Buffer Overflow

libXi before 1.8.4 contains an out-of-bounds read in the XI2 device-class parsing helpers size_classes() and copy_classes(), which a malicious or compromised X server can trigger to crash a connecting X client. The issue inverts the usual X11 trust model: the server attacks the client, so exposure is limited to users who connect an affected client to an untrusted display - a remote/forwarded X session or a hostile server - and requires user interaction to establish that connection (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5). Impact is confined to client-side denial of service with no code execution, data disclosure, or integrity loss; there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor fix is available (libXi 1.8.4, upstream commit f499944a).

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len >= 2 before dispatching into subtype handlers that assume their fixed fields are present. The frames that trip this are not shorter than 2 bytes; they are short relative to their subtype. mwifiex is a concrete in-tree example on the length side: mwifiex_process_mgmt_packet() only requires a 4-address ieee80211_hdr plus the 2-byte firmware length prefix before handing the frame to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and removing addr4, pkt_len can be exactly 24: a bare 3-address management header with no reason-code body. The existing WARN_ON(len < 2) does not fire on such a frame, and cfg80211_process_deauth() then reads u.deauth.reason_code as a two-byte access starting at offset 24, immediately past the 24-byte buffer. Add a frame-control length gate, then validate each subtype's minimum frame size in an if/else-if chain that mirrors the dispatch logic. Trace only after the frame is known to be well-formed. Side effects of this change: - The WARN_ON(len < 2) is dropped. It only guarded the frame_control read, never the subtype fixed fields, and it does not fire on the frames that actually trigger the out-of-bounds read (which are >= 2). The len >= 2 check is kept as the guard before dereferencing frame_control, but without the warning: these are exported callbacks and a malformed frame from a driver should be dropped silently rather than backtraced. - cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype through disassociation handling; it now silently ignores unrecognised subtypes.

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any validation. The crash trace shows that a subsequent SIOCSIWESSID triggers a connection attempt which calls cfg80211_sme_get_conn_ies() to process the stored IE buffer, causing: - An out-of-bounds read in skip_ie() which reads ies[pos+1] (the length byte) past the end of the 1-byte buffer. - An integer underflow in the memcpy size argument when offs returned by ieee80211_ie_split() exceeds ies_len, causing unsigned subtraction to wrap to SIZE_MAX and triggering a fortify panic. Fix this by validating the IE buffer in cfg80211_wext_siwgenie() before storing it. [drop unnecessary ie_len check, update commit message]

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences hdr->addr and hdr->ctrl without validating skb->len first. A truncated frame with skb->len less than the minimum header size causes an out-of-bounds read of uninitialized memory. Additionally, a zero-length frame causes skb->len-- to underflow to UINT_MAX, making skb_tail_pointer() read far past the buffer. Commit 23882b828c3c ("Bluetooth: RFCOMM: validate skb length in MCC handlers") fixed the same class of missing-length-check bugs in the MCC sub-handlers, but the top-level rfcomm_recv_frame() was left unfixed. KMSAN reports: BUG: KMSAN: uninit-value in rfcomm_run ... Uninit was created at: __alloc_skb+0x474/0xb60 vhci_write+0xe9/0x870 Fix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1 (the minimum frame must have a 3-byte header and a 1-byte FCS).

Out-of-bounds reads in libXi before 1.8.4 can crash X11 client applications when they process a crafted XQueryDeviceState() reply, producing a denial-of-service condition with no code execution or confirmed data disclosure. Exploitation requires the victim to initiate a connection to an attacker-controlled or compromised X server, or an attacker able to tamper with an unauthenticated X protocol stream, matching the UI:R requirement; clients limited to trusted local X servers are effectively not exposed. No public exploit code has been identified at time of analysis, and a vendor fix is available.

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pt_event_stop() is called without PERF_EF_UPDATE flag, then perf_aux_output_end() is not called. A subsequent call to pt_event_start() will call perf_aux_output_begin() again which violates the rule against nesting and triggers a WARNING in perf_aux_output_begin(). Originally, pt_event_stop() was never called without PERF_EF_UPDATE, because the only code paths to do so are from event overflow, and Intel PT does not do that. However the introduction of group throttling by commit 9734e25fbf5ae ("perf: Fix the throttle logic for a group") meant that an Intel PT event could be throttled if it was part of a group. Throttling calls PMU ->stop() / ->start() callbacks without flags. An example is when AUX area sampling is used. The following commands hit the issue: echo 10000 > /proc/sys/kernel/perf_event_max_sample_rate perf record -F32000 --aux-sample -e '{intel_pt//u,cycles:u}' \ -- bash -c 'for i in `seq 1 100000` ; do true ; done' Use PERF_HES_UPTODATE to track whether perf_aux_output_begin() and perf_aux_output_end() are balanced. A cleared PERF_HES_UPTODATE bit indicates that an AUX output context is still open. Amend pt_event_start() / pt_event_stop() accordingly so that begin/end stay balanced: - In non-snapshot mode, stop() always closes the buffer (the buffer may have run out of space, and that accounting is done by the update), so a following start() opens a fresh one as before. - In snapshot/overwrite mode, stop() without PERF_EF_UPDATE leaves the buffer open so that pt_event_snapshot_aux() can still copy from it, and start() then only re-enables tracing instead of calling perf_aux_output_begin() again. Note that pt_event_del() calls pt_event_stop() with PERF_EF_UPDATE flag set (as is required by the documentation), so a final call to perf_aux_output_end() is assured.

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from num_pd_vregs to num_pds, which would shift the info pointer past the end of the array for pronto-v3, which does not list power domain regulators in vregs. This showed up as a difference between GCC- and LLVM-compiled kernels on SDM632 devices, where only with LLVM one would get the "regulator request with no identifier" error, because the out-of-bounds memory ended up being zeroed. Fix by skipping the increment when there are more power domains than regulators.

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating the PBL, if it's an indirect PBL we create a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size and can hold 510 addresses (EFA_PTRS_PER_CHUNK) and has a 12-byte control buffer at the end of it holding the next chunk's pointer and its length. If the PBL number of pages is a multiple of EFA_PTRS_PER_CHUNK, the calculated last chunk length is wrongly computed as 0, even though that chunk is fully populated with 510 real page pointers. This wrong length is used both to DMA map the chunk and is propagated to the device, causing the device to see the chunk as empty and reject the memory registration. Fix the calculation so it will be performed only if the number of pages isn't a multiple of EFA_PTRS_PER_CHUNK, if it is, its already handled in the above loop correctly. Also prevent out-of-bounds reach in the chunks array in such scenario.

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvu_register_interrupts() walks every MSI-X vector and uses strstr() to match "Mbox" or "FLR" in irq_name before pinning those interrupts to CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every slot is populated before this loop runs. strstr() keeps scanning until it finds a NUL terminator, so an uninitialized slot can trigger a KASAN slab-out-of-bounds read at boot when debug options are enabled. Use strnstr() with NAME_SIZE to bound the search within each vector's name buffer.

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated. gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read. Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO. This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data.

