Buffer Overflow

Kernel memory corruption in Apple XNU kernel allows a remote attacker to potentially execute arbitrary code or crash the system when a victim connects to a malicious NFS server. Affected are all Apple operating systems—iOS, iPadOS, macOS, tvOS, and watchOS—before version 26.6. No active exploitation or public exploit code has been observed, and EPSS indicates a low probability of widespread attacks.

Kernel memory corruption in macOS allows remote code execution with high impact on confidentiality, integrity, and availability. A buffer overflow vulnerability allows network-based attackers to execute arbitrary code with kernel privileges, potentially compromising the system. Patches are available in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, and while no active exploitation has been reported, the remotely exploitable nature without authentication makes patching critical.

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be triggered by a remote attacker via an out-of-bounds write. The issue, patched in the latest OS updates, carries a CVSS base score of 9.8 but is not known to be actively exploited. EPSS estimates a low 0.25% probability of exploitation, and no public exploit code has been identified.

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6 allows unauthenticated network attackers to corrupt heap memory via an out-of-bounds write. This can lead to arbitrary code execution or unexpected application termination, compromising the affected device

Physical-proximity memory corruption in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS, visionOS) allows a nearby attacker to corrupt process memory, potentially leading to arbitrary code execution or denial of service. No active exploitation is known, and vendor-released patches are available. EPSS score is low (0.16%), and the CVSS vector supplied (AV:N) conflicts with the required physical proximity.

Local kernel memory read in macOS via a buffer overflow, fixed in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. A local user with low privileges can trigger the overflow to read sensitive kernel data, potentially leaking encryption keys or credentials. No active exploitation or public exploit code is known.

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause application termination or arbitrary code execution. Affected products include iOS and iPadOS prior to version 26.6, macOS before Sequoia 15.7.8 and Tahoe 26.6, tvOS before 26.6, and visionOS before 26.6; no active exploitation or public proof-of-concept has been reported.

Kernel memory corruption in Apple macOS allows a remote, unauthenticated attacker to crash the system or corrupt kernel memory on hosts running versions prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6. Apple's advisory attributes the flaw to insufficient bounds checking (CWE-120), and although the vendor rates it 9.8 with full confidentiality, integrity, and availability impact, our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - the demonstrated outcome is denial of service through kernel termination or memory corruption, with code execution not proven and the triggering service, protocol, or listener undisclosed. No public exploit has been identified at time of analysis, EPSS is low (0.26%, 18th percentile), and CISA's SSVC records exploitation as 'none'; vendor-released patches are available, so remediation should be prioritized on network-exposed macOS hosts rather than treated as an emergency active-exploitation event.

An out-of-bounds write vulnerability in macOS allows a malicious application to cause unexpected system termination. Apple addressed this in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is known, and EPSS indicates very low exploitation probability.

Processing a maliciously crafted video file may lead to memory corruption enabling possible arbitrary code execution on multiple Apple operating systems. Affected platforms include iOS, iPadOS, macOS, tvOS, watchOS, and visionOS; fixes are available in the latest updates (iOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6). User interaction is required to open the malicious video, and no public exploit or active exploitation is known at this time.

Buffer overflow in macOS versions prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to escape its

Kernel memory corruption vulnerability in Apple macOS allows a remote unauthenticated attacker to cause unexpected system termination or potentially execute arbitrary code with kernel privileges. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Although EPSS indicates low exploitation likelihood and no active exploitation or public exploit is reported, the critical CVSS score and network attack vector make patching a priority.

Local kernel memory disclosure and denial-of-service vulnerability in macOS 14.x and 15.x prior to patches. An unauthenticated attacker with local access can trigger a memory handling flaw to read kernel memory or cause unexpected system termination. No active exploitation or public exploit code is known; EPSS score is very low (0.14%).

We are tasked with producing a JSON analysis for CVE-2026-64747. We must use all provided data, including EPSS, SSVC, patch availability, CPE, and tags. The vulnerability is a buffer overflow in Apple products, with an app potentially executing arbitrary code with kernel privileges. CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CWE-120. Patch available from vendor. EPSS 0.19% (low). SSVC: Exploitation none, Automatable no, Technical impact total. KEV status? Not in input, so not KEV. POC? Not mentioned. Tags include RCE, Apple, Buffer Overflow, etc. Affected products: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. CPEs confirm. References are Apple support pages. We must produce fields: - product_name: 1-3 words, specific product. Since it spans many OSes, the "primary one"? The CVE description mentions iOS and iPadOS, macOS, tvOS, visionOS, watchOS. The common underlying component is likely the kernel or something. But the product is Apple's operating systems. Could say "Apple OS Family" or "Apple Kernel". The description says "An app may be able to execute arbitrary code with kernel privileges." So the vulnerability is in the kernel, accessible via an app. So product could be "Apple Kernel" or "Apple Operating Systems". But the instruction says "The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel'." So maybe "Apple Kernel". However, it's not explicitly named. The CPEs list specific products: ios_and_ipados, macos, tvos, visionos, watchos. So I'll use "Apple OS Family" but that is 3 words. "Apple Kernel" is 2 words. I'll go with "Apple Kernel" as the vulnerable component. The description isn't clear if it's the kernel itself or a system library, but "kernel privileges" suggests kernel execution. So "Apple Kernel" is appropriate. - summary: 2-3 sentences, original synthesis, avoid starting with "A vulnerability". Start with impact verb a

Mounting a maliciously crafted disk image on macOS may cause unexpected system termination or corrupt kernel memory. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. The vulnerability is an out-of-bounds read in the kernel's disk image handling, exploitable by a locally authenticated user with no privileges beyond the ability to mount a disk image.

