Buffer Overflow

Use-after-free in the Zephyr RTOS Bluetooth GATT client stack allows an adjacent Bluetooth peer acting as a GATT server to crash a Zephyr device or potentially redirect its execution by replying to a CCC-write with an ATT Error Response. The defect is a callback-ordering bug in gatt_write_ccc_rsp(): the API-documented termination signal notify(NULL) was emitted before subscribe(), so applications that free or recycle bt_gatt_subscribe_params in their termination handler dereference a dangling function pointer. No public exploit code or CISA KEV entry exists; a vendor patch commit is available but a specific tagged release version has not been confirmed.

Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.

Remote code execution via stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's Cookie parsing logic affects all firmware versions prior to 2.8.5.1, exploitable by unauthenticated network attackers when the SafeEnhancement feature is enabled. The vulnerability (CWE-121) allows arbitrary code execution on the edge controller, an OT/IIoT device typically deployed in industrial automation environments. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the industrial attack surface warrants heightened concern due to the operational consequences of device compromise. Notably, the provided CVSS vector (C:H/I:N/A:N) is inconsistent with the described code execution impact - a discrepancy that should be verified with the vendor.

Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge controllers is possible through a stack-based buffer overflow in the device's log message handling functionality, exploitable by unauthenticated network attackers on versions prior to 2.8.5.1. Reported by the Cyber Security Agency of Singapore (CSA), the vulnerability carries a CWE-121 classification - a well-understood root cause class with a history of weaponizable exploits, particularly in embedded and OT/ICS devices. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the network-accessible, unauthenticated nature of the flaw and the industrial deployment context elevate operational risk above what the percentile alone suggests.

Stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's password handling routine enables unauthenticated remote code execution when the SafeEnhancement feature is active. All firmware versions prior to 2.8.5.1 are affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface on an industrial IoT edge device warrants prompt patching given OT environment exposure.

Stack-based buffer overflow in the Tenda W6-S wireless router (firmware 1.0.0.4(510)) lets remote attackers corrupt stack memory by sending oversized 'GO' and 'index' parameters to the /goform/wifiSSIDset endpoint, where the formwrlSSIDset handler copies them into a fixed 64-byte buffer via unbounded sprintf. Successful exploitation can crash the device or achieve arbitrary code execution with full impact to confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a detailed technical write-up, though there is no public exploit identified as weaponized and no confirmed active exploitation.

Denial-of-service in an IEC 61850 GOOSE subscriber component allows an adjacent, unauthenticated attacker on the same Layer-2 network to crash the message-processing process by sending a crafted GOOSE frame (EtherType 0x88B8) with an undersized UTC timestamp field, triggering a heap out-of-bounds read (CWE-125). The flaw was reported by DHS ICS-CERT and documented in CISA ICS advisory ICSA-26-211-10; there is no public exploit identified at time of analysis, and the CVSS 4.0 vector scores availability impact only (VA:H) with no confidentiality or integrity effect.

Denial-of-service in an IEC 61850 GOOSE subscriber implementation allows an attacker with access to the substation process bus to crash the subscriber process using a single unauthenticated Layer-2 multicast frame. An off-by-one boundary error in the GOOSE parser triggers a heap out-of-bounds read (CWE-125) that reliably terminates the process. No public exploit identified at time of analysis; this is not listed in CISA KEV, and no EPSS score was provided.

Denial-of-service in an IEC 61850 MMS (Manufacturing Message Specification) protocol implementation allows an attacker with an established MMS session to crash the MMS handling process by sending a malformed BER-encoded confirmed-request message over TCP port 102. The flaw is a heap out-of-bounds read (CWE-125) in the BER decoder's boundary handling. No public exploit or active exploitation is identified at time of analysis; the CVSS 4.0 score of 7.1 reflects a high availability impact with low required privileges and no user interaction.

Heap buffer over-read in MZ Automation GmbH's libiec61850 (versions prior to 1.6.2) allows an unauthenticated adjacent-network attacker to crash the MMS service process by sending a crafted BER-encoded message with an invalid length value in a BOOLEAN or INTEGER field. The MMS BER decoder performs no bounds validation on the attacker-supplied length, causing a read past the end of a heap-allocated buffer and subsequent process termination. CISA ICS-CERT issued advisory ICSA-26-211-10 for this vulnerability; no public exploit code or KEV listing has been identified at time of analysis.