In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn With CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, deferred_grow_zone() initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, the ranges deferred_init_memmap() finds may not add up to the allocation it was asked for, and the function ends up initializing the memory map of the entire zone and still falls short. That is fine in itself: the function accounts for it and leaves the caller to decide whether it now has enough memory. However, the update of pgdat->first_deferred_pfn that tracks where uninitialized memory map starts could overflow. If the node's RAM end is not aligned on PAGES_PER_SECTION boundaries and some deferred struct pages were initialized, pgdat->first_deferred_pfn would point past the end of the node's memory. deferred_init_memmap() later picks up from pgdat->first_deferred_pfn and hits a BUG_ON(), because it expects a pfn within its node. For example, when running a kernel with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y and CONFIG_CMA=y using the following qemu command line qemu-system-x86_64 -enable-kvm -m 8032M -kernel bzImage \ -append "nokaslr cma=4768M@0x100000000" the kernel panics: kernel BUG at mm/mm_init.c:2131! CPU: 3 UID: 0 PID: 36 Comm: pgdatinit0 Not tainted 7.2.0-rc6 #1 RIP: 0010:deferred_init_memmap+0x1b8/0x1c0 RAX: 0000000000236000 R13: 0000000000238000 Call Trace: kthread+0xdf/0x120 ret_from_fork+0x187/0x250 Make sure that the update of pgdta->first_deferred_pfn does not overflow when the entire zone's (and therefore node's) memory map is initialized. [rppt: massaged the changelog]

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in of_alias_scan() stem parser The stem parser tests isdigit(*(end - 1)) before checking end > start and so reads one byte before the property name when the name is empty or all digits. Check the bound first.

A limited out-of-bounds memory read in the host-facing BMC firmware management service of IBM OpenBMC can be triggered by a host system to crash that service and read a small amount of BMC internal memory, producing low confidentiality and availability impact (CVSS 3.4). Only agents who already hold high-privileged control of the managed host can reach the vulnerable interface, since the flaw sits on the local host-to-BMC path (AV:L, PR:H) rather than on the network. Affected firmware levels are FW1060.00 through FW1060.81, FW1110.00 through FW1110.31, and FW1120.00 through FW1120.01; there is no public exploit code identified and no confirmed active exploitation (not in CISA KEV), so the practical risk is low and is largely contingent on the host already being compromised at a privileged level.

Local root access inside a guest logical partition (LPAR) on IBM PowerVM systems running affected partition firmware allows an attacker to send a crafted request to the partition firmware runtime and crash it, with possible memory corruption. Rated CVSS 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), the flaw affects firmware lines FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81 and FW950.00 through FW950.H3; no public exploit has been identified at time of analysis, and the realistic outcome is denial of service to the partition firmware runtime rather than confirmed cross-partition code execution. The guest-root prerequisite makes this a bounded, low-priority risk relevant mainly to multi-tenant or compromised LPARs on shared Power hardware.

Limited information disclosure affects IBM PowerVM Hypervisor firmware on specific service-pack levels (FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, and FW950.00-FW950.H3), where an out-of-bounds read can expose a small amount of adjacent memory content to an attacker. Rated CVSS 4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the flaw requires no authentication or user interaction but is not reachable across the internet: the attacker must already sit on the same adjacent network segment and be able to reach a hypervisor firmware interface that processes malformed input. Impact is confined to partial confidentiality loss with no integrity or availability effect, and no public exploit identified at time of analysis; IBM has published a vendor fix advisory.

Out-of-bounds read in the Huawei HarmonyOS graphics module allows an attacker who can already run code locally on the device - or deliver crafted graphics content for local processing - to read past the end of an allocated buffer and crash the graphics component. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) confirms local-only reachability with no privileges or user interaction required, and bounds the impact to limited memory disclosure plus availability degradation; there is no demonstrated path to code execution or privilege escalation. No public exploit code was identified and the CVE is not listed in CISA KEV, so no confirmed active exploitation at time of analysis.

The CVE-2026-91767 record currently carries no description, no CVSS score or vector, no CWE mapping, and no CPE data; the only intelligence available is that the report originates from the Ubuntu vendor channel. As a result, the affected package, deployment mode, attack vector, and required privileges are all unknown, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the available data, and the assessment must be repeated once the corresponding Ubuntu Security Notice (USN) or NVD record is published.

CVE-2025-1218 is attributed solely to Ubuntu in the available intelligence, with no published description, CVSS vector, CWE classification, CPE data, or reference links, so the concrete security impact cannot be established from the supplied data. Because no affected package, version range, or vulnerable component is identified, neither the attack surface nor the prerequisites (authentication level, network exposure, user interaction) can be scoped for any Ubuntu release. No public exploit code was identified and there is no evidence of active exploitation (no CISA KEV entry) at time of analysis, but the identifier should be treated as unscored rather than low risk until the Ubuntu Security Notice and NVD entry are retrieved.

Ubuntu Linux packages are implicated by a security defect reported through Canonical's coordinated disclosure process, but the intelligence set contains no description, CVSS vector, CWE classification, affected package name, version range, or reference links. Because neither the vulnerable component nor the attack surface can be identified, it is not possible to state whether the issue is remotely or locally exploitable, what privileges an attacker would need, or what level of impact (code execution, privilege escalation, denial of service, information disclosure) would result. No public exploit code and no CISA KEV entry are indicated in the available data, and no vendor patch version is identified at time of analysis; treat this record as unresolved pending retrieval of the corresponding Ubuntu Security Notice (USN) and NVD entry.

Risk cannot be meaningfully assessed from the provided data: CVE-2026-93682 is associated only with the Ubuntu security tracker (reported by vendor:ubuntu) and arrives with no description, no CVSS vector, no CWE classification, and no CPE mapping, so the affected Ubuntu source package, the exposed component, and the attack surface are all unidentified. Because no vulnerability class, privilege requirement, or user-interaction condition can be established, it is impossible to state whether this is remote code execution, privilege escalation, denial of service, or information disclosure. No public exploit code exists at time of analysis and no EPSS score or CISA KEV entry was supplied, but that silence reflects missing intelligence rather than a confirmed low risk, and no patch information was included in the input.

A one-byte heap out-of-bounds read in simdjson 4.6.1 lets remote, unauthenticated attackers crash any application that parses attacker-supplied JSON through the unpadded DOM API (dom::parser::parse_unpadded). The flaw is a CWE-125 out-of-bounds read in which json_iterator::walk_document() dereferences buf[len] after the input buffer has been exhausted, causing process termination and a denial-of-service condition with no confidentiality or integrity impact (CVSS: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Per available intelligence there is no public exploit code and no confirmed active exploitation (not in CISA KEV), and EPSS is only 0.17% (6th percentile); exploitation further requires user interaction and, critically, that the target deployment has chosen the unpadded parsing path rather than the standard padded parse API.

Heap out-of-bounds write in libconfini 1.16.4 causes deterministic denial of service in applications that follow the library's bundled load_ini_buffer.h allocation pattern, which sizes the INI buffer to exactly ini_length bytes while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length]. Any non-empty INI input is sufficient to trigger the resulting single-byte heap corruption, so exploitation requires no special payload or timing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) frames the issue as unauthenticated and remotely reachable, but real-world network exposure depends entirely on whether the host application actually parses attacker-supplied INI content; no public exploit code was identified at time of analysis, there is no CISA KEV entry, and EPSS is only 0.15% (3rd percentile), supporting a low-priority availability assessment with no demonstrated code execution.

Stack-based buffer overflow in the get_alias_name function of the uhttpd web management service on the Fast FAC1900R SOHO router allows a low-privilege authenticated remote attacker to overwrite stack memory with a crafted request, resulting in limited loss of confidentiality, integrity, and availability (CVSS 4.0 base 5.3; vendor vector PR:L). Publicly available exploit code exists and is referenced from a GitHub proof-of-concept repository targeting the device's devDiscoverNotify handling, so the flaw is straightforward to reproduce for anyone who can reach the management interface. The vendor was contacted but did not respond and no vendor-released patch has been identified, leaving exposure reduction as the practical mitigation.

