Buffer Overflow

Malicious or compromised RDP servers can crash FreeRDP-based clients (versions 3.9.0 through 3.31.x) that use Remote Credential Guard by sending crafted, unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, that trigger an out-of-bounds read in the NDR scalar readers. The flaw is remotely reachable without authentication (PR:N in the assessed vector) but requires the victim to initiate the RDP session and have Remote Credential Guard enabled, in addition to high attack complexity and a specific unaligned-payload precondition. No public exploit code has been identified at time of analysis, and the primary impact is denial of service through client process crashes rather than code execution or data disclosure. This is assessed as a moderate-risk, low-urgency issue; however, a user-interaction requirement is present because the client must actively connect to the attacker's server.

Out-of-bounds write in FreeRDP clients running versions before 3.32.0 allows a malicious or compromised RDP server to corrupt client memory when the victim explicitly connects using the non-default /video (MS-RDPEGT) option. The server supplies a signed geometry origin with a negative topLevelLeft value that is stored unchecked in an unsigned surface coordinate, causing the blit clamp in gdiVideoShowSurface() to wrap in 32-bit arithmetic and be skipped, which can result in an out-of-bounds write of decoded H.264 picture data or an abort of the client. No public exploit code or confirmed active exploitation has been identified at time of analysis, and although the CVSS 4.0 base score is 6.0, real-world risk is reduced because /video is off by default and the attack is a reverse server-to-client scenario requiring the user to initiate the connection to the attacker's server.

A heap out-of-bounds read in FreeRDP's Remote Assistance invitation parsing (freerdp_assistance_parse_all_elements_of() in libfreerdp/common/assistance.c) crashes the xfreerdp client when it opens a crafted .msrcIncident file, and it occurs while decrypting and parsing the embedded ConnectionString2 blob, before any RDP session is negotiated. Affected builds are FreeRDP 3.0.0 through versions before 3.32.0, and the CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VA:H) reflects an unauthenticated local file-parsing attack that nevertheless requires the victim to be socially engineered into opening an attacker-supplied invitation plus its accompanying password. Impact is limited to a client-side denial of service; no confidentiality or integrity loss is scored, and no public exploit code or CISA KEV entry was identified at time of analysis. A vendor patch restoring the remaining-length accounting is available in the 3.32.0 release.

A heap out-of-bounds read in FreeRDP's WinPR clipboard function convert_filedescriptors_to_file_list() allows a malicious RDP server to crash X11, Wayland, and SDL clients when an unauthenticated remote attacker sends an odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE and the victim pastes server-copied files. This medium-severity, availability-only vulnerability affects FreeRDP 3.0.0 through 3.31.x; exploitation requires the victim to initiate an RDP connection to an attacker-controlled server, have clipboard file redirection enabled, and actively paste the copied files. No public exploit identified at time of analysis; the vendor has released a patch in version 3.32.0.

Memory corruption in the legacy USB CDC virtual COM (vcom) driver shipped in RT-Thread through 5.3.0 lets a physically connected USB host trigger writes past the serial ring buffer and, on port close, an invalid rt_free(), causing denial of service on the affected device. Only builds that include components/legacy/usb/usbdevice/class/cdc_vcom.c and enable RT_USING_SERIAL_V2 are exposed; exploitation requires physical USB access (CVSS 3.1 AV:P, PR:N), and impact is limited to availability with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited, so this is a medium-severity, low-operational-priority item for most environments; an upstream fix exists (PR #11770 / commit ceef6e0c).

A heap/stack-adjacent buffer overflow in Kamailio's optional sipt module lets remote, unauthenticated attackers crash the SIP server by sending crafted SIP-T/ISUP messages. The flaw lives in isup_get_calling_party() (and the sibling called/redirecting/redirection parses) in src/modules/sipt/ss7_parser.c, where a declared ISUP parameter length is copied into a fixed 26-byte static buffer without being checked against the actual packet length; affected releases are Kamailio up to and including 6.0.7 and 6.1.3. Per independent assessment the realistic impact is availability only (CVSS:3.1 C:N/I:N/A:L), not code execution, and exploitation requires the non-default sipt module to be loaded and its parsing functions invoked from kamailio.cfg on attacker-supplied SIP traffic; vendor-released patches exist in 6.0.8/6.1.4 (commit 3667bebf8d0bea07ed16218fd921d07db87aeb21, PR #4905), and no public exploit was identified at time of analysis.

Out-of-bounds memory write in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows a local attacker to corrupt memory by supplying a crafted HEIF image to the cover-image decoding path. Only devices running builds prior to SMR Oct-2026 Release 1 are affected; the flaw is local (AV:L) but requires no privileges or user interaction once an app or process is present on the device, meaning a co-resident unprivileged application is sufficient. Impact is limited to integrity (no confidentiality or availability effect asserted), and no public exploit identified at time of analysis.

Out-of-bounds read and write in the native AI sound-separation library (lib_sag_ai_sound_sep_v2.00.so) on Samsung mobile devices allows a local, low-privileged attacker to read and write memory outside the intended buffer, with impact bounded to low confidentiality, integrity, and availability within the affected component. The flaw is only reachable by an attacker who already holds local code execution on the device - typically a malicious or compromised app capable of supplying crafted input to the library - and affects firmware versions prior to SMR Oct-2026 Release 1. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation; the moderate CVSS 4.8 score reflects the local attack vector and limited per-component impact rather than a remote or high-severity threat.

Out-of-bounds write in Samsung Android's libsmkvextractor.so media parsing library allows a local attacker to corrupt memory by supplying a crafted Matroska (MKV) file, resulting in low integrity and availability impact. Affected are Samsung devices running firmware prior to SMR Oct-2026 Release 1; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium). The attacker requires local access but no special privileges, and the flaw does not compromise confidentiality or change scope.

Out-of-bounds write in Samsung Android's libcodec2-sec-flacdec.so FLAC decoder allows a local attacker to write memory beyond the intended buffer, degrading integrity and availability of the affected device process. The issue affects devices running firmware prior to SMR Oct-2026 Release 1, and exploitation requires local access plus the ability to push attacker-controlled FLAC data into the codec path, typically through a malicious or compromised app. There is no public exploit identified at time of analysis, and the vendor-assigned CVSS 4.0 base score of 5.1 (bounded to low integrity and low availability impact with no confidentiality loss) places this in routine monthly-patch priority rather than emergency response.

Improper validation of the frequency index passed to the Unisoc kernel apsys DVFS driver (CVE-2026-87765, CVSS 3.1 5.5) lets local code that already holds low-level privileges on the device select an out-of-range operating point, resulting in an out-of-bounds read of the driver's frequency/voltage tables or corruption of the power-management hardware registers, which can destabilize or crash the system. Impact is limited to availability (C:N/I:N/A:H) - no confidentiality or integrity loss is described - and the assessed vector AV:L/AC:L/PR:L/UI:N means there is no remote or unauthenticated path; an attacker must already be able to invoke the DVFS driver interface locally. Exploitation signals are weak: no public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV), and no EPSS score was supplied, so this should be treated as a moderate-severity, low-priority issue remediated through vendor firmware/driver updates rather than emergency action.

