Buffer Overflow

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in page_pool allocation The per‑processor buffering scheme is supported only if the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8). This is already checked in mvpp2_probe() during the initial activation of percpu_pools. However, mvpp2_change_mtu() may later call mvpp2_bm_switch_buffers(priv, true) without this check, which can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ entries, and mvpp2_get_nrxqs() may return exactly that value. The per-CPU scheme then doubles it to nrxqs * 2, exceeding the array bounds. Check that the hardware version is MVPP22 or newer and that the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS before switching to per-CPU mode. Found by Linux Verification Center (linuxtesting.org) with SVACE.

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity data_ep_set_params() allocates each data URB for exactly u->packets isochronous frames, so urb->iso_frame_desc[] has u->packets slots and ctx->packets is the driver's only record of that limit. For an implicit feedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the sync source's packet count, which is calculated independently from the capture endpoint's parameters. When that count is larger, prepare_playback_urb() and prepare_silent_urb() can write iso_frame_desc[] past the allocation; their existing bounds limit payload bytes, not the descriptor index. The reproducer uses a high-speed UAC2 device declaring bInterval 1 for implicit feedback capture (8 packets) and bInterval 4 for playback (1 packet). On the first capture completion after the stream starts, it accesses seven descriptors spanning 112 bytes beyond the one-packet URB: BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560) Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178 prepare_playback_urb (sound/usb/pcm.c:1560) prepare_outbound_urb (sound/usb/endpoint.c:340) snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501) snd_complete_urb (sound/usb/endpoint.c:1834) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741) vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107) kthread (kernel/kthread.c:436) The buggy address belongs to the object at ffff88801e696a00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0) Record the allocated packet count per endpoint and clamp both the adopted count and the packet-size copy to it. Fold the Format Type II delimiter into urb_packs before the allocation loop so the recorded limit matches every URB.

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (which is greater than 4G) to mapped_len. Previously, `mapped_len` was declared as 32-bit `unsigned int`. When accumulating `size_t` lengths, this leads to a silent wrap-around. This truncation causes truncated lengths to be passed to functions like `fill_sg_entry()`. Fix this by changing `mapped_len` to `size_t` (64-bit). While at it, fix similar potential overflow issues in `calc_sg_nents` by using `check_add_overflow()` for `nents` and using `unsigned int` for the loop iterator in `fill_sg_entry` to match.

In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: initialize `options_len` before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneve_opts 4660:66:11223344 dev d0 memcpy: detected buffer overflow: 4 byte write of buffer size 0 kernel BUG at lib/string_helpers.c:1044! ... ip_tun_parse_opts.part.0.cold+0x10/0x10 ip_tun_build_state+0x116/0x2a0 On kernels built with GCC 15+ and `CONFIG_FORTIFY_SOURCE`, the fortified `memcpy()` got 0 sized destination with request of 4 bytes length: static int ip_tun_parse_opts_geneve(...) { ... attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA]; data_len = nla_len(attr); /* == 4 */ struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len; memcpy(opt->opt_data, nla_data(attr), data_len); /* ^^^^^^^^^^^^^ 0 since options_len is assigned afterwards */ Fixed by initializing the counter before the options are referenced. Matching what `tunnel_key_opts_set()` already does.

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() The netif index carried in the DPMAIF PIT header is five bits wide, but ccmni_inst[] only has room for NIC_DEV_MAX (21) entries. t7xx_ccmni_recv_skb() indexes the array without a bounds check, so indexes 21 to 31 read past it. The out-of-bounds value lands in the callback table that follows the array, which is never NULL, so the existing !ccmni check does not catch it and the driver dereferences whatever sits there as a struct t7xx_ccmni. Drop the skb when the index is out of range. Verified in a QEMU guest with a fault injector setting the netif index to 25: the unpatched driver reads a value past ccmni_inst[], which lands in the callback table, and dereferences it far enough to queue the skb. With this check the packet is dropped. Well-formed traffic on index 0 is unaffected. Changes in v2: none.

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can wrap, and the separately computed buf_data can point beyond buf. During automatic scan, enable is false, so the read-modify-write of buf_data[4] can clear the low two bits of a target-selected out-of-bounds stack byte. scsi_mode_select() can then copy up to 64 bytes from outside the buffer into the outgoing MODE SELECT payload, disclosing stack contents to the target. This is reachable while scanning a USB storage device that identifies as an ATA device and advertises CDL support. No filesystem mount or userspace access to the block device is required. On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific, one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator sampling executed a fixed proof command inside the guest and created a UID-0-owned marker during automatic enumeration, with KASLR and NX enabled. The issue was independently found during security research at Drivesec S.r.l. Cap the available length to the buffer size. Validate and consume the mode header and block descriptor lengths before using the page, and require the five bytes needed to access the CDL field.

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16_MAX, the assignment truncates the allocation size. KASAN reports a 32760-byte slab-out-of-bounds write when __ekey_init() copies the master key description into the undersized buffer. The total payload length stored in key->datalen is also a u16. Use check_add_overflow() to reject values that do not fit either destination, and use kzalloc_flex() for the flexible-array allocation.

In the Linux kernel, the following vulnerability has been resolved: Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() When chunking writes into SMBus blocks in rmi_smb_write_block(), the loop calculates block_len using the original total length (len) instead of the remaining length (cur_len). If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32 for every iteration, even on the final partial chunk where fewer than 32 bytes remain. This causes smb_block_write() to read 32 bytes from the advanced data buffer pointer, reading past the end of the input buffer. Fix this by calculating block_len using cur_len and advancing the buffer and address pointers by block_len.

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, add a new mask for controlling the source of the output voltage. Note (groeck): This patch was meant to prepare for support of MAX20826 and compatible devices, which support more than 10 phases per page. However, Sashiko reports that the mp2975 driver already supports up to 14 phases, and the mp2856 driver supports up to 12 phases. This already has the potential for out-of-bounds writes when probing the affected chips, making this patch a bug fix.

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once ieee80211_is_public_action() returns true. That helper only verifies the frame is long enough for the action category field, that is offsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both functions then read the P2P public action header up to oui_subtype at offset 30 and pass "size - ie_offset" to cfg80211_find_vendor_ie(), where ie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32. A public action frame of 25 to 31 bytes passes the check but is shorter than that 32 byte header, so oui_subtype can be read out of bounds, and because the length is unsigned, "size - ie_offset" underflows to a value close to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length, so even the size_t subtraction in mgmt_tx() is truncated to the same value. It then walks far past the buffer searching for a vendor element until it reaches unmapped memory. In the receive path the frame arrives over the air and needs no association, so a nearby unauthenticated device can crash the host while it is in P2P listen. Reject frames shorter than the P2P public action header in both paths before dereferencing it.

