Buffer Overflow

Heap-based buffer overflow in FreeRDP versions 2.0.0 through 3.31.x, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, allows a malicious RDP server to crash the client by sending crafted MP3 audio over the rdpsnd channel, resulting in a client-side denial of service. Exploitation requires the victim to connect to a malicious or compromised RDP server and the specific non-default build configuration; no public exploit code has been identified at time of analysis. The overall risk is moderate and conditional.

An out-of-bounds write in the Whisper speech-recognition model loader bundled with Praat (external/whispercpp/whisper.cpp) is triggered when a user loads a crafted Whisper model whose tensor dimension count (n_dims) falls outside the expected 0-4 range, corrupting memory on the local system. Affected versions are Praat up to and including 7.0.02; exploitation requires user interaction - the victim must actively open the malicious model file - and no authentication is required, with impact limited to low confidentiality, integrity, and availability loss on the local host. Publicly available exploit code exists, but the issue is rated low priority given the local attack path and the required user action, and no data indicates confirmed active exploitation.

Loading an untrusted safetensors model file into ExLlamaV2 up to and including 0.3.2 triggers a heap buffer overflow in the Safetensors Tensor Loader, because STFile.get_tensor in exllamav2/stloader.py acts on the data_offsets value from the model header without validating that it stays within the mapped buffer. The path is network-reachable and requires no credentials (PR:N), but it is gated by user interaction (UI:P, CVSS 4.0) - an attacker cannot hit a passive inference server, only one that is actually made to load a malicious or tampered third-party model. Publicly available exploit code exists and no CISA KEV entry is associated, so this is a proof-of-concept-driven issue rather than confirmed in-the-wild exploitation; the vendor-assessed CVSS 4.0 score is 2.1 (Low), and our independent assessment lands at a similar Low real-world priority because the realistic outcome is denial of service or limited memory corruption rather than reliable remote code execution.

An out-of-bounds read in the tmfile model loader of OAID Tengine (all releases up to and including 1.12.0) allows a malformed .tmfile model to drive reads beyond the end of an allocated buffer through the offset_root argument in source/serializer/tmfile/tm2_serializer.c. Exploitation is unauthenticated but requires user interaction - the victim must load the attacker-supplied model file - so only environments that ingest models from untrusted or third-party sources are realistically exposed, and the independent assessment rates this a low-priority issue notwithstanding its public disclosure. Publicly available exploit code exists (a public GitHub issue, OAID/Tengine#1453), but there is no evidence of active exploitation and no vendor patch has been released at time of analysis; impact is bounded to low-severity information disclosure and availability effects.

Out-of-bounds read in the OpenSIPS rtpproxy module (versions up to 3.6.8 and 4.0.1) allows unauthenticated remote attackers to trigger memory disclosure or a process crash via crafted SDP content processed by rtpproxy_offer() or rtpproxy_answer(). Exploitation requires the rtpproxy module to be loaded and its functions invoked in the routing script on attacker-reachable SIP transactions; no public exploit code has been identified at time of analysis, and no code execution is indicated. This medium-severity issue is fixed in OpenSIPS 3.6.9 and 4.0.2.

Repeatedly delivered crafted log data can push the Palo Alto Networks Panorama management appliance into maintenance mode by triggering a stack-based buffer overflow in its log-processing functionality, producing an availability-only denial of service. The issue is confined to Panorama's management plane: Palo Alto states explicitly that Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are not affected, so data-plane inspection is out of scope. Per the CVSS 4.0 vector the attack is network-reachable and unauthenticated (PR:N), but carries the AT:P flag, meaning success is condition-dependent and typically requires multiple attempts rather than a single reliable request; no public exploit code has been identified and there is no CISA KEV entry indicating active exploitation at time of analysis, and no EPSS score was supplied.

An out-of-bounds write in the DPDK vhost-crypto backend allows a guest VM to overflow a host-side buffer and crash the host data plane. The flaw combines an integer overflow in the chain-length validation logic with missing length checks on the RSA request path, so crafted virtio-crypto descriptors can bypass size validation and corrupt host memory. Exposure is confined to hosts that have explicitly enabled the vhost-crypto (virtio-crypto) backend, exploitation requires low-privileged access from within a guest, and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).

An out-of-bounds write in the DPDK lib/vhost vhost-crypto backend lets a guest VM that is authorized to issue vhost-crypto requests corrupt host memory by supplying an avail-ring descriptor index that the backend uses without validating it against the ring size. The affected code ships in Red Hat Fast Datapath packages for RHEL 8, 9, and 10 and is therefore inherited by related RHEL, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens) deployments that consume those DPDK builds. Exploitation is restricted to hosts where the vhost-crypto backend is actually enabled and a virtio-crypto device is exposed to a guest (CVSS 6.5, AV:L/PR:L/S:C), and the assessed outcome is host datapath denial of service rather than data disclosure or modification; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.

An out-of-bounds read in the Zephyr RTOS STM32WBA IEEE 802.15.4 driver (drivers/ieee802154/ieee802154_stm32wba.c) lets an attacker within radio range of an STM32WBA-based device copy roughly 128 bytes of adjacent RAM into a network packet delivered to the networking stack. The flaw affects Zephyr 4.3.0 through 4.4.2 in the default production configuration (CONFIG_ASSERT=n), where the only length bound is compiled out; builds with CONFIG_ASSERT=y are not exploitable because the assertion would fire first. Impact is limited to a read-only information disclosure and oversized packet allocation in the RX thread - no code execution and no internet-reachable path - and no public exploit identified at time of analysis, with CVSS scored 4.2 (AV:A/AC:H/PR:N/UI:N).

Out-of-bounds write in the Zephyr CC1200 sub-GHz IEEE 802.15.4 driver lets an unauthenticated attacker within radio range transmit a frame whose first byte declares a PHY length above the IEEE 802.15.4 maximum of 127, driving an oversized net_buf allocation and a single SPI burst that can write up to 127 bytes past the end of the first 128-byte buffer fragment. The flaw affects builds that enable CONFIG_IEEE802154_CC1200 with a physically attached CC1200 radio in the driver's default variable-length mode (PKT_LEN = 0xFF), and exploitation is constrained by RF framing/timing requirements (CVSS 3.1 AV:A/AC:H/PR:N/UI:N, CWE-787), with the resulting overflow containing FIFO-underflow bytes so the realistic outcome is network-buffer-pool corruption and crashes rather than a controlled write. An upstream fix is available as a commit to verify_rxfifo_validity(), but no public exploit code or confirmed active exploitation was identified at time of analysis, and no independently confirmed tagged release containing the fix is documented here.

