Buffer Overflow

Memory-corruption in Mozilla Firefox's Audio/Video Playback component allows a remote attacker to achieve confidentiality and integrity compromise (potentially arbitrary code execution) by delivering crafted media content to a victim's browser. Rooted in incorrect boundary conditions (buffer overflow, CWE-119), the flaw affects Firefox versions prior to 153 and carries a CVSS 9.1 rating, though EPSS exploitation probability is low (0.14%, 4th percentile) and no public exploit identified at time of analysis.

Memory corruption in the cubeb audio/video library used by Mozilla Firefox arises from incorrect boundary conditions (CWE-119), and Mozilla fixed it in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13 (advisories MFSA2026-68/69/70). The input CVSS rates it 9.8 (network, no privileges, no user interaction), implying an unauthenticated remote attacker could corrupt memory in the browser and potentially achieve code execution, though as a media-processing flaw real exploitation almost certainly requires a victim to render attacker-controlled audio/video content. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), and it is not in CISA KEV.

Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to read beyond the underlying buffer via a flaw in readAlignedVarUint() when out-of-band zero-copy deserialization is used. Because the affected code relies on sun.misc.Unsafe for direct memory access, an attacker supplying crafted serialized data to an application that has enabled this opt-in feature can disclose adjacent heap memory or crash the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix (version 1.4.0) is available and the issue was reported by the Apache security team.

Memory corruption in Apache Fory's C++ serialization library (versions 0.14.0 up to but not including 1.4.0) lets remote attackers trigger heap type confusion and out-of-bounds read/write by supplying data with an inconsistent schema when deserialization runs in compatible mode. Because the field-skip code paths never validate declared field types against the actual bytes, a crafted payload can corrupt heap memory, creating a path toward remote code execution or denial of service. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CWE-502 root cause and 9.8 CVSS score make it a high-priority patch for any service that deserializes untrusted input with the C++ implementation.

Stack-based buffer overflow in libssh's SFTP server allows a connected client to crash the server or potentially execute code by placing files with overlong names into a directory the server subsequently lists. The flaw lives in how libssh builds the SFTP 'longname' field, concatenating attacker-influenced filenames into a fixed-size stack buffer without adequate bounds checking. There is no public exploit identified at time of analysis and EPSS is very low (0.10%), but the memory-corruption nature (CWE-121) and libssh's broad deployment make it worth prioritized patching.

Arbitrary code execution in Adobe DNG SDK version 1.7.1 (build 2536) and earlier arises from a stack-based buffer overflow triggered when parsing a maliciously crafted image file, allowing an attacker to run code in the context of the current user. Applications that embed the DNG SDK to decode Digital Negative (DNG) raw camera files are affected, and successful exploitation requires the victim to open the malicious file. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Stack-based buffer overflow in rsyslog's optional mmpstrucdata module allows a remote, unauthenticated attacker to crash the rsyslog process and interrupt log collection, with theoretical code execution on weakly hardened builds. Affected versions span rsyslog 7.5.4 through 8.2605.x; the fix is included in 8.2606.0. No public exploit code or active exploitation has been confirmed, but the crash was independently reproduced over both TCP and UDP on Debian 12 with rsyslog 8.2302.0, and the corrective PR (#6991) was merged publicly before coordinated disclosure completed.

Stack out-of-bounds read/write in the Linux kernel i2c-stub driver allows a local user with access to /dev/i2c-* to corrupt kernel stack memory by issuing an I2C_SMBUS ioctl with an oversized block length. The i2c-stub driver's stub_xfer() implements .smbus_xfer directly, bypassing the I2C_SMBUS_BLOCK_MAX (32-byte) length validation applied in the generic i2c_smbus_xfer_emulated() path, meaning data->block[0] values above 32 are accepted and used as a loop bound, reading or writing past the end of the 34-byte union i2c_smbus_data.block buffer onto the kernel stack. No public exploit has been identified at time of analysis and EPSS is 0.17%, but the KASAN trace in the description confirms the crash path is reachable.

Heap buffer overflow in libvips' tiffload operation (versions ≤ 8.18.1) lets an attacker who supplies a crafted TIFF image trigger memory corruption during decode. The flaw stems from libvips incorrectly determining the channel/component count of a JPEG- or JPEG2000-encoded tile embedded in a TIFF, so the pixel buffer is sized from the TIFF photometric metadata while more components are written from the codec. No public exploit has been identified at time of analysis; the issue is fixed in 8.18.2.

Heap-based buffer overflow in libvips through version 8.18.0 lets an attacker who supplies a crafted image to the vipsload operation corrupt heap memory. The library incorrectly computes image dimensions, allowing an integer overflow (CWE-190) in the element/pel/line/image size calculation that produces an undersized allocation followed by an out-of-bounds write. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 8.18.1. CVSS 4.0 base score is 7.0 with high integrity and availability impact.

Memory disclosure and ASLR bypass in ProFTPD's mod_sftp SCP handler affects all releases before 1.3.9c and 1.3.10rc3, letting an authenticated low-privilege user leak server process memory into an uploaded file. By sending a crafted SCP size record of UINT64_MAX, an attacker triggers a signed integer overflow (CWE-190) that produces a ~4 GB overread, exposing libc, libcrypto, and PIE pointers. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the disclosed pointers are sufficient to defeat ASLR and make co-resident memory-corruption bugs reliably exploitable.

Arbitrary code execution in ProFTPD's mod_sftp module (versions before 1.3.9c and 1.3.10rc3) allows authenticated low-privilege SFTP users to run code in the server process by abusing SFTP packet reassembly in fxp.c. The flaw stems from an incorrectly conditioned reallocation of the 16 KB reassembly buffer that corrupts memory-pool freelist metadata, ultimately hijacking pr_fsio_stat() to reach system(). Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the advisory describes a complete exploitation primitive.