Remote attackers can cause unexpected application termination and potentially read sensitive memory on affected Apple devices. This out-of-bounds read vulnerability, tracked as CVE-2026-64768, affects iOS, iPadOS, macOS, tvOS, and visionOS due to insufficient input validation. No active exploitation or public proof-of-concept code has been identified.

Remote exploitation of a buffer overflow in the macOS kernel allows unauthenticated attackers to corrupt kernel memory or unexpectedly terminate the system, potentially leading to

Denial-of-service vulnerability in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS due to an out-of-bounds write in a shared component. A malicious app executed locally can cause a system crash; the CVSS vector also suggests potential high confidentiality impact (memory disclosure), though the advisory only mentions denial-of-service. Fixed in updates; no active exploitation or public exploit code reported, and EPSS probability is very low (0.17%).

Kernel memory-handling faults in Apple macOS can let a remote attacker cause unexpected system termination or corrupt kernel memory on unpatched systems - macOS Tahoe before 26.6, Sonoma before 14.8.8, and Sequoia before 15.7.8. Apple addressed the flaw with improved memory handling in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, so fully updated builds are remediated; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the EPSS score remains low at 0.24% (15th percentile). Apple's own wording that 'a remote user' may trigger the issue, combined with the published CVSS vector (PR:N) versus our assessed vector (PR:L, AC:H), leaves the authentication prerequisite ambiguous, but the realistically demonstrated outcome is denial of service via kernel panic, with memory-corruption-driven code execution or data disclosure possible in principle but unconfirmed.

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an out-of-bounds write bug. An unauthenticated attacker can trigger heap corruption by sending a malicious payload over the network, leading to unexpected application termination or potential arbitrary code execution with no user interaction required. Apple has released platform patches fixing this critical vulnerability, and while no active exploitation or public exploit is known, the EPSS score indicates low near-term exploitation

Memory corruption in macOS allows a malicious app to write kernel memory or cause unexpected system termination. Affected versions include macOS Sequoia prior to 15.7.8, macOS Sonoma prior to 14.8.8, and macOS Tahoe prior to 26.6. Successful exploitation could lead to complete system compromise with kernel-level privileges, though no active exploitation or public exploit code has been identified and EPSS indicates a low probability (0.16%) of widespread attacks.

Memory corruption in the macOS kernel allows a local app to disclose kernel memory, potentially enabling further exploitation. Fixed in macOS Sequoia 15.7.8 and Sonoma 14.8.8, the vulnerability requires user interaction but no elevated privileges. No public exploit code or active exploitation has been identified, and the EPSS probability is very low (0.15%).

Arbitrary code execution via malicious file processing affects multiple Apple operating systems due to an out-of-bounds write. Fixed in iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation or public exploit is known, and EPSS predicts a very low probability of real-world attacks.

Denial of service in Apple operating systems (iOS/iPadOS 26.6, macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a locally installed app to trigger an integer overflow that causes unexpected system termination. The flaw was reported and patched by Apple, and CISA's SSVC framework rates exploitation as 'none' with EPSS at just 0.17% (6th percentile), indicating no public exploit identified at time of analysis. Note a significant signal conflict: the NVD CVSS vector of 9.8 (AV:N, full C/I/A impact) is inconsistent with the description, which describes only an app-triggered crash.

Sandbox escape in Apple iOS/iPadOS, macOS, and watchOS lets a malicious application break out of its sandbox by triggering an integer overflow (CWE-190) in shared OS code, potentially gaining access beyond its permitted boundaries. Apple discovered and reported the issue and shipped fixes across its platform lineup; there is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none, though the total technical impact and scope change make it a meaningful local sandbox-escape risk. EPSS is low (0.16%, 6th percentile), consistent with no observed exploitation.

Memory corruption vulnerability in Apple operating system kernels (iOS, iPadOS, macOS, visionOS) arises from improper memory handling (CWE-119) and can be triggered by a locally installed application. Successful exploitation may allow an attacker to cause unexpected

A memory handling vulnerability in macOS kernel allows a local malicious application to read kernel memory or trigger an unexpected system termination, without requiring elevated privileges. Fixed versions are macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No public exploit code is known, and the extremely low EPSS likelihood (0.16%) indicates no active exploitation attempts.