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() wilc_wlan_handle_isr_ext() takes the RX transfer size from the device-reported interrupt status register (a 15-bit field shifted left by 2, up to 131068 bytes) and reads that many bytes from the device into rx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap check only handles the current offset; the size itself is never compared against the buffer, so a bogus SDIO device can make the driver OOB-write rx_buffer by up to ~32K with data it controls. The oversized transfer also leaves rx_buffer_offset past the end of the buffer, after which the unsigned wrap check stops working and the overflow can repeat. Drop any transfer whose size exceeds the RX buffer, acknowledging the data interrupt and re-arming the RX engine so the bogus frame is discarded and reception can continue. This also restores the rx_buffer_offset <= WILC_RX_BUFF_SIZE invariant the wrap check relies on. This is not expected to change driver behavior in most cases: without this check, an oversized transfer would most likely corrupt neighboring kernel memory instead of completing anyway, and the drop path performs the same interrupt acknowledgment and RX engine re-arming as the normal path, so subsequent transfers are received unaffected. Discovered by Atuin - Automated Vulnerability Discovery Engine.

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54_convert_rev0() and p54_convert_rev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54_convert_output_limits() and p54_convert_db() already validate their counts against the entry length; this path was missed. Reject the entry when the counts do not fit in the entry data.

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing each with memcmp(). The count comes straight from the (attacker-supplied) IE and is never checked against the element's own length, and the callers admit the element on element_id alone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted RSN/WPA IE with a large pairwise count therefore makes the walk read up to 255 * 4 bytes past the element -- an out-of-bounds read of the kmemdup()'d beacon buffer, reachable from any AP whose beacon/probe response is processed during scan-result parsing. Pass the number of IE bytes available at the OUI list and bound the walk to the element. Keep the length signed and reject a negative value before any unsigned arithmetic, so a small or zero IE length cannot underflow to a large size_t and defeat the bound. Found by 0sec automated security-research tooling (https://0sec.ai).

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiex_cfg80211_authenticate() derives the authentication frame length from req->ie_len and req->auth_data_len, both of type size_t, but stores it in a u16. NL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is a u16, a single attribute can carry up to 65531 bytes of payload, so the sum can exceed U16_MAX before it is assigned to pkt_len. The truncated pkt_len determines the skb frame area, while the copy length remains req->auth_data_len - 4, resulting in a heap buffer overflow. For example, with auth_data_len equal to 65510 and no IEs, the sum is 65546. It is truncated to 10 and then reduced by four to 6. The driver appends only six bytes to the skb with skb_put(), but then copies 65506 user-provided bytes into the authentication body. Reaching this path requires CAP_NET_ADMIN in the user namespace owning the network namespace, an up station netdev, and a suitable BSS/SAE authentication request. Compute the length in size_t, reject values that cannot be represented by the firmware's u16 frame length field, and only then assign it to pkt_len.

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to account for the optional Address Extension field. Consequently, an empty PREQ element causes a one-byte read beyond its declared payload. Move the helper call after both size checks, so the bottom fields are only accessed when they are present.

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0-63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots.

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds. Fix this by ensuring src_size >= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer. Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating "attribute not present" or "output buffer too small".

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server->total_read for compound encrypted PDUs In receive_encrypted_standard(), server->total_read is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result, cifs_handle_standard() passes this full size to smb2_check_message(), causing the PDU length guards to incorrectly validate the entire compound frame instead of the current sub-PDU. This allows truncated non-last sub-PDUs to bypass length validation, leading to out-of-bounds reads in smb2_get_data_area_len(). Fix this by setting server->total_read to the true length of the current sub-PDU: next_cmd for non-last sub-PDUs, and the remaining pdu_length for the last one.

A use-after-free (CWE-416) in Qualcomm Snapdragon's DMA buffer management allows a local attacker with low privileges to corrupt kernel memory by triggering a race condition between concurrent DMA buffer allocation and deallocation, potentially leading to code execution or privilege escalation. The vulnerability is not remotely exploitable and requires winning a timing window (AC:H). No public exploit code or active exploitation has been identified at time of analysis; the vendor rates the required privileges as high (PR:H), but independent assessment indicates low privileges (PR:L) may be sufficient.

Memory corruption in the Qualcomm Snapdragon camera driver path that handles operations during driver updates allows a locally positioned attacker who already holds high privileges to trigger an out-of-bounds write (CWE-787) and corrupt memory, with the potential for high confidentiality, integrity, and availability impact on the affected device. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), this is a moderate-severity local privilege/memory-corruption issue rather than an internet-facing emergency; there is no public exploit identified at time of analysis and no CISA KEV listing, and exploitation is gated by the strict prerequisites of local access plus pre-existing elevated privileges and a driver-update code path. Exact affected chipset families and driver configurations are not enumerated in the available data, so Qualcomm's October 2026 security bulletin should be treated as the authoritative scope statement.

Local attackers with high privileges can trigger an out-of-bounds write in the Qualcomm Snapdragon camera CRE (Camera Request Engine) driver, causing memory corruption during hardware update preparation. Tracked as CVE-2026-25272, the flaw requires local access and elevated permissions (PR:H) to invoke the vulnerable driver operation, but successful exploitation yields high confidentiality, integrity, and availability impact confined to the affected device subsystem (scope unchanged). No public exploit code or confirmed active exploitation has been identified at time of analysis.

Out-of-bounds write in the Qualcomm Snapdragon Android Camera driver allows a locally privileged process to corrupt memory by submitting command buffer requests carrying invalid length parameters, potentially achieving code execution or memory corruption within the driver's execution context on affected devices. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires local access and an already-privileged process capable of reaching the camera driver interface, making this realistically a post-compromise privilege-escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis. The CPE entry (cpe:2.3:a:qualcomm,_inc.:snapdragon:*) carries no version constraint, so the exact affected chipset and firmware coverage must be resolved from Qualcomm's October 2026 security bulletin.

Memory corruption in the Qualcomm Snapdragon camera subsystem can be triggered by processing camera requests with excessive batch and IO buffer configurations that exceed allocated memory, resulting in an out-of-bounds write (CWE-787). All versions of Qualcomm Snapdragon platforms are affected according to the vendor CPE. Exploitation requires local access with high privileges (PR:H) and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis, making this a moderate-priority issue for systems where an attacker already has privileged on-device code execution.