Stack-based buffer overflow in the Tenda AC10 router (firmware 16.03.10.09_multi_TDE01) allows a remote, authenticated attacker to corrupt memory in the httpd/netctrl web service by supplying oversized GetValue/SetValue arguments to the fromAdvSetLanip handler at /goform/AdvSetLanip, potentially achieving code execution or a device crash. Publicly available exploit code exists (published via VulDB and a GitHub advisory), but there is no public exploit identified as actively exploited in the wild. The CVSS 4.0 base score of 7.4 reflects high confidentiality, integrity, and availability impact combined with a low-privilege requirement.

Denial of service in FreeRDP servers (versions <=3.27.1) allows unauthenticated remote attackers to crash the service by forging a malicious encrypted client random during RDP Standard Security negotiation. Because the server publishes its RSA public key, an attacker can craft a ciphertext whose decrypted plaintext spans the full RSA modulus (up to 256 bytes for RSA-2048), overflowing a fixed 32-byte heap buffer in crypto_rsa_common() by roughly 224 attacker-controlled bytes before any authentication occurs. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix landed in FreeRDP 3.28.0.

Information disclosure in Google Chrome prior to 150.0.7871.128 allows a remote attacker to leak sensitive data after luring a user to a malicious web page, per the Chrome stable channel update. The CVSS 3.1 score of 8.8 reflects network reach with only user interaction required, and a vendor patch is available. No public exploit identified at time of analysis, and EPSS estimates a low ~0.29% probability of near-term exploitation.

Out-of-bounds read in the Linux kernel's AMD IOMMU debugfs subsystem exposes local users with standard privileges to potential kernel memory disclosure or denial of service via a sign-extension defect. The functions iommu_mmio_write() and iommu_capability_write() declare offset variables as signed int but populate them with kstrtou32_from_user(), allowing values in the range 0x80000000-0xFFFFFFFF to wrap negative and theoretically index before the intended MMIO region. The vulnerability description explicitly characterizes it as latent, acknowledging that three pre-existing defensive layers already prevent exploitation in practice; the fix replaces the unsigned parser with kstrtos32_from_user() and adds explicit negativity checks. No public exploit exists, no KEV listing is present, and EPSS sits at 0.15% (5th percentile).

Memory leak in the Linux kernel's wilc1000 WiFi driver exposes systems with Microchip WILC1000 adapters to kernel heap exhaustion. The function wilc_wlan_firmware_download() allocates a DMA buffer via kmalloc() but an early-return path after the first acquire_bus() call bypasses the established cleanup label, leaking the buffer unconditionally on bus acquire failures. No public exploit has been identified and EPSS probability is extremely low (0.17%, 6th percentile), but repeated triggering on affected embedded hardware could degrade system stability. Upstream stable fixes are available as confirmed kernel commits targeting 6.18.x, 7.0.x, and 7.1.

Out-of-bounds array read in the Linux kernel's ALSA ASIHPI (AudioScience HPI) sound driver allows a local, low-privileged user to trigger memory disclosure or a kernel crash by requesting a cached control info entry with an unchecked index. The find_control() helper indexed its cache array with a caller-supplied index without bounds validation; the fix adds a sanity check. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%), and it is not listed in CISA KEV, so this is a routine defense-in-depth hardening fix rather than an urgent threat.

Out-of-bounds slab read in the Linux kernel Bluetooth management (MGMT) subsystem lets a privileged local user leak adjacent kernel heap memory via the MGMT_OP_ADD_EXT_ADV_DATA command. The handler trusts attacker-supplied adv_data_len and scan_rsp_len fields without confirming those bytes actually fit within the received command payload, so a short command drives an out-of-bounds pointer into tlv_data_is_valid() and can copy past-the-buffer bytes into an advertising instance that the caller then reads back via MGMT_OP_GET_ADV_INSTANCE. Exploitation requires CAP_NET_ADMIN in the initial user namespace; no public exploit identified at time of analysis, and EPSS is low at 0.18%.

Slab out-of-bounds read in the Linux kernel IFB (Intermediate Functional Block) network driver exposes adjacent kernel memory and risks system instability when a local user with low privileges queries ethtool statistics on an asymmetrically configured IFB device. The root cause is a queue-count mismatch: ethtool stat callbacks size and walk per-queue data using real_num_rx_queues and real_num_tx_queues, while the underlying tx_private allocation is sized only to num_tx_queues - creating an over-read when RX queue count exceeds TX queue count. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), though patch availability across multiple stable branches confirms vendor acknowledgment and active remediation.

Local denial-of-service in the Linux kernel's IPv4 raw socket path allows a caller holding CAP_NET_RAW to crash the host by sending an IP_HDRINCL packet whose self-reported header length (ihl) is below the RFC 791 minimum of 5. raw_send_hdrinc() checks that the header fits within the message but never rejects ihl < 5, so the malformed header is injected into the output path where downstream consumers such as ah_output() compute a negative header size, cast it to size_t, and perform an OOB memcpy of nearly SIZE_MAX bytes, panicking the kernel. It affects all maintained kernel branches and is reachable from an unprivileged process inside a user+net namespace (CONFIG_USER_NS=y) or a rootless Docker container with NET_ADMIN; no public exploit identified at time of analysis and EPSS risk is low (0.18%).

Out-of-bounds kernel memory read in the Linux kernel's Soft-iWARP (siw) RDMA driver lets a malicious connected iWARP peer send an MPA FPDU whose 16-bit length field is smaller than the fixed DDP/RDMAP header, triggering a signed-integer underflow that propagates a negative length into skb_copy_bits() as a huge size_t, producing a multi-gigabyte use-after-free read. Affected are kernels from 5.3 up to the fixed stable releases wherever the siw module is loaded; the primary outcome is a kernel crash (denial of service) with potential exposure of adjacent kernel memory. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with the niche siw attack surface despite the high CVSS.

Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees.