Memory corruption vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS) allows an attacker with a maliciously crafted image to corrupt process memory, potentially leading to arbitrary code execution. The issue is fixed in iOS/iPadOS 26.6, macOS Sequoia 15.7.8/macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. No active exploitation has been reported (CISA KEV not listed), and the EPSS score of 0.16% indicates low exploitation likelihood.

Unexpected system termination in macOS prior to Sequoia 15.7.8 and Tahoe 26.6 allows a local application to crash the operating system via an out-of-bounds write. Although the vulnerability is assigned a critical CVSS 9.8 due to potential memory corruption risks, the Apple advisory only confirms denial-of-service impact. No active exploitation is reported, and EPSS (0.15%) indicates low exploitation probability.

An integer overflow vulnerability in macOS can be triggered by a malicious app to cause unexpected system termination, effectively a denial-of-service. The flaw affects macOS versions prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. Although the public CVSS score suggests critical remote code execution, the actual impact appears limited to system crashes, and there is no evidence of active exploitation or public proof-of-concept code.

Unexpected system termination in Apple macOS allows a local application to trigger an integer overflow, causing denial-of-service. Versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 are affected. The vulnerability has a low exploitation likelihood (EPSS 0.16%) and no known active exploitation or public exploit code.

A memory corruption vulnerability in Apple iOS, iPadOS, and macOS when processing a crafted image can allow an attacker to corrupt process memory, potentially leading to arbitrary code execution. Exploitation requires local access and user interaction. Patches are available in iOS 26.6/iPadOS 26.6, macOS Sequoia 15.7.8, and macOS Tahoe 26.6, and no active exploitation or public exploit code

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected application termination or heap corruption via unspecified vectors. Given a CVSS score of 9.8, successful exploitation could lead to full system compromise. Patches are available from Apple in multiple OS updates, and no public exploit or active exploitation has been identified.

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sources: CVE description, CVSS, EPSS, CPE, tags, references, ENISA data. The output must be plain text paragraphs, not arrays/objects. Let's analyze the input: - CVE-2026-64774 - Description: "An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption." - CVSS Score: 9.8, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-190 (Integer Overflow) - EPSS: 0.24%, percentile 16% (low) - Patch: Available from vendor (confirmed by description listing fixed versions) - Reported by: apple - CPE: multiple Apple products: iOS and iPadOS, macOS, tvOS, visionOS - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Integer Overflow (note "Buffer Overflow" tag but it's integer overflow leading to heap corruption, maybe buffer overflow is a result) - ENISA EUVD: affected versions listed: macOS 0 <26.6, macOS 0 <15.7.8, iOS and iPadOS 0 <26.6, macOS 0 <14.8.8, visionOS 0 <26.6, tvOS 0 <26.6. It's weird: "macOS 0 <26.6" maybe means all macOS before 26.6? But they also mention specific Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6. So the affected versions are those prior to these specific fixed versions? - References: many Apple support URLs (128066 to 128072), likely each for a product. Given the description, the integer overflow exists in some component (maybe kernel, a library) across Apple operating systems. It can be triggered remotely by an attacker, leading to unexpected application termination (DoS) or heap corruption (potentially code execution). CVSS says complete confidentiality, integrity, availability impact, but EPSS is low, KEV not mentioned. No POC mentioned. Tags include "Buffer Overflow" which might

Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS, tvOS, watchOS, and visionOS, when processing a malicious accessory. The vulnerability stems from a buffer overflow (CWE-120) addressed with improved bounds checking in the latest updates. No active exploitation or public proof-of-concept is reported; EPSS score is low (0.18%), though the provided CVSS vector implies a critical network-based attack that does not align with the accessory requirement.

We are to produce a JSON object with the required fields, synthesizing all available data. Input data: - CVE: CVE-2026-64762 - Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination. - CVSS: 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-125 (Out-of-bounds Read) - EPSS: 0.15% (percentile 5%), so low exploitation probability. - Patch: Available from vendor - Tags: Apple, Buffer Overflow, Information Disclosure (but CWE is CWE-125, not buffer overflow. Tags may be inaccurate. Description says out-of-bounds read, not buffer overflow. We'll note CWE.) - SSVC: Exploitation: none, Automatable: yes, Technical Impact: total - ENISA EUVD: ID EUVD-2026-49480, affected versions: macOS 0 <14.8.8, macOS 0 <26.6, macOS 0 <15.7.8. Note: "macOS 0" probably means all versions before those fixes, including Sonoma 14.x before 14.8.8, sequoia before 15.7.8, Tahoe before 26.6. But product is macOS. - References: three Apple support articles. Those likely contain patch info. - CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* No KEV mention, so not actively exploited. POC status unknown. So exploitation status: "no public exploit identified at time of analysis" unless there is POC flag, but data says Tags: Apple, ... no mention of POC. I'll assume no public exploit. Now, for each field, construct strings per instructions. product_name: "macOS" (just 3 words? "macOS" is one word. Could be "Apple macOS", but instructions say product name only, not vendor. So "macOS" is fine.) summary: Must not copy or paraphrase description. Synthesize. Provide impact, product, and what attacker can do. Start with specific impact verb and product. Options: "Unexpected system termination in macOS through out-of-bounds read allows...". But description says an app may cause unexpected system termination. So local app can crash the syst