Opening a crafted uncompressed DDS image in GIMP triggers a one-byte heap out-of-bounds read in the file-dds plug-in, which can crash the plug-in process. The flaw requires a local user to open the malicious file (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L), and the crash is non-deterministic because it only occurs when the byte past the pixel buffer lands on an inaccessible memory page; no information disclosure or code execution has been demonstrated. No public exploit code has been identified at time of analysis, and while downstream tracking covers Red Hat Enterprise Linux 6 through 10, the availability-only impact keeps real-world risk low and the 'RCE', 'Buffer Overflow' and 'Information Disclosure' tags attached to this record are not supported by the assessed vector.

Out-of-bounds heap read in GIMP's TIM image loader is triggered when a user opens a crafted 4bpp TIM image that is promoted to an RGBA layer, causing the file-tim plug-in to allocate an undersized row buffer and then process it with the larger RGBA row size. The result is disclosure of adjacent heap memory into the decoded image and a possible plug-in crash, with exploitation requiring local access and victim user interaction (CVSS 4.4, CWE-125). No public exploit is identified at time of analysis, and impact is bounded to partial confidentiality loss and availability loss rather than code execution.

An out-of-bounds read in BusyBox's built-in TLS handshake parser (get_client_hello()) lets unauthenticated remote attackers trigger a limited memory over-read by sending a malformed, truncated TLS ClientHello to a BusyBox process that parses inbound handshake data. Impact is confined to low confidentiality loss (CVSS 5.3, C:L) with no integrity or availability effect, and exploitation requires the atypical configuration of BusyBox acting as a TLS server or handshake receiver, since BusyBox's TLS code is most often used client-side for wget/https. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and Red Hat tracks the issue for Red Hat Hardened Images (advisory: https://access.redhat.com/security/cve/CVE-2026-88840; Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2531354).

Out-of-bounds write in BusyBox's passwd and group applets allows an authenticated attacker with high privileges (PR:H) to corrupt heap memory via a stale endpoint pointer after field trimming. The vulnerability (CVSS 6.7, CWE-787) is local-only (AV:L), requires no user interaction (UI:N), and is confined to the host (S:U), meaning a would-be attacker must already hold root or equivalent privileges to supply the malformed passwd/group entry. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was provided; the primary limiting factor is the PR:H requirement, which makes this a defense-in-depth hardening issue rather than a remotely reachable attack.

An out-of-bounds heap read in BusyBox's dpkg applet (read_package_field()) allows a local attacker who supplies a malformed .deb package to crash the dpkg process and potentially expose a small amount of heap memory, since the assessed vector rates availability impact as High and confidentiality impact as Low (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 6.1 Medium). Exploitation is constrained: it requires a BusyBox build with the dpkg applet compiled in (a non-default option in many minimal configurations, though it is present in the Red Hat Hardened Images builds tracked under the associated CPE) and requires the victim or an automated pipeline to actively invoke BusyBox dpkg against the crafted package. No public exploit identified at time of analysis, and no EPSS data was provided for this CVE; Red Hat is tracking the defect for Red Hat Hardened Images.

Qt Quick's SVG path parsers (Context2D.path in Canvas/Context2D and the QML PathSvg.path element) perform an out-of-bounds read when processing crafted SVG path strings, which can crash or destabilize the hosting application. The issue is reachable only when a Qt Quick/QML application actually feeds attacker-controlled SVG path data into these APIs - applications that render only trusted, bundled SVG assets are not exposed - and the vendor's CVSS 4.0 vector rates it local with low privileges required and passive user interaction, while the independent assessment lands at CVSS 3.1 4.9-equivalent severity with no confidentiality or integrity impact and only limited availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis (exploit maturity Unreported), and a vendor patch is available.

Heap-based out-of-bounds write in Foxit PDF Editor/Reader allows attackers to corrupt memory when a victim opens a PDF containing a crafted WebP image, potentially leading to code execution or a crash. The flaw stems from improper handling of bitmap stride and target buffer formats (CWE-787) and requires user interaction to open the malicious file (CVSS 7.8, AV:L/PR:N/UI:R). No public exploit code or active exploitation has been identified at time of analysis.

Opening a specially crafted PDF in Foxit PDF Reader or Foxit PDF Editor can trigger an arithmetic underflow while the application parses an image soft-mask, leading to a heap-based out-of-bounds read that discloses limited memory contents and terminates the application in a crash. The attack is file-based and requires the victim to open the malicious document (AV:L, UI:R); no authentication is needed (PR:N), but there is no network-remote or automatic trigger, and the impact is capped at a crash plus limited information disclosure rather than code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuine but low-priority issue for most environments.

Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a crafted PDF contains image objects whose compression metadata is inconsistent with the actual image data, causing an undersized buffer and a crash during rendering. The flaw has a CVSS 3.1 base score of 6.1 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, meaning an unauthenticated local attacker must deliver a malicious PDF and convince a user to open it; the realistic outcome is application crash with possible minor memory disclosure, not remote code execution. No public exploit identified at time of analysis, and no active exploitation is reported in the provided data.

Heap-based out-of-bounds read in Foxit PDF Reader and Foxit PDF Editor is triggered when a user opens a crafted PDF containing a malformed image mask whose metadata is inconsistent with its actual pixel and alpha data, causing incorrect alpha-channel processing during rendering and resulting in an application crash with a limited read of adjacent heap memory. The issue is local and requires user interaction - the victim must open the file - with no authentication required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, score 6.1), and the impact ceiling is denial of service plus minor information exposure rather than code execution. No public exploit code or active exploitation has been identified at time of analysis, and the CVE is not listed in CISA KEV; CPE data marks both Foxit PDF Editor and Foxit PDF Reader as affected across all versions.

Heap-based out-of-bounds read in Foxit PDF Editor and Foxit PDF Reader can crash the application and may disclose limited heap memory contents when a user opens a crafted PDF containing embedded JavaScript that triggers an integer underflow during a wide-string deletion operation. Exploitation is local and requires user interaction: the victim must open the malicious PDF and JavaScript execution must be enabled, and the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) indicates no privileges are required but no remote network path. No public exploit identified at time of analysis; confidentiality impact is low and availability impact is high, making this a modest-severity issue that primarily causes denial of service.

Memory corruption and potential code execution in rsyslog's mmpstrucdata plugin allow remote attackers who can send crafted RFC5424 structured-data messages to a reachable syslog input to execute code with the privileges of the rsyslog process. The module is not enabled by default; exploitation requires that mmpstrucdata be explicitly loaded and referenced in a ruleset. No public exploit has been identified at time of analysis, and authentication requirements are not confirmed from available data.

Opening a specially crafted file in Adobe Bridge triggers an out-of-bounds read that leaks potentially sensitive contents of the application's process memory. The flaw is local in nature - an attacker must first deliver a malicious asset and convince a victim to open it in Bridge (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base score 5.5) - so there is no remote or server-side exposure and no authentication requirement. Impact is limited to information disclosure (confidentiality high, integrity and availability unaffected); no public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published advisory APSB26-148 covering the affected Bridge releases.