Heap-based buffer overflow in Samsung rlottie (all versions at or before commit e57b094f03c39a751a1fded6f7d6c13f1ed95ec9) can crash an application that parses a crafted Lottie animation containing an embedded image asset with oversized dimensions, causing an undersized bitmap allocation followed by an out-of-bounds heap write. Exploitation requires local delivery and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - an unauthenticated local context, but the victim must actively open or render the malicious animation - and the impact is limited to availability (denial of service/crash), with no confidentiality or integrity effect assessed. No public exploit code identified at time of analysis, and no CISA KEV listing; EPSS score was not supplied in the available intelligence. Overall this is a genuine but modest-severity defect rather than an urgent priority.

An out-of-bounds memory read in the Zephyr RTOS zbus proxy agent IPC backend allows a peer domain that already controls its own firmware - typically a second core on the same SoC - to leak a small amount of adjacent memory into the receiving domain's log output. The flaw is a non-NUL-terminated channel_name[] array being printed with a plain %s conversion on the frame-rejection error path; it is only reachable when CONFIG_ZBUS_PROXY_AGENT_IPC is built and logging is at warning level or higher (the default). Impact is bounded to limited information disclosure (CVSS 3.4, AV:L/PR:H, C:L/A:L) and a possible fatal fault if the scan leaves a mapped region; there is no public exploit identified at time of analysis and no confirmed active exploitation.

An out-of-bounds stack write in the Zephyr RTOS Goodix GT9xx touch driver (drivers/input/input_gt911.c) lets a malicious or misbehaving I2C touch controller overwrite up to 112 bytes of the gt911_process() stack frame with attacker-chosen data running at kernel privilege, potentially hijacking control flow on the host microcontroller. Only systems built with the GT9xx driver are affected, and reaching the defect requires physical/local access to the I2C bus (AV:P) - there is no network, USB, or syscall path - most plausibly on boards where the panel is a pluggable display module or shield rather than a soldered part. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the fix is a small one-line clamp and the same overflow can occur non-adversarially with a GT9271-class panel or a single corrupted status byte.

An out-of-bounds read in the Open Asset Import Library (Assimp) through version 6.0.5 is reachable through the PLY file handler, specifically in IOStreamBuffer::getNextBlock, when an application imports a crafted PLY model file. Affected deployments are any application, service, or pipeline that converts or previews PLY assets with Assimp; the practical impact is limited to disclosure of adjacent memory contents and/or a denial-of-service crash, with no evidence of code execution. Exploitation requires passive user interaction (someone must open or cause the file to be parsed) and no public exploit code has been identified at time of analysis; the vendor was contacted about the disclosure but did not respond, so no vendor-released patch is identified at time of analysis.

Heap memory corruption in Apache DataSketches C++ (datasketches-cpp) versions 4.1.0 through 5.2.0 allows remote attackers to trigger out-of-bounds reads and writes via a crafted Count-Min sketch submitted to the deserialize() function. The flaw combines a missing preamble size check that permits up to 16 bytes over-read on truncated input, and a 32-bit integer overflow in the serialized bucket count that can wrap to zero, resulting in an empty table and subsequent heap memory corruption during updates or estimate queries. Exploitation requires an application to deserialize Count-Min sketches from untrusted sources; no public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the severity as moderate.

Out-of-bounds reads in MariaDB Server's legacy mysql_json plugin can expose memory contents or crash the server when the plugin parses a specially crafted MySQL-origin table containing invalid MySQL binary JSON. The flaw affects MariaDB 10.6.1 and later branches up to (but excluding) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and is only reachable when tables imported from MySQL must be read through the mysql_json compatibility path - for example during ALTER TABLE ... FORCE. The CVSS vector (AV:L, PR:N, UI:R, S:U, C:L, I:N, A:L, score 4.4) confirms this is a local, interaction-driven issue rather than a remotely exploitable one; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor patches are available.

Authenticated database users can trigger a heap out-of-bounds read in the MariaDB Server qc_info plugin (information_schema.query_cache_info), potentially disclosing adjacent process memory or crashing the server. The flaw affects MariaDB releases from 10.6.1 up to the fixed versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, and requires the optional qc_info plugin to be loaded plus an enabled query cache before a query containing embedded null bytes is cached and the query_cache_info table is then read. Rated 6.4 (Medium) with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L; there is no public exploit identified at time of analysis and the impact is limited to partial memory disclosure or denial of service rather than code execution.

Local denial of service in the illumos reparsed daemon (reparsed) lets a low-privileged authenticated local user crash the daemon and, through repeated requests, drive the svc:/system/filesystem/reparse service into maintenance. The bug is a stack buffer overflow (CWE-121) in the nfs-basic reparse plugin's get_fs_locations(), which copies attacker-supplied host and path components of a reparse string into a fixed 1024-byte stack buffer with no length validation, reachable because the door at /var/run/reparsed_door is world-readable and the door server does not verify caller credentials. Exploitation is availability-only on default builds (stack protection aborts the process rather than yielding code execution), no public exploit code has been identified at time of analysis, and the affected service is disabled by default, which substantially limits real-world exposure; this is a genuinely low-priority, availability-only issue despite the stack-based overflow classification.

A heap out-of-bounds read in Open5GS 2.8.0 and earlier (ogs_pfcp_parse_dropped_dl_traffic_threshold() in lib/pfcp/types.c) lets remote unauthenticated attackers send malformed PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805, using a Dropped DL Traffic Threshold IE with the DLPA and DLBY flags set but a too-short IE length, causing the parser to read past the end of the IE buffer and potentially crash the UPF. The assessed impact is availability-only (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor score 6.9 under CVSS 4.0), so this is a medium-severity denial-of-service issue rather than a top-tier priority. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, though the practical risk depends on exposure of the internal N4 interface.

Open5GS through 2.8.0 contains a heap out-of-bounds read that lets remote unauthenticated attackers crash the SMF by sending a crafted PFCP Session Report Request to UDP port 8805 carrying a Volume Measurement IE whose flag bits are all set while the IE body is too short to hold the declared fields. The parser in lib/pfcp/types.c walks past the end of the IE buffer by as much as 48 bytes, producing availability-only impact (CVSS 4.0 base 6.9, CWE-125); the over-read bytes are not returned to the attacker, so this is a denial-of-service condition rather than a data leak. No public exploit code has been identified at time of analysis, and practical exploitation presupposes that the attacker can reach the internal N4/PFCP control-plane interface between SMF and UPF, which is not intended to be internet-facing.

Opening a maliciously crafted Affinity document in Affinity by Canva builds prior to 3.3.1 can trigger an out-of-bounds read and dereference of an untrusted pointer, resulting in memory corruption or an application crash. Exploitation is file-based and local rather than remote: a victim must open the attacker-supplied document (UI:R) and the malformed raster data must reliably drive the fault across variable memory conditions, making attack complexity high and yielding only a CVSS 3.1 base score of 4.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). No public exploit code exists and the issue is not confirmed actively exploited (it does not appear on CISA KEV); our assessment rates this a genuinely low-to-moderate priority memory-safety defect.

Heap memory disclosure and application crashes affect Affinity by Canva before version 3.3.1 (October 2026 release), where insufficient bounds checking on arrays of strings inside Affinity document files triggers a heap buffer over-read (CWE-126). Exploitation requires unauthenticated but local delivery: a victim must be socially engineered into opening a crafted Affinity document with the vulnerable application, which is consistent with the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/C:L/I:N/A:L and a low base score of 3.6. Impact is limited - any leaked heap contents are non-deterministic and bounded by heap layout (AC:H), and the most likely practical outcome is a client-side crash rather than reliable data theft; no public exploit identified at time of analysis.