Denial-of-service in MZ Automation's libiec61850 (versions before 1.6.2) allows an unauthenticated attacker on the process bus to crash IEC 61850 subscriber processes with a single crafted GOOSE frame. The GOOSE payload parser mishandles nested length fields, so an inner element length that exceeds its enclosing length forces a one-byte out-of-bounds read (CWE-125) that reliably terminates the subscriber. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CISA ICS advisory (ICSA-26-211-10) and a vendor patch are available.

Remote unauthenticated denial of service in MZ Automation's libiec61850 (all versions before 1.6.2) allows an attacker to crash IEC 61850/MMS server processes by opening a crafted TCP/102 connection. The flaw sits in the ISO Presentation layer's normal-mode negotiation, where a missing length check on an attacker-controlled zero-length field triggers a bounded heap out-of-bounds read that terminates the process before any MMS session is even established. No public exploit identified at time of analysis and it is not on CISA KEV, but the pre-authentication network reach and low complexity make it a credible availability threat to exposed OT/ICS devices.

Heap buffer overflow in GoAccess 1.10.2's parse_browser() routine lets a remote attacker corrupt or crash the analyzer by planting a crafted User-Agent string in a web server access log that an operator later processes. Because the code assumes any Opera-matched token starts with the literal 'Opera' and relocates the trailing version substring to a fixed match+5 offset, a specially formed UA drives a memmove that writes one to four attacker-influenced bytes past a heap allocation. There is no public exploit identified at time of analysis, and the flaw is fixed in version 1.11.

Integer overflow in the UA_Variant arrayDimensions product computation in open62541 (versions 1.3.0-1.3.18, 1.4.0-1.4.17, 1.5.0-1.5.5) enables a remote attacker to trigger an out-of-bounds heap write, with potential for denial of service or arbitrary code execution in industrial OPC UA servers and gateways. CISA coordinated disclosure as ICSA-26-211-08 on 2026-07-30, citing risk to critical manufacturing, energy, and transportation infrastructure sectors worldwide. No public exploit identified at time of analysis - PoC code exists but was withheld at o6 Automation's request; the CVE is not in CISA KEV.

Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.

OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and FW1110 families) allows a low-privileged actor inside a logical partition to issue a carefully crafted hypervisor call that crashes the PowerVM hypervisor or corrupts OS memory. Because the flaw crosses the partition-to-hypervisor trust boundary (CVSS scope change), a single guest partition can impact the integrity and availability of the shared virtualization layer serving other partitions. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; IBM, the reporter, has released a fix.

Information disclosure and host-process Denial-of-Service affects VMware ESX, Workstation, and Fusion via an out-of-bounds read (CWE-125) reachable by an actor holding VM deployment privileges. On ESX the flaw can crash or leak memory from the host VMX process (a guest-to-host scope crossing), while on Workstation and Fusion the impact is limited to information disclosure. Reported by VMware/Broadcom with no public exploit identified at time of analysis and no CISA KEV listing.

Guest-to-host escape in VMware ESX (and the ESX component of Cloud Foundation, vSphere Foundation, and Telco Cloud Platform) lets an attacker with administrative privileges inside a virtual machine execute code on the underlying hypervisor host via an out-of-bounds write in the VMXNET3 virtual network adapter. Only VMs configured with the VMXNET3 adapter are affected; other virtual NIC types are not. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-issued Broadcom/VMware advisory and the CVSS 9.3 score reflect a critical host-compromise impact.

Out-of-bounds write in PHP's BCMath bccomp() function allows attacker-controlled inputs to corrupt stack and heap memory in PHP 8.4.x before 8.4.24 and 8.5.x before 8.5.9, with high confidentiality, integrity, and availability impact per the vendor CVSS 4.0 score of 8.1. Exploitation requires an application to pass attacker-influenced values into bccomp() with the BCMath extension enabled; there is no public exploit identified at time of analysis (CVSS E:U, no KEV listing). Memory corruption of this class can lead to crashes and, potentially, arbitrary code execution within the PHP process.

Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Out-of-bounds memory read in the Dawn (WebGPU) component of Google Chrome before 151.0.7922.72 lets a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Google's Chrome team reported it and a fixed Stable-channel build is available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile). Notably, Chromium internally rated the security severity 'Low' even though the NVD-style CVSS base score is 8.1, so real-world impact is likely narrower than the raw score implies.

Out-of-bounds memory access in Google Chrome's Frame component affects all Desktop builds prior to 151.0.7922.72, letting a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Chromium rated the underlying flaw Low severity, yet NVD scores it 8.8 (High) and tags flag potential RCE; there is no public exploit identified at time of analysis and EPSS is a low 0.18% (8th percentile). A vendor patch is available and the issue is not listed in CISA KEV.

Out-of-bounds memory read in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) lets a remote attacker disclose heap memory when a victim opens a crafted HTML page. The flaw is a CWE-122 heap buffer overflow that Chromium itself rated Low severity, with no public exploit identified at time of analysis and an EPSS probability of 0.19% (9th percentile). CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, though technical impact is rated total.

Remote code execution in Google Chrome desktop before 151.0.7922.72 arises from a heap buffer overflow in the browser's media Codecs component (CWE-122), letting a remote attacker who serves a crafted HTML page corrupt heap memory and run arbitrary code - though execution is confined inside the renderer sandbox rather than the host OS. Google rates the Chromium severity as Low despite the NVD-style 8.8 CVSS, and there is no public exploit identified at time of analysis; EPSS is low at 0.24% (15th percentile) and CISA SSVC lists exploitation as none. A vendor patch is available in the 151.0.7922.72 stable channel release.

Out-of-bounds memory read in Chrome's WebXR component allows remote attackers to disclose sensitive renderer process memory or crash the browser tab by luring a victim to a crafted HTML page. All Google Chrome releases prior to 151.0.7922.72 are affected across all platforms, with the vendor confirming a patch in the stable channel update. No public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates low near-term exploitation probability despite the high CVSS base score of 8.1.

Sandbox escape in Google Chrome's media codec handling affects all Chrome desktop builds prior to 151.0.7922.72, where an integer overflow while parsing a maliciously crafted video file can let a remote attacker break out of the renderer sandbox. Exploitation requires the victim to load attacker-controlled media (UI:R), and there is no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the flaw is not on CISA KEV. Notably, Chromium's own triage rated this 'Medium' severity, which conflicts with the NVD-style 9.6 Critical score.

Sandbox escape in Google Chrome's ANGLE graphics layer allows a remote attacker to corrupt memory via a crafted HTML page in versions prior to 151.0.7922.72. The flaw is an out-of-bounds read and write (CWE-125) that a victim triggers simply by visiting a malicious page, potentially letting attacker-controlled code break out of the renderer sandbox. Google has released a fixed stable channel build; there is no public exploit identified at time of analysis and EPSS risk is currently low (0.21%).

Sandbox escape in Google Chrome's Dawn WebGPU implementation (versions prior to 151.0.7922.72) lets a remote attacker corrupt heap memory in the GPU process via a crafted HTML page, potentially breaking out of the renderer sandbox to compromise the host. The CVSS 3.1 vector (AV:N/UI:R/S:C, base 9.6) reflects that exploitation only needs a victim to visit a malicious site but crosses a security boundary; Google rates the Chromium severity as Medium. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.

Sandbox escape in Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) lets a remote attacker corrupt memory via an out-of-bounds write triggered by a crafted HTML page, potentially breaking out of the renderer sandbox. Rated Chromium 'High' and CVSS 9.6 due to scope change and full confidentiality/integrity/availability impact, it requires the victim to visit a malicious page (UI:R). No public exploit is identified at time of analysis, EPSS is low (0.21%), and CISA SSVC records exploitation as 'none'.

Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.

