Buffer Overflow

A stack-based buffer overflow in the web service upload-handling code of Siemens APOGEE and TALON building-automation controllers allows an unauthenticated remote attacker to crash the device, producing a denial-of-service condition. Affected platforms include APOGEE PXC Compact and PXC Modular (BACnet all versions before V3.5.7, P2 Ethernet all versions before V2.8.21), TALON TC Compact and TC Modular (BACnet all versions before V3.5.7), and the APOGEE MBC/MEC (PPC) variants in BACnet and P2 Ethernet builds, which are listed as affected in all versions. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but exploitation is trivial from a network standpoint - the CVSS vector confirms PR:N/UI:N with low attack complexity - so any controller whose HTTP upload interface is reachable is at risk. Siemens rates this CVSS 4.0 8.7; our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Denial of service in the embedded web service of Siemens APOGEE MBC/MEC (PPC), APOGEE PXC Compact/Modular, and TALON TC building-automation controllers, caused by improper validation of multipart input that can crash the service via a stack buffer overflow (CWE-121). An unauthenticated remote attacker with network reachability to the controller's HTTP interface (CVSS PR:N/UI:N) can send a crafted multipart request and take the web service down; the assessed impact is availability-only (C:N/I:N/A:H), with no confidentiality or integrity loss demonstrated. Exploitation is bounded by exposure: these are OT field panels normally expected on segmented building networks, and no public exploit code has been identified at time of analysis - this is a credible OT risk for internet- or IT-reachable controllers, not a confirmed widespread-exploitation emergency. All-version APOGEE MBC/MEC (PPC) models carry the highest residual risk because no fixed version is listed for them, whereas APOGEE PXC Compact/Modular (BACnet) and TALON TC are fixed at V3.5.7 and the P2 Ethernet PXC Compacts at V2.8.21.

Unauthenticated remote attackers can cause a denial of service on Siemens APOGEE MBC/MEC, PXC, and TALON building automation controllers by sending a crafted input that triggers a stack-based buffer overflow (CWE-121) in the device's FTP service. The flaw affects all versions of the MBC and MEC PPC families and PXC/TALON TC models below BACnet V3.5.7 or P2 Ethernet V2.8.21. No public exploit code or confirmed active exploitation has been identified, and the impact is limited to availability (no confidentiality or integrity impact); real-world risk hinges on whether the FTP service is enabled and reachable from an attacker's position on the OT network.

Stack-based buffer overflow in the Wavlink WL-WN530BE1-A router (firmware build 251117) allows remote compromise of the device through its web management interface. An unauthenticated attacker who can reach the device's HTTP server can send a crafted request to /cgi-bin/ExportAllSettings.cgi with an oversized attacker-controlled HTTP_COOKIE / X-Cmd value, overwriting stack memory and potentially achieving code execution with full confidentiality, integrity, and availability impact. The issue is rated 9.3 under CVSS 4.0 and maps to an authoritative assessed CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; publicly available exploit code exists (no CISA KEV listing at time of analysis), and EPSS-style probability data was not provided, so risk is driven primarily by the unauthenticated, trivially reachable attack surface of the exposed CGI endpoint.

Opening a crafted S-102 bathymetric surface HDF5 file in OpenS100 through commit daaa35b can trigger a 32-bit integer overflow that under-allocates a heap buffer and lets attacker-controlled data be written out of bounds, resulting in an application crash or potential arbitrary code execution. The flaw lives in S102_VG_BathymetryCoverage::Read(), where the product of the numPointsLatitudinal and numPointsLongitudinal grid dimensions wraps around before the buffer size is computed. Exploitation is unauthenticated (PR:N) but constrained: no network-reachable path exists (local vector) and the victim must actively open a malicious file, and while publicly available exploit code exists, EPSS is low at roughly 0.20% (10th percentile), the issue is not in CISA KEV, and the overall signal is a real but low-priority issue rather than an urgent threat.

Denial of service is possible in libwebsockets because the LEJP JSON parser's pre-patch bounds checks in lib/misc/lejp.c permit a one-past-the-end write into the fixed-size ctx->i[] and ctx->st[] arrays when deeply nested JSON is parsed. The flaw is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but the affected target is the main-branch commit 106d542c rather than a confirmed released version, and exploitability depends entirely on whether the host application routes attacker-controlled JSON into lejp_parse(); impact is limited to availability (a crash), with no code execution or data disclosure indicated. EPSS is 0.29% (20th percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis, although upstream fixes exist in commits 736a4a2 and c404a20.

An off-by-one heap buffer overflow in libconfini 1.16.4's bundled example utility load_ini_buffer (examples/utilities/load_ini_buffer.h) can crash the process that embeds it, producing a denial of service. The flaw is only reachable when consuming software actually compiles and feeds attacker-influenced input to that example utility; it is not reachable through the core libconfini parsing API alone, and impact is availability-only with no code execution or data disclosure indicated. Exploitation requires an unauthenticated network-reachable path into the affected utility (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L per independent assessment, versus the submitter's N/A:H rating), and no public exploit has been identified; EPSS is 0.29% (20th percentile), consistent with a low-to-moderate real-world priority.

Out-of-bounds access in libwebsockets' LEJP incremental JSON parser allows unauthenticated remote attackers to crash the process via crafted JSON that exceeds the parser's fixed-size path index or stack arrays. Affected are applications that call lejp_parse on untrusted input; publicly available exploit code exists, though exploitation is deployment-dependent and impact is limited to denial of service (no code execution or data disclosure). The root cause is an off-by-one error in lib/misc/lejp.c, where boundary checks are performed after incrementing the index.

Out-of-bounds reads in the IBM i File Server allow a remote authenticated attacker to crash or disrupt the service while also leaking portions of adjacent memory, affecting IBM i releases 7.3, 7.4, 7.5 and 7.6. Exploitation is not unauthenticated: the CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that valid low-privilege credentials and network reachability to the File Server are both required, with high confidentiality and availability impact but no integrity impact, and no user interaction. No public exploit code has been identified at time of analysis, EPSS is low at 0.41% (33rd percentile), CISA SSVC rates exploitation as none and the issue as not automatable, and a vendor patch is available, so this is a moderate-priority patching item rather than an emergency.

Authenticated remote code execution in IBM Planning Analytics 2.0 and 2.1 stems from a stack-based buffer overflow (CWE-121) that allows a remote attacker holding valid low-privilege credentials to corrupt stack memory and execute arbitrary code. IBM assigns a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), and the independent assessment raises the availability impact to High, indicating a successful exploit may also crash or destabilize the affected service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor patches are available via IBM support node 7291604.

Memory corruption in IBM Power Systems host firmware FW1060.00 through FW1060.81 lets an attacker who already holds authenticated, high-privileged service-level access to the Flexible Service Processor (FSP) write crafted configuration data that corrupts the host firmware boot stack during system IPL, with the compromise then propagating to the hypervisor loaded by that firmware and to the managed system. Because the flaw is reachable only from the local FSP interface (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) and only fires on a (re)boot cycle rather than at runtime, the practical attack path is an insider or compromised FSP service account on the management plane rather than a remote network attacker, and no public exploit identified at time of analysis and no CISA KEV listing is associated with this CVE. Full confidentiality, integrity, and availability impact is scored against the managed system, with a scope change reflecting that the corruption begins in host firmware but affects the separately-managed hypervisor.