Qualcomm Snapdragon kernel driver IOCTL handling contains a memory corruption (out-of-bounds write) that a local attacker with low-privilege code execution can trigger by supplying invalid parameters, leading to potential integrity impact and denial of service. This is a moderate-severity local issue (CVSS 6.6) rather than a drop-everything priority. No public exploit code or active exploitation has been identified at time of analysis.

An out-of-bounds read in vLLM up to and including version 0.31.0 lets a caller with low-privilege access to the completions API drive the SSM convolution path past the end of a buffer, degrading availability of the inference worker. The flaw is confined to deployments that serve Mamba/Mamba2-architecture models, because it lives in conv_ssm_forward of vllm/model_executor/layers/mamba/mamba_mixer2.py; instances running only standard transformer models are unlikely to reach the vulnerable code. Publicly available exploit code exists, but there is no confirmed active exploitation (not listed in CISA KEV); the independent assessment bounds impact to low availability loss with no confidentiality or integrity effect, making this a moderate rather than top-tier priority.

A local denial of service in SSSD's Name Service Switch (NSS) responder lets an attacker who can reach the responder's UNIX socket crash the name-resolution service by sending a crafted request containing an undersized packet header, which causes an integer underflow followed by an out-of-bounds read during packet parsing. Affected deployments are Red Hat Enterprise Linux 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4 nodes running SSSD. The impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires prior local access and socket reachability, and no public exploit identified at time of analysis.

A local, low-privilege attacker can crash the SSSD PAM responder on Red Hat Enterprise Linux (versions 6 through 10) and Red Hat OpenShift Container Platform 4 by sending a crafted PAM request that contains a zero-length authentication token. The flaw, tracked as CVE-2026-104042 with a CVSS score of 5.5, stems from missing length validation that leads to an out-of-bounds read and a denial of service; it requires an existing local account and no user interaction. No public exploit code has been identified at time of analysis, and this is a moderate-severity local DoS rather than a remote or privilege-escalation issue.

Denial of service in SSSD's autofs responder allows a local attacker with an existing account on the host to crash the responder process by writing a specially crafted request containing an invalid packet length to its UNIX domain socket. The malformed length triggers an integer underflow that produces an out-of-bounds read (CWE-125), terminating the responder and disrupting automount map lookups; there is no confidentiality or integrity impact and no remote vector. Exploitation requires the autofs responder to be enabled in sssd.conf and local reachability of its socket (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5); no public exploit code and no confirmed active exploitation were identified at time of analysis. Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 (via packaged SSSD) are listed as affected.

SSSD's NFS idmap plugin contains an out-of-bounds write (CWE-787): when a cached user or group name is larger than the destination buffer it is copied into, the size check fires but the copy proceeds anyway. An authenticated, low-privileged local attacker can request identity lookups that resolve to such oversized cached entries, crashing the identity-mapping service (denial of service) and potentially corrupting adjacent process memory; the attack is local-only and depends on the oversized-cache precondition, giving it high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, 5.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.

OS command execution on Dbit WIFI4 N300 1.0.0 routers is achievable by feeding an oversized 'comment' value to the authenticated /api/addStaticDHCP endpoint, which overflows a fixed-size stack buffer in the device's web management daemon and lets the caller pivot from web administrator to a shell on the underlying operating system. The practical barrier is high: the CVSS 3.1 vector (AV:A/PR:H per the independent assessment, versus the vendor-published AV:L/PR:H base of 6.7) means an attacker must already hold valid administrator credentials and be able to reach the device from the local Wi-Fi network - there is no unauthenticated remote path, and no user interaction is required once those preconditions are met. Exploitation status is low-signal: there is no CISA KEV listing and no confirmed in-the-wild activity, though a Klogix Security (Scorpion Labs) technical blog walks through the exploitation chain end-to-end, and EPSS is only 0.22% (12th percentile), underscoring that this is a high-CVSS-but-low-real-world-priority issue.

Boot-time arbitrary code execution is possible on AMD Versal Adaptive SoCs and related Alveo accelerator cards, but only when USB boot mode has been enabled through physical board modifications - a configuration AMD explicitly describes as non-default. A crafted boot image delivered over USB can trigger an out-of-bounds write (CWE-787) that overflows a buffer and overwrites an active function pointer, yielding high confidentiality, integrity, and availability impact confined to the boot process. Because exploitation requires both physical access to the device and a deliberately modified board, plus a non-trivial (high-complexity) overflow, realistic risk is limited to supply-chain, manufacturing, or evil-maid scenarios; no public exploit identified at time of analysis, and no confirmed in-the-wild activity, though the vendor bulletin AMD-SB-8028 documents the issue.

Crashing the SSSD autofs responder process via a crafted request to its UNIX socket allows a local, low-privileged attacker to cause a denial of service on affected Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 systems. The vulnerability stems from improper buffer offset calculation during request parsing, leading to an out-of-bounds read (CWE-125) that terminates the responder process; it carries a CVSS 3.3 (Low) score with no confidentiality or integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the autofs responder service must be enabled for the flaw to be exploitable.

A local, low-privileged user can crash the sssd authentication daemon by submitting a crafted passkey (FIDO2/WebAuthn) authentication token that omits expected null terminators, causing an out-of-bounds read and terminating the service, which disrupts authentication for all users relying on that host. Rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is purely an availability issue confined to systems where sssd's passkey authentication path is configured and reachable; there is no confidentiality or integrity impact and no remote or unauthenticated route. At the time of analysis, no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), and no vendor-released patch has been identified.

An out-of-bounds read in Android's camera3 stream splitter (DeprecatedCamera3StreamSplitter.cpp, returnOutputBufferLocked) lets a locally installed, low-privileged application read a small amount of adjacent process memory while camera output buffers are being returned, potentially disclosing limited information on Android 14, 15, 16, 16-qpr2, and 17. The flaw is a missing bounds check reachable only from local code already running on the device (CVSS 3.1 base 3.3, AV:L/PR:L/UI:N, C:L/I:N/A:N), and no public exploit identified at time of analysis, with SSVC assessing exploitation as 'none' and not automatable. The issue is fixed in the October 2026 Android Security Bulletin (2026-10-01) patch level, and this is a genuinely low-severity, low-priority issue despite being in the ubiquitous Android platform.

Out-of-bounds read in Google Android's MMS PDU parsing code (PduParser.java) allows a remote attacker who can deliver a crafted or malformed Protocol Data Unit to the device to trigger a denial of service against the affected messaging/telephony component, with no user interaction required. Affected platforms are Android 14, 15, 16, 16-qpr2 and 17, per the EUVD version list and the wildcard CPE cpe:2.3:a:google:android:*; the vulnerability is rated CVSS 6.5 (MEDIUM), though independent review downgrades the availability impact to Low and confirms confidentiality and integrity are unaffected, with no code execution possible. No public exploit code has been identified and SSVC rates the issue as non-automatable with exploitation status 'none', so this is assessed as a moderate, low-priority denial-of-service hardening issue rather than an urgent threat.