Untrusted texture processing on unpatched Apple devices triggers an integer overflow (CWE-190) in a graphics/texture-parsing component, causing the affected application to terminate unexpectedly. The flaw affects iOS and iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, and macOS Tahoe, tvOS, visionOS and watchOS before 26.6; exploitation requires local access plus user interaction, specifically the victim opening or rendering an attacker-supplied texture (CVSS AV:L/UI:R). Multiple independent signals point to low real-world risk: EPSS is only 0.17% (6th percentile), there is no CISA KEV entry, SSVC rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis - the demonstrated consequence is availability loss (app termination), not proven code execution, and vendor patches are already available for every affected platform.

Out-of-bounds read in Apple Safari's web content processing can crash the browser and potentially leak sensitive memory contents. This vulnerability affects all Apple platforms where Safari rendering is used and is fixed in Safari 26.6, iOS/iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Exploitation requires user interaction to visit a malicious site; no known active exploits or public proof-of-concept exist.

Memory corruption vulnerability in multiple Apple operating systems allows local attackers to achieve arbitrary code execution by processing a maliciously crafted file. Affected versions include iOS, iPadOS, macOS, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been confirmed, and patches are available.

Out-of-bounds write in Apple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker to trigger memory corruption leading to unexpected application termination when a victim processes maliciously crafted content. The flaw affects all major Apple platforms below the fixed versions and was reported and patched by Apple. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile).

Arbitrary code execution in Apple macOS through image processing is fixed in macOS Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. A buffer overflow in handling maliciously crafted images allows local attackers to execute arbitrary code with the victim's privileges upon opening the file. No active exploitation or public proof-of-concept is reported; EPSS predicts low exploitation probability (0.19%).

Denial-of-service in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to trigger an out-of-bounds read, causing app crashes or system instability. The

Arbitrary code execution in Apple iOS and iPadOS, macOS, tvOS, visionOS, and watchOS permits an attacker to run code or terminate apps by luring a user into opening a crafted file. The out-of-bounds write issue was fixed in all supported Apple operating systems via June 2026 updates. No active exploitation or public proof-of-concept has been reported at time of analysis, and EPSS indicates a low probability of future exploitation.

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS/visionOS/watchOS 26.6) allows a remote user to trigger unexpected system termination (denial of service) or corrupt kernel memory, potentially leading to arbitrary code execution in kernel context. Apple addressed the flaw with improved memory handling and credited its own security team. There is no public exploit identified at time of analysis and EPSS probability is low (0.25%), but the CVSS 9.8 rating and CISA SSVC 'total' technical-impact assessment mark it as a high-severity kernel bug.

Out-of-bounds kernel write in the Linux virtio-net driver's receive_big() path allows a malicious or compromised virtio backend (host/hypervisor-side device emulator) to corrupt guest kernel memory. The length validation meant to bound device-announced packet size still permits a ~20-byte gap, so a crafted len drives page_to_skb() one fragment past the page chain, writing into skb_shinfo()->frags[MAX_SKB_FRAGS] and passing a NULL frag up the receive path. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but the flaw carries a high CVSS (8.4) due to kernel-level memory corruption.

Out-of-bounds read in the Qualcomm rmnet (Rmnet Multiplexing and Aggregation Protocol) driver of the Linux kernel allows a local attacker to read kernel slab memory beyond frame boundaries by injecting a short MAP frame while ingress deaggregation is disabled. The no-aggregation ingress path skipped the length validation performed on the aggregated path, so the parser dereferenced the MAP header and checksum trailer using the on-wire pkt_len without verifying skb->len. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 7th percentile) reflects the local-only, niche-driver nature of the flaw rather than widespread mass exploitation.

Kernel memory corruption in the Linux kernel's BPF sockmap subsystem allows a local actor able to load a BPF sk_msg program to trigger an out-of-bounds write via an integer overflow in bpf_msg_push_data(). A crafted u32 'len' argument (typed ARG_ANYTHING) wraps the 'copy + len' page-allocation size to a small value, producing an undersized allocation followed by an oversized memcpy that corrupts kernel heap memory, enabling denial of service and potential privilege escalation. There is no public exploit identified at time of analysis and the EPSS score is low (0.18%), but the flaw is confirmed and patched upstream by kernel maintainers.