Authenticated attackers holding service-level credentials on the Flexible Service Processor (FSP) can read or modify arbitrary regions of Hostboot memory on IBM Power Systems firmware levels FW1060.00 through FW1060.81 by sending a specially crafted message over the service processor mailbox interface, corrupting the host firmware boot stack and the hypervisor it subsequently loads. The flaw is rated CVSS 8.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), with the scope-change rating reflecting that the FSP compromise crosses a boundary into host firmware and produces high confidentiality, integrity, and availability impact on the managed system. Exploitation is gated behind high-privilege service-processor access rather than network reach to the managed OS, and no public exploit code has been identified at time of analysis; no EPSS score was supplied, so it could not be factored into the risk picture.

Local code execution in IBM Power Systems firmware (FW1060.00 through FW1060.81) lets an attacker who already holds authenticated service-level access to the Flexible Service Processor (FSP) send a crafted service processor mailbox message that overflows host firmware runtime attribute storage, compromising the managed system's memory and hardware interfaces. The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (base 8.2) is internally consistent with that description: the flaw is local, requires high-privilege service-plane credentials, needs no user interaction, and its scope change reflects a jump across the trust boundary from the service processor into the host firmware runtime with high confidentiality, integrity and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; IBM published the vendor advisory at https://www.ibm.com/support/pages/node/7290126.

Arbitrary code execution on the host system is possible in IBM Power Systems firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81, due to a stack-based buffer overflow (CWE-121) in the host firmware boot process image validation path. An attacker with high-privileged service access to the service processor (PR:H, AV:L) can supply a maliciously crafted code update image to execute arbitrary code on the host system, resulting in full confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.2, High). No public exploit has been identified at time of analysis, and exploitation requires local/service-level access and high privileges, substantially limiting real-world risk.

Arbitrary code execution in the host firmware runtime of IBM Power Systems is possible via the service processor mailbox interface, affecting firmware levels FW1060.00 through FW1060.81. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can send a crafted mailbox message that overflows host firmware runtime attribute storage (CWE-121), gaining full access to the managed system's memory and hardware interfaces. This is a high-severity local/management-plane issue (CVSS 8.2) requiring high privileges; no public exploit has been identified at time of analysis, and while it is not a mass-exploitation priority, isolation of the FSP network and limiting service accounts are recommended.

Authenticated local access to the IBM Power Systems service processor enables writing crafted host firmware configuration data that crashes the boot stack during system initialization, potentially corrupting memory in firmware versions FW1060.00 through FW1060.81. This stack-based buffer overflow (CWE-121) has a CVSS 3.1 score of 7.3, with limited integrity impact and high availability impact. Exploitation requires service-level credentials (PR:L) and local access to the management plane (AV:L); no public exploit code or active exploitation is identified at time of analysis.

Buffer overflow in the Edimax BR-6208AC router (firmware 1.32) allows an attacker who can reach the device's HTTP management interface to corrupt memory via a crafted 'ifname' argument sent to the /goform/formWlSiteSurvey endpoint, with high impact to confidentiality, integrity, and availability. Exploitation requires at least low-privileged authenticated access to the web UI (CVSS 4.0 vector PR:L; independently assessed CVSS 3.1 base 8.6), meaning the endpoint must be reachable either from the LAN or from an internet-exposed admin panel using valid or default credentials; no user interaction is required once the attacker is authenticated. Publicly available exploit code exists (a PoC walkthrough is published on GitHub), but there is no evidence of confirmed active exploitation in the wild, and the vendor did not respond to disclosure - the product is end-of-life and no fix is expected.

Stack-based buffer overflow in the Edimax BR-6208AC router running firmware 1.32 allows remote authenticated attackers to corrupt memory via the ateBW argument of the /goform/formWlanMP endpoint, potentially leading to code execution or denial of service. The product is end-of-life and the vendor did not respond, so no vendor patch exists; publicly available exploit code exists, but there is no evidence of confirmed widespread exploitation. Exploitation requires network access to the device's management interface and low-privilege authentication per the CVSS vector (PR:L), which limits anonymous internet-wide attacks; the realistic threat is highest where the admin interface is reachable by untrusted or semi-trusted users.

An out-of-bounds write in the language-processing functionality of Progress MarkLogic Server lets an authenticated remote user with only low-level privileges crash or destabilize the server and, more narrowly, modify limited data. Only MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms availability is the dominant impact while confidentiality is untouched and integrity impact is limited. The mandatory pre-existing authenticated session is the primary limiting factor, so the realistic threat is an insider or an attacker who already holds valid credentials, and no public exploit code and no confirmed active exploitation were identified at time of analysis.

An out-of-bounds read in Progress MarkLogic Server 12.x query-processing functionality allows an authenticated remote attacker to crash or destabilize the server and to read a limited amount of data from process memory by submitting specially crafted input to the affected query routines. The flaw affects MarkLogic Server 12.x releases before 12.1.0; environments on 12.1.0 or later, or on other major branches, are out of scope. Exploitation requires valid low-privilege credentials (CVSS PR:L) plus network reachability to the query interface - this is not an unauthenticated flaw - and no user interaction is needed. Vendor-released patch: 12.1.0. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, driven primarily by the high availability impact of induced server instability.

Memory corruption through a use-after-free (CWE-416) in the JavaScript engine integration of Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 can lead to controlled process failure, server instability, or corrupted memory state. Exploitation is not anonymous: the assessed vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) requires a high-privileged account that can already execute server-side JavaScript, and the high attack complexity indicates the defect depends on specific timing or state conditions that are not reliably achievable on demand - so realistic abuse is confined to trusted, insider, or post-compromise contexts. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixed versions 12.1.0 (12.x track) and 11.3.7 (11.x track).

An out-of-bounds read in the Netcore NR268 router firmware (version 1.7.121109) can be triggered by manipulating the put_file argument of the ARP filter import handler at /router/filter_arp_put_file.cgi, allowing an attacker with an authenticated management session to disclose process memory or crash the device; no code execution or lateral impact was assessed. Exploitation requires high/administrative privileges (CVSS PR:H) on the router, so this is not reachable by an anonymous external attacker despite the network-facing attack vector. Publicly available exploit code exists - the researcher's write-up is published on GitHub and the vendor was contacted but never responded - and the CVSS 4.0 vector carries an E:P (proof-of-exploit) modifier; no CISA KEV listing and no EPSS score were supplied in the available data, and no vendor-released patch has been identified, so unpatched, internet- or management-exposed NR268 units should be treated as at risk of authenticated memory disclosure and denial of service.