An out-of-bounds read in Android's NFC Type 5 Tag reader/writer implementation (rw_t5t.cc) lets a local, low-privileged context read memory that should be out of reach, resulting in information disclosure with no user interaction required. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and per that vector the attacker must already hold a low-privileged foothold on the device, such as an installed application capable of exercising the NFC read path; there is no write or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and remediated builds are addressed through the Android Security Bulletin dated 2026-10-01.

Zabbix Server and Proxy can be crashed by a crafted binary item value containing a NULL byte, causing loss of monitoring availability on deployments that use MySQL or MariaDB as the Zabbix backend database. Exploitation is not anonymous: the CVSS vector (PR:L) indicates an authenticated, low-privileged user able to submit binary item values is required, and the attack additionally depends on a specific input condition (AT:P), which is why the vendor-assigned severity is low (CVSS 4.0 base 2.3) and our independent assessment matches at CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); impact is confined to availability, with no confirmed data exposure, integrity loss, or code execution.

Information disclosure in the Zabbix server's JavaScript preprocessing engine (embedded Duktape interpreter) allows an authenticated 'limited administrator' account to read raw heap memory and potentially expose data belonging to other concurrently running preprocessors that the account should not be able to access. The root cause is an out-of-bounds read (CWE-125) in the JavaScript preprocessing path; exploitation requires only the ability to define or run a JavaScript preprocessing step, and there is no integrity or availability impact. No public exploit code was identified at time of analysis and there is no CISA KEV entry; this is a moderate-severity privilege-boundary/tenant-isolation issue (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) rather than an unauthenticated remote compromise.

Use-after-free in the TXTP file handler of vgmstream (the open-source video-game audio decoding library) affects builds up to and including revision r2117, specifically the make_group_random function in src/meta/txtp_process.c. The flaw is triggered when a locally processed TXTP playlist file uses a random group definition, causing a stale VGMSTREAM pointer to be dereferenced after the group structure is rebuilt; the vendor rates it CVSS 4.0 2.4 (AV:L/PR:L/UI:P), and the independent assessment agrees on local-only, user-interaction-gated reachability with limited impact (C:L/I:L/A:L), making a crash/denial-of-service the most plausible outcome rather than code execution. There is no CISA KEV entry and no public exploit identified at time of analysis. An upstream fix exists as commit ae37662ad626254ddd96ad69ac263792d7a92024.

An out-of-bounds read in vgmstream up to revision r2117 is triggered when a victim opens or plays an attacker-crafted PlayStation VAG audio file through any application that embeds the library; the flaw sits in ps_find_padding() in src/coding/psx_decoder.c, which scans for padding at the end of a stream and reads past the input buffer when fewer bytes remain than a full ADPCM frame. Exploitation requires user interaction (CVSS 4.0 UI:P, PR:N - no authentication needed) and impact is limited to minor memory disclosure or a decoder crash, with no code execution or system compromise demonstrated. The vendor has published an upstream fix (PR #2001, commit 4b8316652a30d40f99ad43310bed273fd1f8a7a3) with a straightforward bounds check; no public exploit identified at time of analysis, and the associated reference issue (#2000) is a bug report rather than weaponized code.

Out-of-bounds write in vgmstream up to r2117 lets a crafted TXTP playlist (or a related TXTH/VAB config or name-table file) overflow fixed-size stack buffers when parsed, corrupting memory in any vgmstream-based player, plugin, or library build that loads the file. The flaw sits in the parse_params/txtp_parse routines of src/meta/txtp_parser.c, where sscanf conversions used unbounded '%[^...]' scans without field-width limits; the trigger is an over-length key, value, or command token. Exploitation is unauthenticated but requires the victim to deliberately open the malicious file (UI:P per CVSS 4.0, UI:R per the assessed CVSS 3.1 vector), and no public exploit code has been identified at time of analysis; the issue is rated 5.3 (CVSS 4.0) and low-to-moderate priority, consistent with a client-side parsing fault that exposes no network service.

Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.

Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to exploit a missing bounds check, causing an out-of-bounds write that can elevate privileges on affected MediaTek chipsets. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and affects 25 listed MediaTek chipset models including MT8196, MT6768, MT6769, MT6833, MT6877, MT8186, and MT8188. No public exploit code or active exploitation has been identified at time of analysis.

Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System privilege on an affected chipset to supply crafted input that triggers a type-confusion-driven out-of-bounds write, corrupting memory and achieving high confidentiality, integrity, and availability impact at a higher privilege level. The issue affects 24 MediaTek SoCs including MT8395, MT6833, MT6789, MT8195, MT6877, MT8189, MT8391, MT8676, MT8678, MT8793, MT8799, MT6855, MT8367, MT8781, MT8196, MT8910, MT8668, MT8188, MT8792, MT6769, MT6768, MT8186, MT8788E, and MT2718, across mobile, tablet, and embedded platforms. Exploitation is local only, requires the System-privilege prerequisite, and needs no user interaction; the CVSS 3.1 base score is 6.7 (MEDIUM) and no public exploit was identified at time of analysis, so the practical risk is a post-compromise escalation primitive rather than a remote entry point.

Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT6985, MT8195, and others listed in EUVD-2026-92196) and allows an attacker with physical access to the device to trigger an out-of-bounds write due to a missing bounds check, achieving high confidentiality and integrity impact. No authentication, existing execution privileges, or user interaction are required once physical access is obtained. No public exploit has been identified at time of analysis; the physical access prerequisite limits remote exploitation and confines realistic abuse to scenarios such as lost or stolen devices, border inspection, or supply-chain tampering.

Use-after-free memory corruption in MediaTek's apusys driver allows a local attacker who has already obtained Android System privilege (uid system) to escalate to kernel-level code execution on affected devices, with no user interaction required once that foothold exists. The flaw affects firmware running on a broad set of MediaTek SoCs - including MT6897, MT6899, MT6989, MT6991, MT8196, MT8678 and the other MT-series chipsets listed in MediaTek's October 2026 bulletin - and is addressed by Patch ID ALPS11076799 (Issue ID MSV-8143). Because the CVSS vector carries PR:H and AV:L, this is a second-stage privilege-escalation link that presupposes a prior System-level compromise rather than a standalone remotely reachable bug; no public exploit code or confirmed active exploitation was identified at time of analysis.