Sandbox escape in Google Chrome's ANGLE graphics component affects all Desktop builds prior to 151.0.7922.72, where an out-of-bounds write (CWE-787) can be triggered by a crafted HTML page to corrupt memory in the GPU process and cross the sandbox boundary. Chromium rates the flaw High and the CVSS 3.1 score is 9.6 owing to the scope change (S:C) and full CIA impact, though it requires the victim to load attacker-controlled content (UI:R). There is no public exploit identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests no observed weaponization yet.

Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.

Sandbox escape in Google Chrome's ANGLE graphics layer on macOS (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope change from renderer to host, it enables full compromise of the browser process. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.29% (21st percentile).

Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).

Sandbox escape in Google Chrome on ChromeOS (versions prior to 151.0.7922.72) stems from a heap buffer overflow in the Color component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the severity High and the CVSS score is 9.6 owing to the scope change into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.31% (24th percentile), consistent with a second-stage bug that requires a prior renderer compromise.

Out-of-bounds read in Chrome's ANGLE graphics abstraction layer (versions prior to 151.0.7922.72) can be leveraged by an attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a second-stage bug rather than a standalone drive-by. Because it requires a pre-compromised renderer, it is typically one link in an exploit chain rather than a single-shot RCE.

Sandbox escape in Google Chrome's ANGLE graphics layer before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, achieving code execution at higher privilege on Windows, macOS, and Linux desktops. Rated High severity by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though the EPSS probability is only 0.21% (11th percentile). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the bug was reported internally by the Chrome team and a fixed build is already shipping.

Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.

Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.

Remote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow in the kernel-resident RTSP connection-tracking (ALG) module. An attacker who lures a LAN-side client into connecting to an attacker-controlled RTSP server can send a crafted RTSP message that the router's kernel helper mishandles, potentially yielding full device compromise. The flaw is exploitable by an unauthenticated attacker against the router's default configuration; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Remote code execution in Xlight FTP Server versions before 3.9.5 allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets once an AES-GCM cipher is negotiated during the SSH/SFTP handshake. An unvalidated length field is passed directly to the GCM decrypt routine, overwriting the stack cookie and saved return address before any authentication occurs, potentially yielding code execution as the FTP service. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the pre-auth, network-reachable nature makes it a high priority.

Pre-authentication heap buffer overflow in Xlight FTP Server before 3.9.5 lets remote unauthenticated attackers write past a heap buffer by sending a malformed SSH client identification string over any SSH or SFTP connection. The flaw is a logic error in the recv-loop termination condition (an OR used where AN AND is required), triggering before authentication and creating strong potential for remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView 2027.0.0 exposes users to application crashes and sensitive memory disclosure when parsing maliciously crafted DWG or DXF files. Exploitation requires a local user to open a weaponized file, making social engineering the primary delivery mechanism targeting CAD operators in AEC and manufacturing environments. No active exploitation has been confirmed (not in CISA KEV), EPSS sits at a negligible 0.12% (2nd percentile), and a vendor patch is available via ADSK-SA-2026-0009.

Arbitrary code execution in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView occurs when a user opens a maliciously crafted DXF file, triggering a heap-based buffer overflow (CWE-122) in the file parser. A local attacker who convinces a victim to open the file can crash the application, read sensitive in-process memory, or run code in the context of the current user. There is no public exploit identified at time of analysis, and the file-format vector plus required user interaction places this in the classic 'malicious drawing file' threat model rather than remote mass exploitation.

Out-of-bounds write in Schneider Electric IGSS (Interactive Graphical SCADA System) Definition module allows an attacker to corrupt memory - causing data loss or potential arbitrary code execution - when a victim imports a maliciously crafted CGF (configuration/definition) file. Exploitation is local and hinges on user interaction (opening/importing the file), with no authentication required once the operator is tricked. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Schneider Electric PSIRT) rates the flaw high at CVSS 8.4.

Out-of-bounds write in GNU binutils' BFD library (bfd/elf32-dlx.c) lets a crafted ELF/DLX object file corrupt memory and achieve arbitrary code execution when parsed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). Reported by Red Hat and tracked against RHEL 6-10, Hardened Images and OpenShift 4, the flaw is only reachable when binutils is compiled with the DLX backend (typically --enable-targets=all), so exposure is gated by a non-default build option. There is no public exploit identified at time of analysis (not in CISA KEV), though the researcher demonstrated code execution via a File Stream Oriented Programming (FSOP) attack on glibc FILE structures.