Heap buffer overflow in FreeRDP 3.0.0 through 3.31.x allows an attacker who controls a physical smartcard token to corrupt heap memory during PKCS#11 smartcard logon, potentially achieving code execution with the privileges of the FreeRDP client. The flaw is in collect_keys(), which enumerates public key objects across PKCS#11 slots into a fixed 64-entry array without bounds checking; a token exposing more than 64 keys with attacker-controlled CKA_ID and CKA_LABEL values overflows the array. Exploitation requires PKCS#11 smartcard authentication to be configured, physical presentation of the malicious token, and user-initiated logon, and no public exploit code or active exploitation is known at time of analysis; this is a constrained, physically proximate issue rather than a mass-exploitation priority.

Remote code execution in AnyDesk before 8.0.3 allows unauthenticated attackers to execute arbitrary code as root on Linux by sending a specially crafted packet to the session protocol's stream packet handler for mode 5. The victim does not need to approve desktop control, and publicly available exploit code exists. This is a critical heap-based buffer overflow (CWE-130) with a CVSS score of 9.8, though the assessed root-level impact is specifically demonstrated on Linux and other platforms are not confirmed.

An authenticated remote stack-based buffer overflow in the Linksys E1700 router (firmware through 1.0.0.4.003) lets an attacker who can reach the device's HTTP management interface and hold a low-privilege session crash or potentially execute code on the device by sending an oversized vlan_set argument to the /goform/setVlan endpoint. Publicly available exploit code exists, including a GitHub proof-of-concept writeup, and the vendor was contacted early but did not respond, so no official fix is currently available. The vulnerability is rated CVSS 4.0 8.6 (independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires prior credentials or a hijacked authenticated session, and the management interface must be reachable from the attacker's position, giving this a targeted rather than mass-exploitation profile.

A stack-based buffer overflow in the Mac Filter configuration handler of Linksys E1700 firmware 1.0.0.4.003 allows an attacker who can reach the router's administrative web interface to send an overlong newap_text_%d value to /goform/ssid1MACFilter and corrupt the stack, resulting in a crash and potentially code execution with the privileges of the device's web server. Publicly available exploit code exists (a detailed PoC is published on GitHub), but there is no CISA KEV listing and active exploitation has not been confirmed, so this should be treated as a credible but not yet observed attack. The vendor was contacted early about the disclosure and did not respond, so no patched firmware has been confirmed; the provided CVSS 4.0 vector rates it 9.3 with PR:N, while our independent assessment maps the same flaw to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, because the /goform endpoint sits behind the admin UI and is normally reachable only after authenticating - resolving that pre-auth vs. post-auth question is the single biggest factor in real-world risk.

An out-of-bounds write in the native library libsamsungtts.so, part of the Samsung Text-to-Speech engine shipped on Samsung Android builds, allows code running locally on the device to corrupt memory and achieve arbitrary code execution in the TTS process context. The vulnerable component is reachable without special privileges or user interaction (CVSS 4.0 PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must already have a malicious or compromised app or local process able to invoke the TTS engine and supply crafted input; there is no remote/network exploitation path. Samsung addresses the flaw in the SMR Oct-2026 Release 1 maintenance update, and no public exploit code has been identified at time of analysis.

Out-of-bounds write in Samsung's libsmkvextractor.so media-extraction library allows arbitrary code execution on Samsung mobile devices running firmware prior to SMR Oct-2026 Release 1. Exploitation requires local access - an attacker must already hold a foothold on the device or get a crafted MKV/Matroska media file into a local parsing path - yet the CVSS 4.0 vector requires no privileges and no user interaction (AV:L/PR:N/UI:N), and our independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) rates the impact as high integrity, low confidentiality, and low availability. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.

Out-of-bounds write in libnfs through 6.0.2 lets an attacker-controlled or man-in-the-middled NFS/RPC server corrupt memory in a client application linked against the library: the ZDR decoders libnfs_zdr_bytes(), libnfs_zdr_string() and libnfs_zdr_array() do not honour the caller-supplied maxsize, so a wire-declared length larger than the caller's preallocated buffer is accepted and copied past its end. The assessed CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, i.e. an unauthenticated remote server can trigger it but the victim must first connect to that server (UI:R), and impact is limited to integrity plus high availability loss rather than data disclosure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the flaw only affects callers that pass a non-zero, non-~0 maxsize with their own fixed-size storage, since zero/0xFFFFFFFF lengths remain intentionally unbounded.

A stack-based buffer overflow (CWE-121) in the UNISOC modem OTA stack lets an attacker within radio range achieve remote code execution or crash the baseband by broadcasting a crafted SIB1 message whose scheduling information is not properly validated, which the modem parses automatically with no authentication or user interaction (PR:N/UI:N). The vendor assigned a CVSS 3.1 score of 9.8 with an AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector, but the exploitation path is adjacency-gated: the adversary must operate a rogue cellular base station (SDR plus a full baseband stack), out-compete legitimate cells so the victim device camps on the malicious cell during idle-mode (re)selection, and the target must run the affected UNISOC modem/OTA stack - making this a proximity-limited, targeted attack rather than an internet-scale one. No public exploit code and no confirmed active exploitation were identified at time of analysis.

An out-of-bounds write of up to 127 bytes in the Zephyr RTOS NXP MCUX TRNG entropy driver (drivers/entropy/entropy_mcux_trng.c) allows a locally-present attacker to corrupt memory immediately following a caller-supplied buffer on affected NXP i.MX RT5xx/RT6xx SoCs. Because entropy_get_entropy() is a syscall whose verifier (K_SYSCALL_MEMORY_WRITE) checks only the requested length, an unprivileged user-mode thread that has merely been granted the entropy device can supply a length such as 1 and an arbitrary destination, causing the kernel to write 128 bytes where 1 was proven to be owned; on these Cortex-M33 parts there is no MMU, so the overflow can land in adjacent kernel state. The same defect is reachable from kernel mode via getentropy() or sys_rand8_get()/sys_rand16_get() where those resolve to the hardware generator. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but exploitation is local, deterministic in offset, and low complexity, which the assessed vector captures as AV:L/AC:L/PR:L with changed scope and high integrity impact.

An unauthenticated attacker on the same link can crash or partially leak memory from Zephyr IPv6 devices by sending a unicast packet to a neighbor entry that is still in the unresolved state: net_route_ipv6_packet() reads the link-layer address at index NET_NBR_LLADDR_UNKNOWN (0xff) and returns a pointer roughly 2.5 KB past the end of the neighbor link-layer address array. Because builds with CONFIG_ASSERT enabled fire the misplaced assertion and panic, the primary outcome is a repeatable remote denial of service (CVSS 7.1, AV:A/AC:L/PR:N/UI:N, A:H), while builds with assertions disabled instead copy up to 8 bytes of unrelated static RAM into the destination link-layer address of the outgoing frame, disclosing them to any listener (C:L). Exploitation requires no router or forwarding configuration: CONFIG_NET_IPV6_ROUTE is enabled by default whenever the IPv6 neighbor cache is, and the attacker only needs to first force a neighbor into the unresolved state (e.g. by eliciting traffic to a spoofed non-existent address, or by sending a Router Advertisement without a source link-layer address option) before sending the trigger packet. No public exploit code was identified at time of analysis.

