Buffer Overflow

Information disclosure in the Linux kernel's isofs filesystem driver allows a local attacker to leak up to 255 bytes of kernel heap memory to userspace by mounting a crafted ISO 9660 image. Because

Incorrect carry overflow in the Linux kernel's ECC vli multiplication allows adjacent network attackers to cause incorrect ECDH shared secret derivation, potentially enabling man-in-the-middle attacks against ECDH-based protocols such as IPsec, TLS, and Wi-Fi WPA3. The vulnerability, introduced in kernel 4.8, can be exploited without authentication or user interaction if ECDH is enabled. No active exploitation or public exploit has been identified, but the bug fundamentally weakens cryptographic guarantees.

Out-of-bounds write in the Linux kernel Intel QAT (Quick Assist Technology) RSA CRT driver corrupts kernel DMA memory when a local attacker supplies an RSA private key with CRT components larger than half the modulus size. The QAT driver's qat_rsa_setkey_crt() allocates DMA buffers at key_sz/2 but the right-alignment expression `dst + half_key_sz - len` wraps on unsigned underflow when len > half_key_sz, directing memcpy to write attacker-controlled bytes past the DMA allocation. No public exploit code exists at time of analysis; EPSS is 0.22% and the bug has been present since Linux 4.8 across all maintained stable branches.

Use-after-free vulnerability in the Linux kernel's fsl-lpspi SPI driver can lead to memory corruption or arbitrary code execution with kernel privileges. A local attacker with high privileges on systems using the affected driver can trigger this flaw, potentially causing a kernel panic or full system compromise. At time of analysis, no public exploit or active exploitation is identified, and EPSS indicates low exploitation probability (0.22%).

Out-of-bounds slab read in the Linux kernel tracing subsystem allows a local attacker with access to the trace event filter interface to leak kernel slab memory or crash the kernel. The flaw exists because `regex_match_glob()` ignores the bounded length passed by filter predicate functions and calls the NUL-terminated-string-only `glob_match()`, which scans past the end of non-NUL-terminated dynamic string fields - exemplified by XFS namespace tracepoints whose dynamic char arrays are copied without a trailing NUL. EPSS is 0.22% (13th percentile); no public exploit code exists and the vulnerability is not listed in CISA KEV.

Out-of-bounds read and write in the Linux kernel exFAT filesystem driver's `exfat_find_dir_entry()` allows a local attacker with low privileges to corrupt kernel heap memory or read adjacent kernel data by mounting or triggering access to a crafted exFAT filesystem image. The bug arises because the `uniname` output pointer advances by a fixed stride of `EXFAT_FILE_NAME_LEN` (15 code units) per TYPE_EXTEND directory entry regardless of actual content length, while the loop guard only checks accumulated `name_len` — a discrepancy a malicious image can exploit indefinitely. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is 0.22%.

Integer overflow in the Linux kernel's KVM guest_memfd memslot binding logic allows a local attacker with low privileges to bypass a critical bounds check, potentially enabling memory corruption with high confidentiality, integrity, and availability impact. The flaw, introduced because offset and size were stored as signed loff_t rather than unsigned uoff_t values, causes the sum of a large positive offset and a valid size to silently wrap into a negative 64-bit value, which always satisfies the less-than comparison against the positive inode size. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.22% (13th percentile), but successful exploitation on an affected KVM host or guest would be severe.

Out-of-bounds read and write in the Linux kernel's synaptics-rmi4 F3A GPIO driver allows local low-privileged users to leak adjacent kernel slab memory to userspace or perform a controlled heap write via the evdev ioctl interface. The root cause is a size mismatch: gpio_key_map is allocated for at most 6 entries while input->keycodemax is set to the full device-reported gpio_count (up to 127), causing the input core's EVIOCGKEYCODE and EVIOCSKEYCODE ioctls to index past the allocation. No public exploit has been identified at time of analysis; EPSS is 0.22%.

Out-of-bounds read and write in the Linux kernel synaptics-rmi4 input driver allows a local attacker with low privileges to gain full root access by exploiting a bound-check flaw in the F30 GPIO/LED interrupt handler. Affects kernels where gpioled_count exceeds 6 and GPIO support is enabled, leading to memory corruption through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls. No known active exploitation, no public exploit code, and EPSS risk is very low (0.22%).