Integer underflow in the NXP KW41Z IEEE 802.15.4 receive path of Zephyr RTOS lets an attacker within radio range corrupt memory in the shared network-buffer pool from interrupt context. The driver samples the over-the-air PHY-header length byte from the ZLL IRQSTS register and subtracts the FCS length in a uint8_t, so a crafted frame advertising a length of one wraps to 255 bytes, which is copied into a single 128-byte net_buf fragment and overruns it by up to 127 bytes while also reading past the end of the radio's RX register array. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited; exploiting it requires RF proximity plus a timing race that the attacker must win by flooding length-one frames.

Out-of-bounds read in the rpd routing process of Juniper Junos OS and Junos OS Evolved allows an adjacent attacker to disclose limited rpd process memory and disrupt a single LDP adjacency via a crafted IPv6 LDP message. The flaw affects numerous Junos OS and Evolved branches, with fixed versions available per Juniper advisory JSA112187. No public exploit code has been identified at time of analysis; exploitation requires the target to have LDP with IPv6 enabled and an attacker on the same network segment, making this a moderate-severity, limited-impact issue.

An out-of-bounds write in the eventd relay service of Juniper Junos OS and Junos OS Evolved allows an attacker who already holds high-privilege local access on the device to crash the event-processing daemon, causing a denial of service. Our independent assessment (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) confirms the attack is local rather than remote, requires high privileges, needs no user interaction, and affects availability only with no confidentiality or integrity impact and only a low downstream system-availability effect. There is no public exploit identified at time of analysis, no CISA KEV entry confirms active exploitation, and the vendor-rated CVSS 4.0 base score of 6.7 places this in the medium-severity range.

An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent BGP peer crash rpd and cause a denial of service by sending a crafted set of BGP communities. Per the CVSS vector (AV:A/PR:L) the attacker must already sit within the routing trust boundary with an accepted BGP peering session rather than being an arbitrary internet host, and exploitation additionally requires BGP to be configured on the target and the device to add the graceful-shutdown sender community while advertising a route. The impact is availability only (no confidentiality or integrity effect), rated 6.8 (Medium); confirmed actively exploited status is not indicated, and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority availability issue rather than a top-tier emergency.

Out-of-bounds read in Godot Engine through 4.7.2 lets a crafted .translation resource drive a hash-table offset far past the allocated bucket table in OptimizedTranslation::get_message, so that loading the resource and performing a tr() string lookup either crashes the Godot editor or an exported game or returns raw heap bytes from elsewhere in the process as the 'translated' string, disclosing process memory. Exploitation is local and requires user interaction - the crafted translation file must be delivered into the project or game and then a lookup performed against it - and reliable heap disclosure depends heavily on process memory layout, so a crash is far easier to trigger than a useful leak; there is no public exploit identified at time of analysis. The report is disputed by the supplier, which argues loading untrusted resource files sits outside Godot's current threat model, and the assessed CVSS of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) reflects a genuinely low real-world risk rather than a remote or wormable issue.

Integer overflow (CWE-190) in the rapidcsv C++ header-only CSV parser prior to version 8.99 allows a local attacker to corrupt heap memory or crash a process that loads an attacker-supplied CSV into an in-memory matrix. The affected APIs - RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames - cast a size_t index to int before adding it to a std::vector iterator, so on 64-bit systems an index above INT_MAX wraps negative and points before the start of the buffer. Exploitation prerequisites are severe: the process must hold a matrix with more than 2^31 elements in a row or column (tens of gigabytes of RAM) and then call one of those APIs, so ordinary CSV workloads are not practically affected. No public exploit identified at time of analysis; the CVSS base score is 2.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), and the fix is the vendor-released patch in v8.99.

Host-side denial of service and potential memory corruption in DPDK's lib/vhost arise because memory-region sizes are not adequately validated before mmap during vhost memory-region setup (CWE-770). The affected code ships to customers through Red Hat Fast Datapath for RHEL 8, 9 and 10, and therefore reaches Red Hat Enterprise Linux 8/9/10, Red Hat OpenShift Container Platform 4 and Red Hat OpenStack Platform 13 (Queens) deployments that use DPDK vhost-user acceleration. An attacker who controls a connected vhost-user frontend - typically a guest VM or a process holding the vhost-user socket - can crash the host (CVSS 6.5, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and there is no confirmation of active exploitation.

A heap out-of-bounds write in Godot Engine through 4.7.2 is reachable when the engine (or an exported game built with it) loads a specially crafted binary resource file (.res). A negative Unicode-string length field read from the file bypasses the buffer-resize check and is then sign-extended into a very large unsigned copy count, causing file-controlled data to be written far past an undersized heap allocation. The attack is local and requires the victim to open a malicious .res file in the editor or to load it at runtime in a game that ingests external assets such as mods or user-supplied content, and reliable code execution demands heap grooming (high complexity); no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the supplier disputes the security relevance, arguing that loading untrusted resource files is outside Godot's threat model, whereas independent assessment rates the confidentiality, integrity and availability impact of a successful trigger as High.

Heap out-of-bounds write in the Radiance HDR (.hdr) image decoder of Godot Engine through 4.7.2 allows an attacker-supplied .hdr file to corrupt heap memory with contents and overflow length controlled by the file, during project import or runtime image loading. The vendor's CVSS 3.1 vector places this at local, high-complexity, user-interaction-required, unauthenticated (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L per the independent assessment), because the victim must import or load the crafted file and success depends on heap layout. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor disputes that attacker-supplied asset delivery is inside the current Godot threat model, leaving real-world priority LOW.

Stack and heap buffer overflow in DPDK's nfp vDPA driver for Netronome/Corigine NFP SmartNICs allows a malicious guest VM with control of the virtqueue to corrupt host memory, leading to high integrity and availability impact and low confidentiality impact. The vulnerability is only exploitable when the host runs DPDK with the nfp vDPA driver active on NFP SmartNIC hardware, and the attacker must be positioned as a local guest able to drive the guest-side virtqueue. No public exploit code has been identified at time of analysis, and the vendor-rated CVSS 3.1 score is 6.5 (Medium); however, our independent assessment assigns a higher impact vector of AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H.

An out-of-bounds heap read in unshield through 1.6.2 lets a crafted InstallShield cabinet file with an out-of-range file_table_offset or an abnormally large file count crash the unshield command-line tool or any application linking libunshield. Exploitation is local and requires the victim or an automated pipeline to actively open the malicious .cab file (CVSS 4.0 base 6.8; assessed 3.1 as AV:L/AC:L/PR:N/UI:R with availability-only impact). Publicly available exploit code exists, but the realistic outcome is denial of service - no code execution or data disclosure has been demonstrated - and there is no evidence of confirmed active exploitation (CISA KEV).