Local privilege escalation and sandbox escape in Zephyr RTOS affects builds with CONFIG_USERSPACE enabled that include a fuel-gauge driver: the syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() size kernel-side variable-length arrays directly from an unvalidated caller-supplied len, letting any user-mode thread displace the supervisor stack and, where the caller holds fuel-gauge object permissions, write len * sizeof(union fuel_gauge_prop_val) bytes of attacker-controlled data into privileged memory. The outcome is an out-of-bounds write executing in supervisor mode with attacker-chosen length and content, leading to kernel code execution or a device crash; with the default CONFIG_PRIVILEGED_STACK_SIZE of 1024 bytes, a len of roughly 170 is sufficient to overrun the privileged stack, and a hardware stack guard does not contain it because the copy begins below the guard and walks upward. CVSS 3.1 rates this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the vector requires the attacker to already hold a low-privilege foothold - here, the ability to execute a user-mode thread on the device - and no public exploit code has been identified at time of analysis.

An out-of-bounds read in the T_STD_STRING typemap shipped with ExtUtils-Typemaps-Default before 1.06 causes the generated C++ conversion to evaluate SvCUR($arg) before stringifying the argument, so a derived XS/C++ module that passes a non-string Perl scalar (integer, number, or reference) into the std::string conversion can read an invalid length and abort or segfault the process. The defect is not present in a running service by default but is compiled into derivative XS modules, and it only triggers when the build toolchain's unspecified argument-evaluation order happens to evaluate the length macro first, so exposure is conditional rather than universal. The headline CVSS 9.1 conflicts sharply with the authoritative assessment (AC:H, C:L/A:H) and a very low EPSS of 0.19% (8th percentile); no public exploit code was identified at time of analysis.

Out-of-bounds read in Apache DataSketches C++ (datasketches-cpp) allows an attacker who controls a serialized VarOpt union image to trigger reads of up to 24 bytes past the end of the supplied buffer, causing a crash (denial of service) and potentially leaking adjacent heap memory into the deserialized union's state. Applications are exposed only if they call var_opt_union::deserialize() on data from untrusted sources; affected releases are 2.0.0-incubating through 5.2.0, and the library is not exploitable on its own. No public exploit code has been identified at time of analysis, EPSS is low at 0.24% (14th percentile), and the issue is not listed in CISA KEV, so the practical priority is moderate rather than urgent. The vendor-released fix is version 5.3.0, which also remediates four other deserialization flaws.

Out-of-bounds read in Apache DataSketches C++ versions 3.1.0 through 5.2.0 is reachable when an application deserializes a compact Theta sketch from an untrusted source, allowing unauthenticated remote attackers to crash the process (denial of service) and potentially disclose adjacent memory contents. The flaw sits in compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap(), which parse header fields before verifying the input length; in the compressed format a 32-bit integer overflow defeats the length check and two decoding-controlling header fields go unvalidated, and the stream-based deserialization path is affected as well. Apache rates this issue low severity in its 5.3.0 release notes, no public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is only 0.20% (9th percentile); exploitation requires the explicit, non-default precondition that the host application accept Theta sketch images from untrusted sources, so the practical priority is lower than the raw 9.1 CVSS might suggest.

Out-of-bounds read and write in the CPC sketch deserialization path of Apache DataSketches C++ (datasketches-cpp) - specifically cpc_sketch::deserialize() called on a byte buffer or a stream - allows a crafted serialized sketch to corrupt heap memory: the decompressor reads past the end of the compressed data because the read position was only checked after decoding finished, and in the hybrid flavor it writes outside an internal heap buffer because decoded row indices were not validated, crashing the process with potential for further exploitation. All releases from 2.0.0-incubating before 5.3.0 are affected, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote, unauthenticated impact, but reachability is conditional: only applications that deserialize CPC sketches from untrusted sources are exposed, since the flaw lives in a C++ library whose attack surface depends on the embedding application. Exploitation signals are mixed and should be weighed carefully - EPSS is only 0.19% (8th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.

Heap buffer overflow in Apache DataSketches C++ (versions 1.0.0-incubating through 5.2.0) allows an unauthenticated remote attacker who can supply a crafted HLL sketch for deserialization to write up to 988 bytes past a fixed 8-entry internal heap buffer, corrupting memory, crashing the process, and potentially enabling further exploitation. The vulnerable code is a library routine with no network listener of its own, so real-world exposure hinges on whether the consuming application deserializes sketch images from untrusted byte buffers or streams; services that only process trusted or internally generated sketches are not realistically exposed despite the AV:N vector. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21% (11th percentile), while the assessed CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst case for applications that do accept untrusted sketches, meaning the high score and low observed exploitation signal must be weighed together.

Remote unauthenticated attackers can trigger a buffer overflow in the OpENer EtherNet/IP stack's GetAttributeList() implementation, causing a denial of service (crash) on devices running version 2.3 or master commit 76b95cf. The flaw is reachable over the network via the EtherNet/IP service (typically TCP/UDP 44818 and UDP 2222) and requires no authentication or user interaction, as indicated by CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with availability-only impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the issue is publicly documented in the project's GitHub issue tracker.

Malformed 6LoWPAN fragments can drive an out-of-bounds read in the GNRC network stack of RIOT OS 2026.07 and earlier, crashing the stack and potentially exposing adjacent memory. The flaw sits in _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c, which forwards an undersized packet into SFF fragment handling after only a minimal payload check, so gnrc_sixlowpan_frag_recv() then interprets bytes as a sixlowpan_frag_t (or larger fragment header) that the packet snip does not actually contain. Exploitation requires no authentication or user interaction (PR:N/UI:N) and, per this assessment, is bounded by delivery: because 6LoWPAN rides on IEEE 802.15.4, the attacker must be within radio range of the node or able to inject fragments into its mesh (AV:A, assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H; the reporter's AV:N/8.2 rating assumes arbitrary remote reachability that is not generally available unless a border router forwards attacker-controlled fragments inward). Availability is the dominant impact (A:H - crash of the GRNC network stack), with limited secondary memory disclosure (C:L); no public exploit code or confirmed active exploitation was identified at time of analysis.

Malicious or impersonated CoAP servers can cause out-of-bounds reads and denial of service in RIOT OS 2026.07 and earlier nanoCoAP clients through the blockwise slice path. The flaw is in nanocoap_sock_get_slice(): a server-controlled Block2 szx value is not checked against the requested block geometry, so a larger block size with the expected block number makes the derived offset exceed the client slice offset and underflows the buffer-relative calculation in _2buf_slice(). The issue is rated CVSS 4.0 7.1 (High) with AV:N/AC:L/AT:N/PR:N/UI:P, meaning unauthenticated network reachability but requiring the RIOT client to initiate a blockwise request to a server the attacker controls or impersonates; no public exploit was identified at the time of analysis, and an upstream fix is available via PR/commit but no fixed release is confirmed.