Stack out-of-bounds write in the Linux kernel Goodix touchscreen driver allows kernel stack memory corruption through a malicious, counterfeit, or physically tampered Goodix I2C touchscreen controller that advertises more than the supported maximum of 10 contact points. All Linux kernel versions from 4.1 through the pre-patch stable series are affected on systems equipped with Goodix GT-series touchscreen hardware; patched releases are available across all active stable branches. No public exploit code exists and no active exploitation has been reported (absent from CISA KEV), with EPSS placing exploitation probability at 0.22%.

Out-of-bounds heap write in the Linux kernel iforce force-feedback input driver allows a physically connected malicious device to corrupt kernel memory. The iforce driver's status packet handler blindly uses a device-supplied effect index masked only to 0-127 as an array subscript into a 32-entry array, enabling `test_and_set_bit`/`test_and_clear_bit` operations up to 95 entries past the array boundary and into trailing kzalloc'd structure members. No confirmed active exploitation exists (not in CISA KEV), and EPSS probability is very low at 0.22% (13th percentile), but successful exploitation against an unpatched kernel yields high confidentiality, integrity, and availability impact at the kernel heap level.

Heap out-of-bounds write in the Linux kernel's touchwin serial touchscreen driver allows a malicious, malfunctioning, or counterfeit Touchwindow peripheral to corrupt kernel heap memory one attacker-chosen byte at a time, potentially enabling local privilege escalation or kernel crash. The flaw exists since Linux 2.6.19 and affects all stable branches through 7.1.3 and pre-7.2-rc1; patched versions have been released across six stable series (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4). EPSS is 0.22% (13th percentile) and no public exploit or CISA KEV listing has been identified, reflecting the niche hardware prerequisite that sharply limits real-world exposure.

Stack out-of-bounds write in the Linux kernel's mms114 touchscreen driver allows a physically-positioned attacker with access to the I2C bus - or the ability to substitute a malicious or counterfeit controller - to overwrite the IRQ-thread stack, corrupting the stack canary, saved registers, and return address for potential kernel-level code execution. Affected systems include Linux kernel builds from version 3.6 onward that load the mms114 driver on hardware incorporating the Melfas MMS114 touchscreen controller. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at just 0.21%, consistent with the narrow hardware-specific attack surface.

Out-of-bounds write in the Linux kernel's siw RDMA driver allows a remote attacker on an established iWARP connection to cause memory corruption and potential code execution by sending a crafted sequence of Read Response segments that exceed the read request's buffer length. Affects all Linux kernel versions with the siw driver since 5.3. No public exploit is known, and EPSS score is low (0.22%), but the CVSS rating is Critical (9.8).

Remote code execution in Knot Resolver versions prior to 6.4.1 stems from a heap-based buffer overflow triggered along the DNS-over-QUIC (DoQ) receive path, allowing a remote unauthenticated attacker to corrupt heap memory by sending malformed QUIC-transported DNS traffic to an exposed resolver. Because the flaw lives in the query-receiving code, any Knot Resolver instance that has DoQ listening is reachable over the network without credentials. Publicly available exploit code exists (a dedicated 'knot-doq' proof-of-concept was published), and the issue was disclosed via oss-security; it is not listed in CISA KEV, so there is no confirmation of active exploitation yet.

Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an out-of-bounds read. An attacker sending a specially crafted Thrift message can trigger this to read beyond the buffer, potentially leaking sensitive memory contents. Remote unauthenticated exploitation is possible against any service using vulnerable bindings, and the issue is fixed in version 0.24.0.

Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending specially crafted compressed data. Affects all versions prior to 0.24.0. No active exploitation or public exploit code has been reported at this time.

Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affects C++ and c_glib bindings before 0.24.0. Attackers can send crafted messages to crash the service. No known active exploitation or public exploit code.

Memory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to exploit an integer overflow when calculating physical offsets for sparse PMRs larger than 4 GB, causing GPU MMU mapping errors that grant access to unintended physical memory. The vulnerability has a CVSS score of 9.8 and is considered automatable, but EPSS indicates low exploitation probability (0.14%) and no active exploitation or public exploit code is known at this time.

...