Heap out-of-bounds read and write in MuJS 1.3.6 through 1.3.8 allows attackers to corrupt process memory by supplying JavaScript that inflates a simple/dense array's length property and then invokes Array.prototype.sort, driving the internal Ap_sort_cmp and Ap_sort_swap helpers to index slots past the allocated heap buffer; the practical result is memory corruption and a process crash (CVSS 4.0 base 6.9, AV:L/AC:L/PR:N/UI:P with high availability and low integrity impact). Publicly available exploit code exists, including a published proof-of-concept write-up demonstrating the array-length trigger, but the issue is not confirmed as actively exploited (no CISA KEV listing) and exploitation requires a target application embedding MuJS to execute attacker-controlled script that a victim loads or opens. Deployments that only ever run trusted, first-party JavaScript are not exposed, and MuJS 1.3.9 and later contain the fix; this is a genuine but moderate-priority memory-corruption flaw rather than an emergency.

Parsing a crafted ADF node header in CGNS through 4.5.2 triggers a stack out-of-bounds read that can crash downstream tools such as cgnslist, giving an attacker a local denial-of-service against the parsing application. The flaw lives in ADFI_read_node_header (src/adf/ADF_internals.c), where an end tag that is not NUL-terminated causes ADFI_stridx_c to scan past the disk_node_data buffer. Publicly available exploit code exists (a HackMD proof-of-concept write-up referenced in the CVE record), but there is no confirmed active exploitation per CISA KEV, and there is no remote or network-triggered path: the victim must locally open an attacker-supplied .cgns or .adf file, and the worst outcome is a process crash with no code execution, data disclosure, or integrity loss.

Stack out-of-bounds read in vgmstream through r2117's G.722.1/Siren14 decoder can be triggered when a victim opens or lets a vgmstream-based application process a crafted .s14 or .sss file, causing an application crash. The issue is local-vector with passive user interaction and is availability-only, consistent with an assessed CVSS 3.1 score of 4.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Publicly available exploit code exists, but no CISA KEV confirmation is provided.

Heap out-of-bounds read in Sofia-SIP through 1.13.18 allows unauthenticated remote attackers to crash SIP processes by sending INVITE requests with a multipart Content-Type whose MIME boundary exceeds the body length, causing memcmp to read past a heap buffer. Publicly available exploit code exists, and the vulnerability is remotely triggerable without authentication or user interaction, affecting network-reachable SIP endpoints such as FreeSWITCH servers. The primary impact is denial of service (availability), with no confidentiality or integrity impact.

A one-byte heap out-of-bounds read in miniupnpc through 2.3.3 lets an attacker on the same local network crash a UPnP client by responding to discovery or SOAP traffic with a crafted XML element name that ends in a namespace-prefix colon. The minixml parser's parseelt function advances past the ':' character without re-checking the end-of-buffer pointer, so a single byte beyond the heap allocation is read, producing a client-side denial of service at worst. No CISA KEV listing exists, but publicly available exploit code exists (a technical write-up detailing the minixml OOB read), while the assessed impact is limited to availability loss (CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor score 2.3 on the CVSS 4.0 scale).

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read in the minixml parser's parseatt() routine: a malicious or spoofed UPnP Internet Gateway Device on the local network can return a crafted device description or SOAP response whose attribute list ends with an '=' character, causing the client to read one byte past the end of its buffer and crash. Publicly available exploit code exists (a detailed write-up is linked alongside the upstream fix), but there is no confirmed active exploitation; the flaw is rated CVSS 2.3 (CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N, low availability-only impact), so the realistic outcome is a limited denial of service for unauthenticated attackers who already share the victim's adjacent network and can spoof the gateway. No code execution or data disclosure is associated with this issue.

Memory corruption in libzvbi through 0.2.45 can occur when a victim application decodes an attacker-supplied Teletext stream containing X/28/3 DRCS packets with unvalidated pixel-mode values, driving an out-of-bounds write in convert_drcs. Exploitation requires local decoding of the malicious stream and passive user interaction (opening or processing the stream/capture), and publicly available exploit code exists; there is no confirmed active exploitation. The out-of-bounds write (CWE-787) crashes the application and may corrupt memory, making this a moderate-severity, low-urgency issue rather than a top priority.

Opening a specially crafted DWG file (versions AC1018, AC1024, or AC1027) in LibreCAD or any application linking libdxfrw can trigger a stack-based out-of-bounds read in dwgReader18::readFileHeader(), which calls strlen() on a decrypted header buffer that is not guaranteed to be NUL-terminated; the read walks past the end of the stack buffer and typically crashes the process. The issue affects libdxfrw through LC2.2.0 and LibreCAD through 2.2.1.5, and exploitation is local, requiring the victim to manually open the malicious drawing (CVSS 4.0 base 4.8; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R with availability-only impact). There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, and the observed outcome is a denial of service rather than code execution or confirmed information disclosure. Upstream fixes have been committed to both the libdxfrw and LibreCAD repositories, though a tagged patched release has not been independently confirmed.

An off-by-one stack out-of-bounds write in Mini-XML 4.0.0 through 4.0.6 lets an attacker who can supply crafted XML corrupt or crash a parsing application, but only when the host process runs under a locale whose decimal separator is not '.'. Supplying a REAL value of exactly 63 digits immediately followed by '.' drives mxml_strtod()'s decimal-point substitution logic to write a NUL byte one position past its 64-byte stack buffer (CWE-193), corrupting adjacent stack memory. No public exploit identified at time of analysis; independent assessment rates this CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L (CVSS 4.0 base score 2.0), so all available signals point to a low real-world priority.

A heap out-of-bounds write in libsixel's GIF decoder (gif_init_frame() in src/fromgif.c) allows a crafted GIF file to corrupt heap memory in any application that links the library and decodes untrusted images. Affected releases are libsixel before 1.8.7-r1 and versions 1.9.0 through 1.10.5. Successful exploitation is gated by several conditions - the decoder must be invoked with a non-NULL background color (the CVSS 4.0 AT:P attack requirement), the GIF must declare a transparent color via its graphic control extension, the active global or local color table must be small, and the transparent index must exceed that palette size - so the practical risk is medium (CVSS 4.0 base 5.8; assessed CVSS 3.1 AV:L/AC:H/PR:N/UI:R with integrity and availability impact only). The vector is local with required user interaction, no public exploit identified at time of analysis, and a vendor fix is available.