Out-of-bounds heap write in the Linux kernel's ADM1266 PMBus power-sequencer hwmon driver allows a locally-privileged attacker - aided by a malicious or non-compliant ADM1266 device - to overflow kernel heap memory by up to 191 bytes, potentially achieving privilege escalation or kernel code execution. The root cause is a size-contract violation between adm1266_pmbus_block_xfer() (which trusts device-supplied lengths up to 255 bytes) and adm1266_nvmem_read_blackbox() (which allocates only 64-byte strides). No public exploit code has been identified at time of analysis; EPSS is 0.18%, consistent with low in-the-wild interest.

Out-of-bounds read and write in the Linux kernel's hwmon PMBus ADM1266 driver (adm1266_gpio_get_multiple) lets a local low-privileged user with access to the driver's GPIO interface corrupt adjacent kernel/caller stack memory, potentially leading to privilege escalation or a crash. The flaw stems from an incorrect loop bound (the PMBus command code 0xE9/233 was used instead of the 25-pin ADM1266_PDIO_NR limit), so the scan walks up to 242 bits and reads/writes past the caller-supplied mask and bits arrays. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile) and the CVE is not on CISA KEV.

Out-of-bounds read and oversized memory allocation in the Linux kernel's Arm Firmware Framework for A-profile (FF-A) driver (drivers/firmware/arm_ffa) arises from unvalidated offset and size fields in framework notification messages placed in the shared RX buffer. Malformed firmware-supplied data can drive an OOB read during UUID parsing or an oversized kmemdup() allocation, affecting kernels from 6.15 onward on Arm systems using FF-A. Rated CVSS 8.4 (local vector); no public exploit is identified and EPSS is low (0.17%), consistent with a firmware-trust-boundary issue rather than a broadly exploitable remote flaw.

Local privilege-adjacent memory corruption in the Linux kernel's fs/statmount subsystem allows an authenticated local user to trigger a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The flaw lives in statmount_mnt_idmap(), which manually advances seq->count after seq_printf(); on overflow this desynchronizes the buffer accounting so seq_has_overflowed() misses the overflow and a later 'seq->buf[seq->count++] = 0' writes past the slab allocation. Rated CVSS 7.8 (High); EPSS is low (0.17%, 6th percentile), no public exploit or CISA KEV listing exists at time of analysis, and a vendor fix is available.

Improper error-path cleanup in the Linux kernel's netfs read subsystem (the netfslib helper used by network filesystem clients such as CIFS/SMB, AFS, Ceph and 9p) mishandles reference counting when preparation of a direct-I/O (DIO) or single-read subrequest fails after being added to the stream's subrequest list. Because the failed subrequest can still be observed by the collector while holding two outstanding references, this leads to reference mismanagement and potential use-after-free/memory disorder on the read failure path, tagged as an information-disclosure risk. The fix has been merged upstream and backported; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%).

A missing back-pressure flaw in the Linux kernel's netfs read path (netfs_read_to_pagecache()) fails to pause generation of new read subrequests after an already-issued subrequest fails, affecting network/cached filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p, and fscache-backed mounts) built on the netfs helper library. The upstream fix has been merged and backported to stable trees; EPSS is very low (0.17%, 6th percentile) and no public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis. Despite an NVD/CNA CVSS of 9.8, the change is a reliability/correctness fix and the supplied tag characterizes real impact as Information Disclosure rather than remote code execution.

Memory corruption in the Linux kernel netfs subsystem allows local authenticated users to corrupt kernel heap state via a crafted sequence of streaming write operations on network-backed filesystems, potentially enabling local privilege escalation to root. The bug resides in netfs_perform_write(): when a subsequent write fully overwrites a partially-dirty streaming-write folio, the netfs_folio struct that tracks the dirty byte region is neither freed nor correctly updated, leaving stale or inconsistent metadata that drives out-of-bounds writes (CWE-787) during later writeback processing. Patched versions are available across all active stable branches (6.12.92, 7.0.11, 7.1, 6.18.34); no public exploit or active exploitation has been identified at time of analysis.

Local information disclosure and memory corruption in the Linux kernel's netfs subsystem arises because netfs_read_folio() does not wait for in-flight writeback to complete before trusting the folio dirty flag and the folio->private data, which the writeback collector may free before it clears the writeback flag. Hosts using network/cache-backed filesystems (9p, AFS, Ceph, CIFS/SMB, and fscache-backed mounts) can hit a race where a read consumes stale or freed metadata. There is no public exploit identified at time of analysis and the EPSS probability is low (0.17%, 6th percentile); the fix is merged in stable releases 6.18.34, 7.0.11, and 7.1.

Local privilege-escalation via kernel memory corruption in the Linux accel/qaic driver (Qualcomm Cloud AI 100 accelerator) lets a user with access to the qaic device trigger a use-after-free by mapping a GEM buffer object (BO) larger than its VMA. The qaic_gem_object_mmap path called remap_pfn_range without bounding it to the VMA size, so an oversized BO mapped pages past the VMA; a later munmap() unmaps only the VMA and leaves stale mappings to freed pages. EPSS is low (0.17%, 6th percentile) with no public exploit and no KEV listing, but the C:H/I:H/A:H impact makes it a valid local escalation primitive on affected hardware.

Local privilege escalation and memory corruption in the Linux kernel's ASoC fs210x audio codec driver arises from a misused strscpy() call in fs210x_effect_scene_info(), where the copy length was derived from the source string (strlen(SRC)+1) rather than the destination buffer size, allowing an overwrite when the source is at least as long as the destination. The flaw affects Linux 6.18 through the fixed stable releases and carries a CVSS of 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.