A missing permission check in MediaTek modem firmware permits an out-of-bounds read that can crash the baseband, producing a remote denial of service on affected handsets. The attack is unauthenticated (CVSS PR:N) and requires no user interaction (UI:N), but it only succeeds if the victim UE is already camped on a rogue base station the attacker controls, which is why the vector is scored AV:A/AC:H and the issue is assessed as moderate severity and low real-world priority. No public exploit code has been identified at the time of analysis, and impact is limited to availability of the modem - no confidentiality or integrity loss, and no code execution. MediaTek has issued a fix under Patch ID MOLY01774038 / Issue ID MSV-8911.

Remote denial of service against MediaTek modem (baseband) firmware affects more than 80 chipsets - including MT6765, MT6785, MT6833, MT6883, MT6985, MT6991 and MT8798 - where a missing bounds check during cellular message parsing produces an out-of-bounds read (CWE-126) that can crash the baseband. An attacker who operates a rogue base station and gets a victim UE to attach can trigger the fault with no authentication (PR:N) and no user interaction (UI:N), though the adjacent-network position and specialized radio hardware required drive the high attack complexity (AC:H) and the CVSS 3.1 score of 5.3, with impact limited to availability. Neither our independent assessment nor CISA's SSVC framework records known exploitation (Exploitation: none, Automatable: no), so no public exploit is identified at time of analysis.

Out-of-bounds read in MediaTek modem firmware (CWE-126) allows an attacker operating a rogue base station to trigger a memory over-read in the modem stack of any UE that connects to it, resulting in a remote denial of service (availability only; no data exposure or code execution). The issue affects a very wide set of MediaTek chipsets (MT6989, MT6990, MT6983, MT6768, MT6765 and dozens more) enumerated in MediaTek's October 2026 product security bulletin. No authentication or user interaction is required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.3), but practical exploitation demands radio proximity, rogue base-station infrastructure, and the ability to coerce device attachment - CISA SSVC rates exploitation 'none' and automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine but moderate-priority issue rather than a critical one.

Denial of service against the cellular modem firmware shipped in a very broad range of MediaTek chipsets (MT6739 through MT6993/MT8893 families) arises from an out-of-bounds read caused by a missing permission check. The precondition is that the victim user equipment has already attached to a rogue base station under the attacker's control, meaning the adversary must operate radio infrastructure within range and successfully induce attachment (downgrade or stronger-signal lure) - hence the AV:A/AC:H scoring and the LOW real-world priority despite the enormous chipset footprint. Once attached, exploiting the flaw requires no authentication (PR:N) and no user interaction (UI:N), but the outcome is availability-only (A:H, with no confidentiality or integrity impact); there is confirmed no active exploitation (CISA KEV absent), no public exploit code identified at time of analysis, and no EPSS signal was provided in the source data.

Local privilege escalation in MediaTek AIDL on affected chipsets is possible via a use-after-free memory corruption, but only after an attacker has already obtained Android System privilege and local access. Successful exploitation requires no user interaction and can yield high confidentiality, integrity, and availability impact within that privileged context. No public exploit identified at time of analysis; the vendor patch ID ALPS11185225 and the October 2026 MediaTek security bulletin address the issue.

Local privilege escalation in the aidl component shipped on a defined set of MediaTek chipsets (MT6899, MT6991, MT8910, MT8781, MT6881, MT8668, MT6989, MT8188, MT6878, MT6993, MT8695, MT8189, MT8696) allows a process that already holds Android System privilege to trigger a use-after-free, corrupt memory, and gain higher-integrity code execution with high confidentiality, integrity, and availability impact. The attack is local (AV:L) and needs no user interaction, but the PR:H prerequisite means it cannot be used for initial access and only functions as a follow-on escalation from an already-compromised privileged context. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS data was not supplied for this CVE. MediaTek has published a fix under Patch ID ALPS11242428 in its October 2026 Product Security Bulletin.

Modem denial of service in MediaTek baseband firmware allows an attacker operating a rogue base station within radio range to crash or reset a victim handset's modem through an out-of-bounds read (CWE-125) caused by an incorrect bounds check on attacker-influenced over-the-air data. The attacker must first get the target UE to camp on the malicious cell (CVSS 3.1 AV:A/AC:H), after which no privileges and no user interaction are required, and the only impact is loss of availability of the modem (A:H, C:N/I:N), yielding a 5.3 base score. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and applicability is limited to devices built on the enumerated MediaTek chipset models with vulnerable modem firmware, so this is a genuine but bounded, proximity-dependent availability risk rather than a mass-exploitation emergency.

Local privilege escalation in the MediaTek display component lets a process that already holds System privilege trigger an out-of-bounds write in a display-path buffer, corrupting memory and potentially escalating to higher-level code execution with high impact to confidentiality, integrity, and availability. The defect is a missing bounds check (CWE-787) reachable without user interaction and with low attack complexity, but only from an existing System-privileged, on-device context (CVSS 3.1 6.7 Medium, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it functions as a second-stage escalation primitive rather than an initial-access or remote vector. Affected hardware spans a broad set of MediaTek chipsets including MT6991, MT6993, MT2718, MT8168-class MT8668/MT8678, MT8171, MT8188, MT8189, MT8196, MT8793, and MT8126; MediaTek has issued Patch ID ALPS11292777 (issue MSV-9195) and no public exploit code has been identified at time of analysis.

Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT6768, MT6853, MT6893, MT6991, MT8186, MT8188 and MT8196) allows an attacker who already holds System privilege to trigger an out-of-bounds write through a missing bounds check, yielding high impact to confidentiality, integrity and availability. No user interaction is required once System access is held, and the flaw is reachable in default configurations of the listed chipsets, making it a post-compromise escalation rather than an initial foothold; the CVSS 6.7 score is dominated by the PR:H prerequisite. A vendor patch is available under MediaTek's October 2026 Product Security Bulletin (patch ID ALPS11276677, issue MSV-9217), and no public exploit code or confirmed active exploitation has been identified at time of analysis.

An out-of-bounds read/write flaw in MediaTek's ccci (cross-core/modem control) component allows an authenticated local attacker who already holds System privilege to corrupt memory, potentially leading to information disclosure, crashes, or further privilege escalation. Exploitation requires local access and, per the vendor description, user interaction - though the vendor CVSS vector omits UI:R - and is limited to specific MediaTek chipsets (MT6880, MT6890, MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988, MT2735, MT2737). No public exploit code has been identified, SSVC reports exploitation: none and not automatable, making this a high-severity but low-urgency issue due to its high-privilege prerequisite.