Heap out-of-bounds reads in libpff through 20260926 allow attackers to crash applications (denial of service) and disclose adjacent heap memory by delivering crafted PST, OST, or PAB files that contain multi-value properties with non-monotonic offsets. Exploitation requires the victim to open or process the malicious file with libpff, the pypff bindings, or the pffexport tool; the flaw is local (AV:L) with passive user interaction (UI:P) and no authentication required (PR:N). No public exploit code was identified at time of analysis, and the impact is bounded to denial of service and information disclosure-not code execution, integrity compromise, or remote exploitation.

Heap out-of-bounds read in TinyEXR through 3.2.0 occurs when ParseEXRMultipartHeaderFromMemory() processes a crafted multi-part EXR file and a later part header carries a stale remaining-size value, bypassing ReadAttribute() bounds checks. The flaw is locally delivered and requires a victim to open or process the malicious EXR file in an application that uses the library, resulting in a likely application crash and only limited disclosure of adjacent heap memory into parsed attribute values; no code execution or data integrity impact is indicated. This is a moderate-severity memory-safety issue (CVSS 6.9) affecting any tinyexr-consuming application that accepts untrusted multi-part EXR input, with no public exploit identified at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix out-of-bounds write in reset_per_cpu_data() In reset_per_cpu_data(), al is computed as: al = sizeof(struct net_dm_alert_msg); al += dm_hit_limit * sizeof(struct net_dm_drop_point); al += sizeof(struct nlattr); skb = genlmsg_new(al, GFP_KERNEL); ... nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg)); ... msg = nla_data(nla); memset(msg, 0, al); Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg_new() allocates al bytes of tailroom starting at nla. However, msg points to nla_data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb_shared_info. Fix this by letting al represent only the payload length, allocating the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing al bytes from msg.

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len). If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory. Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce: 1. Set device MTU bigger than IP_MAX_MTU + 20. cork->base.fragsize will be set to that MTU in ip_setup_cork. 2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be set to device MTU (cork->fragsize) in __ip_append_data, rather than to IP_MAX_MTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of IPv4 header). Device MTU allows it (it's only one byte bigger than IP_MAX_MTU + IPv4 header, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udp_set_len_short. Note: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward always clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward. The Fixes tag points at the first commit where I could reproduce the overflow with IPv4 and IP_PMTUDISC_PROBE.

Denial of service in the HPE NonStop TMF Auditread2 audit-trail utility arises from a stack-based buffer overflow (CWE-121) that can be triggered when the utility processes specially crafted input, crashing the process and disrupting availability of the TMF audit-read function. Exploitation is not remote: the assessed vector (AV:L/AC:H/PR:L/UI:N) requires local, authenticated access to the NonStop host plus the ability to execute or feed crafted data to Auditread2, and the high attack complexity means reliable triggering is not trivial. Vendor scoring is 6.4, while our independent assessment rates the impact as availability-only (A:H), so realistic risk is confined to insiders or post-compromise actors on specialized NonStop deployments; no public exploit code has been identified and there is no confirmed active exploitation (CISA KEV) at time of analysis.

An out-of-bounds write in GStreamer's H.266/VVC Decoding Capability Information (DCI) parser inside libgstcodecparsers allows a remote attacker to crash or corrupt memory in any third-party application that directly calls the affected parsing API by supplying a crafted H.266 bitstream whose reserved DCI field carries an illegal value the parser wrongly accepts. Red Hat rates it CVSS 6.5 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) - network-reachable, unauthenticated and requiring no user interaction per the supplied vector, but with only Low integrity and Low availability impact and no confidentiality loss, consistent with a bounded out-of-bounds write (CWE-787). Exposure is sharply limited: the description states no standard GStreamer pipeline element invokes this code path, so default GStreamer installations and ordinary playback pipelines are not exploitable, and no public exploit has been identified at time of analysis.

Heap out-of-bounds write in the GStreamer ASF muxer plugin (asfmux) occurs when string metadata tags containing Unicode characters outside the Basic Multilingual Plane - such as emoji or supplementary-plane CJK characters - are written into an ASF/WMV container, because the buffer size calculation assumes 2 bytes per code point while UTF-16LE surrogate pairs actually require 4. Exploitation requires a local pipeline that muxes, remuxes, or transcodes attacker-supplied media into ASF while preserving metadata (AV:L, UI:R), enabling a user-assisted heap corruption that can cause a denial of service or limited memory corruption. Rated CVSS 6.1 with C:N/I:L/A:H, this is a medium-severity issue with a narrow attack path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and affected packages are tracked for Red Hat Enterprise Linux 7, 8, 9, and 10.

Command injection and buffer overflow weaknesses in HPE NonStop Java JToolkit can let a locally positioned, already highly privileged attacker corrupt memory or execute unintended commands within the JToolkit process, with impact limited to low confidentiality, integrity, and availability effects (CVSS 3.1 base 3.8, Low). Exploitation is not remote: it requires pre-existing high local privileges (PR:H), local access to the NonStop system (AV:L), a separate user interaction that supplies attacker-influenced input to the vulnerable routine (UI:R), and additional non-deterministic conditions captured by high attack complexity (AC:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), so all available CVSS signals point to a low real-world priority.

Heap- and stack-based buffer overflow in HPE NonStop Hpjmeter, the Java-based performance/profiling analysis client for HPE NonStop systems, can crash the tool when it parses crafted input. Impact is confined to availability (CVSS 3.1 base score 2.0 on the vendor's published vector, assessed as A:L with no confidentiality or integrity effect), and exploitation is gated by high attack complexity and the requirement that a privileged, authenticated user open or process the malicious data - no public exploit has been identified at time of analysis. The published vector nominally claims AV:N, but the behavior described (data/file parsing by a client tool) suggests a local delivery path; this discrepancy is unconfirmed and should be validated against HPE advisory hpesbns05148en_us.

Heap memory corruption in Qt for MCUs (Qt Quick Ultralite) can produce a double free, invalid free, or use-after-free when an application passes text stored in a std::string into the public Qul::String interface, because the conversion copies the pointer without taking ownership and two objects subsequently release the same allocation. The assessed impact is high integrity and availability loss with only limited confidentiality exposure, and exploitation requires that the target application actually use this specific std::string-backed API pattern - no privileges or user interaction are otherwise needed. The vendor rates it 6.5 (Medium) under CVSS 4.0 with attack requirements present (AT:P); no public exploit code or confirmed active exploitation was identified at time of analysis, and the reference set provides only a Qt wiki advisory listing rather than a fix version.

