Buffer Overflow

Stack-based out-of-bounds read in wvWare wv through 1.2.9 allows an unauthenticated local attacker to cause a client-side denial of service: a victim must open a crafted .doc file whose FKP structure carries an oversized crun value, triggering wvGetPAPX_FKP or wvGetCHPX_FKP to read past a 512-byte stack buffer and crash AbiWord or another libwv-based reader. The assessed impact is availability only (CVSS 4.0 local, UI:P, A:H; CVSS 3.1 local, UI:R, A:H), with no confidentiality or integrity impact established. No public exploit code or CISA KEV active exploitation was identified at time of analysis.

Decoding a crafted low-delay Dirac stream with an out-of-range wavelet filter index (7 or greater) or transform depth (5 or 6) in libschroedinger through 1.0.11 triggers an out-of-bounds read past a static quantiser table, crashing the application. The flaw is availability-only (no code execution, data disclosure, or integrity impact) and requires local access plus user interaction to process the malicious stream; no public exploit was identified at time of analysis, and the issue is assessed as moderate severity.

Heap out-of-bounds read in LodePNG's getFilterTypesInterlaced() utility in lodepng_util.cpp can disclose adjacent heap memory or crash applications that process a crafted interlaced PNG declaring a raster larger than its decompressed IDAT stream. This is a moderate-severity, local-vector issue rather than a remote-exploitation priority: exploitation requires local access and user interaction, and the vulnerable helper is outside the core decode path. No public exploit identified at time of analysis.

Heap out-of-bounds read in cgltf through 1.15 can be triggered when an application parses an attacker-supplied glTF or GLB asset and calls cgltf_accessor_unpack_floats() on a sparse accessor whose base bufferView defines a byteStride. The crafted file can pass cgltf_validate(), so validation at that layer does not prevent the over-read, and the result is limited to application crashes and limited heap memory disclosure into vertex data. Exploitation is local and requires user interaction to load the malicious asset; no public exploit identified at time of analysis.

Stack-based out-of-bounds read and write in libtta through 2.3 can corrupt decoder memory when an application processes a crafted .tta file whose header declares zero channels. The flaw is local and requires user interaction-the victim must open or decode the malicious file-so systems that never decode untrusted True Audio input are not exposed; impact is assessed as low confidentiality/integrity/availability, consistent with a crash or constrained stack corruption rather than demonstrated reliable code execution. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) in the provided data, and the risk is moderate rather than urgent.

Heap buffer overflow in libtta through 2.3 allows a crafted .tta file to crash 32-bit applications and affect integrity via an integer overflow in the seek-table allocation path. Exploitation requires user interaction to open the malicious audio file and is constrained to 32-bit consumers with specific malformed header values (sample rate 1 and a large samples field); 64-bit builds are not indicated as affected. Publicly available exploit code exists, but no CISA KEV confirmation of active exploitation is present in the provided data.

Opening a crafted MPEG file with smpeg through 2.0.0 can crash the hosting application through a heap out-of-bounds read in MPEGsystem::FillBuffer(). The issue is reachable only when a local user opens an attacker-controlled file via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, and the assessed impact is availability-only denial of service. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation.

Heap-based buffer overflow in libmng through 2.0.3 allows a crafted MNG file containing MHDR, DHDR, and a multi-record ORDR chunk to overwrite heap memory when an application calls mng_read or mng_readdisplay, producing attacker-controlled out-of-bounds writes and likely application crashes. The attack is local/file-based and requires the victim to open or process the malicious MNG (UI:P), with no confidentiality impact and limited integrity impact but high availability impact. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV) is indicated in the supplied data.

Heap out-of-bounds write in Schism Tracker through 20260524 allows a crafted .ult (UltraTracker) module to corrupt the tracker's instruments pointer array, so that cleanup in csf_destroy() frees attacker-chosen pointers and crashes the application. The defect is in fmt_ult_load_song() in fmt/ult.c, which accepts the file's one-byte sample count without clamping it to MAX_SAMPLES; any build that parses .ult files is affected and no special configuration or privileges are required. Publicly available exploit code exists (the flaw is not in CISA KEV), but the vector is local file parsing that requires the victim to load the file, so the confirmed outcome is denial of service and code execution would additionally depend on controlling heap layout.

A stack out-of-bounds read in Antiword 0.37 and earlier (prop8.c, vGet8PapInfo and vGet8ChrInfo) allows a crafted .doc file containing malformed FKP pages to drive run counts and grpprl offsets past the end of a 512-byte stack buffer, crashing the parser or corrupting style parsing. Exploitation is local and gated by user interaction: a victim must be given the file and invoke antiword on it (AV:L/UI:P), and the assessed impact is availability-only with no confidentiality, integrity, or code-execution effect. The attack is unauthenticated per the CVSS 4.0 vector (PR:N), no public exploit is identified at time of analysis, and the CVSS 4.0 base score of 4.8 (MEDIUM) likely overstates its operational urgency given the limited impact and delivery prerequisites.

Parsing a crafted Word 8 (.doc) file with Antiword 0.37 and earlier can crash the process through a heap out-of-bounds read in vGet8LstInfo (prop8.c), where an inverted bounds check trusts a PlcfLst record count claiming up to 0xffff list entries against a much smaller heap buffer. The vector is local and file-driven: the file itself is unauthenticated input, but the target must actually invoke antiword on the attacker-supplied document (a user or an automated conversion pipeline opening it), so exploitation requires the victim side to feed the file to the tool. Impact per the assessed vector is availability-only (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/C:N/I:N/A:L) - a crash of the antiword process with no code execution or data disclosure demonstrated - and no public exploit or vendor patch has been identified at time of analysis, though the CVSS 4.0 vector supplied by the reporter scores it 6.8 with high availability impact.

An out-of-bounds memory read in MariaDB Server's spatial (GIS) functions lets an authenticated but low-privileged database user pass a truncated WKB MultiPolygon or MultiLineString to ST_Area, ST_Centroid, or GLength and have the parser read past the end of the allocated buffer, returning adjacent heap bytes as a geometry result or error path. Affected releases are MariaDB 10.6.1 through the fixes in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2; exploitation requires valid credentials and the ability to submit attacker-controlled spatial data (CVSS 4.3, PR:L), and the leak is primarily useful as an ASLR-bypass primitive inside a larger exploit chain rather than as a standalone compromise. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it should be treated as low-to-moderate priority and scheduled with routine patching; the vendor advisory GHSA-p7v9-24h4-mch8 and MDEV-40328 document the issue.