Heap buffer over-read in Affinity by Canva versions before 3.3.1 (October 2026 release) allows an attacker to disclose small amounts of adjacent heap memory or crash the application when a user opens a specially crafted Affinity document containing a malformed, incomplete UTF-8 character sequence in its text. The flaw sits in the local document text parser and is rated low severity (CVSS 3.6, AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L): exploitation is local, requires the victim to open the malicious file, and is high-complexity because meaningful disclosure depends on heap layout, with integrity impact absent and only limited confidentiality/availability effects. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version (3.3.1) via its trust center advisory.

Heap-based buffer overflow in Affinity by Canva for macOS before 3.3.1 allows a crafted Affinity document to corrupt memory in the QuickLook thumbnail/preview extension the moment the file is displayed or its containing folder is browsed in Finder, causing the preview process to crash. The bug stems from an integer overflow in image-buffer size calculation when generating QuickLook thumbnails and previews (CWE-122), rated CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L); exploitation requires the malicious file to already be on local storage and demands precise crafting of size metadata plus heap grooming, so overall risk is low-to-moderate. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in version 3.3.1.

Out-of-bounds heap read in Affinity by Canva for macOS before 3.3.1 (the October 2026 release) allows a crafted Affinity document to leak adjacent heap memory - including memory addresses - into the thumbnail or preview image that macOS QuickLook renders in Finder. Affected are users of the pre-3.3.1 macOS app whose QuickLook preview generator is registered with the OS; the victim only needs to select or browse to the malicious file in Finder, as automatic preview rendering triggers the bug without opening the document in the app. The issue is local-only with a high attack complexity (favorable heap layout required) and no authentication requirement (PR:N); it is not confirmed as actively exploited (no CISA KEV listing), no public exploit code was identified at time of analysis, and no EPSS score was supplied - consistent with its low assessed severity (CVSS 3.6) and its practical value as an information-leak primitive to chain with a separate vulnerability rather than a standalone compromise.

An out-of-bounds heap read in Affinity by Canva for macOS (before 3.3.1) lets a crafted Affinity document leak adjacent heap memory into the QuickLook thumbnail and preview images rendered by Finder, or crash the thumbnail/preview extension. The attack is local - the malicious file must already reside on the target Mac - and requires the victim to browse to or preview the file in Finder, which triggers the vulnerable code path; the disclosed bytes are non-deterministic, so an attacker cannot select what is exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed severity is low (CVSS 3.1 base 2.9).

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() sk_protocol lives in struct sock, not in struct sock_common. A timewait or request sock handed to bpf_sock_destroy() by the tcp iterator is neither, so reading sk->sk_protocol runs past the object: ================================================================== BUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0 Read of size 2 at addr ffff8881047d11b4 by task test_progs/428 Tainted: [W]=WARN Call Trace: <TASK> dump_stack_lvl+0x91/0xf0 print_report+0xd1/0x630 kasan_report+0xf3/0x130 __asan_report_load2_noabort+0x14/0x30 bpf_sock_destroy+0xc7/0xe0 bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7 bpf_iter_run_prog+0x538/0xde0 bpf_iter_tcp_seq_show+0x26b/0x4b0 bpf_seq_read+0x424/0x1210 vfs_read+0x197/0xe40 ksys_read+0x119/0x240 __x64_sys_read+0x72/0xc0 x64_sys_call+0x647/0x27e0 do_syscall_64+0xe5/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Only check sk_protocol on full socks. tcp_abort() already knows how to deal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it never matched the code.

Out-of-bounds read of up to roughly 64 KiB in Zephyr's ITE IT8xxx2 SHI host-command backend allows an attacker who drives the SPI host controller to disclose adjacent embedded-controller SRAM to the host, or to fault the controller by reading past the end of SRAM. The root cause is a race: the 8-byte host-command header is copied from the SPI Rx FIFO directly into the shared in_msg buffer before the protocol version and derived packet length are validated, so a second transaction carrying data_len = 0xFFFF can deposit its header into a buffer that verify_rx() has already accepted; if those bytes land before the host-command thread assigns args.input_buf_size = rx_header->data_len, a registered handler is handed a 65535-byte length over a 256-byte buffer. Exploitation requires local control of the inter-processor SHI bus (a compromised host OS driving chip select and clock, or physical access to the SPI lines) plus a timing race the host can retry indefinitely, and is unauthenticated per the CVSS vector (PR:N); no public exploit code or confirmed active exploitation was identified at time of analysis.

OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remtoe attacker to cause a denial of service

Opening a malicious CHM (compiled HTML Help) file in SumatraPDF 3.6.1 or earlier crashes the application: unsigned file-controlled string offsets from the /#WINDOWS and /#IVB sections are narrowed to signed integers in ChmFile::GetCharZ() without a lower-bound check, so a negative offset drives a read before the /#STRINGS buffer. Exploitation is local and requires the victim to open the crafted file, and the outcome is limited to a deterministic termination (denial of service) with no code execution, data disclosure, or privilege gain; no public exploit code was identified at time of analysis. Cross-referenced with the advisory and the fixing commit, this is a medium-severity availability issue rather than a high-urgency priority.

Denial of service in SumatraPDF 3.6.1 and earlier, and in pre-release 3.7.0.20369, occurs when the reader falls back to its legacy IE-based HTML/CHM backend - a path taken only when Microsoft WebView2 is absent or cannot initialize - and opens an attacker-crafted CHM file. The signed host component of an its:// URL is accepted by ParseProtoUrl() and then used directly as an index into the gHtmlWindows collection by FindHtmlWindowById(), so a negative or otherwise out-of-range window identifier triggers an out-of-bounds pointer read, an invalid object callback dereference, and termination of the SumatraPDF process. Exploitation is local and requires the victim to open the malicious document (user interaction, unauthenticated per PR:N in the assessed vector); no public exploit code or active exploitation has been identified at time of analysis, and impact is limited to a crash of a single process rather than code execution, data disclosure, or persistence.

Opening a crafted TIFF file in SumatraPDF 3.6.1 and earlier can crash the application through a stack-based buffer overflow in MaybeFlipBitmap(), where GDI+ writes an attacker-controlled EXIF PropertyTagOrientation size into a fixed 64-byte stack buffer. The attack is local and requires the victim to open a malicious image (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P, base 6.8), and successful exploitation corrupts stack control data that the compiler's stack cookie check intercepts in tested builds, terminating the process. Impact is limited to availability (no confidentiality or integrity loss is claimed), with no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis.

Application termination in SumatraPDF 3.7.0.22298 is reachable when a user opens an attacker-crafted LIT (Microsoft Reader) file, because file-controlled offset and size fields in src/LitDoc.cpp overflow, narrow to negative values, or wrap before incomplete bounds checks, yielding invalid pointer reads and a deterministic crash. The attack path is local and requires the victim to open the malicious document (AV:L/AC:L/PR:N/UI:R, availability-only impact with no confidentiality or integrity loss), and exploitation is further gated by the victim using this specific build and handling the uncommon LIT format. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied, so this remains a moderate-severity denial-of-service condition rather than a high-priority memory-corruption or code-execution threat.

A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve arbitrary code execution or cause a denial of service (application crash) when a user opens a specially crafted PNG file. Exploitation requires user interaction and local access, but the vulnerability is unauthenticated (no privileges required) according to the CVSS vector PR:N. No public exploit code or confirmed active exploitation has been identified at time of analysis; the risk is constrained by the need for a user to open the malicious file on a system with eog installed.