An out-of-bounds write in the Hitachi Disk Array Driver for IBM AIX (versions 01-00 through 01-22, fixed in 01-23-/A) and for Virtual I/O Server (versions 01-04 through 01-22, fixed in 01-23-/A) allows a local user who already holds high privileges to corrupt driver memory, which the assessed vector scores as high availability impact with limited integrity impact. Because exploitation requires the CVSS vector combination AV:L and PR:H with no user interaction, only already-privileged local accounts - or an attacker who has first compromised such an account - can reach the vulnerable code path; there is no network-facing or unauthenticated path. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV entry); a vendor patch is available, which makes this a low-to-moderate prioritization item rather than an emergency.

An out-of-bounds read in curl when built with the GnuTLS TLS backend and WebSocket support allows a malicious WebSocket server to cause the client to send memory beyond its send buffer, potentially disclosing limited process memory (C:L) and causing a low availability impact (A:L). This unauthenticated attack (PR:N) requires user interaction (UI:R) because the victim must connect to an attacker-controlled WebSocket server; affected builds are those using GnuTLS rather than OpenSSL and with WebSocket support enabled, which is experimental and off by default in many distributions. No public exploit code or CISA KEV listing was identified at time of analysis, and no CVSS, EPSS, or POC data was provided, so quantitative exploitation signals are absent; a vendor patch is available per the Ubuntu security notice USN-8927-1.

An out-of-bounds read (CWE-125) in Citrix Workspace app for Windows can be triggered by a local, low-privileged user on an affected endpoint, leading to limited confidentiality and integrity impact together with a high availability impact (crash/DoS) as reflected in both the CVSS 4.0 base score of 5.8 and the independent CVSS 3.1 assessment (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H). Only Windows builds prior to 2603.20 CR, prior to LTSR 2607, and prior to LTSR 2507 CU3 are affected. The attack is not remotely reachable, requires an existing foothold on the host and specific high-complexity preconditions or timing flagged by AT:P and AC:H, and no public exploit code has been identified at time of analysis; this is routine patch-cycle work rather than an emergency.

An out-of-bounds write in the Citrix Workspace app for Windows lets a locally present, low-privileged attacker corrupt memory inside the client process, which the vendor scopes to a high availability impact - realistically a client crash or denial of service rather than code execution or data disclosure. Affected builds are those before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1; fixed installers are available from Citrix, and at time of analysis there is no CISA KEV listing and no public exploit identified. With a CVSS 4.0 base score of 6.8 with a local vector, low privileges and no user interaction, this is a moderate-priority endpoint stability issue rather than a top-priority remote threat.

Heap-based buffer overflow in Microsoft SQL Server allows an attacker who already holds high-privilege, locally authenticated access to the database engine to execute arbitrary code in the context of the SQL Server process, with high impact to confidentiality, integrity, and availability. Affected builds span SQL Server 2017, 2019, 2022, and 2025 releases below the fixed GDR/CU versions documented in ENISA EUVD-2026-100618, and a vendor patch is available from Microsoft. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation as 'none' with Automatable 'no', and the AV:L/PR:H vector confines realistic abuse to malicious insiders or post-compromise privilege leveraging - a moderate priority rather than an emergency patch.

An out-of-bounds read in Microsoft SQL Server exposes memory contents to unauthenticated attackers who can reach the server's database listener from an adjacent network segment. The flaw is rated CVSS 3.1 base 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), so the disclosure is high-impact confidentiality only - there is no integrity or availability effect - and exploitability is constrained by High attack complexity, meaning success depends on server memory layout, timing, or state that the attacker cannot control, making the leak non-deterministic rather than reliably repeatable. Microsoft has published a fix through its update guide, and there is no public exploit code and no confirmed active exploitation (no POC, no CISA KEV; CISA SSVC records Exploitation: none).

Local privilege escalation in Microsoft SQL Server arises from a heap-based buffer overflow (CWE-122) that an already-authenticated, high-privilege attacker can trigger on the database host to corrupt heap memory and execute code in the context of the SQL Server service. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.4) confirms this is a post-compromise escalation primitive: it requires local access to the host plus pre-existing elevated privileges (PR:H) and a precise heap-state condition (AC:H), not a remote or unauthenticated attack path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none with automatable set to no, and vendor-released patches exist for SQL Server 2017, 2019, 2022, and 2025 across both GDR and CU servicing branches, making this a moderate-priority patch-now item rather than an emergency.

Heap-based buffer overflow in Microsoft SQL Server 2022 and SQL Server 2025 allows an attacker who already holds an authorized, high-privilege database session to execute code on the database server over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.6) confirms the attacker must be authenticated with high privileges (PR:H) and must clear a high-complexity exploitation bar (AC:H) such as precise heap state manipulation, while successful exploitation yields full confidentiality, integrity, and availability impact on the SQL Server instance. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and Microsoft has released vendor patches for the affected GDR and cumulative-update builds.

Improper input validation in the Okta Credential Provider for Windows (versions before 1.4.6.0) allows a locally authenticated, high-privilege attacker to feed a malformed serialized credential buffer that the provider parses as a Kerberos logon structure without validating buffer size or packed string offsets, resulting in out-of-bounds memory reads and writes, provider process termination, and potential disclosure of adjacent process memory into local system logs. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires pre-existing high-privilege local access on the host rather than remote or unauthenticated reach, and the primary demonstrated outcome is memory disclosure into logs plus a possible crash, not code execution. There is currently no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); a vendor-released patch (1.4.6.0) is available, which together with the local-only, high-privilege prerequisites makes this a moderate-severity hygiene and hardening issue rather than a mass-exploitation priority.

Heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds high privileges and local access on the database host run arbitrary code in the context of the SQL Server service. Affected builds are SQL Server 2017, 2019, 2022 and 2025 releases below the fixed GDR and cumulative-update versions documented in the vendor advisory (for example, SQL Server 2022 GDR below 16.0.1210.3 and SQL Server 2019 GDR below 15.0.2200.2). Because exploitation requires pre-existing elevated privileges and a local foothold (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), a remote unauthenticated attacker cannot reach this directly; CISA's SSVC assessment rates it non-automatable with no observed exploitation, and no public exploit code was identified at time of analysis, though the technical impact is rated total once the prerequisites are met. A vendor patch is available and should be applied as routine maintenance rather than emergency response.

An out-of-bounds read (CWE-125) in Microsoft SQL Server lets an authenticated attacker who already holds high privileges on the database instance disclose in-process memory contents over the network. The flaw is network-reachable (AV:N) and requires no user interaction (UI:N), but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N vector and the vendor's 'authorized attacker' wording confirm the high-privilege prerequisite, so anonymous or low-privileged callers cannot reach it; impact is limited to confidentiality (C:H) with no integrity or availability effect, for an overall base score of 4.9. CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', so no public exploit code has been identified at time of analysis, and Microsoft has published vendor-released patches that resolve the affected SQL Server 2017, 2019, 2022, and 2025 builds - making this a moderate-severity, low-priority issue despite the ubiquity of the product.