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).

Denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) lets remote attackers crash the proxy by sending crafted input to the uri_signing or url_sig plugins, which recurse or copy unbounded data onto the stack until it is exhausted (CWE-121 stack-based buffer overflow). Only deployments that have loaded and enabled one of these URL-signing plugins are exposed; the impact is availability-only, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor CVSS 4.0 score of 8.2 reflects easy unauthenticated network reach against affected edge nodes.

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Stack-based buffer overflow and integer overflow in Apache Traffic Server's regex_remap plugin expose production proxy deployments to high-impact compromise via crafted substitution input. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are all affected, with confidentiality, integrity, and availability fully at risk. No public exploit identified at time of analysis, though the network-exploitable nature and full-triad impact make patching urgent for any deployment relying on regex_remap for URL rewriting.

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.

Denial-of-service (and potential memory corruption) in Apache Traffic Server affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 when redirect following is enabled. The proxy copies the client-supplied Host header into a fixed-size stack buffer without bounds checking during redirect handling, so an over-long Host header overflows the stack and crashes the process. There is no public exploit identified at time of analysis, and the vendor-assessed impact is limited to availability (CVSS 4.0 base 8.2).

Denial-of-service in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same (adjacent) network segment to send malformed PROFINET communication data that triggers an out-of-bounds write and a runtime exception, forcing a controlled stop of the affected PLC application. The impact is availability-only (no data disclosure or code execution is claimed by the vendor); the CVSS 4.0 vector confirms VC:N/VI:N/VA:H. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.

Out-of-bounds write in Adobe Bridge allows arbitrary code execution when a user opens a malicious file. The vulnerability requires user interaction and runs code in the context of the current user. No active exploitation or public exploit code is known at the time of analysis.

Arbitrary code execution in Adobe Bridge allows local attackers to execute arbitrary code in the victim's context by enticing a user to open a malicious file. The out-of-bounds write vulnerability (CWE-787) requires no authentication and has not been reported as actively exploited or in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is known at this time.

Opening a malicious file in Adobe Bridge triggers an out-of-bounds write, leading to arbitrary code execution with the current user's privileges. Adobe has released a security update to address this issue via bulletin APSB26-89. No active exploitation or public exploit has been identified at the time of analysis.

Opening a malicious file in Adobe Format Plugins can trigger a heap-based buffer overflow, allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction, and no active exploitation or public exploit code has been reported at this time.

Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote code execution, information disclosure, denial of service, or privilege escalation when processing a malicious WAV file. The flaw resides in the read_WAV_Header() function due to lack of bounds checking on chunk size and bytes-to-skip values, enabling heap corruption. A public proof-of-concept exists (CISA SSVC 'poc'), but no active exploitation has been confirmed in CISA KEV.

Memory corruption in Samsung's proprietary ImsService - the IP Multimedia Subsystem component handling VoLTE, Wi-Fi Calling and SIP signaling - can be triggered by a crafted message to produce an out-of-bounds write (CWE-787) and potentially execute arbitrary code on affected Samsung Galaxy devices. Devices running Android 14, 15 or 16 with firmware older than the SMR Jul-2026 Release 1 are exposed; exploitation requires reaching the IMS service stack (per the CVSS 4.0 vector it is unauthenticated with no user interaction, but AT:P indicates a non-attacker-controlled precondition such as an established or negotiable IMS session, a malicious IMS peer, or a position in the carrier signaling path), and confirmed impact is integrity and availability only, with no confidentiality loss. There is no evidence of active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), though the CISA SSVC assessment rates technical impact as total and patch availability (SMR Jul-2026 Release 1) limits the population of vulnerable devices over time.

Heap-based buffer overflow in ESP32-audioI2S 3.4.5 allows remote attackers to cause denial of service, information disclosure, or arbitrary code execution via a crafted MP3 file. Public exploit code is available but no active exploitation is confirmed.