Out-of-bounds read in the Core Libraries of RTI Connext Professional allows a locally positioned attacker with low-level privileges on a host running the middleware to trigger an overread that can crash or destabilize the affected process, producing a denial-of-service condition. Affected builds span 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.x, 6.0.x, 5.3.x, 5.2.x and 5.0.0-5.1.x branches; systems already on the fixed builds are not exposed. The impact is availability-only with no confidentiality or integrity effect, and because the attack requires local access and valid credentials rather than network reachability, realistic exposure is limited to insider or already-foothold scenarios causing service disruption. No public exploit code and no confirmed active exploitation were identified at time of analysis.

An off-by-one error in the RTI Connext Professional Core Libraries (CWE-193) produces an out-of-bounds write that can overflow a buffer when a crafted DDS/RTPS message is parsed, affecting Connext Professional 7.4.0 up to (but not including) 7.7.0.1 and 7.0.0 up to (but not including) 7.3.1.6. Per the CVSS 4.0 vector the flaw is remotely reachable over the network with low complexity and requires no authentication and no user interaction, but impact is bounded: there is no confidentiality loss (VC:N) and only partial integrity and availability impact (VI:L/VA:L), giving a medium-severity 6.9 rather than a code-execution-class outcome. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; practical exposure is further limited because DDS middleware is normally deployed on segmented operational networks in robotics, autonomous systems, and aerospace/defense environments rather than being directly internet-facing.

Out-of-bounds reads in the Core Libraries of RTI Connext Professional can be triggered by local attackers who already hold low-privilege access to a host running the RTI Connext data bus, causing the middleware process to crash and disrupting availability. The flaw affects Connext Professional versions 7.4.0 through 7.7.0.0, 7.3.0 through 7.3.1.5, and 6.1.2.21 onward within the 6.1.* line, and stems from a combination of type confusion, a function called with an incorrect number of arguments, and resulting buffer over-reads in the Core Libraries. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and because exploitation requires local access plus valid low-privilege credentials while the sole impact is a process crash, the realistic priority is low-to-medium rather than matching the raw 6.8 CVSS 4.0 base score.

An out-of-bounds read combined with type confusion in the Core Libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, and 7.3.0 before 7.3.1.6) lets a local attacker with low privileges feed a crafted malformed data type or message that the library misinterprets, producing buffer overreads and a high-availability impact such as a crash of the affected process. The vendor's CVSS 4.0 vector (6.8, MEDIUM: AV:L/AC:L/AT:N/PR:L/UI:N, VC:N/VI:N/VA:H) describes a strictly availability-impacting flaw with no confidentiality or integrity compromise claimed, and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees. Exploitation requires local access to the host running the Core Libraries rather than remote reach into a DDS domain, and at time of analysis no public exploit code or confirmed active exploitation was identified.

The GNU C Library dynamic loader (ld.so) in glibc 2.14 through 2.44 mishandles DT_RPATH/DT_RUNPATH values that begin with the literal string $ORIGIN immediately followed by a NUL byte or a '/' character, producing a stack-based buffer overflow (CWE-121) when such a path is parsed in a setuid or setgid (AT_SECURE) program. A local attacker who can execute an affected privileged binary causes the loader to read past the end of the path buffer and write past the end of a stack-allocated internal buffer, resulting in a loader crash (denial of service) and limited disclosure of process memory, with a low CVSS 3.6 score reflecting the local, high-complexity, non-privilege-escalating nature of the flaw. There is no public exploit identified at time of analysis and no CISA KEV listing; exploitation requires local access (PR:L) plus the pre-existing, non-universal condition that a specially-linked setuid/setgid binary exists on the host and is executable by the attacker, which is why all signals converge on this being a LOW real-world priority despite the ubiquity of glibc.

Out-of-bounds read in radare2's Lua 5.3 bytecode function parser affects all versions prior to 6.2.0, allowing a crafted input file to push parser reads past the end of the allocated buffer. Exploitation is local and requires user interaction: an analyst must open or inspect an attacker-supplied Lua 5.3 bytecode file whose function-name string ends exactly at the input-buffer boundary, after which the parser reads two integers and three one-byte metadata fields beyond the allocation, producing invalid parser results or terminating the process. Per the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) there is no memory disclosure, no code execution, and no privilege escalation - the realistic outcome is a crash of the analyst's own radare2 instance - and there is no public exploit identified at time of analysis and no confirmed active exploitation. The flaw is fixed in radare2 6.2.0.

radare2 versions prior to 6.2.0 can leak uninitialized or adjacent heap memory into JSON output, and may crash the process, when an analyst runs the explicit pFB or pFBj print command over an attacker-supplied binary property list. The root cause is an under-allocated, non-NUL-terminated UTF-8 conversion buffer in the binary-plist Unicode parser (CWE-125, out-of-bounds read) that the JSON encoder then scans as a C string. All signals agree this is a low-priority local issue: the CVSS vector is AV:L/PR:N/UI:R with only low confidentiality and low availability impact, there is no network vector, no privilege gain, and no write or code-execution primitive; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Vendor-released fix: 6.2.0.

Opening a crafted Mach-O file in radare2 versions prior to 6.2.0 can trigger a heap out-of-bounds read in the LC_DATA_IN_CODE parser, potentially terminating the process. The flaw is only reachable when the non-default bin.verbose option is enabled and the crafted file declares an LC_DATA_IN_CODE datasize that is not a multiple of the data_in_code_entry structure size, causing the parser's final loop iteration to read past the allocated buffer. Impact is limited to a denial-of-service style crash (CVSS 2.5, AV:L/AC:H/PR:N/UI:R, availability-only); no attacker-observable memory disclosure has been demonstrated, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Opening a crafted ELF binary with radare2 or rabin2 before version 6.2.0 can drive a heap out-of-bounds read in the ELF parser and terminate the process, giving anyone who can supply the file to an analyst a local denial of service (CWE-125, CVSS 3.1 5.5, AV:L/AC:L/PR:N/UI:R, C:N/I:N/A:H). The trigger is a program-header count of 0xffff (ELF's PN_XNUM sentinel) paired with a small real count in shdr[0].sh_info: the parser allocates the program-header array using the resolved count while several consumers still iterate over the original 65535 value, reading past the allocation. Exploitation requires the user to open an untrusted binary, no public exploit code or confirmed in-the-wild activity has been reported, and memory disclosure or code execution has not been demonstrated, so the practical impact is a crash of the analysis process rather than a compromise.

Heap memory corruption and denial of service in radare2 versions prior to 6.2.0 occur when the CPython .pyc marshal parser processes a crafted bytecode file that declares a string length of 0xffffffff, wrapping the size-plus-one allocation to zero before attacker-controlled data and fill bytes are written past the heap buffer. Exploitation is local and requires user interaction - an analyst must open or inspect the malicious .pyc with r2 or rabin2 - and no privileges are needed per the CVSS vector (AV:L/PR:N/UI:R), with impact confined to corrupting or crashing the analysis process. Arbitrary code execution is possible in principle but has not been demonstrated, no public exploit code has been identified at time of analysis, and the 5.5 CVSS score reflects a genuinely low-priority issue for most environments. Only workflows that routinely open untrusted .pyc files (malware analysis, CTF, reverse-engineering) are realistically at risk.