A stack-based buffer overflow in Adobe Substance 3D Designer (versions 16.0.4 and earlier) allows an attacker to crash the application by supplying a crafted file that the victim opens, producing a denial-of-service condition for the active session. The attack is local (AV:L) and depends entirely on social engineering, since the victim must actively open the malicious asset (UI:R); no privileges are required (PR:N) and the impact is limited to availability with no confidentiality or integrity loss. Exploitation yields only an application crash rather than host compromise, and no public exploit code or confirmed active exploitation was identified at time of analysis.

An out-of-bounds read in Adobe Substance 3D Designer 16.0.4 and earlier (CVE-2026-103825, CWE-125) can expose contents of sensitive memory when a victim opens a maliciously crafted file, resulting in information disclosure. The vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation is local and requires user interaction - the attacker cannot trigger the flaw remotely and no authentication is needed per PR:N, but a crafted file must be opened by the target user. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis; EPSS/KEV data was not provided, and this is assessed as a moderate-severity, low-priority issue rather than an urgent threat.

Opening a crafted file in Adobe Substance 3D Designer 16.0.4 and earlier can overflow a stack buffer and crash the application, giving an attacker a denial-of-service condition against a local user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5, aligned with our independent assessment) confirms the trigger is a locally delivered file, requires the victim to manually open it, requires no privileges, and is scored purely for availability impact with no confidentiality or integrity loss; there is no network-reachable or unauthenticated-remote path. No public exploit code was identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV). This is a genuine but low-priority vulnerability whose realistic risk is constrained by the required user interaction, local file delivery, and crash-only impact.

An out-of-bounds read in Adobe Substance 3D Designer 16.0.4 and earlier can disclose sensitive contents of process memory when a user opens a specially crafted file, yielding a moderate-severity information disclosure (CVSS 5.5, CWE-125). The attack is local-only and cannot be triggered remotely: it requires the victim to interact with the application by manually opening an attacker-controlled file, and there is no privilege or authentication prerequisite on the attacker's side. No public exploit code or confirmed active exploitation was identified at time of analysis, and because the leaked data is limited to the application's in-process memory - which the attacker must still find a way to recover - this should be handled as a routine patch-cycle priority rather than an emergency response.

Opening an attacker-crafted file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds read that discloses sensitive contents of the application's process memory to the attacker. The vulnerability is local in nature (AV:L) and requires the victim to manually open a malicious file (UI:R), so it cannot be triggered remotely or without user interaction; impact is limited to confidentiality, with no integrity or availability effect and no code execution claimed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 5.5 reflects a genuine but moderate-priority information-disclosure issue rather than a high-urgency one.

Importing a specially crafted asset file into Adobe Substance 3D Sampler 6.0.3 or earlier can trigger an out-of-bounds read that leaks contents of the application's process memory to the attacker. The vulnerability is local in nature - there is no network or unauthenticated path to trigger it - and it is gated on user interaction, requiring the victim to be socially engineered into opening a malicious file; the outcome is limited to information disclosure with no integrity or availability impact and no code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is assessed as genuinely moderate risk rather than a top-tier priority.

An out-of-bounds read (CWE-125) in Adobe Bridge allows disclosure of sensitive memory contents when a victim opens a specially crafted file in the application. Affected releases are Adobe Bridge 15.1.8 and earlier and 16.0.7 and earlier (per EUVD); the flaw is locally triggered (AV:L), requires no attacker authentication (PR:N), but mandates user interaction (UI:R) since the victim must open the malicious file, and its impact is limited to confidentiality (C:H with no integrity or availability effect) for a CVSS 3.1 base score of 5.5. There is no CISA KEV listing and no public exploit code identified at time of analysis, and Adobe's PSIRT published advisory APSB26-167 for this issue.

Sensitive process-memory disclosure in Adobe Dimension 4.1.8 and earlier is triggered when a victim opens an attacker-crafted file, allowing an unauthenticated attacker to read out-of-bounds memory contents. The flaw is local (AV:L) and requires user interaction (UI:R) - the attacker must socially engineer the target into opening a malicious file on their own machine; there is no remote or automatic trigger. Impact is limited to confidentiality (C:H) with no code execution, data modification, or denial of service, EPSS/KEV status is negative, and no public exploit code has been identified at time of analysis, so this is a moderate-priority file-parsing issue rather than a top-tier emergency.

Opening a maliciously crafted asset file in Adobe Substance 3D Stager 3.1.8 and earlier can trigger an out-of-bounds read that discloses sensitive contents of process memory to the attacker. Exploitation requires local file delivery plus a victim who actively opens the file (AV:L, UI:R), needs no application-level authentication (PR:N), and is confined to a confidentiality impact with no code execution, data modification, or denial of service. Rated 5.5 (medium) with no public exploit identified at time of analysis, this is a moderate-severity information-disclosure issue rather than an urgent-priority one.

An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network send crafted DNS requests that cause the service to read past the end of an allocated buffer, potentially returning memory contents to the attacker (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts actually running the DNS Server role - typically domain controllers and dedicated DNS servers rather than standard workstations - are exposed, and exploitation requires the PR:L authorization the assessed vector specifies, so this is not an unauthenticated flaw. Impact is limited to confidentiality disclosure with no integrity or availability effect; no public exploit has been identified at time of analysis, and a vendor patch is available from Microsoft.

An out-of-bounds read in the Windows DNS Server role lets an authorized, authenticated attacker send a crafted DNS request that causes the service to read past the end of an allocated buffer and return information it should not disclose over the network. Exploitation requires the DNS Server role to be installed and reachable, and the attacker must already hold a low-privileged position able to send requests to the DNS service (CVSS PR:L, unauthenticated access is not sufficient per the assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); there is no integrity or availability impact, and no user interaction is required. Only Windows client and server builds running the DNS Server role below the patched versions listed in the EUVD data are affected; no public exploit identified at time of analysis, and this is assessed as a moderate authenticated information-disclosure flaw rather than a top-tier emergency.

Information disclosure in Microsoft Windows DNS Server is caused by an out-of-bounds read that a low-privileged, authenticated attacker can trigger over the network to leak memory contents from an affected unpatched system. The issue affects DNS components in Windows Server 2012 through 2025 and Windows 10/11, and exploitation requires network reachability plus authorized low-privilege access as reflected by CVSS PR:L and UI:N. Vendor patches are available, and no public exploit was identified at time of analysis; this is a moderate information-disclosure issue rather than a critical remote-code-execution emergency.

