_wav.h enables arbitrary code execution in 32-bit applications that parse untrusted W64 WAV files containing CUE chunk metadata. The flaw stems from a two-stage allocation mismatch: stage-1 capacity estimation silently truncates a 64-bit W64 chunk size to 32-bit size_t, under-allocating heap space, while stage-2 writes using the full attacker-controlled cuePointCount field without validating against that flawed estimate. The sole runtime guard (DRWAV_ASSERT) is compiled out under -DNDEBUG, the default for release builds, making exploitation silent in production. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Arbitrary-address memory write in the nanoMODBUS Modbus client library (through v1.23.0) allows a malicious or compromised Modbus server to corrupt the memory of any client that issues a Read Device Identification request. The flaw stems from an unchecked server-supplied object_id used as an array index, ultimately steering a strncpy() destination pointer with attacker-controlled data - a condition that typically leads to remote code execution or crash on embedded/IoT clients. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the assigned CVSS is 9.8, though exploitation requires the victim client to communicate with an attacker-controlled server.

Memory corruption in nanoMODBUS through v1.23.0 allows a malicious or compromised Modbus server to crash or potentially execute arbitrary code on connecting clients by sending a crafted Read Device Identification response (FC 0x2B/MEI 0x0E) that triggers an out-of-bounds NUL byte write in recv_read_device_identification_res(). Any application embedding this library and invoking the Device Identification client function is exposed when connecting to an attacker-controlled server. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the off-by-one NUL write primitive into adjacent heap or stack memory represents a realistic path to both denial of service and, depending on allocator layout, code execution.

Out-of-bounds heap/stack write in nanoMODBUS through v1.23.0 lets an unauthenticated network client corrupt memory in the Modbus server via a single crafted Read File Record (FC 0x14) request. The server-side handle_read_file_record() function validates per-request and per-sub-request sizes but never checks the cumulative response size, and a uint8_t accumulator (response_data_size) silently overflows, allowing swap_regs() to write up to ~8490 bytes past the 260-byte receive buffer. There is no public exploit identified at time of analysis, but the flaw yields reliable denial of service and, on embedded/bare-metal targets lacking memory protection, potential remote code execution.

Slab-out-of-bounds read in the Linux kernel's ksmbd SMB2 server allows remote unauthenticated attackers to crash the kernel or leak one byte of adjacent slab memory by sending a crafted compound SMB2 request. The vulnerable path in ksmbd_smb2_check_message() reads the 2-byte StructureSize2 field at offset 64 from each compound element without first confirming the element is at least 66 bytes, so a trailing element of exactly 64 bytes causes a one-byte overread beyond the receive buffer. No exploitation has been publicly confirmed (EPSS 0.16%, 5th percentile, not in CISA KEV), but the unauthenticated network attack vector (CVSS 8.2) makes any ksmbd-exposed host a realistic DoS target. Vendor-released patches are available across all maintained stable kernel series.

Slab-out-of-bounds read in the Linux kernel btrfs free space cache loader allows a local attacker to trigger kernel memory corruption by supplying a crafted btrfs filesystem with an inflated num_entries value in the on-disk btrfs_free_space_header. All Linux kernel versions from commit 5b0e95bf607d through the patched stable releases across the 6.6, 6.12, 6.18, 7.1, and 7.2 series are affected. An attacker who can mount or cause the kernel to process such a crafted volume causes the io_ctl->index pointer to walk past the pages[] array boundary, with the overrun slot treated as a struct page and passed to crc32c(), culminating in a general protection fault with kernel code execution or information disclosure potential. No public exploit has been identified and this vulnerability is not in CISA KEV; EPSS places exploitation probability at the 5th percentile.