A local out-of-bounds read in radare2 6.0 and earlier (fixed in 6.2.0) can crash or corrupt the analysis session when an analyst opens a crafted Mach-O binary containing Swift type or class metadata. The CVSS 3.1 score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), reflecting a 4-byte read immediately before the allocated field-metadata buffer that yields at most a process termination or incorrect metadata processing - no attacker-observable memory disclosure has been demonstrated, and the 'Information Disclosure' tag on this record is not substantiated by the advisory. Exploitation requires the victim to deliberately load an untrusted Mach-O file (user interaction), and there is no remote or unauthenticated path; no public exploit identified at time of analysis and the issue is not in CISA KEV.

An out-of-bounds read in LibreOffice's PICT image import path allows a crafted PICT image - one whose stored palette index exceeds the number of entries in its colour palette - to read memory past the end of the palette buffer, crashing the application and potentially disclosing a small amount of adjacent heap memory. Exploitation requires a victim to locally open a document or image that embeds the malicious PICT file; no authentication or non-default configuration is required because PICT import is a standard feature, and the assessed CVSS vector carries an Exploit Maturity of Proof-of-Concept (E:P), indicating proof-of-concept exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this as a moderate-severity, denial-of-service-oriented client-side memory-safety bug (CVSS 3.1 base 5.4-equivalent, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) rather than a high-priority remotely exploitable flaw.

Stack buffer overflow in LibreOffice's font subsetting path can crash the application and corrupt memory when a document containing an embedded CFF font is exported to PDF. The vulnerable routine converts CFF (Compact Font Format) glyphs to Type 1 operators during subsetting and writes them into a fixed-size stack buffer without verifying remaining capacity, so a glyph that emits many operators overflows the buffer (CWE-787). Exploitation is local and requires the victim to open an attacker-supplied document and trigger the subsetting code path (typically a PDF export); the CVSS v4.0 base score is 5.4 with PR:N and UI:P, and despite a proof-of-concept maturity rating (E:P) indicating publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV). The most likely outcome is an application crash (VA:H) with limited confidentiality and integrity impact; headless or server-side document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.

Stack-based out-of-bounds write in LibreOffice's CFF font hint parser allows an attacker to corrupt memory and crash the application when a victim opens a document that embeds a maliciously crafted font. Affected are LibreOffice versions before the fix that checks the hint count against the array's actual capacity; exploitation requires the victim to open the crafted file (local vector, user interaction) and no authentication, with confirmed impact limited to a crash plus limited confidentiality/integrity effects-reliable arbitrary code execution is not demonstrated. No CISA KEV listing indicates active exploitation, but the CVSS 4.0 exploit maturity metric E:P indicates publicly available exploit code exists, so patching should be prioritized for users who handle untrusted documents.

Heap buffer overflow in LibreOffice Draw's PDF import path allows a crafted PDF to corrupt heap memory and crash the application when a victim opens or imports the document; the independent assessment rates confidentiality and integrity impact as low but availability impact as high, making denial of service the most realistic outcome. Exploitation requires local delivery and mandatory user interaction, and no authentication or non-default configuration is needed because PDF import is a standard feature. Publicly available exploit code exists per the CVSS 4.0 E:P metric, but there is no confirmed active exploitation (no CISA KEV entry); no EPSS score was provided.

Heap-based buffer overflow in LibreOffice's PDF import filter, reachable through LibreOffice Draw, can crash the application or corrupt heap memory when a victim opens a specially crafted encrypted PDF whose encryption dictionary declares a decryption-key length larger than the fixed-size key buffer the importer fills. Exploitation is local and requires user interaction (AV:L, UI:P/UI:R, PR:N per the CVSS 4.0 vector; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), so there is no remote or unauthenticated network trigger and only encrypted PDFs reach the flawed code path; the impact skews heavily toward availability (VA:H) with limited confidentiality and integrity effects. There is no CISA KEV listing indicating confirmed active exploitation, but the supplied CVSS 4.0 vector carries an exploit-maturity metric of E:P, meaning publicly available exploit code exists at proof-of-concept level. This is a moderate-priority memory-corruption bug, not an urgent one, because delivery requires convincing a user to open a malicious encrypted file locally.

Heap buffer overflow in LibreOffice's WMF graphics import path affects documents embedding a crafted Windows Metafile, allowing a local attacker to corrupt memory when the victim opens the file. The flaw arises in a text record that carries its own character advance widths, where the count of advance values and the text length are read independently and need not agree, so rendering walks the advance array past its end when the array is shorter than the text. No public exploit code has been identified at time of analysis, and the impact profile is crash-dominant (confidentiality and integrity Low, availability High), making realistic outcomes denial of service rather than reliable code execution. EPSS is not provided, but exploitation requires the victim to open a malicious document (AV:L, UI:P), so real-world priority is assessed as low despite the MEDIUM CVSS of 5.4.

Memory corruption in the Primary Bootloader (PBL) of Qualcomm Snapdragon chipsets lets an attacker who has physical possession of a device feed a crafted ELF file during the early boot sequence and corrupt bootloader memory, with the scope change indicating a possible escape from the normal boot context into the secure/TrustZone world. Exploitation is highly constrained: CVSS 3.1 scores it 6.9 under a vector of AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning physical access, low-level privileges, high attack complexity (specific timing or hardware state) and user interaction are all required; the practical exposure is limited to lost or stolen devices, supply-chain interdiction, or forensic scenarios rather than remote or default network-reachable attacks. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); Qualcomm has published a security bulletin (May 2026) covering the issue.

Out-of-bounds read in the XS encoder of Perl's Net::IDN::Punycode (all versions before 2.590) lets a remote attacker who can influence a string passed to encode_punycode push a single byte from outside the module's 36-entry punycode digit table into the encoded result, or crash the calling process. The flaw is a signed-integer overflow of the punycode delta accumulator in the compiled XS backend; the pure-Perl PP backend is not affected, so exposure is limited to applications that have the XS module installed and feed it attacker-controlled labels, such as IDN/domain-to-ASCII conversion pipelines. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), impact is bounded to a one-byte information leak or a denial-of-service crash with no code execution or integrity impact, and no public exploit code has been identified at time of analysis; the vendor has shipped a fix in 2.590.

Integer overflow in MPack 1.1.1's mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc() helpers causes the allocation size computation (node.data->len + 1) to wrap to zero when a parsed MessagePack node advertises a length of SIZE_MAX, yielding an undersized buffer allocation and, in the officially scored path, a denial-of-service/crash. Exploitation requires the consuming application to use MPack's node/tree reader API and to call one of these helpers on a node whose length is attacker-controlled; it is realistically reachable on 32-bit platforms where SIZE_MAX equals UINT32_MAX (~4 GB) and generally infeasible on 64-bit platforms. The assessed vector is local (AV:L) with high attack complexity (AC:H) and no authentication or user interaction requirement (PR:N/UI:N), so remote reachability depends entirely on whether the host application exposes the parser to untrusted network input; there is no public exploit identified at time of analysis and EPSS is low at 0.20% (10th percentile).

Authenticated denial of service in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a user with query access to crash the database process by submitting a crafted graph query that reaches the aggregation code path handling GROUP operations. The flaw is a stack overflow in the _GetGroup() function in /ops/op_aggregate.c, scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning low-complexity remote exploitation but requiring prior authentication (PR:L), with impact limited to availability and no confirmed data exposure or code execution. There is no public exploit identified at time of analysis and no confirmed vendor patch version in the provided references, so exposure is bounded by who can reach the query interface and by the narrow 4.20.1-4.20.4 version window.

