Buffer Overflow

Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailServer account - crash the mail server service and potentially execute code in its LocalSystem security context by passing an over-long hexadecimal string to the unauthenticated COM method Utilities.BlowfishDecrypt, which copies input of arbitrary length into a fixed 255-byte heap buffer. Because exploitation requires an existing local login (CVSS AV:L/PR:L) and the only confirmed outcome is a service crash, this is an access-gated local privilege-escalation/denial-of-service issue rather than a remotely wormable emergency; no public exploit identified at time of analysis. Vendor fix is available in hMailServer 6.3.4, which contains the reference commit 135a1908ff820ed587d5f180f98c53bd010d8931.

Unauthenticated attackers with access to an adjacent network segment can crash the web management daemon on Brocade Fabric OS versions before 10.0.1 by sending a single HTTP request containing extreme numerical values in a specific URL query parameter. The flaw is an out-of-bounds memory read that triggers an invalid memory dereference, resulting in a denial of service that temporarily disrupts the management plane but does not affect Fibre Channel data-plane traffic. No public exploit code has been identified at the time of analysis, and the primary limiting factor is that the attacker must be on the management LAN rather than the open internet.

Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. Per the assessed vector (AV:A/PR:N/UI:N, C/H/I/A:H), the attacker must be on an adjacent network segment with reachability to the switch's SNMP service (UDP/161) - a materially limiting factor, since switches with SNMP isolated on a dedicated management VLAN are much harder to hit - and no authentication or user interaction is required; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.

Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. By sending crafted API requests with oversized array counts or string lengths, an attacker can cause memory corruption, leading to a denial of service (daemon crash) or potentially arbitrary code execution within the management process. There is no public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 8.6) and requires only low-privileged REST API credentials and network adjacency.

Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's management service or potentially achieve arbitrary code execution by sending a crafted trunk configuration request through the REST API that is padded with an excessive number of list delimiters. The affected code path copies delimiter-separated list strings into a dynamically allocated heap array without validating the maximum number of elements, so a request that overruns the allocation corrupts heap metadata. Exploitation requires high-level (administrator) credentials and adjacent-network reachability to the management interface - a combination that realistically narrows the threat population to malicious insiders or attackers already holding or abusing admin credentials - and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency.

Cyrus SASL clients that use the DIGEST-MD5 authentication mechanism can be crashed by a malicious or on-path server that supplies a crafted challenge field (such as realm or nonce), because the add_to_challenge() function computes a buffer size before DIGEST-MD5 quoting and fails to account for escaping that lengthens the value, resulting in a heap-based out-of-bounds write. This is a client-side denial-of-service flaw affecting Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H, meaning unauthenticated remote attackers must control or intercept the server endpoint and the victim must initiate authentication. No public exploit code or confirmed active exploitation is identified at time of analysis.

Denial of service in the Excelize Go spreadsheet library (github.com/xuri/excelize/v2 2.0.0-2.11.0 and github.com/xuri/excelize 1.1.0-1.4.1) lets an unauthenticated remote attacker terminate the calling process by supplying a crafted workbook. The ColumnNameToNumber function converts bijective base-26 column names into int64 without overflow detection, so an over-long name such as VGWQHXLSDVIKWV wraps to zero and is later used as a slice index by checkSheetR0 and xlsxWorksheet.checkRow, producing a negative index panic during worksheet normalization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), meaning availability-only impact; there is no evidence of confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though the upstream fix commit and PR are public. This is a moderate-severity denial-of-service condition rather than a high-priority emergency, and it is only reachable when an application built on the vulnerable versions parses an untrusted spreadsheet.