Heap out-of-bounds write in FFmpeg's native PNG and APNG encoders (all versions through 8.1.2) allows remote attackers who can supply a crafted PNG image to cause deterministic heap corruption and a potential arbitrary code execution primitive. The root cause is `add_exif_profile_size()` underestimating the required output buffer when multiple EXIF IFD entries share a large value payload - canonical serialization expands the deduplicated entries back to full size, causing `png_write_chunk()` to write tens of thousands of bytes past the allocated boundary. No public exploit exists and EPSS places exploitation probability at 0.55%, but VulnCheck reports the heap corruption is deterministic, elevating the eventual RCE risk.

Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).

Heap-based buffer overflow in the vf_hqdn3d denoising filter of FFmpeg versions up to 8.1.2 allows remote attackers to execute arbitrary code by tricking a user into processing a crafted video with filter graph reinitialization explicitly disabled (-reinit_filter 0). Exploitation requires the vulnerable filter to be applied to input where frame width increases after the initial frame, causing an undersized buffer allocation and subsequent out-of-bounds write. No active exploitation or public proof-of-concept is known at time of analysis; EPSS score is low (0.29%).

Pre-authentication remote code execution in libssh2 1.11.1 and earlier allows a malicious SSH server to compromise any connecting client. A heap buffer overflow in the Encrypt-then-MAC (ETM) cipher negotiation path overwrites heap metadata, enabling tcache bin confusion and function pointer control before user authentication. No active exploitation is known, and EPSS is low (0.32%), but the client-side impact is severe if a victim can be lured to an attacker-controlled server.

Memory corruption in libssh2's publickey response parser allows a malicious SSH server to leak heap pointers and corrupt the heap, potentially leading to remote code execution. The issue affects libssh2 versions up to 1.11.1 and is triggered when a client connects to an attacker-controlled SSH server and fetches public keys, with no authentication required on the server side. A patch is available in commit a13bb6c, though no tagged release includes the fix yet; no active exploitation or public exploit code is currently reported.

Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.

Out-of-bounds memory access in the Linux kernel’s iwlwifi wireless driver allows a remote attacker on the same WiFi network to corrupt kernel memory, potentially leading to code execution or system crash. The flaw occurs in Block Acknowledgment session handlers where the sta_mask field is not checked before being used to index an array, causing a wrap-around when the mask is zero. Affected are kernel versions prior to 6.18.38 and 7.1.3; no active exploitation or public exploit code is known at this time, and EPSS indicates a low probability of exploitation.

Out-of-bounds read in the Linux kernel elan_i2c touchpad driver allows a local authenticated user to leak kernel memory or crash the system by supplying a malformed firmware blob. The driver fails to validate that the firmware file is large enough to contain the expected number of pages plus the trailing signature before accessing them, affecting all stable kernel branches from 5.10.x through 7.x prior to their respective fix versions. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.17% (6th percentile), indicating this is a local hardware-driver concern rather than an imminent widespread threat.

Out-of-bounds array access in the Linux kernel's OcteonTX2 CGX network driver exposes kernel memory to read or corruption when hardware firmware returns an unexpected link speed index value. The `cgx_speed_mbps` array holds 13 entries (indices 0-12) but the `RESP_LINKSTAT_SPEED` firmware response field can produce values 0-15, causing indices 13-15 to access memory beyond the array boundary. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile) with no CISA KEV listing, though patches are now available across multiple stable kernel branches.

A stack buffer overflow in the AMD display driver (dc_process_dmub_aux_transfer_async) within the Linux kernel allows a local authenticated attacker with low privileges to potentially execute arbitrary code or crash the system. The flaw arises from missing bounds checks on payload length and link_index, impacting all kernels before the patched versions. While no active exploitation or public proof-of-concept is reported, the issue affects a wide range of systems with AMD GPUs.

Out-of-bounds write in the Linux kernel's netfs subsystem enables a local, low-privileged attacker to corrupt kernel memory by crafting network filesystem I/O operations that cause iov_iter_extract_pages() to overfill the pages[] array in netfs_extract_user_iter(). The memory corruption occurs before any bounds guard is applied, making this a CWE-787 write-past-end condition with kernel privilege escalation potential. No public exploit code exists and the CVE is absent from the CISA KEV catalog; EPSS is 0.17% (6th percentile), consistent with no observed active exploitation.