Denial of service in the Zephyr ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) lets a Wi-Fi-adjacent, unauthenticated attacker fault the device or permanently stop Wi-Fi reception in Zephyr builds (assessed range 4.2.0 through 4.4.1) that run an ESP co-processor over SPI with CONFIG_NANOPB_ENABLE_MALLOC selected. The driver takes a 16-bit TLV data_length straight off the wire and passes it to pb_istream_from_buffer() without validating it against the frame length, so pb_decode() can read roughly 62 KB past a 3188-byte stack object (CWE-125); the underlying half-duplex SPI aliasing bug lets the attacker steer the parser onto misaligned protobuf continuation bytes by getting the first fragment of a fragmented control response dropped mid-transmit, and the AP scan list the attacker can grow is the most convenient lever. Impact is limited to availability (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.3) with no disclosure or code execution; the high attack complexity reflects the timing race, no public exploit code identified at time of analysis, and the vendor has published a fix.

A stack buffer overflow in libstoragemgmt's SCSI VPD page 0x80 serial-number parser lets an attacker who controls a local or virtual storage device crash or destabilize the host process that enumerates that device, yielding a denial of service with no confidentiality or integrity impact (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5). Exploitation requires low privileges on the host (PR:L, so an authenticated/local actor) plus the ability to attach or present a device, and it only triggers when the affected process actually queries the device's serial number - the vector is local, not remotely reachable over a network. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); the practical risk is concentrated in environments that enumerate untrusted or attacker-attachable storage, such as multi-tenant virtualization or hosts that accept hostile removable, iSCSI, or hypervisor-presented disks.

Isochronous OUT stream handling in usbredir can leave a stream's single transfer buffer permanently unsubmitted when a transfer count of 1 is used, which defeats the bounds check in usbredirhost_iso_packet() and lets a usbredir peer write beyond the end of the packet descriptor array on every subsequent isochronous packet. The flaw is an out-of-bounds write (CWE-787) affecting usbredir as shipped in Red Hat Enterprise Linux 6 through 10, and the published CVSS:3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H, score 4.1) reflects a local, high-complexity, privileged trigger path whose dominant impact is availability loss rather than code execution. No public exploit identified at time of analysis, and the bug is not listed as confirmed actively exploited (CISA KEV); the realistic risk is materially lower than the raw memory-corruption classification suggests.

An out-of-bounds write of up to 895 bytes into static (.bss) memory can be triggered in Zephyr RTOS's Intel SEDI IPM driver (drivers/ipm/ipm_sedi.c) when the peer processor sets a doorbell payload length larger than the 128-byte incoming_data_buf. The vulnerable path is reachable when an application has registered an IPM receive callback via ipm_register_callback(), the driver's normal mode of use, and requires a local, highly privileged attacker (CVSS PR:H) with host-side ISH driver-level or raw BAR access to the device's memory-mapped register window, plus a production image built without CONFIG_DEBUG so the HAL's DBG_CHECK length guard is compiled away. The result is kernel data-structure corruption and a crash primitive - the overflow clobbers the driver context's k_sem and k_mutex and adjacent static data - but the flaw is platform-specific and locally scoped, so it is a moderate, defense-in-depth-relevant issue rather than an urgent internet-facing emergency; no public exploit identified at time of analysis, and an upstream fix commit is available.

Stack-based buffer overflow in fetchmail when built with NTLM support allows a malicious or compromised mail server to trigger memory corruption by sending a crafted NTLM Type 2 challenge, potentially leading to remote code execution, authentication failure, or process termination. Exploitation requires fetchmail to be built with NTLM and configured to authenticate via NTLM against an attacker-controlled or man-in-the-middle'd server; no public exploit code or active exploitation has been identified. The flaw carries a CVSS score of 8.1 with high confidentiality, integrity, and availability impact, though reliable RCE is limited by stack-frame layout and modern memory hardening (stack canaries, ASLR, FORTIFY_SOURCE) on RHEL builds.

Heap-based buffer overflow in Kamailio's CDP (C Diameter Peer) module allows a remote party that can deliver a malformed Diameter message to a peer socket to corrupt shared-memory (shm) heap state and potentially disrupt or compromise the process. Affected builds are Kamailio up to 5.8.8, 6.0.7, 6.1.4 and 6.2.0-dev1 that actually load the cdp module; SIP-only deployments are not exposed. Publicly available exploit code exists (referenced from a public GitHub issue, with the fix in PR 4877), and while the vendor's CVSS 4.0 base score is 5.5, an independent assessment scores it CVSS:3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), reflecting full availability impact on the affected process; no confirmed active exploitation (CISA KEV) was identified at time of analysis.

Out-of-bounds bad_words token indices in vLLM through 0.29.0 are not validated against the model's generation output width, allowing the indices to be written past the logits buffer and corrupt the sampling state of concurrently batched requests, so unrelated in-flight HTTP requests can receive incorrect output tokens. Exploitation requires API access sufficient to submit sampling requests with a bad_words parameter (authenticated, PR:L), a target model whose tokenizer exposes input-only placeholder tokens with IDs above the model's logits vocabulary (typically multimodal models such as those with <|audio|> tokens), and concurrent requests sharing the batch, so a text-only model whose tokenizer vocabulary equals its output vocabulary is not affected. No public exploit code has been identified at time of analysis and there is no KEV listing; the issue is a low-severity integrity/quality-of-output defect rather than a confidentiality or availability compromise, and an upstream fix is available as a pull request.

An out-of-bounds write in Exim versions before 4.100.1 occurs when the MTA is built and configured to use Proxy-Protocol (the hosts_proxy option) and accepts a PROXY header from an attacker-controlled or spoofed proxy, allowing remote memory corruption (CWE-787) with high integrity impact and low confidentiality/availability impact. The flaw is remotely reachable but unauthenticated only in the sense that no credentials are needed (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, vendor score 7.0); the high attack complexity reflects that Proxy-Protocol is off by default and the attacker must be positioned on, or able to spoof, the trusted-proxy path in front of Exim. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided; a fixed release, Exim 4.100.1, exists and is the primary remedy.

Denial of service in Vinyl Cache releases before 9.0.2 (and in the related Varnish Cache lineage, per the affected CPEs): when the deployed VCL calls the .upper() or .lower() string methods on an attacker-influenced value, a carefully sized request string can overrun the remaining worker-thread workspace at that call site, causing the child process to segfault or trip an assertion and then restart. Reachability is gated by a non-default prerequisite - the VCL must actually apply these methods to request-derived data - and the attacker must know that VCL logic well enough to size the string to land in the narrow window between filling the remaining workspace and the http_req_size / http_req_hdr_len request limits, so this is a deliberately low-priority memory-corruption issue rather than a general-purpose remote attack. No public exploit code has been identified at time of analysis, and the impact is a transient, self-healing outage rather than a persistent one, with no effect on confidentiality or integrity.

Heap buffer overflow in Suricata 8.0.0 through 8.0.5 lets a user who can supply or modify a local detection rule crash the engine by loading a ruleset that pairs frame inspection without a content keyword with a transformed match that also lacks content. The flaw is reached during signature preparation in src/detect-engine-prefilter.c and fires even in config-test mode (suricata -T), so no live traffic is required, but it is strictly local, requires rule-loading privilege, and results only in a denial-of-service crash rather than code execution. This is a low-severity issue: the assessed CVSS vector is AV:L/PR:L with A:L impact only, there is no public exploit identified at time of analysis, and Suricata 8.0.6 plus the entire 7.x line are not affected.