Out-of-bounds read in the Linux kernel's net1080 USB networking driver allows a malicious NetChip 1080 (NC1080) USB device to read slab memory past the end of a socket buffer during RX processing. In net1080_rx_fixup(), an even attacker-controlled packet_len is used to index a pad byte (skb->data[packet_len]) before it is validated against the actual frame length, so a short frame advertising a large even packet_len (e.g. 0x4000, bounded only by NC_MAX_PACKET) triggers a KASAN slab-out-of-bounds read in softirq/ksoftirqd context. This is a vendor-fixed kernel hardening bug with no public exploit identified at time of analysis; EPSS is low (0.18%) and it is not in CISA KEV.

Heap out-of-bounds read in the Linux kernel's DRM EDID parser (drm_parse_tiled_block in drivers/gpu/drm/drm_edid.c) lets a crafted DisplayID tiled-display block trigger a slab-out-of-bounds read past the exact-sized kmemdup()'d EDID buffer. The affected code casts the block to struct displayid_tiled_block and reads the fixed 22-byte layout up to topology_id[7] without validating num_bytes, so an EDID advertising a tiled block (DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for DisplayID v2.0) with an undersized payload at the end of a DisplayID extension reads out of bounds, causing kernel memory disclosure or a crash. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and it is not listed in CISA KEV; the fix is upstreamed and backported to multiple stable trees.

Out-of-bounds kernel heap read in the Linux kernel's usbnet gl620a driver allows a malicious GeneLink (GL620A) USB link-cable device to leak adjacent slab memory into the network stack. The flaw is in genelink_rx_fixup(), which trusts a device-supplied per-packet length (bounded only by GL_MAX_PACKET_LEN of 1514 bytes) without checking it against the number of bytes actually received in the URB. Rated CVSS 8.1, it is unauthenticated (PR:N) and needs no user login, but no public exploit identified at time of analysis and EPSS is low at 0.18% (7th percentile).

Stack out-of-bounds write in the Linux kernel Bluetooth subsystem (net/bluetooth/eir.c) lets a local privileged user corrupt kernel stack memory when an LE-only controller assembles legacy advertising data. eir_create_adv_data() prepends a 3-byte 'Flags' AD structure to a fixed 31-byte buffer without accounting for it in the length check, so an advertising instance created with flags == 0 and a maximal adv_data_len causes a 3-byte overflow past the buffer during hci_update_adv_data_sync(). There is no public exploit identified at time of analysis and EPSS is low (0.16%), consistent with a local, capability-gated memory-corruption bug rather than a mass-exploitation target.

Information disclosure and denial of service in GIMP's file-icns plugin allow local attackers to leak heap memory contents via a crafted ICNS image file. When processing a truncated mask resource, the plugin performs an out-of-bounds read, leaking heap data as alpha channel pixel values or crashing the application. User interaction is required to open the malicious file.

Arbitrary code execution in GIMP when opening a crafted FITS file due to an integer overflow in the file-fits plugin that leads to a heap buffer overflow. An attacker can achieve memory corruption and potentially execute arbitrary code with the user's privileges. No public exploit or active exploitation has been identified at time of analysis.

Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.

Denial-of-service in facil.io HTTP/1.1 chunked transfer encoding parser allows remote unauthenticated attackers to crash the server by sending a negative chunk size. Affected versions 0.7.5 through 0.7.6; a public proof-of-concept exploit exists, but no active exploitation (not in CISA KEV) is confirmed. Attackers can trigger the vulnerability without authentication, causing an out-of-bounds read and server crash.

Remote denial-of-service in facil.io through version 0.7.6 allows unauthenticated attackers to crash worker processes by sending a crafted POST request with an empty Content-Disposition header field name. A public proof-of-concept exploit exists. The integer underflow in http_mime_parser.h causes an out-of-bounds memory read and bus fault, resulting in immediate server disruption.

Remote code execution and denial of service are possible against Erlang/OTP nodes that run the megaco application with the optional flex C-driver scanner, because a single text-encoded H.248/Megaco message carrying an oversized property parm name overflows a fixed 512-byte error buffer and corrupts live pointers inside the scanner driver struct. Affected are OTP releases from 17.0 up to the 29.0.4, 28.5.0.4 and 27.3.4.15 fixes (megaco 3.17.1 through 4.9.1, 4.8.3.1 and 4.7.2.2) where {scanner, flex} is configured; exploitation requires only network reachability to the megaco transport port, with no authentication or user interaction (vendor CVSS:4.0 8.3; independent assessment CVSS:3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:H). Reliable code execution is not confirmed and depends on struct/heap-layout grooming, builds compiled with _FORTIFY_SOURCE abort with SIGABRT (denial of service only), no public exploit code was identified at time of analysis, EPSS is 0.73% (51st percentile), and CISA SSVC rates exploitation as none with automatable as no.

Out-of-bounds memory access in the Linux kernel's ntfs3 filesystem driver allows a crafted NTFS image to corrupt kernel memory during NTFS log replay. When log_replay() converts version 0 restart-table records (DIR_PAGE_ENTRY_32 to DIR_PAGE_ENTRY), it derives a memmove() length directly from the attacker-controlled on-disk lcns_follow field, which check_rstbl() does not bound against the entry size; an oversized value drives reads/writes past the allocated restart-table buffer. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but the flaw carries CVSS 7.8 with high confidentiality, integrity, and availability impact because it executes in kernel context when a malicious volume is mounted.