A deterministic 3-byte heap-based buffer overflow in ssldump's FAN/1 X.509 fingerprinting routine (fanx_fingerprint in ssl/sslxprint.c) corrupts the heap on every call that processes a valid certificate. Exploitation requires the victim to run ssldump with FAN/1 fingerprinting enabled (the -j and -N options) against an attacker-supplied pcap containing a TLS handshake with a valid X.509 server certificate; the attack vector is local and depends on the user actively choosing to parse the malicious capture with non-default options. The most likely outcome is a crash/denial of service, with arbitrary code execution in the context of the ssldump user remaining a worst-case possibility; no public exploit code has been identified at time of analysis, and the overflow content is largely fixed, which makes code execution substantially harder than a denial of service.

Heap out-of-bounds read in the FreeRDP Windows client (versions 3.30.0 up to but not including 3.32.0) lets a malicious or compromised RDP server feed a malformed clipboard file-transfer reply that the client misinterprets, crashing the client or corrupting an internal stream-size value. The attack is only reachable when a user connects to the hostile server and then actively pastes a remote file, so the attacker must control the server side and the victim must perform the triggering UI action; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). Scoring is low by every available signal - CVSS 4.0 base 2.3 and an independently assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L - so this should not be treated as a priority patch under normal circumstances.

An out-of-bounds read (heap over-read) in the FreeRDP Windows RAIL client (wfreerdp) versions 3.0.0 through 3.31.x can be triggered by a malicious or compromised RDP server that sends a full-length WINDOW_ORDER_FIELD_TITLE window-title update lacking NUL termination, a value that wf_rail_window_common passes directly to SetWindowTextW. This reverse (server-to-client) attack requires the victim to initiate a connection to the attacker-controlled server with RemoteApp/RAIL in use; impact is limited to window-title corruption, disclosure of adjacent heap memory, and client crashes, with no code execution or integrity impact assessed (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). No public exploit code or confirmed active exploitation was identified at time of analysis.

A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component

An out-of-bounds write in the Lenovo Energy Management kernel-mode driver lets a local authenticated user crash the affected Windows host with a blue-screen (kernel bugcheck) error, producing a denial-of-service condition on systems where the driver is installed and loaded. The flaw is availability-only: the assessed impact is kernel memory corruption leading to a crash, with no demonstrated path to code execution or data disclosure, and it requires the attacker to already hold a local session on the machine (PR:L) - there is no network-reachable attack surface. No public exploit code and no evidence of active exploitation were identified at time of analysis, so this should be treated as a moderate-severity, patch-and-move-on item rather than an emergency; the vendor advisory is Lenovo LEN-218444.

Memory corruption in Google Chrome's SVG rendering path affects builds prior to 155.0.8059.84 and allows a remote, unauthenticated attacker to read memory from the browser process when a victim opens a crafted HTML page that embeds a malicious SVG image. The flaw is confined to an information disclosure (CVSS 4.3, C:L/I:N/A:N) - no code execution or data modification - and, per the assessed vector (AV:N/AC:L/PR:N/UI:R), requires no privileges but does depend on user interaction. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis, so the practical risk is concentrated on users running unpatched Chrome builds; Google has released a fixed version (155.0.8059.84), which is the primary mitigation.

Memory corruption in Google Chrome before 155.0.8059.84 allows a remote, unauthenticated attacker to read memory from the browser process when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) and results in only low confidentiality impact (C:L) with no integrity or availability loss; CISA SSVC rates exploitation as 'none' and the issue is not automatable. No public exploit code has been identified at time of analysis, and a vendor patch (155.0.8059.84) is available.

Stack-based out-of-bounds read and write in nifti_clib through 3.0.1 allows an attacker who supplies a crafted 540-byte NIfTI-2 header to crash or corrupt stack memory in any application that parses that file through nifti_image_read(). The flaw is unauthenticated per the published CVSS vectors but is local and file-driven: the target must actively open or process the malicious NIfTI-2 file, so there is no remote network-triggered path, and the dominant impact is denial of service (CVSS 6.9, AV:L/AC:L/UI:P, A:H with only I:L and C:N in the independent assessment). No public exploit identified at time of analysis; exposure is confined to software that links the vulnerable nifti_clib versions and accepts untrusted NIfTI-2 header data.

Heap-based out-of-bounds read in unarr through 1.1.1 lets a crafted ZIP archive crash any host application that links the library and passes it attacker-controlled input. The defect is in zip_parse_extra_fields() in zip/parse-zip.c, where an incorrect length check on the ZIP64 extra-field record allows reads past the end of a heap buffer when an archive supplies 0xFFFFFFFF sentinel values together with a truncated ZIP64 record; the demonstrated impact ceiling is a denial of service (process crash), with no confidentiality or integrity compromise and no code execution indicated. Exploitation requires the malicious archive to reach the victim and be opened or processed by the vulnerable application (local attack vector, passive user interaction, no privileges required), and no public exploit identified at time of analysis - this is a moderate-severity, low-priority issue rather than an urgent one.

An off-by-one heap-based buffer overflow in unarr through 1.1.1 (CWE-193) lets a crafted TAR archive that carries a fully populated ustar prefix field together with a full name field trigger a single out-of-bounds NUL write in tar_get_name() when an application calls the ar_entry_get_name() API. The flaw is reachable without authentication (CVSS PR:N) but is local/file-based (CVSS 3.1 AV:L, UI:R), requiring an application that links unarr to open or process attacker-controlled archive input; the assessed impact is bounded to heap corruption and process crash (availability) with no confidentiality loss and only minor integrity effect. No public exploit identified at time of analysis, the package is not listed in CISA KEV, and no vendor-released patch has been identified.

Heap-based out-of-bounds read in LibRaw through 0.22.2 allows a crafted Nikon NEF/TIFF file to crash applications that decode it. The flaw lives in LibRaw::parseNikonMakernote(), where a malformed 5-byte ShotInfo makernote tag declaring version 243 causes the parser to read past the end of a short buffer; because the file must be opened or processed by the victim (CVSS vector PR:N but AV:L/UI:P in the v4.0 score, and AV:L/UI:R in our independent v3.1 assessment), an attacker cannot trigger it remotely on their own. Impact is assessed as availability-only - no confirmed memory disclosure, code execution, or privilege gain - and no public exploit code or confirmed active exploitation was identified at time of analysis, though a technical writeup and the affected source lines are publicly linked. This is a moderate-risk availability flaw, not a top-priority emergency.