Opening a crafted MOBI file in SumatraPDF 3.7.0.22298 triggers an out-of-bounds read that reliably terminates the application with a native access violation. The bug is a signed/unsigned narrowing flaw in src/MobiDoc.cpp: an attacker-supplied mobiHdr.hdrLen value above INT_MAX becomes negative during the upper-bound check, and when the EXTH flag is set that same original unsigned value is reused as a pointer offset, driving DecodeExthHeader() past the end of the record buffer. Only denial of service has been demonstrated - no code execution, information disclosure, or integrity impact - and the CVSS vector (AV:L/PR:N/UI:R, C:N/I:N/A:H) reflects that the victim must actively open the malicious file locally; no public exploit has been identified at time of analysis and this CVE is not in CISA KEV. Several third-party tags (RCE, Information Disclosure, Microsoft) are inconsistent with the technical evidence and the assessed vector and should be discounted.

A remote, unauthenticated attacker can trigger a limited heap-based out-of-bounds read in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, by sending a specially crafted request to an exposed instance. Successful exploitation is confined to a partial memory read that can cause a denial-of-service condition; there is no confidentiality or integrity impact and no code execution path described. This is a low-severity issue (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) that should be treated as low priority despite its network-facing nature, and at time of analysis no public exploit code and no confirmed active exploitation were identified; a vendor patch is available via IBM support node 7291628.

A malformed-BSON out-of-bounds read in the MongoDB Python Driver (PyMongo) can terminate the host Python process when the native C accelerator (_cbson) is loaded. The flaw is reachable only when an application itself passes attacker-controlled BSON into the documented bson.decode() or decode_all() APIs with a truncated regular-expression element that lacks a trailing NUL byte; the driver's normal MongoDB wire-protocol query path never reaches this code, and installations running the pure-Python fallback are unaffected. Both the vendor CVSS 4.0 score (5.9, AV:L/AV:N-derived local vector, PR:N/UI:N, VA:H) and the independent CVSS 3.1 assessment (AV:L, PR:N, UI:N, C:N/I:N/A:H) agree this is an availability-only, denial-of-service condition with no data exposure or code execution, making it a moderate issue that most deployments can deprioritize; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.

Heap buffer overflow in the MongoDB PHP Driver's BSON encoder can corrupt process memory or crash the PHP process when an application encodes a string near 4 GiB under a non-default runtime configuration that permits multi-gigabyte values. The vulnerability requires local access (AV:L) and low privileges (PR:L), and per the independent assessment, exploitation hinges on a specific attack requirement (AT:P) - the enabling configuration - making real-world risk low. No public exploit code or active exploitation (KEV) has been identified at time of analysis. The CVSS 4.0 base score is 2.0, and the independent CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) confirms limited impact (low integrity and availability) with no confidentiality loss.

IBM Guardium Data Protection 12.0, 12.1 and 12.2 ship the WfpMonitor kernel driver, whose METHOD_NEITHER IOCTL handlers dereference caller-supplied pointers without consistent probing or exception handling, so a local attacker who already holds high privileges on the host can trigger a system crash or obtain limited reads of kernel memory. The CVSS 3.1 vector (AV:L/PR:H/UI:N, C:L/I:N/A:H, score 5.1) confirms the flaw is local-only and requires pre-existing elevated privileges, meaning it grants no privilege escalation and has no integrity or code-execution impact. There is no CISA KEV entry and no public exploit code identified at time of analysis, and a vendor patch is available, making this a moderate-to-low real-world priority that is best handled through routine driver patching.

MongoDB C Driver contains an off-by-one heap write in its BSON bulk document writer that can corrupt adjacent memory or crash the process when a serialized document ends at a precise buffer boundary. This medium-severity (CVSS 4.0 base 5.9) issue requires an embedding application to use the BSON bulk-writer API and an attacker to influence document sizes to hit that exact cumulative boundary; the local, unauthenticated attack is difficult to trigger and writes only a single zero byte, so the realistic impact is process termination or limited heap corruption rather than code execution. No public exploit code or active exploitation has been identified at the time of analysis.

Denial of service in the MongoDB C Driver affects any application that uses the driver with SCRAM authentication, because a malformed SCRAM server-final message is parsed with a one-byte out-of-bounds read that can terminate the client process. The attacker must either operate the MongoDB server the client connects to or position themselves as a network intermediary inside the authentication handshake, since the bad message has to arrive before server-signature verification completes; unauthenticated remote delivery is possible under those conditions (CVSS:4.0 PR:N/UI:N, AT:P) but no client privileges or user interaction are required. Impact is limited to availability (VC:N/VI:N/VA:L) and the over-read byte is never returned through the protocol, so there is no data exposure; this is rated medium severity (CVSS 6.3 as published, 3.7 under our assessed CVSS:3.1/AV:N/AC:H vector), with no public exploit code and no confirmed active exploitation (CISA KEV) identified at time of analysis.

A kernel-mode heap buffer overflow (CWE-122) in HP Sure Click and the related HP Wolf Security product family at versions below 4.4.33 allows a local attacker who already holds elevated privileges to corrupt kernel memory and potentially escalate to full system-level code execution. The flaw is reachable only from a local context on a Windows host running the affected endpoint security agent, requires a non-trivial triggering condition such as precise heap state or a memory-corruption race, and exposes no network or remote attack path. HP has released version 4.4.33 as the vendor-released fix, and no public exploit code has been identified at time of analysis.

Denial of service and heap memory disclosure in Dislocker 0.7.3 and earlier: a crafted BitLocker volume image whose metadata announces inflated dataset or datum sizes pushes the parsing routines get_dataset() and get_next_datum() past the end of the allocated metadata buffer, crashing the tool or leaking adjacent heap memory through the volume-parsing output. Any default build of Dislocker at or below 0.7.3 that opens the malicious image is affected, which is of practical concern mainly to forensic, incident-response, and disk-recovery workflows that routinely process untrusted BitLocker volumes. Exploitation is local and requires the victim to actually open or mount the crafted image (UI:P), and no public exploit code has been identified at time of analysis; an upstream fix commit is available. This is a genuinely Medium-severity, lower-priority issue rather than an urgent one, and it is not noted as confirmed actively exploited (CISA KEV).

An out-of-bounds read in IBM DataPower Gateway (CWE-125) lets an attacker who already holds valid credentials on the gateway reach past intended buffer boundaries and have fragments of process memory returned to them, disclosing limited sensitive information. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, as listed in ENISA EUVD-2026-94890 and IBM's advisory node/7289775. The base score is 5.3 with confidentiality-only, low-severity impact and no effect on integrity or availability; IBM's description requires a remote authenticated user, which the independent assessment reflects by treating the vector as PR:L instead of NVD's PR:N. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so realistic risk is confined to credentialed actors and compromised accounts rather than unauthenticated mass exploitation.

An out-of-bounds read in the bundled IJG JPEG decoders of OFFIS DCMTK 3.7.0 (libijg8, libijg12 and libijg16) lets a crafted DICOM file whose JPEG stream carries a Huffman table with a difference category above 15 drive the decoder past the end of the small static extend_test[] and extend_offset[] lookup tables, producing incorrectly decoded pixel data or a crash and disclosing a bounded amount of adjacent process memory. Exploitation is unauthenticated (CVSS PR:N) but strictly local in vector: the attacker must deliver the file and the victim must decompress it (UI:P), and the same exposure applies to dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK. Default builds are affected because the DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK guard is disabled by default; no public exploit identified at time of analysis, SSVC records Exploitation: none and Automatable: no, and the vendor fix is available as a source commit.