Out-of-bounds read in the Qualcomm QMP USB-C PHY driver (`phy: qcom: qmp-usbc`) of the Linux kernel allows a local low-privileged user to read kernel memory beyond the bounds of the `swing_tbl` and `pre_emphasis_tbl` DisplayPort signal-tuning arrays, risking kernel memory disclosure or a kernel panic. The root cause is an off-by-one error where the boundary guard uses `> 4` instead of `>= 4`, permitting array index 4 on 4-element (0-3) rows. Exploitation is constrained to Qualcomm SoC hardware with USB-C DisplayPort capability; EPSS at 0.15% (5th percentile) and the absence of a KEV listing indicate no public exploit and very low current exploitation probability.

Memory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during parsing of Add Source or Modify Source PDUs, leading to a stack buffer overflow or arbitrary out-of-bounds read. This can result in full device compromise. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability, but a vendor patch is available.

Buffer overflow in Apache NimBLE's HCI socket transport (through version 1.9.0) allows an adjacent attacker with a malicious or compromised Bluetooth controller to execute arbitrary code on the host by sending an oversized HCI event. Exploitation requires either a misconfigured event pool size or control of the controller on the HCI link, not over-the-air Bluetooth access. No active exploitation or public exploit code is known, and the real-world risk is low despite a CVSS 7.5 rating.

Stack overflow vulnerability in Perl module TOML::XS versions prior to 0.06 stems from an uncontrolled recursion flaw in the bundled, unmaintained tomlc99 library. An unauthenticated remote attacker can cause denial of service or potentially achieve arbitrary code execution by sending a deeply nested TOML document to any application using from_toml to parse untrusted input. No active exploitation or public exploit code has been identified, but the flaw is easily reachable over the network.

Remote code execution and credential exfiltration in Snowflake libsnowflakeclient versions before 2.9.2 stem from three distinct flaws in the C client library: a stack-based buffer overflow (CWE-121) and an out-of-bounds write in the file-download path, plus improper validation of connection parameters. A lower-privileged principal sharing an internal stage can plant a file with crafted encryption metadata that corrupts memory in a higher-privileged victim process, while the connection-parameter flaw can redirect outbound authentication requests carrying credentials and tokens to an attacker endpoint. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the vendor fixed all issues in 2.9.2, which users must manually install.

Remote code execution in Microsoft Account arises from a heap-based buffer overflow that an unauthorized, network-based attacker can trigger without authentication or user interaction, per the CVSS:3.1 vector (AV:N/PR:N/UI:N). The CVSS temporal data indicates exploit maturity is Unproven (E:U), so no public exploit identified at time of analysis and the issue is not on CISA KEV; however, an official vendor fix (RL:O) with Confirmed report confidence (RC:C) is already available. Given the 9.8 base score and full confidentiality/integrity/availability impact, this warrants priority remediation despite the current absence of exploit code.

Out-of-bounds write in Google Chrome's Codecs component allows remote unauthenticated attackers to potentially escape the browser sandbox and compromise the system via a crafted HTML page. The vulnerability affects Chrome versions before 150.0.7871.186. No active exploitation or public exploit is known, but prompt patching is essential given the high impact.

Denial-of-service in MZ Automation's lib60870, an open-source IEC 60870-5-101/104 telecontrol protocol library used in ICS/SCADA systems, allows remote attackers to crash the message-parsing process via a malformed protocol frame that triggers an out-of-bounds read (CWE-125). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high availability impact and limited confidentiality exposure. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Remote code execution in MZ Automation's libiec61850 IEC 61850 library is possible via a crafted MMS Initiate request that triggers a heap-based buffer overflow (CWE-122); RCE was demonstrated on hosts with ASLR disabled, while ASLR-enabled deployments face memory corruption or denial of service. Any device or application embedding this library and exposing the MMS/TCP (typically port 102) service to attacker-reachable networks is affected. Reported through CISA ICS-CERT (ICSA-26-204-06); no public exploit identified at time of analysis and no EPSS/KEV signal is present in the source data.

Denial of service in MZ Automation's libiec61850 library allows remote unauthenticated attackers to corrupt memory by sending a crafted Read Request, triggering a stack-based buffer overflow (CWE-121). The flaw affects the IEC 61850 MMS server implementation used in power-grid and industrial automation devices, and was disclosed via a CISA ICS advisory (ICSA-26-204-06). No public exploit is identified at time of analysis, and the vendor CVSS 4.0 vector scores only availability impact, indicating a service crash rather than confirmed code execution.