Out-of-bounds read in NASA cFS through 7.0.1 can be triggered by a remote attacker who already holds high privileges and can supply a crafted input file name to the CFE_FS_ParseInputFileNameEx parser, producing only a low availability impact with no confidentiality or integrity loss. The flaw is in the cfe file-system module (cfe/modules/fs/fsw/src/cfe_fs_api.c), and the only identified fix is an upstream pull request that awaits acceptance, so no vendor-blessed patched release is confirmed. No public exploit identified at time of analysis.

Decoding an attacker-crafted APV bitstream with the Academy Software Foundation's OpenAPV reference implementation before version 1.1.1.0 can overflow a heap buffer in the read_bitstream/decoder path, because integer wraparound in the frame buffer-size calculation lets a too-small allocation pass the internal size check. The affected component is the oapvd decoder and the oapv_app_dec sample application; no authentication or non-default configuration is required, but the attack vector is local (AV:L), so exploitation requires the victim to open or process a malicious .apv-style file. Vendor-rated impact is limited (low confidentiality, integrity, and availability per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector), consistent with a crash or constrained memory corruption rather than reliable code execution, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.

Heap-based out-of-bounds write in the boks_ksllogsd logging daemon of Fortra BoKS Manager / BoKS Server allows an authenticated KSL client to corrupt memory by placing an oversized but OpenSSL-recognized digest name in the MD field of a KSL start message. The daemon validates that OpenSSL recognizes the supplied digest name but does not confirm that the name fits the fixed 16-byte checksum context field before copying, so an over-long value is written past the end of the heap allocation (CWE-787; CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Because the attacker must already hold KSL client credentials and the written content is constrained to valid digest-name strings, the practical result is a crash or memory corruption of the logging service rather than reliable remote code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority availability risk pending a vendor fix.

Heap buffer overflow in the Perl Imager module before version 1.037 allows memory corruption inside i_gsampf_fp when a host application asks for float samples across more than one channel of an attacker-supplied paletted image, with the image's own palette controlling the bytes written past the end of the allocation. The vulnerable path is conditional rather than universal: it is only reached when an application calls getsamples() with type 'float' on a palette-type image and requests multiple channels, so real-world exposure depends on how the embedding application uses the library. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC evaluation rates exploitation as 'none' and automatable as 'no'; the vendor CVSS vector indicates low privileges required (PR:L) while our independent assessment treats the vector as unauthenticated with high attack complexity (PR:N/AC:H), so authentication requirements are not consistent across sources.

Heap-based buffer overflow in the tnef command-line TNEF (winmail.dat) extractor allows a crafted TNEF file with a large number of colliding attachment filenames to overflow the numeric-suffix counter used by find_free_number(), producing a crash and denial of service; arbitrary code execution is theoretically possible but unproven. The bug only triggers under a non-default configuration in which numbered backups are enabled while file overwriting is disabled, and it requires the victim to actually run tnef against the malicious file (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, base 3.1), so no public exploit code has been identified at time of analysis and real-world risk is low despite the RCE and memory-corruption tags attached to this report. Impact is limited to availability; there is no confidentiality or integrity impact in the assessed vector.

GEGL's Radiance HDR loader reads past the end of a memory-mapped image when a crafted .hdr file declares a scanline width larger than the actual data present in an uncompressed scanline, crashing the application that consumes the library - most notably GIMP, which uses GEGL for image processing. Any local user who opens such a file is affected; no authentication is required to the library, but the attacker must convince a victim to open the crafted file (UI:R), and the impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, consistent with a low-priority, local denial-of-service rather than a code-execution primitive.

Stack-based buffer overflow in OpenSC's SetCOS smart-card driver (setcos_construct_fci_44 in src/libopensc/card-setcos.c) lets attacker-influenced file attribute data overwrite a fixed-size stack buffer during a file-creation operation. OpenSC builds through 0.27.1 that compile in the SetCOS driver are affected; per the assessed CVSS:3.1 vector (AV:L/PR:L/UI:R) this is a local, low-privilege issue that requires user interaction, such as a user running OpenSC tooling against a malicious or manipulated SetCOS card, with limited confidentiality, integrity and availability impact. Although the upstream fix is publicly visible as a GitHub commit and pull request, no public exploit code or confirmed active exploitation was identified at time of analysis.

A heap buffer overflow in Mozilla Thunderbird occurs when a user opens an email message of 2GB or larger in size, allowing the overflowing write to corrupt memory and crash the client. The assessed CVSS vector (6.1, AV:L/AC:L/PR:N/UI:R) shows the attack is local and requires the victim to actively open the oversized message, with impact limited to availability (crash) and low integrity, and no confidentiality loss; no public exploit code or confirmed active exploitation (CISA KEV) is associated with this issue, and EPSS is low at 0.19% (8th percentile). The flaw is fixed in Thunderbird 157, and the real-world risk is further constrained because mail servers and gateways typically reject or truncate messages of that size before they ever reach the client.

An out-of-bounds read in the kernel-mode layer of NVIDIA's vGPU Virtual GPU Manager for Linux allows a local, already highly privileged user on the hypervisor host to drive the driver past the bounds of an allocated buffer, with the potential for kernel code execution, privilege escalation, information disclosure, denial of service, or data tampering. The issue is rated CVSS 3.1 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and is confined to Linux hosts running the Virtual GPU Manager in vGPU/VDI or cloud-GPU deployments; no public exploit has been identified at time of analysis. Because the attacker must already be authenticated with high privileges on the host and the attack surface is local-only, this is a moderate-priority, defense-in-depth issue rather than an urgent remote threat.

Denial of service in NVIDIA GPU Display Driver for Windows arises from excessive kernel stack consumption in the kernel-mode color transform path when evaluating YCbCr420 display emulation, leading to a stack-based buffer overflow (CWE-121). A local attacker with low privileges (PR:L per the CVSS vector) can crash the system, but there is no impact to confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the moderate CVSS 5.5 reflects the local, DoS-only nature, making this a low-priority issue.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux can be triggered by an already-privileged local user who wins a narrow race condition between concurrent kernel operations, potentially yielding code execution in kernel context, denial of service, privilege escalation, information disclosure, and data tampering. Affected branches include GeForce, RTX/Quadro/NVS, Tesla, and Guest Driver products on Linux (CVSS 3.1 base 6.4). Impact is bounded by the requirement for high local privileges (PR:H) and the non-deterministic nature of the race (AC:H); no public exploit code and no confirmed active exploitation were identified at time of analysis.

An out-of-bounds write in the firmware component of the NVIDIA GPU Display Driver for Windows and Linux lets a local attacker who already holds administrator or root privileges corrupt memory, with potential outcomes spanning code execution, escalation of privileges, denial of service, information disclosure and data tampering. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-787), the flaw affects GeForce, RTX/Quadro/NVS and Tesla products; exploitation requires local access to the host plus high existing privileges, and no public exploit code was identified at time of analysis, so real-world risk is moderate rather than urgent. No user interaction is required and there is no network attack path, which rules out remote exploitation entirely.