Unauthenticated remote denial of service in the OWASP Coraza WAF Go library (versions 3.0.0 through 3.8.0) allows any client that can deliver a JSON request or response body to crash the entire hosting process with an unrecoverable fatal stack overflow. The flaw is reachable with default configuration - the payload stays under the recommended SecRequestBodyLimit and within the default SecArgumentsLimit of 1000 - because the body processor's bounded flattening walk stops early on argument truncation and then unconditionally hands the complete raw body to gjson.Valid, which recurses once per nesting level with no depth bound and cannot be intercepted by recover(). Impact is availability only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-674); no public exploit code identified at time of analysis and no KEV listing, though the vendor advisory documents a working repro payload of roughly 13 MB.

An out-of-bounds stack write in the MariaDB CONNECT storage engine's DOS table type lets an authenticated user crash the server and potentially achieve code execution by supplying a crafted column definition and value. The flaw is an incorrect boundary check in the CONNECT value conversion routine that permits a one-byte null write past a stack buffer at an attacker-controlled offset (CWE-787), and it affects MariaDB from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Exploitation requires the non-default CONNECT engine to be installed and enabled plus privileges to create CONNECT tables of table_type 'dos' with a crafted numeric definition such as double(255,30); the vendor rates it CVSS 8.5 while the independent assessment is slightly lower (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because authentication, a non-default engine, and high attack complexity are needed, and no public exploit code was identified at time of analysis.

Buffer overflow in the optional lwIP SMTP client application module lets an unauthenticated remote attacker corrupt memory by supplying oversized input that the client fails to length-check, yielding high confidentiality, integrity, and availability impact on embedded and OT devices that use the module. The vendor-supplied CVSS 4.0 score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), while our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N because successful exploitation requires the optional apps/smtp module to be compiled into the build and actively used, and generally requires the attacker to control the SMTP server the device talks to (or to be positioned to MITM that session) or to control the email field data (recipient, subject, body) handed to the client. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected version is a wildcard in the CPE, so the precise vulnerable lwIP releases remain unconfirmed; the issue is tracked through the ICS-CERT advisory ICSA-26-279-02 and its CSAF machine-readable counterpart.

Sandbox escape and kernel-level out-of-bounds write in the Zephyr RTOS userspace subsystem: an unprivileged user-mode thread that holds an assigned resource pool can pass a size near SIZE_MAX to the k_object_alloc_size() syscall (or the thread-stack branch via k_thread_stack_alloc()), causing an unsigned integer wrap-around in dynamic_object_create() so that a few-byte heap chunk is allocated while the object descriptor is registered under the caller's requested type. The subsequent init syscall (for example k_mutex_init(), k_sem_init(), or k_thread_create()) then writes a full kernel object over the truncated allocation, giving a supervisor-mode heap overflow of attacker-influenced size and content that corrupts sys_heap chunk metadata and adjacent kernel objects, and - when CONFIG_GEN_PRIV_STACKS is set - plants an attacker-influenced wild pointer as a user thread's privileged stack base. This is a local, high-priority privilege-escalation issue (CVSS 8.8, AV:L/PR:L/S:C) rather than a remotely reachable one: exploitation requires code execution as an unprivileged thread inside the CONFIG_USERSPACE sandbox on a build that also enables CONFIG_DYNAMIC_OBJECTS (or CONFIG_DYNAMIC_THREAD under userspace) and that assigns a resource pool to the calling thread; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. The vendor has published a fix that rejects both overflowing computations and frees the partially built descriptor.

Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attacker within Bluetooth radio range write attacker-chosen bytes into static .bss state by broadcasting a crafted Basic Audio Announcement (BASE) with more subgroups or a larger metadata LTV than the sink's fixed arrays can hold. No pairing, bonding, GATT connection, or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8); the target must be a build with CONFIG_BT_BAP_BROADCAST_SINK enabled and must be periodic-advertising-synced to the attacker's source, or to an advertiser whose address and SID the attacker impersonates (periodic advertising data is unauthenticated). Impact includes corruption of adjacent Bluetooth-audio state with potential remote code execution in the Bluetooth RX thread, plus out-of-bounds disclosure via the BAS receive-state notification; no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is a genuine high-priority flaw rather than a CVSS-inflated paper risk, and an upstream fix is available.

Heap-based out-of-bounds write in FalkorDB's Bolt/WebSocket handling (all versions before 4.20.0) allows a remote unauthenticated attacker to crash the server and potentially corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The flaw spans ws_read_frame in src/bolt/ws.c and buffer_apply_mask in src/bolt/buffer.c, where the only length check is an ASSERT() that is compiled out of release builds, so the masked XOR operation runs past the end of the receive buffer. Impact is limited to deployments that explicitly enable the Bolt endpoint via BOLT_PORT, which is disabled by default; no public exploit code has been identified at time of analysis.

FalkorDB instances that explicitly enable the optional Bolt wire-protocol endpoint can be crashed, and possibly have arbitrary code executed, by an unauthenticated remote attacker who sends a single crafted Bolt RESET message with an attacker-chosen 16-bit chunk size. The vulnerability is a heap-based out-of-bounds write (CWE-787) in BoltReadHandler in src/bolt/bolt_api.c present before version 4.20.0; the size check is performed only with ASSERT(), which is compiled out of release builds, so production binaries provide no runtime guard. Exploitation requires the Bolt port (BOLT_PORT) to be enabled and network-reachable - it is disabled by default and is the decisive precondition that sharply limits the exposed population; with no CISA KEV entry and no public exploit code identified at time of analysis, reliable denial of service is the confirmed impact while remote code execution remains a theoretical possibility that has not been demonstrated.

Heap memory disclosure and denial of service in FalkorDB before 4.18.4 stem from an out-of-bounds read in the RDB deserialization routine BufferSerializerIOv2_ReadBuffer, which trusts a sub-buffer length field taken from the incoming stream and validates it only with an ASSERT() that is compiled out of release builds. Unauthenticated remote attackers who can drive a Redis replication exchange - for example by acting as a replication master against a network-reachable instance with no requirepass/ACL configured - can supply a crafted RDB stream to read past the end of a heap allocation, crashing the server or leaking heap memory (CVSS 8.8, high confidentiality and availability impact). No public exploit code has been identified at time of analysis, and the vendor has released a fix in FalkorDB 4.18.4, so residual risk is concentrated on unauthenticated, network-exposed deployments that have not yet upgraded.

Stack-based buffer overflow in FalkorDB versions before 4.18.4 allows remote attackers who can issue Redis replication commands - for example against a network-reachable instance with no password configured - to crash the graph database and possibly achieve code execution by supplying a crafted RDB stream whose entity property count is unbounded. The decoder sizes two variable-length arrays on the thread stack from that attacker-controlled count and then fills them with attacker-supplied values, so a single malformed RDB payload overflows the stack (CWE-121). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released FalkorDB 4.18.4 moving large property sets to the heap; CVSS 4.0 rates this 9.2 with AV:N/AC:H/PR:N/UI:N, where the high attack complexity reflects the difficulty of converting the overflow into reliable arbitrary code execution rather than a denial of service.