Crafted AMS (Velvet Studio) module files can crash any application that uses libmodplug 0.8.9.1 or earlier by triggering a heap-based out-of-bounds read in CSoundFile::ReadAMS2(). The attacker must deliver a specially formed AMS file whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer; the victim must then open or process the file, and no authentication is required. The issue is a local, client-side denial-of-service (CVSS 6.8) with no confirmed confidentiality or integrity impact, and no public exploit code or active exploitation has been identified at time of analysis.

Processing a malicious DSM module file with libmodplug through 0.8.9.1 triggers a heap-based out-of-bounds write in CSoundFile::ReadDSM(), corrupting heap memory and crashing the consuming process. Exploitation is local in nature: it requires a victim to open or load a crafted DSM file whose header declares more than 240 PATT chunks or whose patt_len value wraps, defeating the missing nPat bound against MAX_PATTERNS. Impact is bounded to availability (process crash) with limited integrity effect and no confidentiality disclosure, and no public exploit code was identified at time of analysis; a public technical write-up of the defect exists, and the risk converges on a medium-severity memory-safety issue rather than a top-tier priority.

Decoding crafted iCalendar text that ends in a trailing backslash drives a heap-based out-of-bounds read in libical 4.0.6 and earlier, allowing the attacker to crash the consuming application or expose a small amount of adjacent heap memory. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning a victim must locally open or process the malicious calendar data (for example a crafted .ics file, meeting invite, or subscribed feed) and the dominant outcome is a crash / denial of service, with only limited confidentiality loss rather than code execution; the PR:N component indicates no attacker credentials are needed on the affected host. No public exploit identified at time of analysis, the flaw is not listed in CISA KEV, and an upstream fix exists via the referenced pull request and commit.

An out-of-bounds memory read in Microsoft PowerPoint lets remote attackers leak information from the memory of the affected Office process when a user opens a specially crafted presentation file. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), meaning confidentiality is heavily impacted while integrity and availability are untouched, and it affects Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 on both Windows and macOS. No public exploit has been identified at time of analysis, but the attack path is straightforward: an unauthenticated attacker only needs to convince a victim to open a malicious .ppt/.pptx file, so email and web-delivered documents remain the primary delivery vector. A vendor patch is available through Microsoft's update guide.

An information disclosure vulnerability in Microsoft PowerPoint allows a remote, unauthenticated attacker to trigger an out-of-bounds memory read by convincing a victim to open a specially crafted presentation file, potentially exposing heap contents that may contain sensitive data. Affected builds span Microsoft 365 Apps for Enterprise, Office 365 for Mac, and the Office LTSC 2021 and 2024 releases on both Windows and macOS. The attacker needs no credentials (PR:N), but the attack hinges entirely on user interaction (UI:R) - the document must be opened, and Protected View or Mark-of-the-Web handling for externally sourced files can interrupt the chain. Microsoft has released a vendor patch and no public exploit code or active exploitation has been identified at time of analysis.

Opening a specially crafted PowerPoint document in an unpatched Microsoft Office build can trigger an out-of-bounds read that leaks the contents of process memory to the attacker. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the corresponding Office for Mac / LTSC for Mac 2021 and 2024 clients; exploitation is remote and needs no credentials (AV:N/PR:N) but hinges entirely on user interaction (UI:R), since the victim must open or preview the malicious file. The result is read-only memory disclosure (C:H, I:N, A:N) rather than code execution or data tampering, and there is no public exploit identified at time of analysis, though a vendor patch is available per the Microsoft Security Response Center advisory.

An out-of-bounds read in Microsoft Word (CWE-125) lets remote, unauthenticated attackers disclose the contents of process memory when a victim opens a specially crafted document, with affected builds spanning Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021/2024, and Office LTSC for Mac 2021/2024. Exploitation requires the user to open the malicious file (UI:R) and deliver it successfully through social engineering, so it is not a zero-click or wormable flaw, and the impact is limited to information disclosure (C:H, I:N, A:N) without code execution or persistence. No public exploit code has been identified at time of analysis, and Microsoft has published a vendor patch through its update guide.

An out-of-bounds read in Microsoft Word (CVE-2026-108434, CVSS 6.5) allows a remote, unauthenticated attacker to disclose information from process memory if the victim opens or previews a specially crafted Word document. Affected builds are Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, per the vendor CPE list. Because the vector requires user interaction (UI:R) and the impact is limited to confidentiality (C:H with I:N/A:N), there is no zero-click or server-side exploitation path; Microsoft has published a fix through its MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority patching item rather than an emergency.

Opening a crafted R2004 or R2010+ DWG file with GNU LibreDWG through 0.14.8612 can crash the parsing application and expose a small amount of process memory, because the AcDs data-section decoder indexes a static schema-property-type handler table using an unchecked 'schdat' index. The issue is local and user-assisted: an attacker must deliver the file, and a victim or an automated pipeline must actually parse it with dwgread, dwg2dxf, or any tool linked against LibreDWG; no authentication is required and default configurations are affected (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:L/A:H). No public exploit code was identified at time of analysis, and the practical impact is a medium-severity denial-of-service against DWG-processing workflows plus limited out-of-bounds information disclosure, making this a defense-in-depth file-parsing issue rather than an emergency.

A heap out-of-bounds read in libmikmod's IMF_Load() loader (CWE-125) lets a crafted Imago Orpheus (IMF) module map notes to sample indices far past the allocated sample table, crashing any application that parses the file with libmikmod 3.3.15 or earlier. Exploitation is local and requires the target application to load attacker-supplied IMF content, with no privileges or authentication needed, so the practical impact is denial of service against media players, trackers, and game engines that link the library. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 base score of 6.8 reflects high availability impact with no demonstrated confidentiality or integrity loss.