Kernel memory corruption in the Linux IPsec IP-TFS/AGGFRAG (xfrm iptfs) receive path allows crafted or normal traffic arriving on an IPTFS tunnel to corrupt kernel memory and panic affected hosts (introduced in Linux 6.14, fixed in 6.18.42, 7.1.6 and 7.2-rc4). Because iptfs_skb_add_frags() fails to propagate the SKBFL_SHARED_FRAG flag when copying page-pool-backed shared frags, a subsequent nested transport-mode esp_input() takes the no-COW fast path and decrypts in place over pages still referenced by the outer SKB. There is no public exploit identified at time of analysis and EPSS is low (0.15%), consistent with the narrow, non-default configuration required.

Stack-based buffer overflow in Apache Lucy (all versions) enables potential arbitrary code execution through crafted input triggering memory corruption in the retired C-based search library. All versions are affected with no patch planned, as the Apache Software Foundation has officially retired the project. No public exploit or active exploitation has been identified at time of analysis, but the absence of any future fix makes this a permanent unresolved risk for any remaining deployments.

Stack-based buffer overflow in UTT HiPER 1200GW firmware up to v2.5.3-170306 enables network-reachable authenticated attackers to corrupt stack memory and achieve arbitrary code execution on the device. The vulnerable C runtime function strcpy in the web management endpoint /goform/ConfigAdvideo performs no bounds validation on the timestart HTTP parameter, allowing oversized input to overwrite return addresses and redirect execution flow. A public proof-of-concept exploit is available on GitHub; no vendor patch exists as UTT did not respond to the coordinated disclosure.

Out-of-bounds heap read and write in libXfont2's font server client (all versions prior to 2.0.9) allows a malicious or compromised network font server to corrupt X server heap memory, enabling privilege escalation when the X server runs as root or denial of service via crash in unprivileged configurations. The flaw arises because fs_read_glyphs() in src/fc/fserve.c allocates the encoding[] array based on num_extents from one protocol reply but indexes it using num_chars from a separate reply with no cross-validation, so a crafted server can send mismatched values to trigger OOB heap reads and attacker-controlled OOB heap writes. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-released fix is confirmed in libXfont2-2.0.9.

Heap buffer overflow in libXfont2's font-server client allows a malicious or compromised font server to overflow the X server's heap with attacker-controlled content by sending overlapping glyph source offsets. Affected systems running X server as root are exposed to privilege escalation; unprivileged X server instances crash with denial of service. All libXfont2 versions prior to 2.0.9 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attacker-controlled write primitive makes this a high-severity memory corruption issue.

Stack-based buffer overflow in the UTT HiPER 1250GW firmware (all versions up to v3.2.7-210907-180535) allows authenticated remote attackers to corrupt stack memory via the tempName argument of the /goform/getOneApConfTempEntry endpoint, with potential for arbitrary code execution on the device. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path available. No CISA KEV listing exists, but the PoC availability combined with an unpatched network device significantly elevates practical risk for any exposed management interface.

Stack-based buffer overflow in UTT HiPER 1250GW firmware (all versions through 3.2.7-210907-180535) enables low-privileged remote attackers to corrupt stack memory and achieve arbitrary code execution by submitting an oversized value to the cipher parameter of the /goform/APSecurity_5g endpoint. A public proof-of-concept exploit is available on GitHub, materially increasing opportunistic abuse risk. No vendor patch exists - the vendor failed to respond to responsible disclosure - leaving no fix-based remediation path at time of analysis.

Stack-based buffer overflow in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 allows a remote unauthenticated attacker to crash worker processes by exploiting the watcherinfo XML generation path in the presence module. The attacker sends a SIP SUBSCRIBE with a From URI exceeding 200 characters, establishing an oversized watcher entry, then triggers presence.winfo generation to overflow a fixed-size stack buffer in create_winfo_xml() within notify.c. No public exploit has been identified at time of analysis, but the unauthenticated network vector and straightforward two-step attack path make this a credible denial-of-service risk for any SIP infrastructure exposing presence services.