Kernel memory corruption in the Linux iwlwifi 'mld' Wi-Fi driver occurs when AMSDU is disabled for a traffic ID and the TSO segmentation path (iwl_mld_tx_tso_segment) fails to detect the sentinel value max_tid_amsdu_len == 1, producing gso_size = 0 and exploding a single GSO skb into ~32,000 tiny segments that flood the TX ring and trigger a use-after-free (refcount underflow) in TCP's retransmit queue. Only the newer 'mld' driver is affected; the legacy 'mvm' driver is immune because it checks amsdu_enabled first. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and a vendor patch is available.

Local privilege-context memory corruption in the Linux kernel's cgroup/rstat subsystem allows a process holding CAP_BPF and CAP_PERFMON to trigger an out-of-bounds array access by passing an unvalidated CPU index to the css_rstat_updated() BPF kfunc. Because the caller-supplied cpu argument is used for per-cpu rstat lookups without a possible-CPU bounds check, a value such as 0x7fffffff drives an array-index-out-of-bounds condition (confirmed on UBSAN kernels) inside kernel/cgroup/rstat.c. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; exploitation requires elevated BPF-related capabilities, which sharply narrows the realistic attacker set.

Remote kernel crash in the Linux kernel's mac80211 WiFi stack affects WiFi 7 (802.11be) clients: the ieee80211_ml_epcs() handler fails to bounds-check the 4-bit link_id (0-15) extracted from an EPCS PER_STA_PROFILE subelement, but sdata->link[] holds only 15 entries (indices 0-14), so link_id=15 reads out of bounds. A connected access point can send an EPCS Enable Response action frame with link_id=15 to read a garbage pointer that bypasses the NULL check and is dereferenced in ieee80211_sta_wmm_params(), crashing the kernel. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and this is a denial-of-service (kernel panic) rather than the code-execution/data-disclosure implied by the vendor CVSS.

Local information disclosure and memory corruption in the Linux kernel's rxrpc (AF_RXRPC/AFS) subsystem allows a local user of an encrypted rxrpc socket to trigger pagecache corruption because DATA packets were decrypted in-place on shared sk_buffs while splice() referenced the same pages. This is a hardening follow-up to CVE-2026-43500, replacing in-place decryption with a per-call bounce buffer so recvmsg() copies clean data and the sk_buff is never mutated. No public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not listed in CISA KEV, consistent with a niche kernel subsystem rather than a mass-exploitation target.

Out-of-bounds array access in the Linux kernel's Microsoft Azure Network Adapter (mana) driver lets a malicious hypervisor corrupt guest kernel memory within Confidential VMs. In mana_hwc_rx_event_handler(), the rx_req_idx index is read from host-shared DMA-coherent memory (a WQE's sge->address) without a bounds check, so in SEV-SNP/TDX guests the untrusted host can steer the index to read/write past the reqs[] array. There is no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a defense-in-depth hardening fix for the confidential-computing threat model rather than an actively exploited flaw.

Use-after-free in the Linux kernel keyring subsystem (security/keys) allows a local low-privileged user to read freed memory because find_key_to_update() calls assoc_array_find() without holding the RCU read lock, racing against assoc_array_gc() which frees nodes after an RCU grace period. The flaw is exercised specifically through the persistent-keyring path, which does not rely on the keyring semaphore that masks the issue for regular keys. No public exploit identified at time of analysis; EPSS probability is low (0.17%, 7th percentile) and it is not listed in CISA KEV.

An out-of-bounds read in the Linux kernel's usbtouchscreen NEXIO code path lets a malicious or malfunctioning USB touchscreen that enumerates as a NEXIO device leak roughly 64 KiB of adjacent kernel memory to userspace, delivered as fake touch coordinates through ABS_X/ABS_Y input events, and can additionally fault the kernel if the walk reaches an unmapped page. Only systems whose kernel was built with the usbtouchscreen driver and NEXIO support are affected, and exploitation requires physical attachment of (or control over) the specific NEXIO USB peripheral, so exposure is limited to uncommon hardware deployments rather than anything remotely reachable. Vendor patches are available in the stable releases listed below; no public exploit code has been identified at time of analysis and EPSS is low at 0.18% (7th percentile).

Local privilege-scoped memory corruption in the Linux kernel's IPsec/xfrm subsystem allows a low-privileged user with network-configuration capability to trigger a massive out-of-bounds kernel write. The xfrm_state_mtu() helper computes an ESP MTU in unsigned modulo-2^32 arithmetic; by installing an IPv4 ESP tunnel SA with an oversized truncated auth key, a tiny interface MTU, and a large XFRMA_TFCPAD value, an attacker forces the result to underflow, and esp_output() later treats it as a negative signed length passed to memset() — producing a near-16 EB write of zeroes at the skb tail. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and the flaw is not in CISA KEV, but the ubiquity of the Linux kernel makes patching important.

Out-of-bounds memory access in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem allows a crafted, truncated supervision frame to trigger an OOB read when the code accesses a TLV header that was not fully linearized into the socket buffer. The flaw affects systems running the net/hsr driver across numerous stable kernel branches (fixed in 6.1.176, 6.6.143, 6.12.93, 6.18.35 and others). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a niche, protocol-specific attack surface rather than broad exploitation.

Out-of-bounds kernel write in the Linux kernel's ethtool CMIS CDB handling (cmis_cdb_process_reply) allows a malicious or buggy SFP/QSFP transceiver module to corrupt kernel memory by returning a CDB reply whose rpl_len exceeds the expected rpl_exp_len. Affected callers (password validation, module feature discovery, and firmware-management feature discovery) cast the reply payload to fixed-layout structs at fixed offsets, so an over-long reply writes past the kmalloc'd page buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%), and it is not on CISA KEV; the fix is a defensive exact-length check merged upstream and backported to stable trees.

Out-of-bounds kernel write in the Linux kernel's ethtool CMIS firmware-update path (cmis_fw_update_start_download) lets a malicious or malfunctioning pluggable transceiver module overflow a 112-byte stack/heap buffer by returning an oversized start_cmd_payload_size in its CDB FW Management Features reply. The value is used unchecked as a memcpy byte count, so any attacker able to present a crafted module-or corrupt its CDB response-can corrupt adjacent kernel memory. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix simply rejects payload sizes larger than the destination buffer.