Loading a crafted MultiTracker (.mtm) module file with a declared channel count above 32 in applications linked against libmikmod through 3.3.15 triggers an out-of-bounds read in MTM_Load(), crashing the process. The flaw is a medium-severity local denial-of-service issue (CVSS 4.0 base 6.8) requiring user interaction to open or process the malicious file; no public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds read in UADE through 3.05 crashes applications that probe or play attacker-supplied Amiga module files, because an unsigned length subtraction in uade_filemagic() wraps around on deliberately short inputs. The malformed module must be small enough to slip past the format-probe bounds checks in amifilemagic.c yet trigger the bufsize underflow, after which the code reads far past the end of the buffer. Impact is limited to a denial of service, typically a segmentation fault that terminates the host player or library consumer; the attack requires the crafted file to be opened locally and the user to trigger the probe/playback path (CVSS:3.1/AV:L/PR:N/UI:R, availability-only), with no code execution, privilege gain, or data disclosure. The affected software is a niche Amiga emulation/audio library with limited deployment, so real-world risk is moderate; no public exploit identified at time of analysis, and the CVE is not in CISA KEV.

Denial of service in WildMIDI through 0.5.0 occurs when an application using the library opens or decodes a crafted HMI file that places a 0xfe 0x10 sub-event near the end of the input buffer. The _WM_ParseNewHmi() routine in src/f_hmi.c performs a heap out-of-bounds read of up to four bytes past the allocation, crashing the decoder; the issue is CWE-125 and cannot be triggered remotely without local file delivery and user interaction, and the over-read does not expose the four bytes to the attacker. Independent assessment rates this CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (low-to-moderate real-world risk, below the headline CVSS 4.0 score of 6.8), and no public exploit identified at time of analysis.

Heap out-of-bounds read in WildMIDI through 0.5.0 allows attackers to crash applications or disclose adjacent heap bytes by supplying a crafted .hmp file with an HMP chunk length of 0-12 that underflows to roughly 4 GB. Exploitation is local and file-driven: the target application or user must load the malicious .hmp file, reaching _WM_ParseNewHmp() with no authentication or special privileges required, and the impact is limited to denial of service or heap information exposure via WildMidi_GetInfo() with no code-execution or write primitive. This is a genuine but modest-priority issue, not a high-urgency flaw; no public exploit identified at time of analysis and CISA KEV does not list active exploitation.

Off-by-one stack out-of-bounds write in libADLMIDI 1.6.2 through 1.6.2.1 lets an attacker corrupt stack memory in the BW_MidiSequencer when a crafted MIDI file is parsed through adl_openFile() or adl_openData(). The trigger is a note-on event with status byte 0x9F and note 0x7F (127), which overruns the noteStates index and can crash the hosting media player or game engine. This is a local, file-based issue requiring the victim to load the malicious MIDI (CVSS 6.9 Medium); no public exploit identified at time of analysis, and the demonstrated impact is denial of service rather than reliable code execution.

Heap out-of-bounds read in libewf through 20260924 allows an attacker to crash an application or leak uninitialized heap memory by supplying a crafted .L01/.Lx01 logical-evidence image containing oversized 'ea' (extended attribute) metadata counts. The flaw is reachable only when the tool actually parses the attacker-controlled image: the CVSS 4.0 vector is local (AV:L) with passive user interaction (UI:P) and no privileges required (PR:N), and impact is concentrated in availability (VA:H, a crash) with only limited confidentiality (VC:L, memory disclosure). Public exploit code exists, but the vulnerability is not confirmed as actively exploited in CISA KEV.

Heap out-of-bounds read in EarthScope libmseed through 3.5.4 occurs when an application passes a truncated 40-to-47-byte miniSEED 2 record that still satisfies the MS2_ISVALIDHEADER check to msr3_parse() or ms3_detect(); the parser then reads the blockette-offset field beyond the end of the allocated buffer, over-reading up to 8 bytes and potentially crashing the process. Publicly available exploit code exists (a detailed write-up and the upstream fix are both linked from the CVE references), but CISA KEV does not list this issue, so there is no confirmation of active exploitation. Impact is limited to a denial of service (process crash) with no confidentiality or integrity effect; exploitation is local and requires passive user interaction, since a victim application or automated ingest pipeline must actually feed the malformed record to the parser - no authentication is required.

Heap out-of-bounds write in SoX (the sox CLI and any application linking libsox) through 14.4.2 allows a crafted MS ADPCM WAV file with an odd samplesPerBlock value in its fmt chunk to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt(), corrupting adjacent memory. Triggering the flaw requires the victim to open or submit the malicious file to sox/libsox (local attack vector, user interaction), but no authentication or privileges are needed; publicly available exploit code exists and no CISA KEV listing is present. The assessed impact is low integrity and high availability (CVSS 3.1 6.9, CWE-787), with exposure concentrated in automated audio-processing services that decode untrusted files.

Out-of-bounds write in libTiMidity through 0.2.8 allows unauthenticated local attackers to corrupt heap memory and crash applications by loading a crafted SoundFont (.sf2) file whose preset header 'bank' or 'preset' values index past the fixed 128-entry tonebank or drumset arrays in init_soundfont(). The vendor CVSS 4.0 base score is 6.9 (moderate), reflecting high availability impact (crash) and low integrity impact, with exploitation requiring passive user interaction to open the malicious file. Publicly available exploit code exists, increasing the likelihood of targeted attacks against applications that process untrusted SoundFonts.

Heap out-of-bounds reads in the SoundFont loader (src/sndfont.c) of libTiMidity 0.2.8 and earlier allow an attacker to disclose heap memory and crash an application whenever a crafted .sf2 SoundFont is loaded through mid_set_soundfont(). The attack is local and requires the victim to open or otherwise load the malicious SoundFont (UI:P with AV:L), so the impact is bounded to low-confidentiality memory disclosure and a high-availability crash, with no confirmed integrity loss or code execution; any product that never parses untrusted or third-party SoundFont files is effectively unaffected. Publicly available exploit code exists - a public writeup and the referenced upstream source lines demonstrate the unvalidated sampleId/generator indexing - but there is no evidence of active exploitation, and exploitation prerequisites make this a moderate-priority rather than a critical remote threat.

Stack out-of-bounds write in libTiMidity through 0.2.8 occurs when the SoundFont loader parses crafted .sf2 files, allowing an unauthenticated local attacker to corrupt stack memory via out-of-range pgen/igen generator operators in parse_gen, which writes chosen 16-bit values near the stack Layer object. This leads primarily to denial of service (crash) with a constrained memory corruption primitive; exploitation requires the victim to load a malicious SoundFont file (user interaction), and publicly available exploit code exists but there is no confirmed active exploitation. The assessed severity is moderate (CVSS 3.1 base score 6.1), consistent with a file-parsing memory-safety bug rather than a top-priority threat.