Heap-based buffer overflow in Systerel S2OPC Toolkit 1.7.3 enables remote denial of service by sending a crafted OPC UA PublishResponse containing malformed EventNotificationList data to the Alarm/Conditions client wrapper. The affected code paths - libs2opc_client_alarm_conditions.c, state_machine.c, and sopc_event_manager.c - process incoming subscription notification data without adequate bounds checking, allowing a malicious or compromised OPC UA server to crash any connected S2OPC client. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.5/High rating and unauthenticated network vector make this a meaningful risk in OPC UA-enabled industrial environments.

Denial-of-service via buffer overflow in open62541 v1.5.5 allows a remote, unauthenticated attacker to crash an OPC UA server by sending a crafted Service_Call request with malformed input arguments. The flaw resides in the method-call service handler (ua_services_method.c), where input arguments are validated against runtime-resolved InputArguments metadata without proper bounds enforcement. No active exploitation or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful availability risk for any OPC UA server deployment based on this library version.

Remote unauthenticated denial of service in Systerel S2OPC Toolkit 1.7.3 is exploitable via the OPC UA AddNodes service, triggering a classic buffer overflow (CWE-120) in address_space_bs.c and sopc_node_mgt_helper_internal.c that crashes the server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is reachable from the network without credentials or user interaction, making it trivially automatable against exposed OPC UA endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis, though the impact is particularly acute in OT/ICS environments where S2OPC is deployed, as availability loss in industrial control infrastructure can translate to physical process disruption.

Heap-based buffer overflow in lib60870-C 2.4.0 affects the server-side FileSegment ASDU encoding path, where FileSegment_encode() checks only the standalone segment length via FileSegment_GetMaxDataSize() but never verifies remaining capacity in the current ASDU frame before writing object fields and segment data. In IEC 60870-5-101/104 telecontrol servers using the library's file transfer functionality, this out-of-bounds heap write can corrupt memory, enabling denial of service and potentially remote code execution. There is no public exploit identified at time of analysis, and the flaw is tracked upstream as issue #201 against the current 2.4.0 release.

Out-of-bounds read in S2OPC Toolkit 1.7.3's RepublishResponse message handler enables unauthenticated remote attackers to crash the OPC UA service via a crafted network message, resulting in denial of service. The vulnerable code paths span the subscription publish service layer (msg_subscription_publish_bs.c, msg_subscription_publish_ack_bs.c) and the common encoder module (sopc_encoder.c). No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates low-barrier remote exploitation requiring no authentication against reachable OPC UA endpoints.

Stack-based buffer overflow in Systerel S2OPC 1.7.3 enables remote denial of service against OPC UA client applications. A malicious or compromised OPC UA server can send a crafted DeleteMonitoredItemsResponse message that triggers an overflow in LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems within the client_wrapper state machine, crashing the client process. No public exploit or active exploitation has been identified at time of analysis, though source code references confirm the vulnerable code path exists in the published repository.

Memory corruption in the OpenSIPS SIP server (versions prior to 3.6.6 and 4.0.0-rc1) lets remote attackers overflow a fixed 1024-byte global buffer via an oversized SIP URI username, deterministically corrupting adjacent global state such as the disable_503_translation flag and altering the server's routing behavior for subsequent messages. Exploitation requires that the deployed routing script pass an attacker-controlled username into construct_uri(); where that pattern exists, the flaw affects integrity and availability without authentication. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.

Heap-based buffer overflow in open62541 1.5.5 allows unauthenticated remote attackers to crash an OPC UA server by sending a crafted HistoryRead request when the default memory backend is in use, resulting in denial of service. The CVSS vector confirms network-accessible, unauthenticated exploitation with no interaction required, and SSVC classifies it as automatable with a proof-of-concept available. Despite these concerning attributes, EPSS at 0.14% (4th percentile) and absence from CISA KEV indicate limited real-world exploitation activity at time of analysis.

Remote denial-of-service in open62541 v1.5.5 is achievable by exploiting a buffer overflow in the OPC UA Discovery/Local Discovery Server (LDS) handling code. An unauthenticated remote attacker can send a specially crafted OPC UA discovery request to crash the affected server process, resulting in full availability loss. No public exploit code has been confirmed and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.