Out-of-bounds read in the Windows DNS Server role lets an attacker who holds low-level authorization (authenticated, PR:L) disclose server memory contents over the network, giving a high confidentiality impact with no integrity or availability effect (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only Windows hosts that have the DNS Server role installed and reachable over the network are exposed; the flaw lives in that role's request-parsing path, so Windows systems without the role are not affected, and EUVD enumerates the vulnerable build ranges across Windows 10, Windows 11, and Windows Server 2012 through 2025. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, while a vendor patch is available per the Microsoft advisory.

An out-of-bounds read in the Windows DNS Server role allows an attacker who already holds low-level authorization on or toward the target to read beyond the bounds of an allocated buffer and disclose server memory over the network (CVSS 6.5, CWE-125, PR:L). Only hosts running the DNS Server role are in scope - domain controllers and dedicated DNS servers on Windows Server 2012 through 2025 and supported Windows 10/11 builds - so the network vector does not translate into an anonymous internet-wide attack. Microsoft has published vendor updates for the affected builds, and no public exploit identified at time of analysis; impact is confidentiality-only, with no integrity or availability effect.

Information disclosure in the Windows DNS Server role allows a remote attacker holding valid low-privilege credentials (CVSS PR:L) to read out-of-bounds memory by sending a crafted DNS request, leaking data over the network with high confidentiality impact but no integrity or availability effect. Only pre-patch Windows Server and Windows 10/11 builds with the DNS Server role installed and reachable are affected, and exploitation requires that the attacker can already query or reach the DNS service rather than being an anonymous internet-wide attacker. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the vendor has released a patch and the flaw carries a moderate CVSS base score of 6.5.

Memory disclosure via an out-of-bounds read in the Windows DNS Server service allows a remote, authenticated low-privilege attacker to leak server process memory over the network. Affected deployments are Windows Server 2012 through Windows Server 2025 (including Server Core) and Windows 10/11 builds running the DNS Server role that have not been updated to the fixed builds listed by Microsoft; no public exploit identified at time of analysis. The assessed impact is information disclosure only (CVSS 6.5, C:H/I:N/A:N) with no code execution or denial of service, but leaked memory may expose sensitive data that aids follow-on attacks.

Out-of-bounds read in the Microsoft Windows DNS Server role lets an authenticated, low-privileged attacker reachable over the network read past the end of a buffer and disclose information from server memory, rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw affects a broad set of Windows client and server builds running the DNS Server role, enumerated by EUVD-2026-100438, and exposure is limited to confidentiality - integrity and availability are unaffected and no user interaction is required. There is no CISA KEV listing and no public exploit identified at time of analysis; the PR:L vector means the attacker must already hold low-level credentials, which constrains opportunistic mass exploitation, and vendor patches are available.

An out-of-bounds read in the Windows DNS Server role allows an authenticated attacker with low-level privileges to disclose sensitive information over the network. This medium-severity (CVSS 6.5) flaw affects many Windows Server and Windows client versions when the DNS Server role is installed, including Windows Server 2012 through 2025 and Windows 10/11 builds prior to the fixed versions listed in Microsoft’s advisory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.

Information disclosure in the Windows DNS Server role allows an authenticated, low-privilege network attacker to trigger an out-of-bounds read that leaks memory contents in responses. Tracked as CVE-2026-97835 (CVSS 6.5, CWE-125, C:H/I:N/A:N), it affects the DNS Server component across Windows 10, Windows 11, and Windows Server 2012 through 2025, but only on hosts where the DNS Server role is actually installed and reachable - typically domain controllers and dedicated DNS hosts in Active Directory environments. Exploitation requires low-privilege credentials (PR:L via CVSS:3.1/AV:N/AC:L/PR:L/UI:N), not fully anonymous access, and the outcome is limited to confidentiality loss with no code execution, tampering, or denial of service. Vendor patching is available from Microsoft and no public exploit code or confirmed active exploitation was identified at time of analysis.

An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds valid low-level credentials on the network cause the service to read past the bounds of a memory buffer, disclosing sensitive information over the network. This is a medium-severity (CVSS 6.5) information-disclosure flaw rated AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - exploitation requires a reachable, running DNS Server role (typically on domain controllers or dedicated DNS hosts) and at least low-level authorization, but needs no user interaction and has low attack complexity. The privilege prerequisite narrows the attacker population and the impact is confined to confidentiality: there is no code execution, integrity, or availability impact, and no public exploit identified at time of analysis. A vendor patch is available.

Information disclosure in the Windows DNS Server role allows a network-positioned attacker holding a low level of authorization (CVSS PR:L, described by Microsoft as an 'authorized attacker') to trigger an out-of-bounds read and leak data from server memory. The issue is rated CVSS 6.5 with confidentiality impact only and no integrity or availability effect, and it affects a wide range of unpatched Windows Server and Windows client builds that enable the DNS Server role, from Windows Server 2012 through Windows Server 2025 plus Windows 10 and Windows 11 releases. No public exploit code has been identified at time of analysis, there is no CISA KEV listing indicating active exploitation, and Microsoft has published a patched update; systems already at the fixed build numbers in the vendor advisory are not affected.

Information disclosure in the Windows DNS Server role lets an authenticated, low-privileged attacker read past the bounds of an allocated buffer and leak memory contents over the network. The flaw (CWE-125, out-of-bounds read) affects a broad set of Windows Server builds - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and only exposed systems that have the DNS Server role installed and reachable. Impact is limited to confidentiality (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability effect; no public exploit has been identified at time of analysis, and vendor-released patches are available per the Microsoft advisory.

An out-of-bounds read (CWE-125) in the Windows DNS Server role allows a remote attacker holding some level of valid privilege (CVSS PR:L) to leak server memory contents over the network, resulting in information disclosure only. Successful exploitation requires network reachability to a DNS Server host and prior access to the DNS service - it is not anonymously exploitable from the internet - while no user interaction (UI:N) and only low attack complexity (AC:L) are needed. The confidentiality impact is rated High but integrity and availability are unaffected, and no public exploit code or confirmed active exploitation has been identified at time of analysis; vendor patches are available, making this a genuine but moderate-priority issue rather than an emergency.

An out-of-bounds read in Microsoft's Windows DNS Server role lets an attacker who already holds low-level authorized network access (PR:L) leak process memory across the network, producing a high confidentiality impact with no integrity or availability effect. Exploitation is limited to hosts where the DNS Server role is installed and reachable, and the authentication prerequisite rules out anonymous internet-wide attacks, so the issue is rated CVSS 6.5 and treated as moderate rather than emergency priority. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence, though vendor patches are available for all affected branches.