A heap-based out-of-bounds read in OFFIS DCMTK 3.7.0's DcmRLECodecDecoder::decodeFrame() allows unauthenticated local attackers to read up to 63 bytes of adjacent heap memory or cause a crash by tricking a victim application into decoding a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RLE header. Exploitation requires user interaction to open or process the malicious file and only affects applications using the frame-by-frame decoding path (e.g., via DcmPixelData::getUncompressedFrame()); the dcmdrle command-line tool is not affected. The issue is fixed in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d, and no public exploit code has been identified at time of analysis.

Heap-based buffer overflow in hMailServer's legacy Blowfish encryption routine can crash the service, affecting Progressive Robot hMailServer versions 6.0.0 through 6.3.5. Remote exploitation requires hMailServer 6.3.4 or 6.3.5 with the non-default self-service REST API enabled and an authenticated mailbox user who creates a fetch account with a password 129-247 characters long that is not a multiple of 8 and then requests a personal data export; locally on Windows, any interactive user can reach the same routine through the COM method Utilities.BlowfishEncrypt without hMailServer authentication, and stored-secret writes are affected when ProtectStoredSecretsWithDPAPI is set to 0. No public exploit was identified at time of analysis. The CVSS 3.1 score is 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), an availability-only impact; real-world priority is lower than the base score suggests because the remote path depends on a non-default feature and the unauthenticated path requires local interactive access to the Windows host.

Stack buffer overflow in Brocade Fabric OS WebTools administrative interface allows an authenticated user with permissions to perform configuration downloads using remote server profiles to crash the weblinker daemon, resulting in a privileged denial of service. Affected versions are Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. Exploitation requires adjacent network access (AV:A) and high privileges (PR:H); no public exploit code has been identified at time of analysis.

Integer overflow in containerd overlaybd's LSMT index loader (do_load_index) lets a crafted, untrusted overlaybd blob pulled from a registry corrupt heap state and crash the host-side runtime, degrading availability for all overlaybd-backed containers on the node. Affected are overlaybd builds through 1.0.18 that are actually used as the container snapshotter/backend; exploitation is unauthenticated (CVSS PR:N) but requires high attack complexity (AC:H) - the victim must load an attacker-controlled blob in a deployment running multiple overlaybd-backed containers, which is why Scope is Changed. Impact is availability-only (C:N/I:N/A:H, CVSS 6.8); there is no public exploit identified at time of analysis and no CISA KEV confirmation, and organizations pulling only from trusted, signed sources are not realistically exposed.

Heap- or stack-based memory corruption in the internal FSPF route-validation and diagnostic routine of Brocade Fabric OS can crash the routing daemon or, worst case, allow code execution in the daemon's context, but only for a local, authenticated attacker who first chains one or more separate vulnerabilities to inject an oversized diagnostic state payload. The flawed code path is explicitly not exposed through standard user interfaces or CLI management commands, so the CVSS 4.0 score of 6.8 overstates standalone risk; our independent assessment rates it medium (CVSS 3.1 AV:L/AC:H/PR:L/UI:N, availability-only impact) and it cannot be triggered in isolation against a default configuration. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; the vendor fix is Fabric OS 10.0.1.

Denial of service in Brocade Fabric OS before 10.0.1: an authenticated user holding administrative privileges on the switch can crash the diagnostic execution utility by passing a diagnostic command string containing an excessive number of tokenized arguments, which overflows a fixed-capacity argument array on the stack and terminates the process. The issue is reachable only from an adjacent network position such as the management LAN (AV:A) and requires pre-existing admin credentials (PR:H, no user interaction), so it is a medium-severity availability problem for already-privileged operators rather than a remote, unauthenticated compromise path; confidentiality and integrity of the device are unaffected, with the availability impact rated High. No CISA KEV entry or publicly available exploit code was identified, and no public exploit identified at time of analysis; EPSS data was not provided in the available intelligence.

A single crafted IKEv2 packet with an oversized Nonce payload can crash the IPsec data-plane process on Brocade Fabric OS extension switches and blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. Only deployments that terminate IKEv2 on UDP port 500 are exposed, and the attacker needs IP reachability to that listener from the adjacent storage-extension network but no credentials (CVSS vector indicates PR:N). The result is limited to a denial of service (process crash) with no code execution or data disclosure claimed; there is no CISA KEV listing and no public exploit code identified at time of analysis, and independent assessment rates this as a moderate-priority availability issue rather than a critical one.

Brocade Fabric OS before 10.0.1 contains a stack-based buffer overflow in its security library when parsing uploaded X.509 PEM certificates. An authenticated administrator can trigger the overflow by importing a certificate with an oversized Authority Key Identifier (AKI) extension, crashing the management daemon and causing a denial of service. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 score is 6.9 (medium), reflecting the need for adjacent-network access and admin credentials.

Out-of-bounds memory access in the phalFelica module of NXP NXPNfcRdLib on RC663-based NFC reader deployments (versions through 07.14.00_Pub) can corrupt or expose memory when an API caller supplies values that the library fails to bounds-check, resulting in limited loss of confidentiality, integrity, and availability. Exploitation requires local access with high privileges and high attack complexity per the assessed CVSS vector (AV:L/AC:H/PR:H), so there is no remote or unauthenticated path, and no public exploit has been identified at time of analysis. The issue is rated low severity (CVSS 3.9) and is remediated in NXPNfcRdLib 07.18.00 and later, making patching straightforward for teams able to update the library.

libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service.

An out-of-bounds slice access in the Excelize Go library (versions 2.7.1 through 2.11.0) lets a crafted .xlsx workbook crash the host application, causing denial of service. When mergeCellsParser encounters a mergeCell element with an empty 'ref' attribute it returns an empty rectangle and passes it to cellInRange, which indexes four positions without a length check; any non-streaming cell API such as GetCellValue then panics on the first affected cell operation. The bug is remotely triggerable but requires the victim application to process an attacker-supplied spreadsheet and invoke an affected cell-reading API (CVSS 3.1: AV:N/AC:L/PR:N/UI:R, A:H only), and no public exploit or confirmed active exploitation is known at time of analysis.

Heap-based buffer overflow in GIMP's 'Hot' color filter plug-in allows a crafted, extremely large image to corrupt heap memory when the filter is invoked, giving an attacker the ability to crash the plug-in and potentially achieve code execution within the running user's session (CWE-119). The flaw is reachable only locally and requires the victim to open an attacker-supplied image with dimensions so large that the width * height allocation arithmetic overflows 32-bit integers, then actively run the Hot filter on it - hence the assessed vector AV:L/AC:H/PR:N/UI:R with high integrity and availability impact but no confidentiality impact. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided, so this is a targeted, social-engineering-dependent client-side issue rather than an automatable, mass-exploitation threat. Red Hat hosts the primary advisory (access.redhat.com/security/cve/CVE-2026-106067) with tracking in Bugzilla 2547461, and GIMP packages across Red Hat Enterprise Linux 6 through 10 are enumerated as affected via CPE.