SIP message smuggling in OpenSIPS via unsigned integer overflow in TCP Content-Length parsing enables unauthenticated remote attackers to inject arbitrary SIP messages that bypass front-end SBC and proxy security policies, inherit connection authentication context, and evade rate limiting. All OpenSIPS instances with any TCP-based transport enabled (proto_tcp, proto_tls, proto_ws, proto_wss) running versions prior to 3.6.6 or 4.0.0-rc1 are affected, with no routing-script preconditions required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires only a single malformed packet against a default TCP-enabled configuration.

Adjacent-buffer overflow in OpenSIPS 3.4.0-beta through 3.6.5 and 4.0.0-beta arises in the {s.b64encode} string transformation, where the size check only validates that the input fits the 64 KB transformation buffer but ignores the ~33% expansion that base64 encoding introduces. Remote attackers can send a SIP message with a header value of roughly 50,000+ bytes to overflow the buffer by up to 21,844 bytes into an adjacent transformation buffer, corrupting values used by chained transformations on the same message; exploitability hinges on the routing script applying {s.b64encode} to attacker-controlled input. No public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available in 3.6.6 and 4.0.0-rc1.

Remote code execution and denial of service in OpenSIPS SIP server (versions 4.0.0 and prior) arises from a stack buffer overflow in the sip_to_json() function, where an attacker-controlled SIP header name longer than 255 bytes is memcpy'd into a fixed 255-byte stack buffer. Because both the length and content of the overwrite are attacker-controlled, a single unauthenticated UDP packet to SIP port 5060 can crash the process or, on builds lacking stack protections, hijack the saved return address for RCE. No public exploit identified at time of analysis; the issue was not fixed at publication, making this an unpatched flaw affecting any deployment whose routing script invokes sip_to_json().

Remote code execution in Keysight IxChariot Endpoint and related Keysight network-test products (Hawkeye, IxTap, IxProbe, IxBypass) allows an unauthenticated attacker to run arbitrary code with administrative privileges by sending a single specially crafted packet. The flaw is a classic stack-based buffer overflow reachable over the network with no user interaction (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the trivial attack complexity and lack of any authentication make it a high-priority patch for any environment running these test tools.

Out-of-bounds read in SSSD's PAM responder allows a local low-privileged attacker to crash the SSSD process and disclose sensitive memory contents by sending a crafted protocol v1 authentication request. Affected systems span all major Red Hat Enterprise Linux releases (6 through 10) and OpenShift Container Platform 4, representing a broad footprint in enterprise Linux environments. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 3rd percentile reflects a very low observed exploitation probability at time of analysis.

Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact.

Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or tamper with data via network-reachable attack surface, scoring CVSS 8.2 High. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special conditions, and no user interaction are required for exploitation. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but self-disclosure by NVIDIA and a High CVSS score warrant prompt patching in AI inference infrastructure environments.

Buffer overflow in the TP-Link Tapo P110 v1 smart plug's HTTP request handling allows an adjacent-network attacker to crash the web service process, resulting in a denial-of-service condition. The device's web service performs a memory copy of HTTP request body data without validating input length against the destination buffer, enabling an oversized payload to corrupt adjacent memory regions. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released firmware patch is available via the TP-Link download portal.

Memory corruption in Qualcomm Snapdragon's fastboot command handler for audio framework configuration allows an attacker with physical USB access to a device in bootloader mode to send malformed input and trigger memory corruption with cross-scope impact - potentially reaching privileged firmware or TrustZone-adjacent components (S:C in the CVSS vector). The full confidentiality, integrity, and availability impact (C:H/I:H/A:H) indicates the compromise can extend beyond the vulnerable component itself. No public exploit code exists and no CISA KEV entry is present at time of analysis.

Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.