Opening a malicious NSF file through libgme's gme_open_data or gme_open_file entry points can crash the host application via a global out-of-bounds read in Classic_Emu::mute_voices_, as a chip_flags value such as 0x3F implies a voice count exceeding the fixed 16-entry voice-type table. This affects Game Music Emu (libgme) through version 0.6.5; the vulnerability is local (AV:L) and requires user interaction (UI:P) to load the crafted file, but requires no privileges (PR:N). Publicly available exploit code exists, and the CVSS 4.0 base score is 6.8, though no confirmed active exploitation (CISA KEV) has been observed. No vendor-released patch has been identified at time of analysis.

Heap out-of-bounds read in libgme (Game Music Emu) through 0.6.5 allows local attackers to crash applications that parse a crafted ZXAYEMUL (AY-format) file through gme_track_info or gme_start_track. The root cause is an integer underflow in the AY loader's track-table bounds check in gme/Ay_Emu.cpp; the assessed impact is denial of service (process crash) with no confirmed code execution or data disclosure, and exploitation requires that the victim opens or otherwise processes a malicious file. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the assessed CVSS:3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Heap out-of-bounds write in OpenJPH 0.32.0 and earlier allows memory corruption when the library decodes a crafted JPEG 2000 codestream (.j2c or .jph) that uses small precinct sizes to create degenerate one-row codeblocks; the HTJ2K cleanup-pass decoder then writes a second row beyond the end of the codeblock buffer, causing heap corruption and crashes. Publicly available exploit code exists, including a detailed technical write-up, but there is no indication of confirmed active exploitation (no CISA KEV listing), and the assessed attack vector is local with user interaction (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, integrity impact low, availability impact high). Realistic exposure requires OpenJPH to sit in a decode path that accepts untrusted images, such as an upload handler, image viewer, or batch conversion service, where a victim is induced to open the malicious file.

Heap out-of-bounds read in the PCM data-block decompressor (DecompressDataBlk) of ValleyBell libvgm through commit a6eed945 allows a crafted .vgm file to crash the consuming application. A malicious file supplies a PCM data block of type 0x7F with an undersized compression table that is then indexed by wider compressed values, forcing an out-of-bounds heap read; the confirmed impact is a denial-of-service crash of whatever player, converter, or emulator embeds the library, with no code execution, privilege escalation, or confirmed data disclosure. Publicly available proof-of-concept exploit code exists, and the issue is being tracked by VulnCheck; no confirmed active exploitation (CISA KEV) has been reported. Exploitation is local and file-based (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), so an attacker must convince a victim to open the malicious media file, and no public EPSS score was included in the available data.

Decoding a crafted PICT image with FreeImage (danoli3 fork) through 3.19.23 can over-read up to 64 KiB of heap memory inside Unpack32Bits() in PluginPICT.cpp, leaking process memory into the decoded pixel output or crashing the host application. The flaw affects any application that links the danoli3 fork (or the corresponding FreeImage codebase) and attempts to decode an attacker-supplied PICT file; per the assessed vector (AV:L/PR:N/UI:R) the attack requires a victim to open or process the malicious file, with no network-facing or unauthenticated remote path. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV entry), and the impact is bounded to information disclosure and denial of service rather than code execution.

Loading a crafted PSID/RSID SID tune file in applications built on libsidplayfp through 3.1.1 crashes the process through a heap out-of-bounds read. The library trusts the header's data offset without validating it against the real file size, so an attacker-supplied offset wraps the length calculation in SidTuneBase::resolveAddrs() and the code reads up to 64 KiB past the heap buffer. The confirmed impact is denial of service only - no code execution and no verified data exposure - and an attacker must get a victim to open or play the malicious tune, so this is a moderate, not high-priority, issue; publicly available exploit code exists (a HackMD write-up), but there is no confirmed active exploitation (not in CISA KEV).

Heap out-of-bounds read in libyal libesedb (through 20260704, all versions per the wildcard CPE) lets an attacker who supplies a crafted ESE/EDB database file to a libesedb consumer such as esedbexport cause the parsing process to crash or to disclose roughly 32 KiB of adjacent heap memory through libesedb_record_get_multi_value(). Publicly available exploit code exists, but there is no indication of confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 vector (AV:L, UI:P) means the issue is not remotely reachable: an attacker must first place the malicious file on a target system and get a user or an automated job to parse it. Impact is bounded to denial of service and limited heap information disclosure - not code execution - so this is a genuine but moderate-priority issue for workflows that process untrusted ESE databases.

Heap out-of-bounds read in ytnef through 2.1.2 allows an attacker to crash the ytnefprint utility and incidentally leak small amounts of adjacent heap memory by supplying a crafted winmail.dat whose compressed RTF property decompresses to data without a trailing NUL terminator. The flaw sits in MAPIPrint() in lib/ytnef.c and is reachable unauthenticated, but exploitation requires that a victim or an automated workflow open the malicious file, since the attack surface is local file parsing rather than a network service. Publicly available exploit code exists (linked proof-of-concept write-up), and there is no confirmed active exploitation (not in CISA KEV); the dominant realistic outcome is denial of service via crash, with only incidental memory disclosure of limited value.

Heap out-of-bounds read in ytnef through 2.1.2 allows unauthenticated local attackers to crash the application and leak adjacent heap memory by supplying a crafted winmail.dat TNEF file with a malicious PT_BINARY MAPI property. Publicly available exploit code exists, though the vulnerability is not confirmed as actively exploited. The CVSS 4.0 score is 6.9 (moderate), and exploitation requires the caller to process the attachment (passive user interaction).

An out-of-bounds read in libansilove through 1.4.2 lets a crafted compressed XBIN file, particularly one whose run-length data ends on a control byte such as 0x7F, drive the ansilove_xbin() loader past the end of its input buffer and crash the rendering application. Applications that link libansilove and render untrusted XBIN art are affected; the outcome assessed is denial of service via crash rather than code execution or disclosure of sensitive data. Publicly available exploit code exists in the form of a published proof-of-concept writeup, and exploitation requires a victim to open an attacker-supplied file, making this a local, user-interaction-dependent medium-severity issue rather than a remotely reachable emergency.

Processing a crafted ZIP archive with zziplib through 0.13.80 can cause a denial-of-service (crash) via an out-of-bounds read in the mmapped parsing path (zzip/mmapped.c). This local attack requires the victim to open the malicious file (passive user interaction) and no authentication, but results only in a crash (CVSS 4.0 base 6.8, availability impact only). No public exploit code or active exploitation has been identified at time of analysis.