We are tasked with producing a comprehensive JSON analysis for CVE-2026-51273. We have multiple intelligence sources: mitre (CVE description, CVSS, CWE, references), tags, SSVC, ENISA EUVD. The input provides the CVE ID, description, CVSS score, vector, CWE, and multi-source intel including CPE, references, tags, SSVC, and EUVD data. We must synthesize all this into a JSON object with the specified fields, each a plain text string. First, let's parse all the given data: - CVE ID: CVE-2026-51273 - Description: "In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf() to write formatted strings into ps_ptr heap buffer without length validation. Successful exploitation allows attackers to execute arbitrary code, leak sensitive memory data, cause device crash, or escalate privileges via a crafted malicious audio file." - CVSS Score: 7.8 - CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-122 (Heap-based Buffer Overflow) - Reported by mitre. - CPE (affected products): cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (this is a placeholder; the real product is schreibfaul1 ESP32-audioI2S, but CPE string is given as "n/a:n/a"). So product is "ESP32-audioI2S" by schreibfaul1. But the CPE doesn't provide a proper string; we'll note that in confidence_notes. - Tags: RCE, Buffer Overflow, N A, Heap Overflow - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. So a proof-of-concept exists, but exploitation is not automatable. - ENISA EUVD: EUVD-2026-49928, affected versions: ["n/a n/a"] (again placeholder). So no specific version range from EUVD, but description says version 3.4.5 is affected. - References: 1. (None) https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp (source code link) 2. (None) https://github.com

Heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library (version 3.4.5) exposes ESP32-based audio devices to remote code execution when they parse malicious HTML entities in streamed content. The flawed htmlToUTF8() decoder rearranges string data with memmove/memcpy without checking remaining buffer space, so an attacker who controls the HTML the device fetches (e.g. a web-radio stream or its metadata) can force an out-of-bounds heap write leading to code execution, memory disclosure, or a crash. Publicly available exploit code exists per the CISA SSVC 'poc' status, but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.27% (19th percentile), indicating no evidence of widespread active exploitation yet.

Heap-based buffer overflow in ESP32-audioI2S 3.4.5’s ID3v2 APIC frame parser lets remote attackers execute arbitrary code or crash vulnerable devices by supplying a crafted MP3 file. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.

Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to fully compromise a device by sending a malicious MP3 file or stream. The flaw lies in the MP3Decoder::UnpackSFMPEG1 function, which lacks input validation on attacker-controlled MP3 metadata, triggering a classic buffer overflow (CWE-120). A publicly available proof-of-concept exists, although no active exploitation has been confirmed via CISA KEV.

Denial of service in Schreibfaul1 ESP32-audioI2S version 3.4.5 allows unauthenticated network attackers to crash the audio service by exploiting a buffer overflow in the MP3Decoder::decode() function. Missing validation on untrusted mainDataBegin and nSlots values from incoming MP3 streams leads to memory corruption and service unavailability. No active exploitation or public exploit code has been identified at time of analysis.

Heap-based buffer overflow in the connecttospeech() function of schreibfaul1 ESP32-audioI2S version 3.4.5 allows remote attackers to achieve arbitrary code execution by supplying an overly long speech text string. The flaw arises because the library performs URL encoding of attacker-controlled input and appends it to a fixed-size heap buffer without length validation, leading to a heap overflow. A public proof-of-concept exploit is available, but active exploitation has not been confirmed.

Heap-based buffer overflow in schreibfaul1 ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to corrupt PSRAM memory, leading to denial of service and potential arbitrary code execution. An unchecked unsigned integer overflow when allocating a buffer for audio processing results in an undersized allocation; subsequent read/write operations overrun the heap. A proof-of-concept exploit is publicly available, but the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

A heap-based buffer overflow in ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to crash or potentially execute arbitrary code on vulnerable ESP32 devices. The flaw exists in the Audio::openai_speech function, which manually constructs JSON/HTTP payloads by concatenating user input without length checks. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.