Out-of-bounds write in the NVIDIA GPU Display Driver for Linux kernel mode layer allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, potentially achieving code execution, privilege escalation, denial of service, information disclosure, or data tampering. Affected driver branches cover GeForce, RTX/Quadro/NVS, and Tesla products below the fixed versions listed in NVIDIA's advisory, and the attack surface is local-only, so real-world risk is assessed as MODERATE-LOW. No public exploit identified at time of analysis.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, with the potential for code execution, privilege escalation, information disclosure, denial of service, and data tampering. Affected installations are those running GeForce, RTX/Quadro/NVS, or Tesla display drivers at versions below the fixed release for their branch (for example prior to 610.88, 582.78, 616.92, or 580.178.04), on either Windows or Linux. The CVSS 3.1 base score of 6.7 reflects the non-network, high-privilege access prerequisite rather than broad exposure; no public exploit code has been identified at time of analysis.

A kernel-mode out-of-bounds write in the NVIDIA GPU Display Driver for Linux lets a local attacker who already holds high privileges corrupt kernel memory in the driver's kernel mode layer, which the vendor states may lead to code execution, denial of service, privilege escalation, information disclosure and data tampering. The flaw carries a CVSS 3.1 base score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is strictly local and requires pre-existing elevated/administrative access on the host; there is no network attack vector and no user interaction is needed. Affected systems are Linux hosts running GeForce, RTX/Quadro/NVS or Tesla driver branches below the fixed releases published in NVIDIA security bulletin 5861, and there is no public exploit identified at time of analysis.

Out-of-bounds read in the firmware component of NVIDIA GPU Display Drivers for Windows and Linux allows a local attacker who already holds high privileges (PR:H, per CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) to read memory beyond intended firmware buffer bounds, most plausibly resulting in memory disclosure or a driver/GPU crash, with the vendor also flagging the potential for code execution, escalation of privileges and data tampering. The CVSS 3.1 base score is 6.7; the attack path is local-only, requires no user interaction, and is gated behind pre-existing high privilege, which materially limits real-world exposure. No public exploit code has been identified for this issue and it is not in CISA KEV, so no public exploit identified at time of analysis.

An out-of-bounds read in the kernel-mode layer of NVIDIA's GPU Display Driver for Windows and Linux can be triggered by a locally present attacker who already holds high privileges, potentially leading to kernel-context code execution, privilege escalation, denial of service, information disclosure, or data tampering. Exploitation requires local code execution at an elevated privilege level (CVSS vector PR:H) against a vulnerable driver build that is installed and loaded, so there is no remote or unauthenticated path and the practical risk is a defense-in-depth and privilege-boundary concern rather than an initial-access vector; no public exploit has been identified at time of analysis. NVIDIA has published fixed driver builds per product line and branch, and the affected install base spans GeForce, RTX/Quadro/NVS, and Tesla GPUs.

An out-of-bounds read in the NVIDIA GPU Display Driver kernel-mode layer on Windows and Linux lets a locally authenticated attacker who already holds high privileges trigger an unbounded string operation that reads beyond the end of an allocated buffer, with vendor-acknowledged consequences including code execution, denial of service, privilege escalation, information disclosure, and data tampering. The flaw (CWE-125, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7) affects GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest driver builds below the fixed versions published in NVIDIA's 2026 advisory, and exploitation is strictly local - there is no network vector, no user interaction, and no non-default configuration requirement, only a privileged process on an affected host. Real-world risk is moderate and localized: no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so value to an attacker is mainly as a local privilege-escalation or kernel-tampering primitive after an initial foothold.

Kernel-mode out-of-bounds write in NVIDIA GPU Display Driver for Windows and Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) allows a local attacker with high privileges to corrupt kernel memory, potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering. No public exploit has been identified at time of analysis. Affected driver branches include GeForce prior to 595.91.07, RTX/Quadro/NVS prior to 596.86, Tesla prior to 616.92, and vGPU guest drivers prior to vGPU 19.5/20.1, among others.

Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, first_match and match_details methods use the T_STD_STRING typemap to translate Perl scalars (SVs) into strings via the std::string constructor, using the SvPV macro to stringify the haystack input, and the SvCUR macro to determine the length of the SV. When the input SVs are references, integers (IVs) or floats (NVs), the SvCUR macro will return an invalid length if it is run before the input is stringified, leading to an out-of-bounds read which can abort the process. Note that the evaluation order of arguments to std::string is unspecified. Depending on the compiler, SvCUR may be run first and lead to an abort that cannot be caught within Perl. This can be triggered when the haystack is a numeric value, for example, my $ac = Algorithm::AhoCorasick::XS->new( [ "11", "22" ] ); $ac->matches( 211 ); This can occur when the haystack is the result of reading data from decoded JSON or a numeric database column. It can also be triggered when using a blessed object as a haystack.

A heap/stack buffer overflow in the GPAC DASH client's URL resolution routine (gf_dash_resolve_url in src/media_tools/dash_client.c) lets a remote attacker corrupt memory by supplying a crafted DASH presentation whose initialization segment resolves to a scheme-prefixed gmem://blob URL, which is then written into an undersized output buffer. All GPAC builds up to and including 26.07.0 that exercise the DASH client path are affected; the attacker cannot reach the flaw unless a victim opens or streams the malicious DASH content (user interaction required) and no authentication is needed, with impact limited to low confidentiality, integrity and availability loss. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released abi-16.26 plus the upstream fix commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd, making this a moderate, low-priority-by-signal issue.

Stack-based buffer overflow in Artifex Ghostscript up to 10.09.0 within the pdfwrite (vector output) device, reachable through Type1 charstring subroutine handling in devices/vector/gdevpsfx.c (type1_callsubr). Attackers can trigger the overflow remotely by supplying a crafted document/font that is processed through the pdfwrite path, unauthenticated but requiring the victim or an automated conversion pipeline to render the malicious input; publicly available exploit code exists, so exposure should be treated as urgent for any service or workstation that converts untrusted PostScript/PDF content. CVSS 4.0 base is 5.3 (E:P) and the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, with bounded impact that realistically skews toward denial of service or limited memory corruption rather than guaranteed code execution; EPSS, KEV and SSVC provide no signal of active exploitation at time of analysis.