Heap out-of-bounds write in FFmpeg's vf_swaprect video filter (versions 3.0 through 8.1.2) lets an attacker corrupt heap memory by getting the library to process a crafted NV12 video frame with odd width, causing an 18-byte copy into a 17-byte buffer. Successful exploitation causes at minimum a process crash and potentially arbitrary code execution in the context of the application embedding FFmpeg. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and it is not on CISA KEV.

Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.

Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.

Heap out-of-bounds write in FFmpeg's TDSC video decoder (versions 2.7 through 8.1.2) lets a remote attacker corrupt heap memory and potentially achieve code execution when a victim opens or transcodes a crafted AVI file whose frame dimensions change across TDSF frames. The flaw carries a CVSS 4.0 base score of 8.5 with high confidentiality, integrity, and availability impact, and requires the target to process the malicious file (UI:P). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by VulnCheck.

Out-of-bounds heap read in PyTorch torchvision's native GIF decoder (versions through 0.28.0) lets attackers who supply a malicious or truncated GIF trigger a segmentation-fault denial of service or leak adjacent heap memory. The flaw sits in the libgif read_from_tensor callback, which passes an unclamped length to memcpy. A public exploit and reproducer exist and an upstream fix is available (commit 4e05dc2), but there is no public exploit identified in the sense of confirmed active exploitation - it is not on CISA KEV. Applications that decode untrusted GIFs via torchvision are affected.

Out-of-bounds memory access in Apple swift-nio-ssl allows information disclosure and denial of service when parsing X.509 certificates with non-ASN1_STRING Subject Alternative Names. The vulnerability affects versions prior to 2.37.2 and can be triggered locally by a crafted certificate, leading to potential data leakage or process crash. Public proof-of-concept code exists, but no active exploitation has been reported at this time.

Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.

Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to crash the process (denial of service) or trigger undefined behavior by supplying maliciously crafted BSON data that is mishandled during aggregation pipeline processing (CWE-122 heap overflow). Only servers explicitly started in the non-default compute mode are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical) despite high attack complexity and a required precondition.

Out-of-bounds read and write in the FFmpeg ADX audio decoder (libavcodec/adxdec.c) affects versions 4.4 through 8.1.2, where a mid-stream channel layout change corrupts memory. When AV_PKT_DATA_NEW_EXTRADATA side data arrives mid-stream, adx_decode_frame re-parses the header but leaves the internal channel state stale, so later decode operations index the prev[] state array with a wrong channel count. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw enables both reads and writes and carries a CVSS 4.0 base score of 8.7.

Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. No public exploit identified at time of analysis; a vendor upstream fix commit is available, and CVSS 4.0 is rated 8.7 (High).

Stack buffer overflow in FFmpeg's Vulkan HEVC hardware decoder (versions 8.0 through 8.1.2) lets remote attackers overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream, potentially achieving arbitrary code execution. The flaw sits in the vk_hevc_end_frame function, where a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS overflows stack-allocated arrays. Reported by VulnCheck with an upstream fix committed; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation appears theoretical for now despite the high CVSS 4.0 score of 8.7.

Heap buffer overflow (out-of-bounds write) in FFmpeg's VobSub subtitle demuxer lets an attacker corrupt adjacent heap memory and potentially achieve arbitrary code execution in any application that links FFmpeg's libavformat and processes a malicious .sub/.idx file. All releases from 2.1 through 8.1.2 are affected. A vendor patch exists (commit dbd495f) and the issue was reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote denial-of-service in NLnet Labs Unbound 1.9.0 through 1.25.1 allows an unauthenticated attacker to crash the recursive DNS resolver by sending a single malicious encrypted DNSCrypt query over TCP. The TCP in-place encryption routine omits the reply-length clamp that protects the UDP path, so an oversized reply is shifted 48 bytes forward past the end of a heap allocation sized to 'msg-buffer-size' (CWE-122). Only builds compiled with '--enable-dnscrypt' and an active 'dnscrypt:' clause are affected; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Denial-of-service via stack-based buffer overflow affects Hikvision DS-2CD and DS-2DE series IP cameras, where an authenticated attacker sending specially crafted network packets can corrupt memory and force device malfunction. The vendor's CVSS vector claims full confidentiality and integrity impact (C:H/I:H) in addition to availability, hinting at possible code execution beyond the DoS described, though the advisory text only states device malfunction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Denial of service (with potential memory corruption) in select Hikvision network cameras - specifically the DS-2CD and DS-2DE series - lets remote unauthenticated attackers crash or destabilize a device by sending specially crafted packets that trigger a heap buffer overflow. The flaw carries a CVSS 7.7 (AV:N/PR:N) and, per the supplied CVSS vector, high integrity and availability impact, though the vendor advisory characterizes the primary observable effect as device malfunction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