Heap out-of-bounds write in schreibfaul1's ESP32-audioI2S library version 3.4.5 stems from an unsynchronized AudioBuffer::freeSpace() calculation that concurrent FreeRTOS tasks can race, producing an inflated free-space value that callers trust when writing decoded audio. Successful exploitation corrupts heap memory on the ESP32 microcontroller, causing crashes and potentially arbitrary code execution. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity despite the 9.8 CVSS.

Heap buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls the audio stream host or URL corrupt memory on the ESP32 microcontroller. The dismantle_host() parser feeds attacker-supplied host, request-host, extension, and query-string segments into clone_from(), which copies them into fixed-size heap buffers without length checks, enabling potential remote code execution or device crash. Rated CVSS 9.8 with SSVC marking technical impact as total and exploitation as automatable, though EPSS is only 0.18% and there is no public exploit identified at time of analysis.

Remote heap buffer overflow in the ESP32-audioI2S library 3.4.5 allows unauthenticated attackers to corrupt heap memory, potentially leading to arbitrary code execution or denial of service on affected ESP32 devices. The flaw arises from an unsafe memcpy in AudioBuffer::writeSpace() that copies a full UINT16_MAX bytes without validating the destination buffer size. A public proof-of-concept exists, elevating the urgency for IoT devices using this library.

Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote attackers to execute arbitrary code, disclose information, crash the service, or escalate privileges by sending a malicious URL with an oversized path and query string to the vulnerable urlencode function. No active exploitation has been confirmed by CISA KEV, and no EPSS score is available at this time.

Remote code execution in schreibfaul1 ESP32-audioI2S 3.4.5 allows unauthenticated attackers to overflow a heap buffer via crafted HTTP request headers. Public exploit code is available, enabling arbitrary code execution on vulnerable ESP32 devices. No official patch has been released.

Out-of-bounds read in macOS allows a malicious app to trigger unexpected system termination. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates low probability of widespread exploitation.

Connecting to a malicious SMB server can cause unexpected system termination in macOS due to a memory handling vulnerability (CWE-119). The issue affects all macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 and has been addressed with improved memory handling. No known active exploitation or public exploit code exists, and the EPSS probability of exploitation is very low (0.15%).

Buffer overflow in Apple macOS allows a malicious app to cause unexpected system termination. Affects macOS versions prior to 26.6 (Tahoe). No active exploitation or public exploit code is known, and EPSS indicates a low 0.15% probability of exploitation.

Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).

Unexpected system termination in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 allows a local application to trigger a denial-of-service via an out-of-bounds read. No active exploitation or public exploit is known, and EPSS indicates a low exploitation probability. The high CVSS score likely overstates the risk, as only a crash is confirmed in the description.

Arbitrary code execution via buffer overflow in Apple iOS, iPadOS, and macOS. Processing a maliciously crafted file can

Memory corruption in Apple's cross-platform image-processing stack allows a maliciously crafted image to corrupt process memory across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple self-reported and patched the flaw (fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and the 26.6 releases of tvOS/visionOS/watchOS). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and CISA SSVC records exploitation status as none, though the technical impact is rated total.

Memory corruption in Apple Safari 26.x allows remote code execution via processing maliciously crafted web content. This buffer overflow (CWE-119) affects all Apple platforms—iOS, iPadOS, macOS, visionOS, and watchOS—requiring user interaction to visit a malicious webpage. While the CVSS score is critical (8.8), EPSS (0.13%) indicates low current exploitation probability and no KEV listing or public exploit exists.

Memory corruption in macOS prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows a local app to cause unexpected system termination or corrupt kernel memory. Despite a CVSS score of 9.8, the attack vector is local and no public exploit or active exploitation has been identified; EPSS estimates exploitation probability at 0.16%, and CISA SSVC confirms no current exploitation but notes the issue is automatable with total technical impact.

Memory corruption in macOS may allow a malicious app to corrupt the memory of a system process, potentially leading to arbitrary code execution. This issue is fixed in macOS Sonoma 14.8.8 and macOS Tah

Denial-of-service

Out-of-bounds read in macOS allows an attacker to crash applications and potentially access sensitive memory by tricking a user into opening a maliciously crafted file. Affecting macOS Son