Out-of-bounds memory access in the Linux kernel's IP tunnel path-MTU discovery code (iptunnel_pmtud_check_icmp) affects IPv4 tunnel interfaces where the function may run on packets whose skb transport header is unset, causing an ~65535-byte offset read past the linear buffer. Remote attackers can trigger this by sending crafted ICMP traffic to a tunnel endpoint, potentially leaking adjacent kernel memory or crashing the host (denial of service). This is a supplier-reported (Linux stable) fix with no public exploit identified at time of analysis and a low EPSS score of 0.18%.

Out-of-bounds heap write in the Linux kernel ethtool netlink coalesce interface allows a local privileged user (CAP_NET_ADMIN) to corrupt kernel memory beyond a 5-element IRQ moderation profile buffer, enabling privilege escalation, denial of service, or information disclosure. The flaw lives in ethnl_update_profile(), which trusts a fully user-controlled Netlink nest count while writing into a kmemdup()'d array sized at NET_DIM_PARAMS_NUM_PROFILES (5). This has been resolved upstream and is not known to be exploited; EPSS probability is low (0.17%, 6th percentile) and no public exploit has been identified at time of analysis.

Out-of-bounds read in the Linux kernel's ethtool module-EEPROM Netlink fallback path allows a local privileged user to read memory beyond the intended EEPROM buffer. The flaw lives in fallback_set_params(), which checks that the requested offset is below eeprom_len but never validates that offset + length also stays within bounds - a check the ioctl path (ethtool_get_any_eeprom()) has always enforced. A compounding issue is the use of plain kmalloc() instead of a zeroed allocation, so uninitialized kernel memory may be returned to the caller. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not in CISA KEV.

Out-of-bounds heap corruption in the Linux kernel's IPv6 RPL Source Routing Header handling (net/ipv6/exthdrs.c) allows remote attackers to corrupt the routing header of forwarded packets by sending a crafted compressed SRH. The bug stems from a __u8 truncation of the computed hdrlen in ipv6_rpl_srh_decompress(): with n=127 segments the value (128*16)>>3 = 256 wraps to 0, causing the compressed header to overlap the decompressed region so ipv6_rpl_srh_compress() writes into kernel memory it should not. Rated CVSS 9.8 but EPSS is only 0.18% (7th percentile); no public exploit and no CISA KEV listing exist at time of analysis, and exploitation requires an unrealistic 127-segment header on a node with RPL source routing enabled.

Out-of-bounds read in the Linux kernel Bluetooth HIDP (Human Interface Device Protocol) subsystem lets a paired, malicious Bluetooth peripheral send a truncated interrupt frame that hidp_input_report() parses without validating skb->len, causing the handler to read past valid skb data. The stale bytes are interpreted as phantom keystrokes or spurious mouse movement, giving an adjacent attacker a limited local input-injection/info-leak primitive. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a niche Bluetooth-range issue rather than mass exploitation; a vendor patch is available across multiple stable branches.

Host-side buffer overflow in the Linux kernel's KVM AMD SEV/SEV-ES support (arch/x86/kvm/svm/sev.c GHCB handling) lets a malicious or compromised confidential guest corrupt host memory by abusing Page State Change (PSC) requests. KVM miscomputes the maximum length of the in-GHCB scratch area, treating the guest-supplied @len as the buffer's full size when for PSC it is only a minimum, allowing a guest to drive writes past the shared GHCB buffer. Rated CVSS 9.3 for a scope-changed guest-to-host escape; no public exploit is identified at time of analysis and EPSS is low (0.22%), but a vendor patch is available across multiple stable branches.

MACsec replay-protection bypass in the Linux kernel allows an adjacent attacker to indefinitely replay a captured frame on Extended Packet Numbering (XPN) associations. Because macsec_post_decrypt() computes pn + 1 on a u32, the value 0xFFFFFFFF wraps to 0 and fails to advance next_pn_halves, so lowest_pn never rises and the same IV keeps validating. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.1 reflects high integrity and availability impact against encrypted L2 links.

Kernel-level out-of-bounds write in the Linux octeontx2-af driver (Marvell OcteonTX2 admin function) lets a low-privileged VF whose parent PF is in switchdev representor mode corrupt kernel memory. The rvu_mbox_handler_rep_event_notify() handler queues a sender-controlled REP_EVENT_NOTIFY body whose nested event->pcifunc is never bounds-checked, so an out-of-range index reaches rvu_get_pfvf()/rvu_get_pf() and, on RVU_EVENT_MAC_ADDR_CHANGE, becomes a six-byte attacker-chosen OOB ether_addr_copy() write in the AF worker (KASAN slab-out-of-bounds in rvu_rep_wq_handler). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with niche Marvell SmartNIC hardware rather than mass exposure.

Information disclosure (slab-out-of-bounds read) in the Linux kernel IPv6 datagram stack lets a local unprivileged attacker leak adjacent kernel slab memory and potentially crash the system. The flaw lives in ip6_datagram_recv_specific_ctl(), which trusts the on-wire extension-header length byte when building IPV6_HOPOPTS/DSTOPTS/RTHDR control messages; because nftables is reachable from an unprivileged user namespace, an attacker can rewrite that length after parse-time validation and force put_cmsg() to copy up to 2040 bytes from an 8-byte header. There is no public exploit and it is not in CISA KEV (EPSS 0.21%), so risk is credible but not yet demonstrated at scale.

Out-of-bounds kernel write in the Linux `wacom` HID driver affects the `wacom_hid_set_device_mode()` routine across long-lived kernel branches (5.10 through 7.x). The driver wrongly assumes the HID_DG_INPUTMODE usage always lives in the report's first field, so a HID device (Wacom-class or a device spoofing one) that places that usage in a later field with a smaller report_count triggers a write past the bounds of `r->field[0]->value`, corrupting kernel memory. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile), consistent with a bug that requires attacker-supplied hardware rather than remote reachability.