An out-of-bounds read and write in ANGLE within Google Chrome on Android allows a remote attacker to potentially escape the browser sandbox via a crafted HTML page. The flaw is patched in Chrome 150.0.7871.182. No public exploit or active exploitation has been reported; EPSS estimates a low 0.16% probability of exploitation.

Stack buffer overflow in V8, Chrome's JavaScript engine, enables remote code execution confined to the renderer sandbox when a victim visits a specially crafted HTML page. Affects all Google Chrome releases prior to 150.0.7871.182 on all desktop platforms. No public exploit code or active exploitation has been confirmed at time of analysis; vendor-released patch 150.0.7871.182 is available and should be applied immediately given the broad attack surface.

Sandbox escape in the Chromecast component of Google Chrome before 150.0.7871.182 lets a local attacker corrupt memory through an integer overflow (CWE-190) triggered by crafted network traffic, potentially breaking out of the renderer sandbox to gain broader access on the host. Google rated the Chromium severity High, and the CVSS score is 9.3 driven by the scope change from a sandbox escape. There is no public exploit identified at time of analysis, EPSS exploitation probability is very low (0.10%), and CISA SSVC marks exploitation as none.

Sandbox escape in Google Chrome prior to 150.0.7871.182 via an out-of-bounds write in the ANGLE graphics layer allows remote attackers to escape the browser sandbox after compromising the renderer process. No active exploitation or public exploit has been confirmed; EPSS likelihood is very low.

Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.

Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.

Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 stems from a heap-based buffer overflow in the set_ap_param command exposed by the /localcfg endpoint. An authenticated attacker who can reach the device's local configuration interface can send oversized input to crash the charger or potentially execute arbitrary code on it. Publicly available exploit code exists (published by CyberDanube), and the CVSS 4.0 base score is 9.4, though there is no evidence of active exploitation in the CISA KEV catalog at time of analysis.

Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-interleaved, 4:2:0 encoding allows an attacker to overwrite a C++ vtable pointer and redirect control flow. Exploitation requires user interaction to open the malicious file, and no public exploit code is known, though EPSS indicates a low probability of widespread exploitation.

Denial of service in the Go golang.org/x/net/dns/dnsmessage package allows remote attackers to crash any application that parses attacker-supplied DNS responses by sending a malformed SVCB or HTTPS resource record. When the declared size of a service-parameter value exceeds the remaining DNS message buffer, the parser panics instead of returning an error, taking down the DNS client, resolver, or proxy embedding this library. EPSS is low (0.15%) and there is no public exploit identified at time of analysis, but a vendor patch is available and the pre-conditions are trivial for any host that resolves DNS through untrusted responders.

Out-of-bounds read in the Perl module Data::HashMap::Shared before 0.14 lets a local peer that can write the shared-memory backing file corrupt per-record offset and length values, causing the map to copy attacker-controlled regions out of the arena. The flaw affects the each, keys, values, pop, shift, take, swap, drain and cursor code paths and can leak adjacent process memory or crash the process. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 5th percentile).

Out-of-bounds read in the Data::RadixTree::Shared Perl module (all versions before 0.02) lets a local peer with write access to the shared memory-mapped backing file corrupt trusted node records and force a lookup to dereference attacker-controlled node and arena indices, leaking adjacent process memory or crashing the process. The attach-time validator rdx_validate_header checks the header and region layout but never bounds-checks the node records that rdx_find_locked subsequently trusts. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.

Out-of-bounds memory read in the Perl module Data::SortedSet::Shared before 0.03 lets a local peer who can write the shared mmap-backed file poison tree link indices, causing the next rank, min, or max query to dereference an out-of-bounds node and leak adjacent process memory or crash. The flaw stems from an attach-time validator that checks only the root index, deferring the full structural check to a separate, rarely-invoked validate method. No public exploit has been identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not on the CISA KEV list.