Transient denial of service in Qualcomm Snapdragon's Wi-Fi 6 stack allows adjacent, unauthenticated attackers to crash affected devices by transmitting a malformed Target Wake Time (TWT) channel usage response frame with an undersized packet payload. The CVSS scope change (S:C) indicates the crash propagates beyond the Wi-Fi subsystem to impact the broader host environment. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Memory corruption in Qualcomm Snapdragon IOCTL device driver handling enables a local low-privilege attacker to achieve full confidentiality, integrity, and availability impact on the affected system. The flaw (CWE-822: Untrusted Pointer Dereference) allows a process to supply invalid pointer arguments via IOCTL calls that the driver dereferences without adequate validation, corrupting kernel memory. No public exploit code or CISA KEV listing has been identified at time of analysis; however, kernel-level driver bugs in Snapdragon have historically been chained with initial-access exploits to achieve full Android device compromise.

Memory corruption in Qualcomm Snapdragon's fingerprint Trusted Application (TA) allows a local low-privileged attacker to corrupt memory by sending malformed request parameters, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability resides within the TrustZone Trusted Execution Environment (TEE), making successful exploitation particularly severe as it targets the secure world isolated from the Android normal world. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the EPSS signal is absent from available data.

Memory corruption in Qualcomm Snapdragon platforms occurs when a packet with a size value near the maximum allowable limit is processed, triggering an integer overflow (CWE-190) that leads to a buffer overflow condition. Affected Snapdragon chipsets - used extensively in Android smartphones, IoT, and automotive platforms - are exposed to local exploitation with low privileges, yielding high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the vulnerability was disclosed via Qualcomm's August 2026 Security Bulletin.

Stack-based buffer overflow in Autodesk FBX SDK's fbxsdk::ExtractDrive function allows arbitrary code execution in the context of the current process when a user opens a maliciously crafted FBX file. Any application embedding the FBX SDK for 3D asset import - including game engines, VFX pipelines, and CAD tools - inherits this attack surface, making the blast radius broader than the SDK itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS score (7.8) and RCE primitive make this a priority for organizations ingesting untrusted 3D content.

Stack-based buffer overflow in Autodesk FBX SDK's binary file parser allows arbitrary code execution when a user opens a maliciously crafted FBX file. The vulnerable function `fbxsdk::FbxIO::BinaryReadSectionHeader` fails to properly bound-check attacker-controlled data from binary section headers, overflowing the call stack and enabling control-flow hijacking in the context of the host process. Any application embedding the affected SDK version - including Autodesk DCC tools and third-party game engine editors - is exposed when users import FBX assets from untrusted sources; no public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflows in GIMP's APNG and DDS image loaders let an attacker corrupt heap memory - and potentially achieve code execution - when a victim opens a specially crafted image file. The APNG path is triggered when the fcTL frame width exceeds the IHDR image width, so pixel data is written past the end of a heap allocation, while the DDS path involves a bits-per-pixel mismatch inside the load_layer() function. Exploitation is local and gated by user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, 7.8 High), no public exploit code has been identified at time of analysis, and EPSS is very low at 0.13% (3rd percentile); Red Hat has shipped patched packages via RHSA-2026:73768 and RHSA-2026:50817.

Out-of-bounds read in open62541 1.5.5 allows a malicious OPC UA server to crash connecting clients via a crafted namespace array response. The flaw resides in the client-side connection handler responseReadNamespacesArray() in src/client/ua_client_connect.c, triggered during the namespace discovery phase of the OPC UA session establishment. With a CVSS availability impact of High and no privileges required on the attacker side, the practical effect is a remotely-induced denial of service against any open62541-based OPC UA client that connects to an attacker-controlled server. No public exploit identified at time of analysis.

Buffer overflow in open62541 1.5.5's Local Discovery Server (LDS) enables an unauthenticated remote attacker to crash the discovery service by sending a RegisterServer or RegisterServer2 request containing an abnormally large number of unique discoveryUrls, but only when the MDNSD multicast discovery backend is enabled at build time. The impact is a denial of service (A:H) with no confidentiality or integrity exposure. No active exploitation is confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis.

Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects authenticated network attackers (PR:L per CVSS). The CWE-126 flaw allows an authorized attacker to corrupt memory and execute arbitrary code within the browser process over a network channel. No active exploitation is confirmed (not listed in CISA KEV, SSVC exploitation=none), and EPSS of 1.00% at the 59th percentile reflects above-median but still modest real-world exploitation probability.

Heap-based out-of-bounds write in the Zephyr RTOS hawkBit OTA update client (versions 2.4.0 through <4.5.0) allows a malicious or compromised hawkBit update server to corrupt device heap memory by sending a crafted HTTP response body. The off-by-one flaw in response_json_cb() allocates exactly the response body length with no room for the NUL terminator, writing one byte past the heap object and corrupting adjacent allocator metadata. No public exploit identified at time of analysis, but the SSVC framework rates this as automatable and the trigger is deterministic in Zephyr v4.0.0 and later for any response body exceeding 1100 bytes - a size normal for hawkBit deployment metadata.

Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear.

Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis.

Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis.

Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment (UE) is connected to an attacker-controlled rogue base station. The flaw stems from a missing bounds check (CWE-125) in modem protocol processing, crashing or disrupting the modem without requiring any user interaction or device-side privileges. No active exploitation is confirmed (no CISA KEV listing), and EPSS probability is very low at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' status - though the attack is classified as automatable once rogue infrastructure is in place.

Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code.

Stack buffer over-read and stray one-byte NUL write in Zephyr RTOS's experimental OCPP 1.6 client allow a malicious or compromised OCPP central server - or an on-path attacker exploiting the commonly unencrypted ws:// transport - to crash a connected embedded device by sending a crafted WAMP RPC frame with an oversized uid or action field. The vulnerable helper extract_string_field() uses strncpy() without guaranteeing NUL-termination, causing a subsequent strchr() call to scan unbounded into adjacent stack memory; a secondary defect in extract_payload() compounds this on maximal-length frames. No active exploitation has been confirmed by CISA KEV, but SSVC classification indicates publicly available proof-of-concept code, and EPSS sits at a low 0.19% (10th percentile), consistent with a niche embedded RTOS attack surface.

Integer overflow in FreeRDP's audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends affects all versions before 3.29.0, exploitable by a malicious or compromised RDP server. The server can supply a crafted FramesPerPacket value that causes allocation size wraparound, leading to a heap-based buffer overflow on Linux/ALSA - potentially enabling code execution - or denial of service on all supported platforms. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; vendor-released patch (3.29.0) is available.

Heap-based buffer overflow in FreeRDP's Windows clipboard client (versions ≤ 3.29.0) allows a malicious or compromised RDP server to write attacker-controlled data beyond the bounds of a paste consumer's heap allocation. The flaw in CliprdrStream_Read trusts the server-supplied response length (req_fsize) rather than the caller-supplied buffer bound (cb), so any OLE paste consumer such as explorer.exe that calls IStream::Read against server-offered clipboard file contents can have its heap corrupted. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and a fix is available in FreeRDP 3.30.0.

Heap buffer overflow in FreeRDP's server-side RAIL channel handler (versions ≤ 3.28.0) allows any connecting RDP client to crash the FreeRDP server process through a crafted RAIL PDU. The root cause is an unchecked subtraction of RAIL_PDU_HEADER_LENGTH from a client-controlled orderLength field in rail_server_handle_messages(); values 0-3 cause an unsigned integer underflow to a very large size, which causes pointer arithmetic wraparound that defeats the Stream_EnsureRemainingCapacity() guard, ultimately triggering an out-of-bounds heap write via WTSVirtualChannelRead(). No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available in FreeRDP 3.29.0.