An out-of-bounds read in zziplib through 0.13.80 allows attackers to crash applications that open a specially crafted ZIP archive via zzip_dir_open() when the library is compiled in mmap mode. The vulnerability triggers a 28-byte ZIP64 extra field over-read when an entry name ends exactly at the end of the mapped central directory. Exploitation requires a local attack vector, high complexity, and user interaction to open the crafted archive; there is no confidentiality or integrity impact, only availability loss (crash). No public exploit identified at time of analysis.

Heap out-of-bounds read in libregf (all snapshots through 20260526) allows an attacker who supplies a crafted legacy Windows registry hive (REGF format version 1.0/1.1) to make a value-data cell appear shorter than it actually is, so the library reads past the end of the cell and either leaks adjacent heap bytes or crashes the process. Exploitation is local and requires the victim or an automated pipeline to actively open the malicious hive; no privileges are required, but user interaction is needed, and the assessed impact is limited to confidentiality loss and denial of service, with no write primitive or code execution indicated. Publicly available exploit code exists in the form of a linked technical writeup, but there is no CISA KEV confirmation of active exploitation; downstream consumers such as regfexport and plaso/log2timeline are affected.

A heap out-of-bounds read in NetSurf libnsbmp through 0.1.7 can crash applications that call bmp_decode() when they process a crafted ICO file whose inner bitmap width is not a multiple of 8. Publicly available exploit code exists, and exploitation requires user interaction to open or process the malicious file. The flaw is a one-byte over-read (CWE-125) with no privileges required (PR:N) but a local attack vector; the impact is limited to a possible application crash, with no confirmed data disclosure or code execution.

Decoding a crafted RLE8- or RLE4-compressed BMP image with NetSurf's libnsbmp 0.1.7 or earlier can drive a one-byte heap over-read in bmp_decode_rle8() or bmp_decode_rle4(), crashing the consuming application. The trigger is narrow: the image must use RLE compression and end on an odd-length absolute run, so the word-alignment pad byte that the decoder forgets to count defeats its absolute-run bound check. Publicly available exploit code exists (a technical write-up with a reproducer is linked in the advisory), and exploitation is unauthenticated but requires a user or process to load and decode the attacker's image; impact is bounded to denial of service via crash, with no code execution, memory corruption, or confidentiality impact, making this a moderate, bounded issue rather than a top-tier priority.

Out-of-bounds write in libsmi through 0.5.0 allows attackers to corrupt adjacent library globals via a crafted MIB file that supplies an OCTET STRING DEFVAL of 512 or more octets beginning with a 0x00 byte, causing smiValueAsString() to overflow a fixed 1024-byte static buffer during hex rendering and crash smidump or other consumers. Exploitation requires the victim to load the malicious MIB (UI:P per CVSS 4.0; UI:R per independent CVSS 3.1 assessment) and is limited to local memory corruption with high availability impact and low integrity impact. Publicly available exploit code exists.

Heap out-of-bounds write in libInstPatch through 1.1.7 allows a crafted SoundFont 2 (.sf2) file to corrupt process memory when a victim loads it in Swami or any other application that uses the library's SF2 loader. The flaw lives in ipatch_sf2_gen_is_valid(), which fails to range-check pgen or igen generator IDs before the validity-mask test, so out-of-range IDs cause values to be written past the zone genarray into adjacent heap memory, crashing or potentially corrupting the consumer. The vector is local and requires user interaction (the victim must open the untrusted file), no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, though a public technical writeup describing the root cause is available.

A heap out-of-bounds read (CWE-125) in libyal's libfwsi shell-item parsing library, through the 20260522 snapshot, lets a crafted MTP volume shell item read past allocated buffer bounds inside libfwsi_mtp_volume_values_read_data(), typically crashing the consuming process. The issue is triggered locally and requires the victim to actively open or process an attacker-supplied Windows shell-item artifact - a .lnk file, a jump list, or a shell bag - that embeds a 10 to 53 byte MTP volume shell item declaring an item data size of 44 bytes or more; no attacker privileges are required (CVSS 4.0 base 6.9, PR:N). Practical exposure is limited to environments that actually run libfwsi-based parsers, such as digital-forensics and timeline tooling, and the realistic outcome is process termination (availability impact rated High) with only limited information disclosure possible; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Heap out-of-bounds read in libfwsi (libyal) through version 20260522 allows an attacker to craft an MTP file entry shell item that makes a libfwsi-based parser read past the end of a heap buffer, crashing the consumer and potentially disclosing a small amount of adjacent heap memory. The trigger is a shell item of 10-73 bytes whose declared item data size is 44 or more, embedded in a Windows .lnk file, jump list, or shell bag that the victim's tooling later loads or analyzes; the assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning local delivery, no privileges required, passive user interaction, high availability impact and only limited confidentiality impact. No public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and the practical outcome is a denial-of-service crash in DFIR/shell-item tooling (for example plaso) rather than remote code execution.

Heap out-of-bounds reads in libfsapfs through 20260921 can be triggered by a crafted encrypted APFS image, enabling adjacent heap memory disclosure and application crashes. The flaw is an integer underflow in libfsapfs_key_encrypted_key_read_data() that occurs during parsing of malformed HMAC or wrapped KEK attribute lengths, before any password verification, so no encryption key is needed. This local, user-interaction-dependent issue has a medium severity (CVSS 4.0 base 6.9) and no public exploit identified at time of analysis.

Rendering a crafted XPS document drives GNOME libgxps through 0.3.2 (the renderer used by consumers such as Evince) into a heap out-of-bounds read inside path_geometry_start_element(), allowing an attacker to crash the consuming application and leak adjacent heap bytes into rendered output. The trigger is a PolyBezierSegment or PolyQuadraticBezierSegment Points attribute whose point count is not a multiple of three (bezier) or two (quadratic), so exploitation is limited to a local, file-based attack that requires the victim to open or render the malicious document via user interaction (CVSS 4.0 AV:L/UI:P, PR:N) with no authentication or privilege bypass, no code execution, and only low confidentiality impact alongside high availability impact. An independent assessment scores the flaw 6.9 (medium) using CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, and no public exploit identified at time of analysis despite a public technical writeup documenting the arity mismatch; the affected range is captured by the wildcard CPE cpe:2.3:a:gnome:libgxps:*:*:*:*:*:*:*:*.