Remote denial of service in ESP32-audioI2S 3.4.5 allows unauthenticated network attackers to crash ESP32 devices by sending crafted MP3 audio data that triggers a buffer overflow in the UnpackFrameHeader() function. Public proof-of-concept code is available, enabling automated exploitation. The vulnerability does not impact confidentiality or integrity.

Heap-based buffer overflow in LibRaw 0.21 allows remote code execution when a user opens a maliciously crafted RAW image file. The flaw resides in the stretch() and fuji_rotate() functions and requires user interaction, enabling a complete compromise of confidentiality, integrity, and availability. Proof-of-concept code exists, but no active exploitation has been confirmed.

Kernel memory leak in the Linux kernel's IIO event subsystem allows local attackers to read kernel memory via a race condition. A local unauthenticated attacker with low privileges can exploit a race between file descriptor installation and FIFO reset to trigger an out-of-bounds read, potentially leaking sensitive kernel data. No active exploitation or public exploit code is currently known, and the EPSS likelihood is low (0.22%).

Out-of-bounds read/write in the Linux kernel's ALSA virtio sound driver allows a malicious hypervisor to corrupt guest memory, potentially leading to code execution or information disclosure. Affected are Linux kernel versions with the CONFIG_SND_VIRTIO option enabled, where the driver trusts device-supplied control metadata without validation. Exploitation requires a compromised or malicious host with local access to the virtualized guest; no public exploit or active exploitation has been identified.

Out-of-bounds array access in the Linux kernel PCI SR-IOV subsystem crashes the kernel when a GPU or other PCIe device becomes unresponsive during a power-state restore. Inside `sriov_restore_vf_rebar_state()` (drivers/pci/iov.c:948), if the VF Resizable BAR Control register returns PCI_ERROR_RESPONSE (0xffffffff), the 3-bit `nbars` and `bar_idx` fields both evaluate to 7, which exceeds the `barsz[]` array bound of 6 (PCI_SRIOV_NUM_BARS), triggering a UBSAN array-index-out-of-bounds kernel crash. Observed in production on NVIDIA RTX PRO 1000 (GB207GLM) hardware during a failed GC6 power-state exit; no public exploit code identified at time of analysis.

Out-of-bounds slab read in the Linux kernel TIPC (Transparent Inter-Process Communication) protocol lets a malicious TIPC neighbour trigger a heap over-read by sending a single crafted broadcast PROTOCOL/STATE_MSG carrying a Gap ACK blocks record. Affecting kernels 5.8 through the fixed stable releases, the broadcast path (tipc_bcast_sync_rcv → tipc_link_advance_transmq) fails to bound the Gap ACK record against the actual message data size, so kmemdup() copies up to 1024 bytes past a ~704-byte skb, corrupting/leaking adjacent slab memory and crashing the host (KASAN slab-out-of-bounds). No public exploit is identified at time of analysis and EPSS is low (0.22%), consistent with a niche, non-default kernel subsystem.

Local privilege escalation in Linux kernel's vme_user staging driver via an out-of-bounds write in slave read/write helpers. A local attacker can overflow the fixed-size kern_buf when the VME window exceeds 128 KiB, leading to arbitrary code execution. No active exploitation or public exploit is known, but the vulnerability has been confirmed dynamically with KASAN; EPSS indicates low exploitation probability.

Out-of-bounds read in the Linux kernel's CIFS client during SMB2 message validation allows an unauthenticated remote attacker acting as a malicious server to leak kernel memory and crash the client before session authentication. The vulnerability, which affects the smb2_check_message() function, can be triggered during NEGOTIATE or SESSION_SETUP exchanges. No active exploitation has been reported, and the EPSS probability is low (0.22%).

Heap buffer overflow in the Linux kernel's rtl8723bs staging WiFi driver (rtw_cfg80211_set_wpa_ie()) allows a local low-privileged user to corrupt kernel memory by one byte via a crafted nl80211 connect request, enabling potential privilege escalation to kernel context. The 256-byte supplicant_ie array in struct security_priv overflows when a WPA IE with length 255 is supplied, writing 257 bytes and clobbering the adjacent last_mic_err_time field; a flawed length check in rtw_parse_wpa_ie() using u8 narrowing silently permits the overflow. Patches are available across all active stable kernels; EPSS is 0.23% and no public exploit or CISA KEV listing exists at time of analysis.

Out-of-bounds read in the Linux kernel's rtl8723bs staging driver allows adjacent network attackers to read sensitive kernel memory and cause denial of service via a malicious association response. Exploitation requires a rogue access point sending crafted IE data. Patches are available, and no active exploitation or public exploit has been reported.