Heap out-of-bounds read in FreeRDP's glyph cache subsystem (versions <= 3.28.0) allows a malicious or compromised RDP server to crash any connecting FreeRDP client by sending a GLYPH_FRAGMENT_ADD update with a server-controlled declared fragment size that exceeds the actual received buffer. The vulnerability exists because update_process_glyph_fragments() and glyph_cache_fragment_put() in libfreerdp/cache/glyph.c read a one-byte declared size and proceed to allocate and copy that many bytes without first validating that the declared size fits within the remaining data in the received packet. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with AV:N/AC:L/PR:N reflects trivial remote exploitation requiring only a client connection to a rogue server.

Heap use-after-free in FreeRDP's asynchronous update message proxy (all versions before 3.29.0) enables a malicious or compromised RDP server to crash the connecting client or induce memory corruption by sending crafted RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER update packets. The vulnerability surfaces only when the AsyncUpdate option is enabled on the client, limiting but not eliminating real-world exposure given the feature's performance benefits and common usage. Vendor-released patch version 3.29.0 is available; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Heap use-after-free in FreeRDP's async update message proxy allows a malicious or compromised RDP server to crash the client and corrupt heap memory through a crafted RAIL WINDOW_ORDER_ICON message. The flaw is gated on the AsyncUpdate feature being explicitly enabled via the /async-update flag - a non-default client configuration - which limits real-world exposure relative to the CVSS 4.0 score of 8.7. All FreeRDP versions prior to 3.29.0 (CPE: cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) are affected; no public exploit or CISA KEV listing has been identified at time of analysis.

Out-of-bounds read in FreeRDP's async update message proxy exposes clients to memory disclosure or process crash when connecting to a malicious or compromised RDP server with AsyncUpdate enabled. The flaw is in update_message_PolygonSC() and update_message_PolygonCB(), which allocate a fresh points array but copy data from the enclosing order structure's base address rather than from the correct ->points member, reading adjacent heap memory. All FreeRDP versions before 3.29.0 are affected; no CISA KEV listing and no public exploit code exist at time of analysis.

Heap-based remote code execution in the FreeRDP Windows client (all versions before 3.29.0) is triggered when a user pastes clipboard content sourced from a malicious RDP server. The client fails to validate the server-supplied data size in CLIPRDR_FILE_CONTENTS_RESPONSE PDUs against the destination buffer, allowing an oversized payload to corrupt heap memory. A publicly available vendor advisory (GHSA-cj9v-h4hq-29jr, reported by VulnCheck) documents the flaw; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Heap out-of-bounds read in FreeRDP's TSMF FFmpeg decoder allows a malicious RDP server to crash connecting client processes by sending malformed AVC1 MPEG2VIDEOINFO media type data with undersized ExtraData buffers. All FreeRDP releases prior to 3.29.0 are affected (CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*), with the root cause being fixed-offset heap reads in the media format parser that proceed without validating source buffer length - a CWE-125 pattern. No CISA KEV listing or public exploit code has been identified at time of analysis; the vendor has released a patch at version 3.29.0 and the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity consequence per the provided vector.

Arbitrary code execution in Adobe Premiere Pro stems from an out-of-bounds write (CWE-787) triggered when processing a specially crafted media or project file, running code in the context of the logged-in user. The attack is file-based and local, requiring an adversary to socially engineer a victim - a realistic threat vector for creative professionals who routinely receive media files from external sources. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the high CVSS impact metrics (C:H/I:H/A:H) indicate full user-level compromise upon successful exploitation.

Heap memory disclosure in Coturn 4.5.2-4.14.0 allows an unauthenticated remote attacker to extract up to ~870 bytes of adjacent process heap per request by sending a single HTTP GET to the ACME redirect plaintext TCP listener. The leaked memory originates from recycled, unzeroed network receive buffers and on busy relay servers can contain TURN credentials, OAuth tokens, or relayed session payloads from concurrent clients. Exploitation is trivially automatable against the affected configuration; no public exploit identified at time of analysis beyond the proof-of-concept test case shipped with the advisory.