Out-of-bounds heap read and remote kernel panic in the Linux kernel NFC HCI/HCP stack (nfc_hci_recv_from_llc() and nci_hci_data_received_cb()) let an adjacent malicious NFC peer send a crafted 0-byte HCP frame that reaches these handlers before any length check, reading packet->header past the buffer and, when the frame is queued as a non-final fragment, underflowing msg_len to UINT_MAX and forcing skb_over_panic(). No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the flaw is not in CISA KEV, so this is a proximity-limited DoS/info-leak affecting any NFC-enabled Linux device, fixed by the maintainers. Exploitation requires NFC radio range and an active NFC/HCI stack, which sharply narrows the real attack surface versus the raw 8.8 score.

Heap out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated remote user to read 2 bytes past the pntsd allocation during SMB2_CREATE handling, potentially leaking adjacent heap memory or crashing the kernel. The flaw is a regression: commit d07b26f39246 introduced a transposed bounds check in smb_check_perm_dacl() that always evaluates false, turning the ACE-size guard into dead code and re-opening a previously fixed OOB. No public exploit identified at time of analysis, and EPSS risk is low (0.21%, 12th percentile); it is not on CISA KEV.

Remote denial-of-service and slab corruption in the Linux kernel iSCSI target (LIO) subsystem affects the Text-phase command handler iscsit_handle_text_cmd(), where two latent bugs have existed since the original LIO integration (commit e48354ce078c). A CRC32C overread reads four bytes past a kzalloc'd buffer on every Text PDU when DataDigest=CRC32C is negotiated, and a stale cmd->text_in_ptr causes a double-free on ErrorRecoveryLevel>0 bad-DataDigest drops and at session teardown. On distro kernels built with CONFIG_SLAB_FREELIST_HARDENED=y (the default) the double-free becomes a remote kernel BUG(); on non-hardened builds it corrupts the slab freelist. No public exploit identified at time of analysis, though the flaw is directly reproducible under KASAN; not listed in CISA KEV and EPSS is low (0.22%).

Heap buffer overflow in the Linux kernel iSCSI target (LIO/TCM) subsystem lets a remote attacker who can reach the target's login service corrupt kernel memory during login text-key negotiation. The iscsi_encode_text_output() path performs unbounded sprintf() concatenation of "key=NotUnderstood" response records into a fixed 8 KiB login->rsp_buf, and a single Login PDU packed with ~2048 minimal unknown key/value pairs expands to roughly 32 KiB of output, producing a ~24 KiB overrun in the kmalloc-8k slab. CVSS is rated 9.8, but EPSS is low (0.22%, 13th percentile); no public exploit is identified at time of analysis and it is not on CISA KEV.

Heap out-of-bounds write in the Linux kernel iSCSI target (LIO) driver lets a remote attacker overflow the heap-allocated client_digest buffer by supplying an over-length BASE64-encoded CHAP_R response during login. chap_server_compute_hash() decodes up to 127 base64 characters (95 bytes) into a buffer sized to the digest (32 bytes for SHA-256, 16 for MD5), overflowing it by 63-79 bytes before the too-late length check at line 344. The input assigns CVSS 9.8; however EPSS is low (0.21%, 11th percentile), it is not in CISA KEV, and no public exploit was identified - indicating a serious memory-corruption bug that is not yet being exploited.

Local memory corruption in the Linux kernel's AMD Kernel Fusion Driver (amdkfd) stems from an integer overflow in the KFD debugger's get_queue_ids() routine, where num_queues * sizeof(uint32_t) can wrap on 32-bit size_t builds and produce an undersized allocation. A local user with access to the KFD debug interface can trigger kernel heap corruption impacting confidentiality, integrity, and availability. No public exploit is identified at time of analysis; EPSS is low (0.22%, 12th percentile) and it is not on CISA KEV, but a vendor patch has been released across multiple stable trees.

A shift-out-of-bounds (undefined behavior) exists in the Linux kernel's mac80211 wireless stack, in ieee80211_parse_tx_radiotap(), where an 8-bit IEEE80211_RADIOTAP_ANTENNA value from a userspace-injected frame is used directly as a BIT() shift count, allowing shifts of up to 255 on a 64-bit unsigned long. A local user able to inject frames on a monitor-mode interface can trigger the UB, flagged by UBSAN, with no public exploit identified at time of analysis and a low EPSS score (0.16%, 5th percentile). The realistic impact is undefined behavior / potential instability rather than the memory-corruption RCE implied by the assigned 7.6 CVSS.

Local privilege-relevant memory corruption in the Linux kernel's KEYS subsystem allows an authenticated local user to overflow an internal output buffer via the keyctl() public-key operation path. The flaw stems from keyctl_pkey_params_get_2() sizing its internal output buffer using the caller-supplied length instead of the cryptographic primitive's maximum length, so a too-small buffer triggers a heap overflow. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so risk is theoretical rather than actively exploited.

Out-of-bounds kernel memory read in the Linux kernel's f2fs filesystem driver allows an attacker who can get a crafted f2fs image mounted to leak kernel memory and crash the system. When the flexible_inline_xattr feature is enabled, do_read_inode() trusts the on-disk i_inline_xattr_size for inodes that carry inline dentries or inline data but lack the FI_INLINE_XATTR flag, so an unvalidated, attacker-controlled size drives inode geometry negative and produces an out-of-bounds read in f2fs_fill_dentries() when the inline directory is read. EPSS is low (0.16%, 5th percentile) and there is no public exploit identified at time of analysis nor CISA KEV listing; a vendor patch is available.