Out-of-bounds writes in the Triton bincount sampling kernel of vLLM through 0.29.0 let unauthenticated remote clients corrupt a neighboring request's repetition-penalty state by submitting multimodal audio input that contains a token ID equal to the model's vocabulary size. The root cause is an unvalidated array index (CWE-129): prompt and output token IDs are used to index the penalty prompt-presence bitset and output bin counts without any bounds check against vocab_size, so a one-past-the-end token spills into the adjacent request's mask/count rows. Impact is integrity-only and confined to altered repetition-penalty behavior for concurrently served requests - there is no code execution, data disclosure, or denial of service - and exploitation requires a CUDA GPU with compute capability >= 8.0, a multimodal model accepting audio tokens, and concurrent traffic in a shared, multi-tenant deployment; no public exploit code and no confirmed active exploitation have been identified at time of analysis.

An out-of-bounds write in osmo-ggsn 1.14.0 allows a remote, unauthenticated sender of GTP signalling to corrupt process memory by delivering a PDP context whose GSN-Address sub-field is malformed; the decoder writes length-driven data without adequately bounding it to the destination buffer. The practical impact is availability-oriented - the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) indicates a low-complexity remote trigger that can crash or destabilise the GGSN, with a limited integrity effect, rather than a confirmed confidentiality breach. No public exploit code identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC records Exploitation as 'none', though Automatable is 'yes'. Vendor/reference commit-level fix code is available upstream.

Heap-based out-of-bounds write in the PJSIP pjmedia AVI player (pjproject 2.17 and earlier) lets a crafted AVI file overwrite memory beyond a frame buffer when an application plays the file or pulls its frames. The buffer capacity is derived from the video dimensions declared in the file, while the copy length is taken from the file's own chunk header, so a malicious header produces an attacker-controlled write; the protection that would normally catch this is a pj_assert() that is compiled out of production release builds. The issue is local and file-driven, requiring the victim to open the media (CVSS v3.1 AV:L/UI:R, PR:N per the assessed vector), with crash-level impact for ordinary local playback and full memory corruption for applications that ingest untrusted AVI from relays, transcoders or user uploads; no public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no fixed release version is available as of this review.

An integer-wraparound in Cockpit's do_lastlog() login-accounting routine on ILP32 (32-bit) builds allows a low-privileged but authenticated local user holding an administrator-provisioned abnormally large UID to read and modify other users' lastlog records, producing low confidentiality and low integrity impact (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a 32-bit build, a deliberately created large-UID account, and local access to the host; 64-bit LP64 builds do not overflow and are unaffected, and no public exploit code has been identified at time of analysis.

Heap out-of-bounds read in libheif prior to 1.23.2 lets an application that builds inline-mask region metadata through the library's writer API leak adjacent heap memory or crash. Specifically, heif_region_item_add_region_inline_mask_data() stored a caller-supplied mask buffer without verifying that mask_data_len equals ceil(width*height/8); a later heif_region_get_mask_image() render derives the number of bytes to read from the region geometry, so an undersized buffer causes the reader to copy bytes past the end of the allocation into the returned monochrome mask image. The file-parsing/decode path validates the canonical mask size and is explicitly not vulnerable, so merely opening a crafted HEIF/AVIF file does not trigger the bug; exploitation requires a local program in which attacker-influenced geometry and mask data disagree, consistent with the assessed vector AV:L/AC:H/PR:N/UI:N (CVSS 4.0). There is no confirmed active exploitation (no CISA KEV listing), and no public exploit code was identified at time of analysis; the issue is a genuine but low-priority memory-safety defect rather than an emergency, and version 1.23.2 fixes it.

Denial of service in OpenImageIO versions prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1 occurs when the library processes a truncated TGA file while writing GIF output, triggering a signed 32-bit integer overflow in GifSplitPalette() that leads to an out-of-bounds read (CWE-125) and a process crash. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates the attacker is unauthenticated (PR:N) but requires local access and user interaction, with no remote or unauthenticated network trigger. No public exploit code or active exploitation has been identified; this is a low-priority hardening issue for workflows that transcode untrusted images to GIF.

Denial of service in OpenImageIO's PSD reader allows a crafted PSD file carrying an invalid color_mode value to index beyond the fixed color-mode tables, producing a global out-of-bounds read and potentially a bogus allocation that crashes the reading process. The exposure is narrow: the raw path is only reachable when the non-default oiio:RawColor or psd:RawData option is explicitly enabled, and an attacker must get a target application or automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5, CWE-125), so impact is availability-only with no confidentiality or integrity effect. No public exploit has been identified at time of analysis, and vendor-released fixes exist in 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.

A heap out-of-bounds read in the OpenImageIO PSD reader can crash any application that processes a crafted indexed Photoshop (PSD) file while the non-default oiio:rawcolor or psd:rawdata option is enabled. The flaw affects OpenImageIO builds prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, where a PSD whose transparency metadata yields fewer stored channel buffers than the advertised channel count causes PSDInput::interleave_row() to read past the end of channel_buffers. Exploitation is local with required user interaction (the victim must supply or open the malicious file), the vulnerable rawcolor/rawdata path is not the default configuration, and impact is limited to a denial-of-service crash of the processing process, with no code execution or data disclosure reported; no public exploit has been identified at time of analysis, and CVSS 5.5 (A:H, C:N/I:N) reflects the availability-only, non-default-path nature of the issue.

Stack-based buffer overflow in OpenImageIO's Cineon image reader (CineonInput::open()) lets a crafted .cin file that declares more than the format's maximum of eight channels overwrite stack pointers and corrupt adjacent memory, crashing the application that processes it. Exploitation requires the victim or an automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, 6.1), so it cannot be triggered remotely without inducing file ingestion; the assessed impact is denial of service with only low integrity risk and no confidentiality loss. No public exploit identified at time of analysis and the issue is not in CISA KEV; vendor fixes shipped in OpenImageIO 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.

Heap out-of-bounds read in OpenImageIO's IFF image reader (src/iff.imageio/iffinput.cpp, IffInput::readimg()) affects all releases prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, allowing a caller that opens a crafted uncompressed 16-bit IFF file containing a z-buffer channel to trigger a crash or leak adjacent heap contents into the decoded image output. The flaw is an allocation/stride mismatch: the temporary scanline buffer is sized from m_header.rgba_count while the subsequent memcpy uses m_header.pixel_bytes(), whose stride also counts z-buffer bytes, producing an oversized copy. Exploitation requires local, user-initiated parsing of the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 6.1) with no privileges needed but no remote zero-interaction path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV data were not provided. Vendor-released patches exist in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.

An out-of-bounds read in Zephyr RTOS's gPTP (IEEE 802.1AS) announce-qualification routine lets an unauthenticated attacker with layer-2 adjacency to a vulnerable device send a single crafted Announce frame that drives the stack about 2 KB past the end of the received network buffer, potentially faulting the networking RX thread and causing a denial of service. The flaw affects only builds that enable the opt-in, experimental CONFIG_NET_GPTP option used in TSN/AVB deployments (Zephyr 1.13.0 up to before 4.4.2 per EUVD); default configurations are not vulnerable, and because gPTP frames go to a non-routed link-local multicast address, internet or routed exploitation is not possible. The impact is bounded by the assessed CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and no public exploit has been identified at time of analysis.