Out-of-bounds read in the Linux kernel's staging rtl8723bs Wi-Fi driver can be triggered by a malicious Access Point sending a crafted Beacon frame, allowing an adjacent attacker to read sensitive kernel memory and potentially crash the system. Affected kernels from version 4.12 onwards that include the rtl8723bs driver; vendor patches are available.

Out-of-bounds write in the Linux kernel's rtl8723bs staging Wi-Fi driver when processing a maliciously crafted 802.11 Association Response frame. An attacker within Wi-Fi range can send an oversized HT Capabilities IE, leading to up to 229 bytes of kernel memory corruption, resulting in high integrity and availability impact with no user interaction or authentication required. No public exploit or active exploitation is known; EPSS indicates very low exploitation probability (0.22%).

Uninitialized memory read in the Linux kernel's PF_KEY IPComp implementation allows local unprivileged users to disclose kernel memory or cause a denial of service. The vulnerability arises from a missing initialization of the alg_key_len field in the xfrm_algo structure when adding IPComp security associations, leading to an out-of-bounds slab read during XFRM state migration. Affected are all Linux kernels since version 2.6.21, with patches backported to multiple stable series.

Heap-based out-of-bounds write in the Linux kernel's ntfs3 filesystem driver during journal replay allows local attackers to achieve kernel code execution by mounting a malicious NTFS image. The vulnerability exists because log_replay() does not validate Dirty Page Table capacity against attacker-controlled fields, leading to a slab corruption. No active exploitation or public exploit code has been identified, and the attack requires user interaction to mount a crafted filesystem.

Out-of-bounds memory write in the Linux kernel's legacy NTFS driver allows a local attacker with filesystem mount privileges to corrupt kernel heap memory via a crafted NTFS image. The flaw lives in `ntfs_icx_ib_sync_write()`, which unconditionally calls `post_write_mst_fixup()` even when `pre_write_mst_fixup()` has already rejected the index block as invalid - the caller does not distinguish between I/O errors and validation failures. By manipulating `usa_ofs` or `usa_count` fields in the NTFS index block, an attacker can drive both slab-out-of-bounds reads and writes into the kernel, as confirmed by KASAN traces in the bug report. No public exploit or CISA KEV listing exists; EPSS is 0.20%.

Integer overflow in the Linux kernel's TCP networking subsystem (net/ipv4) allows a local user with network-namespace privileges to trigger an out-of-bounds read, potentially disclosing kernel memory or crashing the system. Writing a negative integer to the `net.ipv4.tcp_reordering` sysctl causes a silent type-coercion wrap when the value is copied into the `u32 tp->reordering` field, producing an enormous effective value. When `tcp_mtu_probing=2` is also active, this wrapped value overflows the `size_needed` computation in `tcp_mtu_probe()`, bypassing send-queue and window bounds checks entirely, leading to a CWE-190 integer overflow driving a subsequent out-of-bounds read. No public exploit and no KEV listing have been identified at time of analysis; EPSS is 0.23%.

Stack buffer over-read in the Linux kernel's netfilter ebtables module allows a local attacker with low privileges to read kernel stack data and potentially crash the system. When updating ebtables counters, a 32-byte user-supplied table name is passed without NUL-termination to a kernel function that uses it in a module autoload request, causing vsnprintf to read beyond the stack buffer. No active exploitation or public exploit code is known, and EPSS indicates a low exploitation probability (0.22%).

Out-of-bounds read in the Linux kernel's Bluetooth L2CAP configuration option parser allows an adjacent attacker to crash the system or leak up to 4 bytes of kernel memory. The vulnerability arises from a validate-after-use bug where an attacker-controlled option length is dereferenced before checking bounds, affecting all Bluetooth-enabled kernels prior to the fix

Out-of-bounds write in the Linux kernel's CoreSight ultrasoc-smb driver when used as a perf AUX sink allows a local attacker to elevate privileges. The vulnerability arises from improper page index normalization in smb_sync_perf_buffer(), leading to a heap buffer overflow. Although no active exploitation or public proof-of-concept is known, the weakness has been patched upstream and carries an EPSS score of 0.21%.

Memory leak in the Linux kernel's SMB client encrypted receive path (receive_encrypted_standard()) allows a local low-privileged user or a cooperative malicious SMB server to exhaust kernel heap memory, with potential for heap grooming-based privilege escalation. The bug was introduced with commit b24df3e30cbf and affects multiple stable kernel series from 4.19 onward. No public exploit code exists and EPSS is 0.22%, but the kernel team's classification of CWE-787 and a C:H/I:H/A:H CVSS score reflect the Linux security team's assessment that the leaked kernel buffer is exploitable beyond simple resource exhaustion.

Local privilege escalation via stack buffer overflow in the Linux kernel's hid-goodix-spi driver allows a user with access to a Goodix SPI HID device node to corrupt kernel stack memory and achieve full system compromise. The goodix_hid_set_raw_report() function copies caller-supplied report data into a fixed 128-byte stack buffer without bounds checking, so a hidraw SET_REPORT ioctl carrying more than ~116 bytes overflows it. There is no public exploit identified at time of analysis, and the low EPSS score (0.23%) plus the local-only, hardware-specific attack surface indicate limited real-world exposure despite the high 7.8 CVSS.