Exporting an oversized image through GIMP's raw data export plug-in can under-allocate a heap buffer and cause an out-of-bounds write on the heap, with the failure originating in an integer overflow in the g_malloc() size computation (width × height × bytes-per-pixel). Per the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H), exploitation is local-only, requires the victim to actively start the export, requires no privileges (PR:N), and is gated by high attack complexity because the image dimensions must be crafted so the size arithmetic wraps; the assessment rates confidentiality impact as none and integrity/availability impact as high. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the EPSS-style signals provided are consistent with a moderate-priority rather than critical issue, since the plug-in is standard GIMP functionality but the trigger depends on user-driven export of deliberately large images.

Heap-based buffer overflow in GIMP's PCX export plug-in allows a local attacker to corrupt memory when a user opens or creates an image with extremely large width and height and exports it to PCX format. The flaw, tracked as CVE-2026-106065 with a CVSS score of 6.3 (AV:L/AC:H/PR:N/UI:R), stems from 32-bit integer overflow in the width*height size calculation while GEGL operations use the full extent. Affected GIMP packages ship with Red Hat Enterprise Linux 6 through 10; no public exploit code or active exploitation has been identified at time of analysis.

Heap buffer overflow in ImageMagick's distributed pixel cache (DPC) server (versions prior to 7.1.2-31) allows an unauthenticated adjacent-network attacker to crash the server by sending crafted pixel data that causes an integer overflow in the packet size calculation. Exploitation requires the target to run the opt-in DPC clustering feature, which is not enabled by default and is not reachable via normal image processing paths. No public exploit identified at time of analysis. This is a moderate availability-only issue (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H per independent assessment).

Denial of service in ImageMagick versions prior to 7.1.2-32 allows remote, unauthenticated attackers to crash the process by supplying a crafted EXR image that triggers a heap buffer overflow in the EXR decoder. The vulnerability requires an ImageMagick build with EXR/OpenEXR delegate support enabled and an application that passes attacker-controlled EXR files to it; the impact is limited to a single-process crash (low availability). No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 7.1.2-32.

Integer overflow in GIMP's GIF export plug-in leads to a heap-based buffer overflow when a user exports an image whose width and height are large enough to wrap the 32-bit pixel-buffer size calculation, resulting in an out-of-bounds write that can crash the application or corrupt memory. Affected software is the GIMP package as distributed in Red Hat Enterprise Linux 6, 7, 8, 9 and 10, and exploitation is local (AV:L) with high attack complexity (AC:H) and mandatory user interaction (UI:R) while requiring no privileges (PR:N) - the attacker must induce a user to export an image with extreme dimensions. No public exploit identified at time of analysis, and the independent assessment rates this a moderate-severity, genuinely low-urgency issue rather than a top priority.

Heap-based buffer overflow in XnView Classic 2.52.5 allows a crafted FLI file to corrupt heap memory when a victim opens it, requiring user interaction and no authentication; publicly available exploit code exists per the CVSS v4.0 E:P metric. This client-side parsing flaw has low confidentiality, integrity, and availability impact, making it a moderate-severity, low-priority issue, and upgrading to version 2.52.6 is recommended.

An out-of-bounds read in Apache YuniKorn's non-default LDAP group resolver allows a malformed LDAP group-membership entry to panic the scheduler process in versions 1.8.0 through 1.9.x, making the scheduler unavailable until it is restarted. The crash occurs only when an installation has explicitly configured the LDAP group provider and the LDAP server returns a memberOf entry for a user referenced in a submitted pod that does not begin with the 'CN=' prefix; default installations that use the built-in group resolution are not affected, and successful triggering generally requires an authenticated, low-privileged user able to have a pod processed. This is a low-severity, availability-only defect - CVSS 4.0 base score 2.1 (low) and an independently assessed CVSS 3.1 vector of AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L - with no public exploit identified at time of analysis and no confirmed active exploitation; a vendor fix is available in 1.10.0.

An integer overflow in the glamor rendering upload path of the X.Org X server (and Xwayland) can produce an undersized heap allocation and subsequent out-of-bounds memory writes, and is one of the issues bundled into the October 2026 X.Org security advisory tracked as CVE-2026-93521. The affected code is in builds of X.Org X server prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14; exploitation requires an authenticated local X client able to reach a depth-24 drawable uploaded into a depth-32 pixmap while glamor GL acceleration is active, with the byte_stride * height computation in glamor_upload_boxes overflowing before XNFalloc is called. No public exploit code, EPSS score, CWE assignment, or CISA KEV entry was present in the input, so there is no public exploit identified at time of analysis, and because the per-CVE description for CVE-2026-93521 is absent from the truncated advisory these conditions are inferred from the associated commit and should be verified against the vendor's per-CVE entry.

Out-of-bounds heap reads in GIMP's XMC (X cursor) thumbnail loader can crash the application or corrupt process memory when a victim opens a crafted XMC file, or when thumbnail generation is triggered for one by a file manager. The root cause is an integer overflow: the loader sizes a pixel buffer using width * height computed in 32-bit signed arithmetic, so an oversized product wraps to a small allocation that a later GEGL buffer read then indexes using the unwrapped dimensions. Exploitation is strictly local and user-interaction dependent (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), with no network attack surface and no confidentiality or integrity impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat tracks the issue across RHEL 6 through 10.

Out-of-bounds read in NVIDIA TensorRT can crash the inference runtime when an application parses an attacker-supplied, maliciously crafted model or serialized engine file, yielding denial of service limited to the affected process. The flaw is rated CVSS 5.5 (CWE-125, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning it is not remotely reachable: a local user or local process must deliberately load the crafted input, and no privileges are required (PR:N) although user interaction is (UI:R). There is no privilege escalation or confirmed data exposure from this vector, no public exploit identified at time of analysis, and it is not listed in CISA KEV; consistent with our assessment this is a moderate-severity, low-urgency issue best handled through routine patching and supply-chain hygiene around model/engine files.

A buffer overflow in an affected interface of HPE Aruba AOS-S (ArubaOS-Switch) networking devices lets an authenticated remote attacker crash or destabilize the switch, producing a denial-of-service condition. Successful exploitation requires valid credentials on the device (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 6.5), so the realistic risk is management-plane disruption and loss of network availability rather than data compromise or code execution - the assessed impact is availability-only (A:H) with no confidentiality or integrity effect. There is no indication of confirmed active exploitation or of publicly available exploit code at the time of analysis, and the issue is rated moderate priority; specific affected firmware builds and configuration preconditions must be confirmed against HPE advisory hpesbnw05156en_us.

Integer overflow leading to a heap-based buffer overflow in GIMP's DICOM export plug-in allows a local user to corrupt memory when exporting an image whose width and height are large enough that the 32-bit width × height × bytes-per-pixel product wraps and undersizes the heap allocation. Exploitation requires the victim to initiate the export and involves a crafted image with extremely large dimensions, so the attack is local (AV:L) and user-interaction dependent (UI:R), with high attack complexity (AC:H); the assessed CVSS is 6.3 with high integrity and availability impact but no confidentiality impact. No public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV), and no vendor-released patch version is identified in the available data.

Memory disclosure in Arista access points configured with VXLAN tunnelling and L2-proxy (the VESPA use-case) lets an unauthenticated adjacent-network wireless client associated to a tunnelled SSID send a crafted packet and cause the AP to expose memory contents in network traffic. The flaw is an out-of-bounds read (CWE-125) rated CVSS 4.0 2.3, with the independent assessment bounding impact to low confidentiality loss only; no write primitive, integrity impact, availability impact, or remote code execution is possible. The issue is low priority despite alarmist RCE/buffer-overflow tags, and no public exploit was identified at time of analysis.