Remote denial of service against devices running the OpENer EtherNet/IP adapter stack v2.3.0 (commit 76b95cf): an out-of-bounds read in the unconnected explicit messaging path lets a remote, unauthenticated attacker crash or destabilize the CIP stack by sending crafted unconnected explicit requests to an exposed EtherNet/IP interface. The assessed vector (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms network-reachable, unauthenticated exploitation with high availability impact and no confidentiality or integrity impact, so the outcome is a process crash/denial of service rather than data disclosure or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiter is whether the device's CIP/encapsulation port (typically TCP/UDP 44818) is reachable across network segmentation.

An out-of-bounds read in EIPStackGroup's OpENer EtherNet/IP stack (v2.3 through master commit 76b95cf) allows remote, unauthenticated attackers to crash the service by sending a Common Packet Format message whose optional socket address information item (type 0x8000 or 0x8001) is truncated. The parser routine CreateCommonPacketFormatStructure() then reads a fixed-size sockaddr structure past the end of the supplied buffer, faulting the process - this is an availability-only impact with no confidentiality or integrity effect, consistent with the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation was identified at time of analysis, and practical risk is bounded by the requirement that the attacker reach the EtherNet/IP TCP service on the affected device.

Remote denial of service affects devices running the OpENer server-side EtherNet/IP adapter stack (v2.3, up to and including commit 76b95cf), where an out-of-bounds read in the ForwardOpen connection-path parser can crash the service. The flaw is reachable over the network with no authentication, privileges, or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH), and publicly available exploit code exists; there is no CISA KEV listing and no confirmed active exploitation, so the practical risk is driven by exposure of EtherNet/IP endpoints on reachable networks. CISA's SSVC assessment rates the issue automatable with partial technical impact, consistent with an unauthenticated crash of an embedded industrial adapter rather than a full compromise.

An out-of-bounds read in the server-side CIP SetAttributeList service of EIPStackGroup OpENer allows an unauthenticated remote attacker to crash or destabilize the CIP/EtherNet/IP stack, producing a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms the impact is availability-only and requires no privileges, user interaction, or non-default configuration. Affected builds are OpENer v2.3 and master through commit 76b95cf. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so the practical risk hinges on network reachability to embedded industrial controllers, which are typically deployed on segmented OT networks.

Remote, unauthenticated attackers can crash devices running the EIPStackGroup OpENer EtherNet/IP stack (v2.3.0 and master up to commit 76b95cf) by sending a crafted Connection Manager request that triggers an out-of-bounds read during parsing. The flaw requires only network reachability to the stack's EtherNet/IP service on its default operating mode - no credentials, no special configuration, and no user interaction - and yields availability-only impact (CVSS 7.5, C:N/I:N/A:H), meaning denial of service rather than code execution or data disclosure. No public exploit identified at time of analysis, and the issue is tracked upstream as GitHub issue #577; exploitability is mainly bounded by the fact that affected devices typically sit on segmented OT/ICS networks rather than being internet-exposed.

Unauthenticated denial of service in the TP-Link Tapo C325WB v2 camera allows a crafted pair of RTSP-over-HTTP tunneling requests sent to the streaming service on TCP port 554 to corrupt memory (stack-based buffer overflow, CWE-121) and crash the streaming daemon, disrupting live video and related streaming functions until the daemon recovers or restarts. Only cameras with the optional Camera Account feature enabled are exposed, and the attacker must be positioned on the same adjacent network segment (Wi-Fi or LAN) as the camera, since the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no authentication or user interaction is required. Impact is availability-only and temporary, no public exploit identified at time of analysis, and a vendor patch is available per the TP-Link firmware release notes and advisory FAQ 5333.

Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is enabled by a buffer overflow that an unauthenticated network attacker can trigger without user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, giving total loss of confidentiality, integrity, and availability on a successful exploit. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation with non-automatable attack steps, and EPSS places exploitation likelihood at 0.37% (29th percentile), so signals are mixed and point to a credible-but-not-yet-urgent priority. The practical limiting factor is network reachability: Guardium is typically deployed as an internal database-activity-monitoring appliance, so an attacker generally needs a foothold on, or routing into, the management or database-monitoring network rather than open internet access.

Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is possible through a stack-based buffer overflow (CWE-121) in reachable product code, with the vendor CVSS vector indicating a network-accessible, unauthenticated trigger and no required user interaction (AV:N/PR:N/UI:N) and a maximum impact rating of 9.8. Our independent assessment scores the same impact but raises attack complexity to High (AC:H), reflecting that reliable code execution likely requires an attacker to defeat standard memory protections such as stack canaries, ASLR, and DEP, and CISA's SSVC framework rates the issue non-automatable with no observed exploitation; no public exploit identified at time of analysis, and EPSS is low at 0.37% (29th percentile). The practical picture is a high-severity, patch-priority issue rather than an emergency: the vulnerable code is assumed reachable in standard deployments since the advisory names no special prerequisite, but exposure is confined to environments running the three named 12.x releases and the vendor fix closes the window once applied.

Crafted TDS PRELOGIN packets traversing a network segment monitored by an IBM Guardium Data Protection 12.0, 12.1, or 12.2 Collector trigger a buffer overrun in the appliance's Microsoft SQL Server protocol decoder, reliably causing denial of service and, per the vendor, potentially allowing arbitrary code execution on the Collector itself. Exploitation is unauthenticated (CVSS vector PR:N) and requires no user interaction, but it depends on the attacker's ability to place a malformed packet onto the monitored database network rather than reaching a directly addressable service, because the Collector inspects traffic passively. No public exploit code has been identified at time of analysis and EPSS is low at 0.36% (28th percentile); IBM has published a vendor fix, and CISA's SSVC assessment records no observed exploitation.

Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated network attackers to trigger a buffer overflow and execute arbitrary code, with total confidentiality, integrity, and availability impact as assessed by CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; EPSS is low (0.37%, 29th percentile), and CISA SSVC marks the attack as not automatable, meaning exploitation would likely require target-specific effort. A vendor patch is available per IBM advisory node/7291674.

Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is achievable by an unauthenticated remote attacker (CVSS PR:N, UI:N) through a buffer overflow that corrupts memory in a way that can be leveraged to run arbitrary code, yielding high confidentiality, integrity, and availability impact (CVSS 8.1). Attack complexity is High (AC:H), so reliable exploitation depends on conditions outside the attacker's control - such as precise memory layout, timing, or a specific non-trivial input path - which tempers the practical risk despite the elevated base score. Only the listed 12.x branches are affected and patched builds are not exploitable; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.

Remote code execution is possible in IBM Guardium Data Protection 12.0, 12.1, and 12.2 through a buffer overflow (CWE-119) triggered over the network, but exploitation requires valid low-privileged credentials (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, base 8.8) - this is not an unauthenticated flaw, so an attacker must already hold an account or captured credential on the appliance. A successful exploit yields full compromise of confidentiality, integrity, and availability of the affected system, making privileged accounts and network reachability the key gating factors. Exploitation status is benign-to-moderate: no public exploit code has been identified and no confirmed in-the-wild activity is reported (EPSS 0.42%, 34th percentile; CISA SSVC exploitation: none), and IBM has published an advisory with a vendor fix, so patching is the decisive control.