Out-of-bounds write in the Linux kernel's HID wacom driver allows an adjacent attacker to corrupt kernel memory, potentially achieving code execution or crashing the system. The flaw, present in kernels from commit 5e013ad2... up to the fixed versions 6.18.39, 7.1.4, and 7.2-rc1, stems from a missing emptiness check that causes the FIFO to read stale data and bypass the buffer size guard. No active exploitation or public exploit code has been identified, and EPSS predicts a low exploitation probability (0.22%).

Out-of-bounds bit manipulation in the Linux kernel HID multitouch driver allows an attacker with a crafted USB or Bluetooth multitouch device to corrupt adjacent kernel data structures and panic the kernel. The driver uses mt_io_flags - a single unsigned long - as a variable-length per-slot bitmap indexed by slot number, which is bounded only by the device-reported ContactCountMaximum (up to 255). When that value exceeds BITS_PER_LONG, set_bit()/clear_bit() operations in mt_release_contacts() overwrite adjacent struct mt_device members, zeroing the td->applications list head and causing a null-pointer dereference in softirq context. No local privileges are required; physically connecting a crafted device is sufficient. No public exploit code has been identified at time of analysis.

Integer wrap-around in the Linux kernel's HFS/HFS+ filesystem driver allows a local low-privileged user to bypass a critical bounds check, triggering a memmove that reads approximately 4GB past a node buffer in kernel memory. The flaw originates in check_and_correct_requested_length(), where u32 arithmetic on off+len wraps silently when len arrives as a large underflowed value from hfs_brec_remove(); the wrapped result passes the node_size guard and proceeds to an out-of-bounds memory operation. No public exploit has been identified at time of analysis, and EPSS stands at 0.22%, reflecting low real-world exploitation expectation despite full C:H/I:H/A:H impact ratings.

An out-of-bounds memory access in the Linux kernel's BPF devmap broadcast redirect for XDP frames, introduced in version 5.14, can be triggered by remote unauthenticated attackers sending specially crafted fragmented network packets. This could lead to kernel memory corruption and arbitrary code execution. Though CVSS rates this as critical (9.8), no public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.21%).

Local privilege escalation in the Linux kernel's digi_acceleport USB serial driver allows authenticated local users to corrupt kernel memory and execute arbitrary code as root. The vulnerability arises from a race condition in the digi_write_inb_command() function that mishandles timeouts and incorrectly updates transfer buffers, leading to write buffer corruption. No active exploitation has been reported, and publicly available exploit code has not been identified; a vendor patch is available across multiple stable kernel branches.

Out-of-bounds array read in the Linux kernel's USB Type-C Port Manager (TCPM) svdm_consume_modes() function allows a physically connected malicious USB-C partner device to read kernel memory beyond the svids[] array boundary and force registration of an arbitrary, attacker-chosen SVID via typec_partner_register_altmode(). The vulnerability arises because pmdata->svid_index - which is incremented in response to partner-supplied SVDM messages - is never validated against SVID_DISCOVERY_MAX (16) before indexing pmdata->svids[]. Patches are confirmed available across eight stable kernel branches (5.10 through 7.2-rc3); no public exploit or CISA KEV listing exists at time of analysis.

Local denial of service in the Linux kernel UDF filesystem allows an unprivileged local user to panic the system by truncating a file on a crafted UDF media. On desktop systems where polkit permits unprivileged mounting of removable media, an attacker can trigger this reliably. The vulnerability has public patches with exact fixed versions and a low EPSS exploitation probability (0.21%).

Out-of-bounds read in the Linux kernel's UDF filesystem driver allows a local low-privileged attacker to leak kernel memory or cause a denial of service by mounting a crafted UDF image with a malicious Virtual Allocation Table (VAT) header. The vulnerability resides in the udf_load_vat() function, which fails to validate the attacker-controlled VAT header length against the inode size, leading to a large out-of-bounds read index. No active exploitation or public proof-of-concept has been identified; EPSS predicts a very low exploitation probability (0.22%).

Out-of-bounds read and write in the Linux kernel's UDF filesystem driver allows a local attacker with the ability to mount a crafted UDF image to escalate privileges to root. The vulnerability stems from the sparing table length being validated as a byte count but consumed as an entry count, leading to memory corruption. No active exploitation (KEV) or public proof-of-concept is currently known, and EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.

Out-of-bounds heap read in the Linux kernel's nvmet-auth module allows pre-authentication remote attackers to read up to 526 bytes of heap memory beyond a crafted DHCHAP_REPLY message. By sending an NVMe-oF authentication reply with a small transfer length but inflated hash and DH value length fields, an unauthenticated attacker can extract sensitive data or cause a denial-of-service. Patches are available in upstream stable kernels.