Heap-based buffer over-read in the HDF5 library's scale-offset filter decoder (H5Z__filter_scaleoffset) allows a local, unauthenticated attacker to cause a denial of service by supplying a crafted HDF5 file that a victim opens. The flaw occurs when the filter's stored minimum-bits parameter equals the datatype's full precision and the decoder attempts to copy d_nelmts * size bytes from a compressed chunk that is too short, triggering an out-of-bounds read and application crash. The vendor CVSS 4.0 vector (6.8 Medium) rates this as an availability-only impact with no confidentiality or integrity effect; no public exploit code has been identified, and the fix is available as an upstream pull request but not yet confirmed in a tagged release.

An out-of-bounds read in Google Chrome's Skia graphics rendering library (CWE-125) allows an attacker to read a limited amount of process memory when a victim is socially engineered into opening a crafted file that Chrome renders, with the flaw present in all Chrome builds prior to 155.0.8059.39. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 3.3) shows no authentication requirement but a mandatory victim interaction and only a low-confidentiality memory exposure with no integrity or availability impact, which keeps real-world risk small; Google rates it Low. EPSS is 0.11% (1st percentile), no public exploit has been identified at time of analysis, and Chrome builds at or above 155.0.8059.39 are not affected.

Out-of-bounds memory reads in Google Chrome's ANGLE graphics layer (the WebGL/OpenGL ES translation backend) affect all versions prior to 155.0.8059.39, letting a remote attacker leak memory located outside the browser sandbox when a victim loads a crafted HTML page. The impact is disclosure-only: the changed-scope score (S:C) reflects a sandbox boundary crossing, but there is no integrity or availability effect, and per the assessed vector the attack still requires victim user interaction (UI:R) even though no authentication is needed (PR:N). No public exploit code has been identified at time of analysis, EPSS is low at 0.18% (6th percentile), and a vendor patch is available in Chrome 155.0.8059.39.

Out-of-bounds memory read in Google Chrome's Printing component on Windows (all versions prior to 155.0.8059.39) allows an attacker who has already compromised the renderer process to read memory outside the sandbox when a victim is socially engineered into loading a crafted HTML page. The flaw is rated Chromium security severity Medium and carries a CVSS v3.1 base score of 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), reflecting a scope-changing confidentiality-only leak with no integrity or availability impact. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (6th percentile), and a vendor patch is available.

TP-Link Tapo C500 v2.0 cameras with the ONVIF PTZ interface enabled are vulnerable to an out-of-bounds stack write (CWE-121) that can be triggered by an authenticated ONVIF client sending an excessive number of preset-related elements to the PTZ SOAP handlers, resulting in a service crash and denial-of-service. Exploitation requires valid ONVIF credentials and adjacency to the camera's network (CVSS 4.0: 6.8, AV:A/PR:H), and while the attacker cannot execute code or access data, repeated crashes can disrupt camera management and PTZ functionality until the service restarts. TP-Link has released a firmware patch, and no public exploit code has been identified at time of analysis.

Cross-origin data disclosure in Google Chrome desktop (Compositing component) affects builds prior to 155.0.8059.39, where a remote attacker can use a crafted HTML page to exploit an integer overflow and read limited data belonging to another origin. Exploitation is not passive: per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) the victim must load the attacker-controlled page, so a malicious-site, malvertising, or social-engineering delivery is required, and the impact is confined to low-confidentiality leakage with no integrity or availability effect. No public exploit code has been identified at time of analysis - this is not on CISA KEV - and the vendor patch is already available, meaning the effective window is mostly determined by how quickly browsers auto-update; despite the 'High' Chromium internal severity label, this is a moderate-severity, low-real-risk issue.

An out-of-bounds write in the Android kernel's Wacom HID driver (wacom_hid_set_device_mode in wacom_sys.c) lets an attacker who can physically attach or emulate a malicious Wacom HID peripheral corrupt kernel memory and escalate privileges on the affected device. No authentication or user interaction is required once the peripheral is connected, because the crafted report reaches the driver's missing bounds check directly; the CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms a physical-access-only attack path with high confidentiality, integrity, and availability impact. Only Pixel/Android kernel builds that include and exercise the Wacom HID driver are affected, and there is no public exploit identified at time of analysis; CISA SSVC rates exploitation as none and automatable as no, so the practical risk is bounded by the strict physical-access requirement and the inability to exploit this remotely or at scale.

An out-of-bounds heap read in tftp-hpa's rewrite_string() function (tftpd/remap.c) lets an unauthenticated remote attacker send a TFTP read or write request whose filename matches a configured remap 'jump' rule, causing the forked in.tftpd request handler to read past the end of a heap buffer and crash. Only tftp-hpa 5.4 through versions before 6.0 are affected, and exploitation is not possible in a default deployment: the daemon must be started with the remap feature enabled (the tftpd '-m'/mapfile option) and the rule set must contain at least one jump rule. The vendor-supplied CVSS 4.0 vector scores this 6.3 (medium), but the impact is limited to a low availability effect - the crashed process is the per-request child, not the listening daemon, so the practical result is aborted individual transfers rather than full service loss; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).

Heap memory corruption in the lrzsz lrz ZMODEM receive utility (all versions before 0.13.0) allows a malicious or compromised ZMODEM sender to overflow the fixed-size Pathname buffer in procheader() by supplying an overlong filename of up to 8192 bytes, crashing lrz and potentially enabling limited heap manipulation. Exploitation is not passive: the victim must be actively running the lrz receive utility and accept an inbound transfer from the attacker-controlled sender (UI:P/AT:P), and the demonstrated primary impact is denial of service rather than confirmed remote code execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; the overall real-world risk is constrained by these preconditions, consistent with a moderate-severity rating.

A heap out-of-bounds read in the Impulse Tracker loader of libmikmod before 3.3.14 lets a crafted .it module drive the parser past its pattern buffer, crashing the host application. Any program statically or dynamically linking the vulnerable library - classic MikMod-based players, games, and media tools - is exposed when it opens an untrusted module. The trigger is an oversized pattern of more than 200 rows, which overruns the hardcoded itpat allocation (200*64 ITNOTE entries) and causes IT_ConvertTrack() to read adjacent heap memory. The assessed impact is availability only (AV:L, UI:P, A:H) with no confidentiality or integrity loss, so there is no public exploit identified at time of analysis; the practical risk is a local denial of service against applications that parse attacker-supplied tracker files.

Heap out-of-bounds read in GNU Aspell's binary dictionary loader (ReadOnlyDict::load() in readonly_ws.cpp) lets a crafted .rws dictionary file trigger limited heap memory disclosure or a crash of the aspell process. The victim must deliberately run aspell against the attacker-supplied dictionary via --master, --dict-dir, or an equivalent configuration setting, so the vector is local, high-complexity and dependent on user interaction, and no privileges are required (PR:N). Impact is confined to limited information disclosure and denial of service with no code execution or integrity impact, and no public exploit has been identified at time of analysis.