Out-of-bounds read in the Perl module Data::ReqRep::Shared before 0.05 lets a local peer with write access to the shared mmap-backed file leak adjacent process memory or crash the process. The flaw sits in reqrep_recv_locked, which trusts an arena offset and length read straight from the shared segment without bounding them against the arena capacity. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not listed in CISA KEV.

Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can write the shared backing file corrupt process memory or crash consumers of the disjoint-set structure. The dsu_find routine trusts a file-stored parent index that is never bounds-checked against the node count, so the next find or union operation dereferences and path-compresses through an out-of-bounds pointer. No public exploit is identified at time of analysis, and the EPSS score is very low (0.17%), consistent with a niche CPAN module rather than a broadly exploited target.

Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write access to the shared backing file corrupt memory in any process that queries or inserts into the spatial hash. The attach-time validator sph_validate_header checks header scalars and region layout against file size but never validates the array contents it subsequently trusts, so poisoned bucket, next-link, and free-list indices flow unchecked into sph_walk_cell and sph_alloc_slot. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the module is not in CISA KEV.

Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets a local peer who can write the shared backing file leak adjacent process memory. The attach-time validator (si_validate_header) checks header magic, version, offsets, total_size and counts but never bounds-checks the slot, reverse, and arena arrays it subsequently trusts, so a poisoned index in si_idx_find drives a triple-indirection read past valid bounds. No public exploit is identified at time of analysis and EPSS risk is low (0.17%), but a vendor patch (0.02) is available.

Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the shared memory backing file corrupt adjacent stack frames. The attach-time header validator (ring_validate_header) checks capacity-overflow and total_size consistency but never bounds elem_size, so ring_read_seq memcpys a file-controlled length into a fixed 8-byte destination scalar. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and it is not on CISA KEV, but the memory-corruption primitive is unambiguous and a vendor patch (0.04) exists.

Authenticated remote code execution affects the command-line interface of HPE Aruba Networking AOS-CX, the network operating system running on Aruba CX-series switches. Multiple buffer overflow flaws in the CLI let a high-privileged operator break out of the managed shell and run arbitrary code as a privileged user on the underlying operating system, converting administrative CLI access into full control of the switch OS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged, authenticated user to exploit a buffer overflow in the command line interface (CLI) and run arbitrary code as a privileged user on the underlying switch operating system. Because the CVSS vector is AV:N/PR:L, an attacker who already holds any valid low-level CLI account (e.g., an operator-level login over SSH) can escalate to full device control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; risk is driven by the high CVSS (8.8) and full C/I/A impact.

Memory-corruption in Mozilla Firefox ESR 115.37 and 140.12 could allow attackers to run arbitrary code by triggering memory-safety bugs (CWE-119) that Mozilla observed showing evidence of memory corruption. Reported by Mozilla and tracked under advisories MFSA2026-69/70, the flaw is remotely reachable and carries a CVSS 9.8, though there is no public exploit identified at time of analysis and no active-exploitation (KEV) listing. Mozilla explicitly frames exploitation as presumptive ('with enough effort'), indicating no confirmed working exploit.

Memory-safety defects in Mozilla Firefox 152 and the Firefox ESR 115.37 and 140.12 release trains can corrupt process memory, and Mozilla states some showed evidence of memory corruption that could be leveraged to run arbitrary code. The flaws were resolved in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), consistent with a batch of internally-found bugs rather than an actively exploited zero-day.

Memory corruption in Mozilla Firefox 152 and Firefox ESR 140.12 could allow attackers to run arbitrary code within the browser, per Mozilla advisories MFSA2026-68 and MFSA2026-70. The flaw is a batch of internally-discovered memory safety bugs (CWE-119) affecting the Firefox rendering/JavaScript engine, at least some of which showed evidence of exploitable memory corruption. No public exploit identified at time of analysis; the issues were reported by Mozilla itself and fixed in Firefox 153 and Firefox ESR 140.13.

Memory corruption in Mozilla Firefox 152 lets a remote attacker who lures a victim to a malicious web page trigger memory-safety violations that Mozilla assesses could be leveraged for arbitrary code execution. The flaw is one of a batch of internally-discovered memory safety bugs (CWE-119) rolled up under MFSA2026-68 and carries a CVSS 9.8 rating; there is no public exploit identified at time of analysis, and it is fixed in Firefox 153.