An off-by-one stack out-of-bounds read in libxmp through 4.7.4 allows a crafted headerless P61A (ProPacker 61A) module to make the prowizard depacker read one byte past a stack buffer, leaking a small amount of stack memory into sample metadata and/or aborting the module load. The flaw is reachable only when an application built on libxmp opens the attacker-supplied file, so exploitation is local and requires user interaction (no credentials are involved, per the PR:N vector), and the assessed impact is limited to low confidentiality loss with high availability impact - no code execution or data modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is a genuine but moderate-priority concern rather than a top-tier emergency.

Processing a crafted MIRAX whole-slide image with OpenSlide through 4.0.1 can trigger a heap out-of-bounds read in the MIRAX tile-position logic, crashing the consuming application and exposing limited adjacent heap data. The issue is local and user-assisted because a malicious .mrxs/Slidedat.ini must be opened or ingested by a victim or automated pipeline, and it does not by itself enable code execution or persistent data modification. No public exploit identified at time of analysis, and no CISA KEV active-exploitation entry is present in the supplied intelligence.

An out-of-bounds read in catdoc's xls2csv converter lets an attacker who supplies a crafted .xls file cause the tool to read past the end of a heap buffer and emit adjacent memory contents into the converted CSV output, or crash the process outright. The flaw lives in copy_unicode_string() in src/xlsparse.c and is triggered when a LABEL, STRING, or SST record declares 0xFFFF two-byte characters, a count that is consumed without adequate validation against the actual buffer size. All catdoc versions through 0.95 are affected, and exploitation requires a victim or an automated document-processing pipeline to open the malicious spreadsheet with xls2csv; the impact is therefore moderate in human-driven workflows but materially higher where untrusted spreadsheets are converted automatically, and no public exploit code was identified at time of analysis.

Out-of-bounds read in catdoc through 0.95 allows an attacker who can supply a crafted .xls workbook or raw BIFF stream to cause xls2csv to read past its static rec buffer in the MULRK record handler. Exploitation requires that a user or automated service invoke xls2csv on the malicious file, and no authentication is required; the attack is local to the host processing the file, with user interaction required per the independent assessment. Impact is bounded to leaking limited adjacent process memory into CSV output or crashing the conversion process, and no public exploit identified at time of analysis or CISA KEV activity is present in the supplied data; this is assessed as a moderate, not top-tier, priority.

Heap-based out-of-bounds read in the HCOMPRESS tile decoder of CFITSIO through 4.7.0 lets unauthenticated attackers trigger memory reads beyond the compressed tile buffer by supplying a crafted FITS file whose compressed image declares ZCMPTYPE HCOMPRESS_1 with oversized tile geometry; the flaw sits in the input_nnybble logic of fits_hdecompress.c and is reached through fits_read_pix. Impact is limited heap disclosure plus high availability loss - malformed reads can crash the consuming application - while confidentiality and integrity are only lightly affected (C:L, I:N per the source CVSS 4.0 vector, and assessed CVSS:3.1 as AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Publicly available exploit code exists, so the practical barrier is low, but exploitation is file-based: a victim application must ingest and decompress the malicious FITS file, so the issue is a genuine but moderate-priority concern rather than a top-tier emergency.

CFITSIO through 4.7.0 contains a heap out-of-bounds read in its image decompression routines when processing a crafted FITS file that uses SUBTRACTIVE_DITHER_1 compression and sets the ZDITHER0 seed to zero or a negative value. Triggering the bug requires local access and user interaction to open the file and decode pixels, resulting in a crash (denial of service) and a limited, non-targeted leak of heap memory into decoded pixel values. No public exploit code or active exploitation has been identified, and the issue is best characterized as a moderate-priority file-parsing bug rather than a remote code execution threat.

Out-of-bounds write in FluidSynth (versions through 2.6.1) allows an attacker to corrupt heap and stack memory by getting a crafted SF2 SoundFont loaded and played - unvalidated PMOD/IMOD modulator destination values of 63 to 255 are used to index the per-voice generator array and updated_gen_bit bitfield without bounds checking. Because the attack vector is local and the victim (or an application acting on their behalf) must open or play the malicious SoundFont, the realistic impact is memory corruption and application crashes (availability) rather than code execution or data theft. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the write-up and source references point to a code-review/crash class of issue rather than an urgent, remotely exploitable defect.

Heap out-of-bounds read in AdPlug through 2.4 can crash an application that parses a truncated TwinTeam DMO file, yielding a local availability-only denial of service rather than code execution or data disclosure. The attack requires the victim to open or load a crafted 12- or 13-byte DMO file that still passes dmo_unpacker::decrypt() and reaches CdmoLoader::load() via CAdPlug::factory; publicly available exploit code exists, but exploitation is local and depends on user interaction. The independent assessment rates this as a low-priority memory-safety defect, not an urgent crisis.

Out-of-bounds read in AdPlug through 2.4 lets a crafted XSM file (with 'ofTAZ!' signature and a song byte of 0x80 or higher) crash applications that play the file, requiring victim interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); the CVSS 4.0 score is 6.8 while the independent CVSS 3.1 assessment is 5.4 (AV:L/AC:L/PR:N/UI:R, availability-only). The vulnerability is a low-to-moderate priority local denial-of-service issue, with no code execution, privilege escalation, or data disclosure per the assessed impact (C:N/I:N/A:H).

AdPlug through 2.4 contains a heap-based buffer overflow in the KSM (Ken Silverman Music) module player, CksmPlayer::update() in src/ksm.cpp, where register writes accumulated for a single time slot overflow the fixed databuf[2048] array and corrupt the heap-resident player object. A crafted .ksm module whose notes share one time slot triggers the out-of-bounds write without authentication (CVSS PR:N), but the attacker-supplied file must reach and be opened or played on the target (AV:L, UI:R/UI:P), so the real-world exposure is local and interaction-dependent, with the dominant impact being availability loss (A:H) and minor integrity effects (I:L) rather than code execution. An upstream fix is available in GitHub PR #295; no public exploit code was identified at time of analysis.

Out-of-bounds read in HPE NonStop SQL/MX EXE allows local attackers with low-level privileges to cause information disclosure, process termination, CPU halt, or data corruption by supplying a corrupted file. This medium-severity vulnerability (CVSS 6.5) requires a specific file state to trigger and has no public exploit identified at time of analysis. It affects HPE NonStop SQL/MX EXE deployments.