GNU Aspell's prezip-bin decompressor suffers a heap-based buffer overflow (CWE-122) that lets a crafted prezip-compressed file corrupt heap memory and crash the process. The issue affects Aspell versions prior to 0.60.8.3 and is only reachable through a local chain: an attacker must deliver a malicious compressed file and then persuade a user to run prezip-bin against it, so no privileges are required (PR:N) but user interaction and high attack complexity apply. The assessed impact is availability-only (VC:N/VI:N/VA:L) with a low CVSS 4.0 base score of 1.8 and an equivalent CVSS 3.1 assessment of AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Multiple signals - trivial score, local-only vector, interaction requirement and crash-only outcome - converge on a genuinely low-priority issue.

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() iptfs_skb_reset_frag_walk() advances to the fragment containing @offset with an unbounded loop: while (offset >= walk->past + walk->frags[walk->fragi].len) walk->past += walk->frags[walk->fragi++].len; walk->fragi is advanced and walk->frags[walk->fragi] is dereferenced without ever checking fragi against walk->nr_frags. When the requested offset is at or beyond the total length spanned by the walk's fragments, fragi runs past nr_frags and off the end of the fixed-size on-stack frags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory. The two callers behave differently: iptfs_skb_add_frags() already guards against this with if (!walk->nr_frags || offset >= walk->total + walk->initial_offset) return len; but iptfs_skb_can_add_frags() has no such guard and calls iptfs_skb_reset_frag_walk() unconditionally, so it performs the out-of-range walk. Its own "fragi < walk->nr_frags" bound check runs only afterwards, too late to prevent the read. This is reachable from the receive path: a crafted IP-TFS (AGGFRAG) payload delivered to an IPTFS SA drives iptfs_reassem_cont() -> iptfs_skb_can_add_frags() with an offset past the fragment total, e.g.: BUG: KASAN: stack-out-of-bounds in iptfs_skb_reset_frag_walk+0x235/0x250 Read of size 4 at addr ffff888008ad7210 by task repro/345 iptfs_skb_reset_frag_walk+0x235/0x250 net/xfrm/xfrm_iptfs.c:392 iptfs_skb_can_add_frags+0x155/0x310 net/xfrm/xfrm_iptfs.c:420 iptfs_reassem_cont+0xcf8/0x1140 net/xfrm/xfrm_iptfs.c:902 iptfs_input_ordered+0x552/0x670 net/xfrm/xfrm_iptfs.c:1280 iptfs_input+0x3d6/0xde0 net/xfrm/xfrm_iptfs.c:1741 xfrm_input+0x282f/0x6140 net/xfrm/xfrm_input.c:700 xfrm4_esp_rcv+0x93/0x120 net/ipv4/xfrm4_protocol.c:104 ip_rcv+0x278/0x2d0 net/ipv4/ip_input.c:612 Give iptfs_skb_can_add_frags() the same up-front guard that iptfs_skb_add_frags() already has, so the walk is never entered with an out-of-range offset. When it triggers, the caller falls back to the existing linearize-and-copy path, which is safe.

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. NDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses .validation_type, so no validation is applied: # ynl --family rt-neigh --do setneightbl \ --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 0}}' # ynl --family rt-neigh --dump getneightbl --output-json | \ jq '.[] | select(.name == "arp_cache" and has("config")) | .parms["interval-probe-time-ms"]' 0 Moreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is silently cast to u32, so a larger value can bypass the min check: e.g. 4294967296 == 0x100000000 # ynl --family rt-neigh --do setneightbl \ --json '{"name": "arp_cache", "parms": {"interval-probe-time-ms": 4294967296}}' # ynl --family rt-neigh --dump getneightbl --output-json | \ jq '.[] | select(.name == "arp_cache" and has("config")) | .parms["interval-probe-time-ms"]' 0 msecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is larger than INT_MAX. Also, INT_MAX ms overflows int NEIGH_VAR() when HZ > 1000 (Alpha, MIPS), and passing a negative integer to queue_delayed_work(unsigned long delay) causes sign extension, which wraps around the expiry time to the past, resulting in it being handled as 0 delay in the timer wheel. Let's use NLA_POLICY_FULL_RANGE() and limit the max to 1 day. The same max check is applied to sysctl as well. Note that this controls the probe interval for NTF_MANAGED entries, so the max of 1 day is unlikely to break any deployments.

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as (actual_length - 4) / (in_n_analog << 2) * (out_n_analog << 2) + 4, where actual_length is the unsigned length the device reported for the matching IN packet. A packet completed with status 0 and actual_length < 4 wraps the subtraction to 0x7fffffec; a zero-length isochronous packet is legal on the bus, and the preceding loop rejects only non-zero status. The sum reaches memset() on out_urb->buffer, a 4832-byte object from kcalloc(PCM_MAX_PACKET_SIZE, PCM_N_PACKETS_PER_URB). Even without the wrap the result is out of bounds: at 88.2/96 kHz the 4-in/6-out scaling turns a full 420-byte IN packet into 628, so eight packets span 5024 bytes of that buffer. usb_submit_urb() rejects an over-long descriptor only after the memset() and the usb6fire_pcm_playback() copy of user PCM data have run. Guard the subtraction as the sibling usb6fire_pcm_capture() already does, and limit the frame count to what fits in rt->out_packet_size, the OUT endpoint's wMaxPacketSize. This bounds total_length by the buffer size while keeping each packet length aligned to a whole output frame. BUG: KASAN: out-of-bounds in usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338) Write of size 18446744073709551456 at addr ffff88802a3d0000 by task vhci_rx/5018 Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200) __asan_memset (mm/kasan/shadow.c:84) usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741) vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107 drivers/usb/usbip/vhci_rx.c:242) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) Allocated by task 10: __kmalloc_cache_noprof (mm/slub.c:5563) usb6fire_pcm_init (sound/usb/6fire/pcm.c:560 sound/usb/6fire/pcm.c:595) usb6fire_chip_probe (sound/usb/6fire/chip.c:133) usb_probe_interface (drivers/usb/core/driver.c:399) The buggy address belongs to the object at ffff88802a3d0000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 0 bytes inside of 4832-byte region [ffff88802a3d0000, ffff88802a3d12e0) Kernel panic - not syncing: Fatal exception in interrupt

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry): for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */ Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate TX skb length in send_sync btintel_pcie_prepare_tx() copies skb->len bytes into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintel_pcie_send_frame(); any future caller of btintel_pcie_send_sync() would silently overflow the DMA buffer. Add the bounds check in btintel_pcie_send_sync() itself, right before skb_push() and the DMA copy.

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatm_send(), LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit packets passing through ppp_start_xmit() have their header unshared via skb_cow_head(). However, packets can also reach pppoatm_send() via PPP channel bridging (PPPIOCBRIDGECHAN) without going through ppp_start_xmit(). Use skb_cow_head() to ensure both sufficient headroom and a writable header before pushing the LLC header. While at it: - Call pskb_may_pull(skb, 1) before inspecting skb->data[0] to prevent out-of-bounds reads on zero-length or non-linear frames (e.g. from bridging). - Defer SC_COMP_PROT protocol compression until after pppoatm_may_send() succeeds. This eliminates the temporary skb allocation on admission failure and completely removes the fragile "undo" heuristic at the nospace label, avoiding any risk of reading uninitialized headroom or performing an unbalanced skb_push().

In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the route to the tunnel's remote endpoint and set ctx->dev to its device, which is the tunnel itself when that route resolves back to the tunnel. dev_fill_forward_path() then makes no progress and trips WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to offload a flow through the tunnel. That routing loop is a configuration any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and ip6_tnl_xmit() already treat it as a tx error, so remove the warning and just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE when accessing forward path array") did for the path stack overflow.