Remote code execution or denial of service in NetScaler ADC and NetScaler Gateway (CVSS 9.5) via a memory overflow when configured as a SAML Service Provider or Identity Provider. Affected versions include 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (and FIPS/NDcPP equivalents) when acting as SAML IdP, as well as all earlier versions when acting as either SP or IdP. No authentication is required (PR:N) and no public exploit has been identified at time of analysis, though the high attack complexity (AC:H) may limit reliable exploitation.

Arbitrary code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) when an attacker who already holds administrative privileges on the appliance and can reach the local management interface supplies input that overflows a fixed-size stack buffer. The assessed CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with CWE-787 as the root cause, so the flaw is high-severity on impact but gated by a strong prerequisite: administrative control of the management plane rather than unauthenticated reach. Patch available per vendor advisory (IBM support page node/7291628); there is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC decision points record Exploitation: none, Automatable: no, Technical Impact: partial.

Stack-based buffer overflow in Poppler's Decrypt::revision6Hash() allows a caller-supplied password longer than 127 bytes for an AESV3/R6 (AES-256 revision 6) encrypted PDF to overwrite the K1 and E stack buffers, crashing the process and corrupting nearby memory. Poppler 0.42.0 through 26.10.0 is affected across libpoppler, libpoppler-glib and the C++ API, and the flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:4.0 PR:N) but carries an explicit attack requirement - the attacker must control the password string passed to the decrypt routine - so realistic exposure is automated or server-side PDF pipelines that decrypt files with externally supplied passwords rather than interactive viewers where the user types the password. Impact is primarily availability (A:H) with a limited integrity effect (I:L); no public exploit identified at time of analysis, no CISA KEV confirmation of active exploitation, and an upstream fix is tracked via freedesktop GitLab merge request 2398 with a vendor advisory noted.

An out-of-bounds read in the TDS7 LOGIN7 protocol parser of IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated remote attackers to deliver a crafted LOGIN7 packet with invalid offset or length values, causing denial of service and limited memory disclosure. The published CVSS 3.1 score is 9.1, but our independent assessment reduces confidentiality to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), and with EPSS at only 0.29% (20th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world priority is lower than the headline score suggests even though technical impact is rated total. The dominant limiting factor is network reachability: only deployments whose TDS/database-interception listener is exposed to untrusted networks are practically at risk.

Remote, unauthenticated memory corruption in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows an attacker who can reach a monitored MongoDB data path to overflow a heap buffer in the product's MongoDB protocol parser and potentially crash the appliance or execute arbitrary code. The flaw is triggered by a MongoDB SCRAM authentication message carrying an oversized username field, and because the parser runs inside the inspection engine, exposure is limited to deployments where Guardium's S-TAP/collector is actively inspecting MongoDB traffic. The vendor-rated CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a pre-authentication, low-complexity flaw with full confidentiality, integrity, and availability impact, though no public exploit code has been identified at time of analysis and reliable code execution (as opposed to a denial-of-service crash) is constrained by heap-exploitation difficulty.

A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an unauthenticated remote attacker to crash the agent or potentially execute arbitrary code by sending crafted TDS login fragments that overflow the fixed-size reassembly buffer. Affected deployments are Guardium Data Protection (S-TAP agent) versions 12.0 and 12.1, with EUVD additionally listing 12.2; exploitation requires the S-TAP agent to be actively inspecting TDS traffic on a reachable database-communication path, so exposure is limited to networks where an attacker can inject traffic into monitored Microsoft SQL Server or Sybase/SAP ASE sessions. The vendor rates this CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis.

Decoding a truncated map32 MessagePack value in msgpack5 (npm) before 6.1.0 causes the decoder to read the four-byte length field of a five-byte header that has not fully arrived, producing an out-of-bounds buffer read that throws RangeError instead of IncompleteBufferError; the unauthenticated network-vector flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) can abort a request, stream, or worker in applications that use IncompleteBufferError to decide whether to wait for more bytes. Impact is denial of service only - the underlying buffer implementation bounds-checks the read, so there is no adjacent-memory disclosure and no path to code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version (6.1.0).

Unauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 release trains, where a heap-based buffer overflow caused by improper bounds checking lets an attacker who can reach the appliance's request-processing path corrupt heap memory and run arbitrary code with full confidentiality, integrity and availability impact. The flaw is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required, and it is exploitable over the network. There is no public exploit identified at time of analysis and it is not confirmed actively exploited (no CISA KEV listing); IBM has published a vendor fix, and this is a genuine high-priority issue rather than an inflated high-CVSS score.

Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected service, producing a denial-of-service condition; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, score 8.2) confirms network reachability with no authentication, no user interaction, and no unusual configuration required, while availability impact is High and there is a limited Confidentiality impact from potential leakage of adjacent memory. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This issue is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, but a vendor patch is available and the affected versions are frequently internet-facing, so prioritization should follow normal critical-exposure timelines rather than emergency response.

Denial of service in IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 allows an attacker who already holds a valid low-privileged account to trigger improper memory allocation during key derivation, corrupting memory and rendering the gateway unavailable (CVSS 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Because the vector requires PR:L, the flaw is not exploitable pre-authentication, and its scope-changed rating reflects that the availability impact can extend past the initially compromised security boundary; there is no confidentiality or integrity impact. Patch available per vendor advisory and no public exploit identified at time of analysis, so risk is concentrated in unpatched appliances where an attacker can obtain even limited authenticated access.

Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2) is caused by a heap-based buffer overflow that a remote attacker can trigger without authentication or user interaction, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) with total impact to confidentiality, integrity, and availability. Exploitation is not confirmed by any signal: no public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, SSVC reports Exploitation=none with Automatable=no, and EPSS is only 0.37% (29th percentile). The practical risk therefore hinges on whether affected DataPower builds are reachable from untrusted networks, since IBM has published a fix and the high base score reflects worst-case impact rather than observed attack activity.

Out-of-bounds memory handling in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2) allows network attackers to trigger a buffer overflow that can disclose sensitive process memory or crash the appliance. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), exploitation is unauthenticated and requires no user interaction, with high confidentiality and availability impact but no integrity impact - consistent with the CWE-125 out-of-bounds read classification rather than a write-based code-execution primitive. No public exploit code was identified at time of analysis, CISA SSVC records exploitation as 'none' and automation as 'no', and EPSS is low at 0.22% (12th percentile); note that the vendor's own 9.8 rating assumes full C/I/A impact, which this assessment does not corroborate. Patch available per vendor advisory (IBM support page node/7289775).

A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrupt memory and potentially allow an attacker to fully compromise the affected appliance, as reflected in the assessed CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with the flaw reachable in the normal network-processing path since no authentication, user interaction, or special configuration is required. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the unauthenticated network attack surface and memory-corruption impact make this a genuine high-priority issue for exposed deployments; IBM has published a vendor fix via its support advisory.

Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance supplies crafted oversized input to a component that performs improper bounds checking, allowing an out-of-bounds write and, potentially, execution of arbitrary code in the appliance's process context. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; IBM has published a vendor fix, and no public exploit code was identified at time of analysis. Note that the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) characterizes this as remotely exploitable without privileges, which is inconsistent with the description's requirement for a local user and with the independent assessment of AV:L/AC:L/PR:L/UI:N - the local-access prerequisite is the practical limiter on real-world risk, while the impact if triggered remains full confidentiality, integrity, and availability loss.

Stack-based buffer overflow in IBM DataPower Gateway firmware tracks 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows an authenticated attacker holding administrative-level privileges to execute arbitrary code on the gateway. Exploitation is network reachable but gated by high attack complexity (AC:H), meaning the attacker depends on conditions they cannot fully control, such as a specific memory layout or parsing state, so a single deterministic trigger is not guaranteed; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); IBM has released patched builds via its support advisory.

Out-of-bounds heap reads in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows (versions before 2.8.88) let a malicious or compromised VNC server crash the viewer and leak small amounts of adjacent heap memory into the rendered framebuffer. The victim must initiate the VNC session to the attacker-controlled or man-in-the-middle'd server and the connection must negotiate ZRLE encoding; the server then sends palette-based tiles whose colour indices exceed the declared palette size, causing readPaletteRleTile() and readPackedPaletteTile() to index past the end of the palette allocation. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H (7.1), a medium-to-high client-side flaw whose score is driven almost entirely by availability impact (viewer termination) plus a limited confidentiality leak (heap bytes rendered as garbled colours), with no code execution achieved; no public exploit code has been identified at time of analysis, and vendor patches are available in 2.8.88.

Out-of-bounds write in IBM DataPower Gateway lets a remote, unauthenticated attacker corrupt memory and potentially execute arbitrary code on affected gateway builds (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2), as reflected in the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.1. The PR:N/UI:N components mean no credentials or user interaction are required, so any network-reachable instance on an affected build is exposed, though the AC:H rating indicates exploitation depends on satisfying a non-trivial condition - most likely a specific input state, parsing path, or memory layout - to escalate the write beyond a crash into reliable code execution. Vendor patch data indicates a fix is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis; the EPSS score was not provided in the underlying intelligence, so no probabilistic exploitation estimate can be quoted.

Unauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 - stemming from an out-of-bounds write (CWE-787) that corrupts memory and can be leveraged to run attacker-controlled code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the flaw is reachable over the network with no authentication and no user interaction, making any internet- or partner-facing DataPower instance running an unpatched build a high-priority target. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; patch available per vendor advisory (IBM support page node/7289775), with the specific fixed firmware builds published there.

IBM DataPower Gateway can be driven into a denial-of-service condition by a remote, unauthenticated attacker who supplies input that reaches a flawed sorting comparator, causing the comparator to violate strict-weak-ordering and triggering an out-of-bounds memory access (CWE-787) that can crash or destabilize the affected service. All builds in the 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 ranges are affected; the impact is confined to availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect and no privilege gain. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and IBM has published a fix via its support advisory, so this should be treated as a patching-priority availability risk rather than an emergency.

Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gateway and cause a denial of service. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, so any attacker who can reach a listening interface and deliver a crafted request to the vulnerable parsing path can trigger the fault. The assessed impact is availability-only (A:H, C:N/I:N) rated 8.2 High; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is governed mainly by network exposure of the gateway's listening interfaces. This is a genuine but tier-two priority issue rather than an emergency, with patches available from IBM.

Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in disclosure of sensitive information and denial of service. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with a CVSS 3.1 base score of 8.6 driven by high availability impact alongside limited confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and IBM has made a fix available through its support advisory, so this is a credible operational priority rather than a confirmed emergency - exposure depends on whether the gateway's network listeners are reachable by the attacker.

IBM DataPower Gateway is vulnerable to a remote, unauthenticated denial of service (CVSS 3.1 base 7.5) in which a crafted request triggers an out-of-bounds read, degrading or crashing the affected gateway service. All supported firmware streams in the affected ranges are exposed: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6 (the 10.6 CD stream), and 11.0.0.0 through 11.0.0.2. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms exploitable over the network with no authentication, privileges, or user interaction, but restricts impact to availability - no confidentiality or integrity loss is assessed - so exploitation results in service disruption rather than compromise; there is no public exploit identified at time of analysis, and a vendor patch is available.

Denial of service in IBM DataPower Gateway affects releases 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, where crafted network input reaching the vulnerable parsing path overflows a buffer and can crash the affected service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), exploitation requires no authentication and no user interaction, so any internet- or partner-facing listener that processes malformed input is exposed; impact is availability-only - a crash/restart condition rather than data exposure or code execution. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), so this is a genuine but bounded operational risk that depends primarily on whether affected listeners are reachable from untrusted networks.

An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows an unauthenticated remote attacker to corrupt gateway memory, most reliably causing a denial of service and potentially enabling partial confidentiality or integrity compromise. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), and the vector's PR:N/UI:N components confirm no credentials or user interaction are required to reach the vulnerable code - the practical limiting factor is whether the attacker's network can reach a DataPower service listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix via IBM Support (node/7289775).

Remote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, because an out-of-bounds write in the RFC2047 encoded-word parser can corrupt memory and be leveraged to run arbitrary code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) indicates the flaw is network-reachable with low complexity, requires no credentials and no user interaction, and carries full confidentiality, integrity, and availability impact, though exploitation depends on a reachable service or flow that passes attacker-controlled data through MIME encoded-word decoding. According to available intelligence there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the primary source is IBM's advisory at https://www.ibm.com/support/pages/node/7289775.

Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or degrade an affected gateway by sending crafted input that the product fails to validate correctly, resulting in an out-of-bounds write in memory. All four supported release trains are affected: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms the attack is launched over the network with no authentication and no user interaction, and that the sole impact is availability - there is no confidentiality or integrity loss, so the risk is bounded to service outage on gateways whose vulnerable interface is reachable from untrusted networks. No public exploit code has been identified at time of analysis, no EPSS score was supplied, and CISA KEV does not list this CVE.

A heap buffer overflow in IBM DataPower Gateway (affected firmware levels 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows remote attackers to crash the service and cause a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, privileges, or user interaction are required, so any reachable affected gateway is a candidate target. Impact is confined to availability - the vendor reports no confidentiality or integrity loss and no code execution. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); this is a genuine availability risk but not a top-tier emergency, with practical exposure limited by how broadly the gateway's data-plane and management interfaces are reachable.

Denial of service in IBM DataPower Gateway lets unauthenticated remote attackers send crafted network traffic that triggers an out-of-bounds write (CWE-787), degrading or halting the gateway's availability. The flaw affects version lines 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, scoring CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with availability-only impact. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but IBM has published a vendor fix, so internet-facing gateways should be treated as the highest-priority upgrade target.