Out-of-bounds memory write in HPE NonStop RDMA Services NSK can corrupt memory, and the 5.8 CVSS score reflects a local attack path that also requires high privileges, user interaction, and high attack complexity. Only HPE NonStop systems using the RDMA Services NSK component are affected based on the supplied CPE, and no public exploit code or CISA KEV entry is present in the data. Realistic exploitation is limited to a privileged local user who can induce a separate user to interact under race/condition-dependent circumstances, making this a moderate-severity, low-priority issue in practice.

Memory corruption and null pointer dereference in the HPE NonStop SQL/MX Run-Time Statistics component let an attacker who already holds low-level authenticated access to a NonStop system (PR:L) crash the affected process, producing a denial of service, with a secondary possibility of limited information disclosure (C:L, I:L). The high attack-complexity rating (AC:H) reflects that a single deterministic request is not enough - the attacker must craft malformed input that satisfies specific state or timing conditions before the flaw triggers. This is a moderate-severity (CVSS 6.4) input-validation defect (CWE-20) reported by HPE itself; no public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to NonStop environments that actually run the SQL/MX Run-Time Statistics feature.

Improper input validation in HPE NonStop KMS Server (Key Management Services) can let a locally authenticated user, with required operator interaction, trigger a buffer overflow via a crafted input message, causing a limited availability impact to the KMS Server. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L (score 2.8), so exploitation requires local access, low-level privileges, and user interaction, with no confidentiality or integrity effect. No public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.

Arbitrary code execution is possible in HPE NonStop Posix User Threads for an authenticated local user with low-level privileges who supplies crafted input to the pthread functionality, due to a heap-based buffer overflow (CWE-122). The flaw requires pre-existing local access (AV:L), no user interaction (UI:N), and no non-default configuration indicated by the available data; there is no public exploit identified at time of analysis. The vendor advisory is at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US, and the independent assessment rates confidentiality, integrity, and availability impact as High despite the vendor's 6.6 Medium base score with Low/Low/High impact.

A stack-based buffer overflow in the HPE NonStop Kernel Level Thread Model library allows a locally authenticated, low-privileged user to overwrite stack memory and, in the assessed worst case, execute arbitrary code in the context of the affected library. The vulnerability is reachable only with local access and valid low-privilege credentials (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so it cannot be triggered remotely and requires an attacker to already hold a foothold on the NonStop host; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed severity is moderate rather than emergency-grade. Success depends on invoking the vulnerable library from an existing session, which constrains realistic exposure to insiders, compromised local accounts, or post-exploitation privilege-escalation chains on operator-managed NonStop systems.

Stack-based buffer overflow in HPE NonStop EMS Distributor (CWE-121) allows an attacker who already holds a local presence on the NonStop host to corrupt the memory of the Event Management Service Distributor process, producing low integrity and low availability impact with no confidentiality exposure. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, base 4.0) means the flaw cannot be reached remotely, requires conditions beyond the attacker's control to trigger reliably, needs no application-level authentication once local access exists, and involves no user interaction - making this a low-priority issue rather than a critical one. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS score was supplied; the impact is bounded to the local host and to degradation of the EMS Distributor rather than a full system compromise.

Authenticated buffer overflow in QNAP Qsync Central (the QsyncServer app on QNAP NAS devices) prior to 5.0.0.4 allows a remote attacker who already holds a valid Qsync Central user account to corrupt memory or crash the Qsync process, degrading availability with no confirmed path to data theft or modification. The vulnerability is a classic CWE-120 buffer copy without input-size checking, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) confirms the impact is availability-only and gated behind account possession. There is no public exploit identified at time of analysis, no evidence of active exploitation, and an official fix is available in Qsync Central 5.0.0.4 and later, making this a low-priority, readily remediated issue.

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.

An out-of-bounds memory read in HPE NonStop EXPAND can be triggered by an authenticated, highly privileged local operator on the NonStop platform, potentially leaking memory contents or destabilizing the EXPAND networking subsystem. Exploitation requires local access (AV:L), pre-existing high privileges (PR:H), and a hard-to-control memory or timing condition (AC:H), so it is neither remotely nor anonymously reachable; no user interaction is required. No public exploit code has been identified at time of analysis, and the vendor security bulletin (hpesbns05148en_us) is the authoritative source for affected releases and fixes.

Out-of-bounds memory read in HPE NonStop EXPAND can disclose sensitive information to a local attacker who already holds high privileges on the NonStop system. The flaw requires local access and high privilege with high attack complexity, so realistic exploitation is limited to malicious or compromised privileged operators rather than external or unauthenticated attackers. No public exploit identified at time of analysis, and the CVSS 3.1 score is 4.7 (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:L), consistent with a low-priority information-disclosure issue.

Out-of-bounds memory read and write operations in HPE NonStop EXPAND can be triggered by malformed traffic sent to the EXPAND networking subsystem, potentially leading to information disclosure or memory corruption. The vulnerability is rated CVSS 6.4 (AV:A/AC:H/PR:N/UI:N) - an attacker needs an adjacent-network position and no credentials, but exploitation depends on specific, attacker-uncontrolled memory or timing conditions, which keeps this at moderate rather than critical severity. No public exploit code or active exploitation has been identified at time of analysis; remediation guidance should be taken from the HPE security bulletin.

Stack-based buffer overflow in HPE NonStop TELSERV (T9553L01^BAJ and earlier) allows unauthenticated remote attackers who can reach the Telnet server subsystem to corrupt memory and crash the service, producing a denial-of-service condition. The vulnerability is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H): exploitation is network-reachable and requires no credentials, but the High attack complexity means the attacker must satisfy non-trivial conditions such as a specific memory state to reliably trigger the overflow, and the impact is confined to availability with no confidentiality or integrity effect. There is no public exploit identified at time of analysis, no CISA KEV listing, and NonStop deployments are typically confined to segmented back-office or payment networks rather than being internet-facing, making this a moderate-severity, limited-impact issue rather than a top-tier priority.

An out-of-bounds read in ggml-org whisper.cpp through version 1.9.4 lets a local attacker crash the application by getting a victim to load a crafted GGML model file whose tensor-type field ('ttype') falls outside the valid range. Exploitation is strictly local and requires user interaction - the victim must choose to open the untrusted model - and the assessed impact is limited to availability (a process crash), with no confidentiality or integrity effect. Publicly available exploit code exists (the upstream issue and PR are public), but the vulnerability is not in CISA KEV and its severity is low.