Out-of-bounds heap read in the Linux kernel's F2FS filesystem lets a local low-privileged user disclose adjacent kernel memory or crash the system by reading POSIX ACLs from a maliciously crafted f2fs image. The flaw lives in f2fs_acl_from_disk() (fs/f2fs/acl.c), which dereferences an ACL entry's e_id before confirming a full f2fs_acl_entry fits in the xattr buffer. It is fixed upstream, carries CVSS 7.8, and shows a very low EPSS (0.17%, 6th percentile); there is a KASAN crash reproducer in the report but no public weaponized exploit and no CISA KEV listing - no public exploit identified at time of analysis.

Out-of-bounds read in the Linux kernel's KVM x86 shadow MMU allows a malicious or misbehaving guest to trigger a host kernel page fault (crash) during hugepage recovery. The flaw occurs when the KVM host recovers hugepages and queries the max mapping level for a direct shadow page whose base gfn falls outside the target memslot, causing an out-of-bounds access into the vmalloc'd lpage_info array. Rated CVSS 8.8 (local, scope-changed) but with low real-world exploitation probability (EPSS 0.17%); no public exploit and no CISA KEV listing - no public exploit identified at time of analysis.

Local memory corruption in the Linux kernel scheduler's per-mm concurrency-ID (mm_cid) subsystem lets an unprivileged task trigger a deterministic out-of-bounds single-bit clear in kernel memory. The flaw lives in mm_cid_fixup_cpus_to_tasks(), where a task whose CID is still the MM_CID_UNSET sentinel (BIT(31)) is wrongly marked in-transit and later fed to clear_bit(), clearing a bit 256 MiB past the mm_struct CID bitmap. It was surfaced by syzkaller as a KASAN use-after-free in __schedule; no public weaponized exploit and no CISA KEV listing exist at time of analysis.

Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem allows a crafted on-disk group descriptor to trigger a use-after-free/OOB read during suballocator bitmap operations. The bug lives in ocfs2_validate_gd_parent(), which only checked bg_bits against the parent allocator's chain geometry and not against the bytes that physically fit in the group descriptor block, so a malicious bg_size/bg_bits pair drives later bitmap scans (ocfs2_find_max_contig_free_bits / ocfs2_block_group_set_bits) past bg_bitmap. It was found via KASAN and fixed upstream; no public exploit has been identified at time of analysis.

Out-of-bounds heap write in the AMD SEV debug-encrypt path (sev_dbg_crypt/__sev_dbg_encrypt_user) of the Linux kernel's KVM/SVM code (kvm_amd) lets a local, privileged VMM process corrupt kernel slab memory by up to 15 bytes past a single-page buffer. The per-iteration transfer length is bounded by the source page offset but not the destination page offset, so when d_off > s_off the PSP command and a following memcpy()/copy_from_user() spill beyond the 4096-byte dst_tpage allocation. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but a KASAN slab-use-after-free splat is included in the report, confirming reliable reproducibility.

Kernel memory disclosure in the Linux kernel fbcon (framebuffer console) subsystem allows a local low-privileged attacker to trigger an out-of-bounds read by exploiting incomplete error-path rollback in fbcon_do_set_font(). When a font-set operation fails partway (e.g., vc_resize() allocation failure under memory pressure), the hi_font_mask and screen buffer are left desynchronized from the reverted 256-character font array, causing the VT subsystem to render character indices above 255 against undersized data. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available across multiple stable branches.

Heap out-of-bounds read in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client leak kernel heap memory or crash the server on shares that use ACL xattrs. The flaw lives in smb_check_perm_dacl(), which validates an ACE header and caps sub-authority count but never confirms the ACE is large enough to hold those sub-authorities before compare_sids() dereferences them. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a memory-disclosure/DoS bug rather than a mass-exploited RCE.

Out-of-bounds array read in the Linux kernel's IIO veml6075 UV light sensor driver allows a local low-privileged user reading the sensor's integration-time data to trigger access past the 5-element veml6075_it_ms lookup table. The VEML6075_CONF_IT register field can decode to index values 0-7, but only indices 0-4 are valid; a reserved value (5-7) drives the driver to read beyond the array. This is a hardening fix against faulty hardware, device misprogramming, or bus corruption rather than a directly attacker-controllable memory-corruption primitive; no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).

Out-of-bounds array read in the Linux kernel's TI ADS1298 IIO ADC driver (ti-ads1298) lets a local, low-privileged actor read past the 7-element ads1298_pga_settings table when a channel's PGA field decodes to the reserved value 7 (0b111). Affected are systems running the ti-ads1298 driver against a TI ADS1298 biopotential/ECG analog front end; the upstream fix adds a bounds check that returns -EINVAL. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile), consistent with a niche, hardware-dependent code path rather than a broadly weaponizable flaw.

Local privilege escalation and kernel memory disclosure in the Linux kernel's Renesas RZ/V2H IVC media driver (rzv2h-ivc) stems from a race condition where rzv2h_ivc_transfer_buffer() calls list_del() on the shared buffer queue from a workqueue context without holding the protecting spinlock. On affected embedded systems using the RZ/V2H SoC, a local low-privileged user can concurrently modify the buffer list to corrupt kernel memory, potentially leaking data or achieving code execution. EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis; the flaw is fixed upstream in the stable kernel tree.

Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.

Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_device.dev_name buffer via an oversized device_name field on the /modbus endpoint. Because getData() in modbus_master.cpp copies delimiter-bounded characters with no bounds check, a ~200-byte value writes 100 bytes past the allocation, overwriting adjacent Modbus config fields (protocol, dev_address, ip_port) and crashing the PLC control loop. No public exploit identified at time of analysis, though VulnCheck published a detailed technical advisory; the affected repository is archived and no vendor-released patch was identified.

Stack-based buffer overflow in Shibby Tomato 1.28 router firmware lets an authenticated attacker corrupt memory through the Scheduler Name Handler (function sub_42537C) by supplying an overlong scheduler-name argument, enabling likely remote code execution on the device. The affected build is a niche, community-maintained MIPS router firmware distribution that has been retired and superseded by FreshTomato. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the VulDB-assigned CVSS 4.0 score is 8.7.

Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.

Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.

Heap-based buffer overflow in IBM Storage Protect Client (versions 8.1.0.0-8.1.27.1 and 8.2.0.0-8.2.1.0) lets a remote attacker corrupt heap memory through improper bounds checking, potentially achieving arbitrary code execution or crashing the affected process. The flaw carries a CVSS 3.1 base score of 9.8, but no public exploit identified at time of analysis and the EPSS probability is low (0.46%, 37th percentile). Note that the affected component is the backup Client, while the description references crashing 'the server,' introducing ambiguity about the true exploitation path.

Out-of-bounds heap write in the freedesktop xdgmime library (bundled with GLib-based MIME detection) allows a local attacker to crash or corrupt the memory of any application that guesses content types via g_content_type_guess(). The flaw lives in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c and triggers on little-endian systems when a maliciously crafted MIME magic file placed in a user-writable XDG data location is parsed, producing a 2-byte out-of-bounds write. Red Hat rates it 7.1 (Important); no public exploit is identified at time of analysis and it is not listed in CISA KEV.

Arbitrary code execution in Adobe Acrobat Reader arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted file, allowing an attacker to run code in the context of the current user. All affected versions covered by Adobe advisory APSB26-63 are impacted, and successful exploitation grants full high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so risk is currently latent rather than active.

Denial of service in Wazuh's analysis engine (wazuh-analysisd) lets an unauthenticated remote attacker permanently halt SIEM alert processing on Wazuh manager versions 1.0.0 through 4.14.4. Because the official wazuh/wazuh-docker deployment ships with password-less agent enrollment enabled by default, an attacker can register as an agent and send a crafted rootcheck event that overflows a fixed 30-byte heap buffer, crashing the daemon while the dashboard and API keep showing stale data - silently blinding the SIEM. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Memory-disclosure via heap buffer overflow in libjxl (the JPEG XL reference codec) versions 0.11.2 and earlier lets an attacker who supplies a crafted APNG image trigger an out-of-bounds access in the DecodeImageAPNG function, leaking sensitive process memory. The upstream fix (PR #4804) adds a missing row-index bounds check before accessing frame rows. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and the issue is not listed in CISA KEV.

Local privilege escalation and silent denial-of-service in the Wazuh Windows agent (versions 4.6.0 through 4.14.4) arise from a heap-based buffer overflow in the syscheck registry-monitoring component. Because wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, a low-privileged local user who creates a 255-character registry subkey under a monitored wildcard path can trigger an out-of-bounds heap write, either blinding the agent or potentially executing code as SYSTEM. Proof-of-concept exploit code exists (SSVC: poc), but it is not in CISA KEV and EPSS is very low (0.09%, 1st percentile), consistent with the local-only, non-automatable attack profile.

Denial of service in Quicly, the QUIC protocol library embedded in the H2O HTTP server, allows remote attackers to corrupt connection state and crash the process prior to commit 8b178e6. Quicly's packet decoder accepts Connection IDs up to 255 bytes (permitted for unknown QUIC versions) but its version-1 CID buffers are only 20 bytes, and the library - unlike its bundled CLI - never rejected over-length CIDs, letting an oversized CID overrun the buffer within its allocated chunk and trigger assertion failures. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.

Remote code execution in Microsoft Windows Terminal allows an unauthenticated attacker to run arbitrary code by tricking a user into interacting with malicious content that triggers an integer overflow (CWE-190). The flaw carries a CVSS 7.5 rating driven by high complexity and required user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Microsoft has released a patch through the MSRC update guide.

Out-of-bounds heap read in YAML::Syck before 1.47 for Perl lets an attacker who controls a parsed YAML document trigger a one-byte over-read in the bundled libsyck lexer, with a total (per SSVC) technical impact of information disclosure or process crash. The flaw sits in newline_len/is_newline, which dereference the scan pointer (and the following byte for a "\r\n" pair) with no NUL-terminator or bounds check, so a block scalar sitting at a document boundary runs one byte past the heap lexer buffer. There is no public exploit identified at time of analysis and it is not in CISA KEV, but CPANSec-documented trigger inputs exist and it is explicitly an incomplete fix of CVE-2025-11683 on a lexer path the earlier patch missed.

Out-of-bounds read in the Perl module YAML::Syck before 1.47 lets a remote attacker leak adjacent process memory by feeding a crafted YAML document to Load or LoadFile. The bundled libsyck base64 decoder (syck_base64dec) indexes its 256-entry b64_xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table; because !!binary is a standard tag processed on the default Load path (not gated by $LoadBlessed or $LoadCode), the flaw is reachable without any opt-in. No CISA KEV listing and EPSS is low (0.19%, 8th percentile), so no public weaponized exploit is identified at time of analysis, though the exact trigger strings (e.g. '--- !!binary \x80\x80\x80\x80') are publicly documented in the vendor's CI test suite and the oss-security advisory.

Local privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write (CWE-787) reachable through a crafted IOCTL request to a privileged kernel-mode component, corrupting kernel memory. An authenticated local attacker on an engineering workstation running the software can leverage the corruption to escalate to SYSTEM/kernel privileges or crash the host. No public exploit identified at time of analysis; the flaw is documented in CISA ICS advisory ICSA-26-197-04 (reported by ICS-CERT) but is not listed in CISA KEV, and no EPSS score was supplied.

Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel memory by issuing a crafted IOCTL request to an out-of-bounds write flaw (CWE-787). Successful exploitation can elevate privileges to SYSTEM/kernel level or crash the host running this engineering workstation software for AutomationDirect Productivity-series PLCs. Reported through CISA ICS-CERT (ICSA-26-197-04); no public exploit identified at time of analysis and no KEV/EPSS signal is present.