Information disclosure in Windows DNS Server allows an authenticated attacker with low privileges to read sensitive memory contents over the network. This buffer over-read affects numerous Windows Server and Windows client versions, including Server 2012 through 2025 and Windows 10/11 builds. No public exploit has been identified at time of analysis, and vendor patches are available.

An out-of-bounds read (CWE-125) in the Windows DNS Server service lets an attacker who already holds low-level credentials read beyond a buffer and disclose in-memory information over the network, rated CVSS 6.5 with a confidentiality-only impact and no effect on integrity or availability. Exploitation requires authentication (CVSS PR:L), network reachability to a host actually running the DNS Server role, and low attack complexity with no user interaction, so this is a moderate-priority authenticated information-disclosure flaw rather than a pre-authentication remote code execution issue. Affected systems span Windows Server 2012 through Server 2025 (including Server Core installs) and several Windows 10 and Windows 11 client releases; Microsoft has published a fix through its update guide, and no public exploit code was identified at time of analysis.

Information disclosure in the Microsoft Windows DNS Server role lets an authenticated, network-positioned attacker trigger an out-of-bounds read and retrieve memory contents over the network. The flaw (CWE-125) affects a wide span of Windows builds where the DNS Server role is installed and running - Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus Windows 10 (1607-22H2) and Windows 11 (23H2 through 26H2) - and requires only low-privilege access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N with C:H/I:N/A:N, base 6.5) with no user interaction; impact is confined to confidentiality, with no integrity or availability effect. There is no public exploit code identified at time of analysis and the issue is not listed on CISA KEV, but Microsoft has published vendor fixes, so patching priority is driven by the sensitivity of data exposed by DNS infrastructure rather than by observed exploitation.

An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds authorized access to the DNS service (CVSS PR:L) disclose memory contents over the network, with no user interaction required (UI:N) and low attack complexity (AC:L). Impact is strictly confidentiality (C:H/I:N/A:N) - there is no code execution, data modification, or denial of service, and only Windows and Windows Server builds with the DNS Server role enabled are exposed. This is a genuine but moderate-priority issue rather than a top-tier emergency: CISA SSVC records Exploitation as 'none' and Automatable as 'no', and no public exploit code has been identified at time of analysis, though a vendor patch is available.

Out-of-bounds read in Windows DNS Server allows authenticated remote attackers with low-level privileges (PR:L) to disclose sensitive information from process memory over the network. Affected versions include Windows Server 2012 through 2025 and various Windows 10/11 builds hosting the DNS Server role, as detailed in the EUVD advisory. Vendor patches are available, and no public exploit code or active exploitation is identified at time of analysis; the CVSS score of 6.5 reflects high confidentiality impact but requires prior authentication, making this a moderate-priority issue.

Out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to disclose sensitive memory contents over the network, affecting Windows Server 2012 through Server 2025 and Windows 10/11 systems that have the DNS Server role enabled. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is a CWE-125 read-only disclosure with no integrity or availability impact, and has no public exploit identified at time of analysis; vendor patches are available.

An out-of-bounds read in the Microsoft Windows DNS Server service lets an authorized, network-positioned attacker cause the server to read past the bounds of an allocated buffer and return the resulting memory contents within DNS responses (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Only hosts that have the DNS Server role installed and running on unpatched Windows 10, Windows 11, or Windows Server builds are affected; the PR:L requirement means the actor must already be authorized to submit queries or data that reach the vulnerable parser, so anonymous Internet clients are not sufficient. Impact is limited to information disclosure of server memory with no integrity or availability effect, and no public exploit identified at time of analysis. Microsoft has released updates that raise each affected build to a fixed revision.

Information disclosure in the Microsoft Windows DNS Server role allows an authenticated, low-privileged attacker to trigger an out-of-bounds read and leak memory contents over the network. The flaw affects Windows Server 2012 through Server 2025 as well as multiple Windows 10 and Windows 11 builds, and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no integrity or availability effect and no code execution or denial of service implied. Vendor-released patches exist as fixed build numbers per the EUVD data and the MSRC advisory, and no public exploit identified at time of analysis (no KEV or POC signal in the provided intelligence).

An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network read memory beyond intended buffer boundaries and disclose that information over the network. Only hosts running the DNS Server role are affected, spanning Windows Server 2012 through 2025 (including Server Core installations) plus Windows 10 and Windows 11 clients that host the role; exploitation requires an authenticated/authorized position (CVSS PR:L) with network reachability to the DNS service, so it is not an unauthenticated remote flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis - the practical risk concentrates in environments where low-privilege accounts or internal footholds can reach a DNS server.

An out-of-bounds read (CWE-125) in the Microsoft Windows DNS Server role allows an attacker holding low-privilege authenticated access to disclose information over the network. Only hosts actually running the DNS Server role are exposed; the flaw is rated CVSS 6.5 with high confidentiality impact but no integrity or availability impact, and exploitation requires authorized (PR:L) rather than unauthenticated network access. Patched builds are available from the vendor per the MSRC update guide, and no public exploit code or active exploitation has been identified at time of analysis.

Heap-based buffer overflow in Windows DNS Server allows an authenticated, low-privilege attacker with network access to disclose sensitive information from server memory. The vulnerability affects numerous Windows Server and Windows 10/11 builds that have the DNS Server role installed, with no public exploit identified at time of analysis. Although rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the confidentiality-only impact and requirement for authentication limit the realistic threat to information leakage rather than code execution or denial of service.

Heap memory disclosure in Microsoft Windows Hyper-V lets an authenticated, low-privileged principal - such as an account inside a guest VM or a low-rights user able to reach the Hyper-V service over the network - read leaked contents of the hypervisor's heap, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025 including Server Core installations. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and low attack complexity are required, but the attacker must already hold valid credentials and the outcome is read-only: confidentiality is fully impacted while integrity and availability are untouched, so hosts without the Hyper-V role enabled are not exposed. No public exploit been identified at time of analysis, and Microsoft has published fixed builds via its MSRC update guide.

Information disclosure in Microsoft Excel allows unauthenticated remote attackers to read sensitive memory contents by enticing a user to open a specially crafted Excel document. The flaw affects multiple Microsoft Office products, including Office LTSC 2024, Office LTSC 2021, Office Online Server, and Microsoft 365 Apps, and requires user interaction (opening or previewing the file) for exploitation. No public exploit code has been identified, and CISA SSVC rates exploitation as none; the risk is considered a moderate-priority information-disclosure issue.