Memory-corruption via integer overflow in the Audio/Video Playback component of Mozilla Firefox lets a remote attacker who serves crafted media content trigger heap corruption that can lead to arbitrary code execution in the browser process. All Firefox versions prior to 153 are affected, and the NVD-assigned CVSS 3.1 base score of 9.8 (network vector, no privileges, no user interaction) reflects a full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so the score reflects potential rather than observed exploitation.

Memory corruption via integer overflow in Mozilla Firefox's ImageLib graphics component allows remote attackers to potentially achieve code execution by serving a maliciously crafted image, with the flaw resolved in Firefox 153. The CVSS 9.8 rating reflects unauthenticated network reach with high impact to confidentiality, integrity, and availability, though no public exploit has been identified and the EPSS probability of 0.13% (3rd percentile) indicates no observed exploitation activity to date. It is not listed in CISA KEV and there is no public exploit identified at time of analysis.

Memory-corruption via an integer overflow in Mozilla Firefox's Audio/Video component allows remote attackers to compromise the browser when a victim processes attacker-controlled media, with the CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicating unauthenticated network exploitation and high impact to confidentiality, integrity, and availability. The flaw was fixed in Firefox 153 per Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Memory corruption in the Audio/Video Gecko Media Plugin (GMP) component of Mozilla Firefox lets remote attackers trigger a buffer overflow through crafted media content, which per CVSS can disclose sensitive process memory and corrupt process state (C:H/I:H). The flaw affects Firefox before 153 and the ESR 115.x and 140.x branches; Mozilla shipped fixes in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the 9.1 CVSS reflects an unauthenticated, network-reachable memory-safety bug in a core browser subsystem.

Memory corruption in Mozilla Firefox's WebGPU graphics component (fixed in Firefox 153) lets a remote attacker serving crafted web content trigger an out-of-bounds memory operation, enabling sensitive memory disclosure and browser crashes. The flaw is a CWE-119 boundary-condition error rated CVSS 9.1 (C:H/A:H, no integrity impact), consistent with an information-leak-plus-denial-of-service primitive rather than confirmed code execution. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile), indicating no evidence of active exploitation despite the high base score.

Memory-safety compromise in Mozilla's NSS (Network Security Services) cryptographic library allows remote attackers to trigger an integer overflow that leads to out-of-bounds memory access, remediated in Firefox 153 (advisory MFSA2026-68). The flaw stems from incorrect boundary conditions during size calculations in NSS Libraries code, and because NSS handles TLS/certificate and cryptographic parsing, malicious network-supplied data can reach the vulnerable path without user authentication. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating no observed weaponization despite the critical CVSS score.

Memory corruption in the Graphics component of Mozilla Firefox stems from incorrect boundary conditions (a buffer overflow) that can be triggered when the browser processes maliciously crafted graphics content, potentially leading to arbitrary code execution in the content process. It affects Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13, and is fixed across those releases per Mozilla advisories MFSA2026-68/69/70. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.15%, 5th percentile) despite the vendor-supplied CVSS of 9.8.

Memory corruption in Mozilla Firefox's JavaScript WebAssembly engine, stemming from an integer overflow (CWE-190), can be triggered by attacker-controlled web content and was patched in Firefox 153 and Firefox ESR 140.13. Reported by Mozilla and tracked as EUVD-2026-46202/MFSA2026-68 & MFSA2026-70, the flaw carries a 9.8 CVSS rating implying potential remote code execution, though no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.15% (5th percentile).

Memory corruption in Mozilla Firefox's WebAssembly (JavaScript) engine allows remote attackers to trigger a buffer overflow through incorrect boundary condition handling, potentially leading to arbitrary code execution in the browser content process. The flaw carries a critical CVSS 9.8 and affects Firefox prior to version 153 and Firefox ESR prior to 140.13; it is fixed in those releases per Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation in the wild has not yet been observed.

Sandbox escape in Mozilla Firefox before version 153 stems from an invalid pointer (CWE-119 memory-safety error) in the Disability Access (accessibility) APIs component, letting an attacker who can execute code in a constrained content process break out of the browser sandbox and reach the more privileged parent process with full confidentiality, integrity, and availability impact (CVSS 10.0, scope-changed). No public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), indicating no evidence of widespread exploitation despite the maximum CVSS score.