An integer overflow in the blosclz decompression path of C-Blosc2 3.3.2 and earlier allows a remote attacker who can supply crafted compressed data to a program that calls blosclz_decompress to corrupt an output-buffer bounds computation, potentially causing memory corruption. Successful exploitation depends entirely on a consuming application accepting and decompressing attacker-influenced Blosc2/blosclz data, and the vendor characterizes the attack as high complexity and difficult; per the CVSS 4.0 vector the impact is Low across confidentiality, integrity, and availability and no privileges or user interaction are required. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is assessed as a real but low-priority memory-safety defect; the vendor-released fix is version 3.3.3.

Integer overflow in the image-encoding routines of nothings/stb (stb_image_write.h, stb through version 1.16) allows remote attackers who can influence image dimensions or channel counts passed to stbi_write_png_to_mem, stbi_write_jpg_core, or stbi_write_tga_core to corrupt memory or crash the encoding process. Publicly available exploit code exists (no CISA KEV entry, so active exploitation is not confirmed), and the flaw requires an application that feeds attacker-controlled sizing into the encoder rather than simple network reachability. The published CVSS 4.0 score of 6.9 overstates practical risk: an independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N with only low integrity and availability impact and no confidentiality impact - a genuine but modest-severity issue whose real exposure depends entirely on whether the host application passes untrusted dimensions to the write functions.

Integer overflow in the hexwave_init() function of Nothings stb (stb_hexwave.h) corrupts allocation sizing when an application passes attacker-influenced width or oversample arguments during wave-table initialization. Exploitation is remote and unauthenticated at the library level and publicly available exploit code exists (no confirmed active exploitation), but the practical attack surface is limited: these are initialization parameters normally hardcoded by the developer, so exploitation requires an application that surfaces them to untrusted input. Impact is bounded to low integrity and availability loss, consistent with memory corruption or a crash rather than reliable code execution, and the project has not responded to the issue report, leaving no confirmed vendor patch.

Signed integer overflow in the Splash rasterization backend of Freedesktop Poppler (SplashClip::clipToPath in splash/SplashClip.cc) lets a local attacker crash or destabilize any Poppler-backed application that renders an attacker-crafted PDF, yielding a denial-of-service primitive with no confidentiality or integrity impact. Versions up to and including 26.08.0 are affected, publicly available exploit code exists (no KEV listing, so this is not confirmed active exploitation), and the flaw is fixed in 26.09.0. Exploitation is local in nature and requires the victim to open or render the malicious document, so despite the alarming CWE-190 integer-overflow class the realistic risk is low and availability-only.

An out-of-bounds write in U-Boot's Android boot method (boot/bootmeth_android.c) lets someone with physical access to a device boot from crafted media whose boot image header declares a size larger than the containing partition, causing U-Boot to write past its load buffer into bootloader memory before 2026.10-rc3. Only devices that actually use the Android bootmeth and do NOT have Android Verified Boot (AVB) enabled are exposed, since AVB rejects the tampered image; authentication requirements are not confirmed from available data, but the assessed vector is CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H and there is no public exploit identified at time of analysis, nor any CISA KEV listing. The practical risk is low-priority: exploitation is gated on physical possession of the device plus an unprotected boot chain, and impact is limited to integrity and availability of the bootloader rather than confidentiality or a remote attack path.

Out-of-bounds write in the U-Boot bootloader's RLE8-compressed BMP decoder (video_display_rle8_bitmap in drivers/video/video_bmp.c) lets an attacker who can place or modify a crafted splash/logo image write past the framebuffer, corrupting adjacent memory and crashing the bootloader. All U-Boot versions through 2026.10-rc5 are affected per the wildcard CPE, but exploitation is genuinely constrained: the platform must actually route an attacker-controlled BMP through the BMP display path, which in typical deployments means write access to boot media, the splash partition, or the environment-configured image source, and the outcome is primarily availability loss with only limited integrity impact and no confidentiality exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is moderate rather than critical despite the headline score.

An out-of-bounds read in Chrome's WebGL implementation allows a remote attacker to disclose a limited amount of memory beyond the renderer/sandbox boundary in Google Chrome builds prior to 154.0.8037.92. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled HTML that exercises the WebGL rendering path (UI:R), and the confirmed impact is limited to a partial information disclosure with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical value to an attacker is low because the quantity and controllability of the leaked data are constrained and unpredictable. Chromium rated the issue High severity, and Google has published a stable-channel fix, but the assessed CVSS of 4.7 keeps this in low-priority territory relative to memory-corruption bugs that grant code execution.

Buffer overflow in the API endpoint of HPE Networking Instant On lets an authenticated attacker who already holds administrative privileges interrupt the affected service, producing a short-lived denial of service that recovers on its own without manual intervention. Only administrators can reach the vulnerable code path (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), and there is no confidentiality or integrity impact, so the practical exposure is limited to brief, self-healing service interruptions. All Instant On versions up to and including 3.4.1.0 are reported affected; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), which is consistent with the low 2.7 base score.

A local buffer overflow in the underlying operating system of HPE Networking Instant On devices (all builds up to and including 3.4.1.0) allows a low-privilege authenticated local attacker to interrupt the normal operation of a single affected service. The flaw is rated CVSS 3.1 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), meaning it is not remotely reachable, requires an existing low-privileged local foothold on the device OS, and is limited to partial availability impact on one service with no confidentiality or integrity loss; no public exploit identified at time of analysis, and no CISA KEV listing or EPSS scoring is associated with this CVE. Overall risk is low and the pre-existing authenticated local access requirement is the dominant limiting factor.

Memory corruption in the network-facing interface of HPE Networking Instant On firmware (version 3.4.1.0 and earlier) allows an unauthenticated remote attacker to disrupt the affected service and retrieve a limited amount of information from the component. The flaw scores CVSS 3.1 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L, so the limiting factor is high attack complexity - reliable triggering depends on specific memory state or precisely crafted input rather than a simple repeatable request - and the realistic impact is service outage plus limited disclosure, with no integrity impact and no confirmed path to code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation additionally requires network reachability to the affected interface.

Memory corruption reachable through an unvalidated format string in the management API of HPE Networking Instant On access points allows an attacker who already holds high administrative privileges to provoke a denial-of-service condition or potentially achieve remote code execution on devices running firmware 3.4.1.0 and earlier. The flaw is scored CVSS 3.1 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting that the attacker must be authenticated with high privileges and that reliable exploitation hinges on crafting format-string input that reliably corrupts memory, which often requires memory-layout knowledge or repeated attempts. No public exploit code or confirmed active exploitation was identified at time of analysis, so the dominant risk driver is the high-privilege prerequisite - an attacker must first obtain or compromise an admin account, or chain another vulnerability to reach the vulnerable function.