An out-of-bounds read in the Zephyr RTOS gPTP (IEEE 802.1AS) Ethernet layer lets an attacker on the same link crash-free but silently expose memory contents: a truncated Ethernet frame with ethertype 0x88F7 and fewer than 34 bytes of payload is accepted by gptp_handle_msg(), which dereferences a gPTP header pointer that extends past the received data and then retains the short packet for later state-machine parsing. Affected are Zephyr releases from 1.13.0 up to (but not including) 4.4.2 built with CONFIG_NET_GPTP on an interface configured as a gPTP port; no authentication or user interaction is required (PR:N/UI:N), though exploitation is limited by the adjacent-only vector and the requirement for a link that can deliver sub-minimum frames (for example the native_sim TAP driver or a MAC that accepts undersized frames). The impact is read-only and low (CVSS 3.1 base 3.1, C:L/I:N/A:N): under the default fixed-size buffer allocator only stale recycled buffer contents within the 128-byte fragment are disclosed, while a genuine out-of-bounds read requires the experimental CONFIG_NET_BUF_VARIABLE_DATA_SIZE allocator. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; an upstream fix commit and vendor advisory are available.

Integer overflow in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service condition against affected NAS appliances. Only systems running DSM versions prior to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 are affected; the vulnerability requires a valid DSM account with rights to invoke File Operation, matching the CVSS vector's PR:L (authenticated) rating. Impact is confined to low availability loss with no confidentiality or integrity effect, no public exploit code has been identified at time of analysis, and EPSS/KEV data do not indicate active exploitation, making this a low-priority issue despite the network attack vector.

An out-of-bounds read in GPAC's RTP depacketizer lets unauthenticated remote attackers crash or partially disclose memory by delivering a crafted 3GPP timed-text (TTXT) RTP payload with an oversized advertised length. The flaw lives in gf_rtp_parse_ttxt() in src/ietf/rtp_depacketizer.c and affects GPAC 26.08-DEV and earlier builds prior to abi-16.26; exploitation requires the target to be acting as an RTP receiver/depacketizer rather than simply parsing a local file. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), so this is a genuine but moderate-severity memory-safety defect whose practical reach depends on GPAC being deployed in an RTP-consuming configuration.

Integer overflow in the JBIG2 code-table parser (JBIG2Stream::readCodeTableSeg) of Freedesktop Poppler 26.07.0 allows a remote attacker to crash or destabilize the rendering process by supplying a crafted PDF that embeds a malicious JBIG2 image stream. The flaw is reachable without authentication, but requires the victim to open the document or have a batch tool such as pdftoppm or pdfimages process it, and the independent assessment limits realistic impact to denial of service (integrity and confidentiality are unaffected). Publicly available exploit code exists (a write-up and PoC linked from the CVE references), and the CISA KEV catalog does not list this CVE, so it is a low-to-moderate, non-urgent memory-safety issue rather than a confirmed actively exploited threat.

Integer overflow in Freedesktop Poppler 26.07.0's SampledFunction::SampledFunction (poppler/Function.cc) allows unauthenticated remote attackers to crash PDF-rendering applications by supplying a crafted PDF with an oversized BitsPerSample value, resulting in an availability-only denial of service. Exploitation requires a victim to open or render the malicious file (UI:P/UI:R), and publicly available exploit code exists; the issue is not confirmed as actively exploited in CISA KEV. With a CVSS 4.0 base score of 2.1 and an independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, the risk is low and confined to availability with no demonstrated confidentiality or integrity impact.

Heap memory corruption in snappy-java 1.1.10.8 and earlier allows remote attackers to write attacker-influenced bytes past the bounds of the output array when an application decompresses untrusted compressed data through the typed Snappy.uncompress*Array APIs (such as uncompressIntArray, uncompressFloatArray, or uncompressDoubleArray), which size their result array using the uncompressed length divided by element size while forwarding the undivided length to the native JNI layer. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:L) no authentication or user interaction is needed, but exploitation is conditional: the consuming application must expose the typed decompression path to attacker-controlled input, and applications that only use the generic byte[] uncompress path are not exposed. Impact is currently rated Low integrity and Low availability (heap corruption and crash) with no confirmed confidentiality loss or demonstrated code execution, and no public exploit was identified at time of analysis; this is a genuine memory-corruption flaw but a moderate, not top-tier, priority, and no vendor-released fixed version is identified in the available data.

An out-of-bounds read in the Perl Imager image module (versions 0.45_02 through 1.034, including the 1.033/1.034 development releases) lets a crafted TIFF/EXIF file cause tiff_load_ifd() to accept an IFD entry whose start offset lies outside the EXIF block, so EXIF tags returned to the caller can contain bytes read from adjacent memory or the process can crash. Any application or service that calls Imager->read() on an attacker-supplied image is affected; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per independent assessment), though real exposure depends on whether the deployment actually parses untrusted images and on the target platform's integer widths. There is no public exploit identified at time of analysis and EPSS is low at 0.18% (7th percentile), but a fixed release (Imager 1.035) and upstream commits are available, so patching is straightforward and low-risk.

Heap out-of-bounds read in the PoDoFo C++ PDF library (versions 1.0.0 through 1.1.0) lets a crafted PDF containing an Indexed color-space image cause the library to read past the end of its palette lookup buffer. An attacker must convince a victim to hand the malicious PDF to an application built on the affected library and have that application decode or render the embedded Indexed image; no authentication is required (CVSS 4.0 vector PR:N, AV:L, UI:P), and the practical impact is dominated by a process crash leading to denial of service, with only adjacent heap bytes potentially disclosed rather than targeted secret exfiltration. Exploitation yields a limited confidentiality gain and a high availability impact; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. The flaw is fixed in PoDoFo 1.1.1.

An out-of-bounds read in OpenImageIO's BMP reader allows a crafted palette BMP to crash any process that decodes it, causing denial of service. Affected are versions prior to 3.0.16.0 and 3.1.11.0: a malformed file whose DIB header sets the palette flag but supplies an empty color table, combined with RLE4 or RLE8 compression, drives BmpInput::read_native_scanline into an invalid palette lookup. Exploitation requires the victim to process the attacker-supplied image (for example via oiiotool or an application linked against OpenImageIO), making the realistic risk concentrated in automated or batch image-ingestion pipelines; no public exploit identified at time of analysis, and CISA KEV does not list this issue.

Memory disclosure in Google Chrome prior to 153.0.8010.52 allows a local attacker to read out-of-bounds data through the browser's DataTransfer implementation, with the sandbox-crossing scope change (S:C) in the CVSS vector indicating the leaked memory can originate outside the renderer process rather than from within the attacker's own context. Per the assessed vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, base 6.3) exploitation requires the attacker to already be running a local program on the victim's machine and to use social engineering to obtain user interaction, and it produces only confidentiality impact with no integrity or availability effect, so this is an information-disclosure bug rather than a sandbox escape or code-execution primitive. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (it is not in CISA KEV); Google has shipped version 153.0.8010.52, which resolves the flaw.

Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. No public exploit code or active exploitation (CISA KEV) was identified in the provided intelligence.

Denial of service in rabbitmq-c (librabbitmq) versions prior to 0.16.0 lets an attacker-controlled or on-path AMQP server crash a connecting client during the login handshake by sending an undersized HEADER or METHOD frame. The malformed frame triggers an unsigned size_t underflow in the frame parser that defeats downstream bounds checks and causes an out-of-bounds read, terminating the client process. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) the impact is purely availability, requiring the victim to initiate a connection (UI:R); no public exploit identified at time of analysis, and TLS with proper certificate validation neutralizes the on-path variant.