Denial of service via out-of-bounds slice access in the Nickname profile of golang.org/x/text/secure/precis (all versions before 0.41.0), where transforming crafted input into a short destination buffer triggers a Go runtime panic. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5), but impact is confined to availability (C:N/I:N/A:H) because Go's memory-safe runtime converts the invalid slice access into a panic rather than exploitable memory corruption. Applications are only exposed if they actually invoke the precis Nickname profile on attacker-controlled strings such as usernames or nicknames; projects that merely depend on x/text without hitting that code path are unaffected. No public exploit identified at time of analysis, and vendor-released patch: golang.org/x/text 0.41.0.

Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless range trigger memory-safety failures on Cisco Meraki MR wireless access points, MV cameras, MX appliances, and Campus Gateway software, with the grouped advisory rated CVSS 9.6 (scope change plus high confidentiality, integrity, and availability impact). Exploitation requires the attacker to already sit on the same broadcast domain, Layer 2 segment, or RF coverage area - the flaw is not reachable from the routed internet - and the hardening bulletin does not disclose which protocol or feature actually triggers the CWE-119 condition. No public exploit code or confirmed active exploitation was identified at time of analysis; the fix ships as part of a vendor internal hardening release rather than a discrete single-version patch.

Remote code execution and denial of service in Cisco NX-OS Software are possible when the SRv6 OAM (NGOAM) and SRv6 features are both enabled, due to a stack-based buffer overflow (CWE-121) from improper input validation of IP traffic. An unauthenticated, remote attacker with network reachability to an IP interface can send crafted packets to execute arbitrary code with root privileges or cause a reload, resulting in a DoS condition. Exploitation requires the non-default configuration of both NGOAM and SRv6 features; no public exploit was identified at time of analysis, and no CISA KEV listing exists.

Remote code execution with root privileges and denial-of-service in Cisco NX-OS Software can be triggered by unauthenticated network attackers when the NGOAM (VXLAN OAM) feature is enabled. Crafted IP packets sent to a device IP interface exploit improper input validation (stack buffer overflow, CWE-121), allowing arbitrary code execution or process crashes that reload the device. No public exploit identified at time of analysis; the non-default NGOAM configuration requirement limits exposure, but this remains a high-priority vulnerability per our independent assessment.

Unauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execution with root privileges - or force a process crash and device reload - by sending crafted packets to the VXLAN Operation, Administration, and Maintenance (NGOAM) feature. The flaw is a stack-based buffer overflow (CWE-121) triggered by insufficient validation of IP traffic, and it is fully unauthenticated and requires no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N), yielding a 9.8 base score. Exploitation is gated by configuration: NGOAM is not part of a default NX-OS base image and must be explicitly enabled, so only VXLAN deployments that have turned the feature on and that expose an IP interface to the attacker are exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high EPSS-relevant severity and pre-auth RCE impact warrant priority patching on any NGOAM-enabled fabric.

Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running in ACI mode, and NX-OS-based software managed through Cisco UCS - carry a vendor CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated attacker with network reachability could potentially cause high confidentiality, integrity, and availability impact. The issues were discovered during a Cisco internal security review and are delivered as part of a bundled software hardening release rather than a single pinpointed defect, so the affected subsystem, protocol, or port is not enumerated in the available data. At time of analysis there is no public exploit identified, CISA SSVC records exploitation as 'none' with automatable 'no', and EPSS is low at 0.28% (19th percentile), indicating manual, targeted rather than scalable risk.

Unauthenticated remote code execution in the NX-API feature of Cisco NX-OS Software lets a remote attacker who can reach the NX-API listener run arbitrary code with root privileges, or crash processes hard enough to force a device reload (DoS), by sending a single crafted HTTP request. Exposure is conditional: NX-API is an optional, non-default feature, so only NX-OS devices and UCS-managed systems where it has been explicitly enabled are vulnerable to an attacker with routing access to the management/HTTP endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required once that exposure exists. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 severity, root-level impact, and full CIA loss make this a high-priority item for any environment exposing the NX-API management plane.

Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote, unauthenticated attackers to cause a denial-of-service condition (process crash/restart) on affected devices. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), and exploitation is limited by reachability to the vulnerable management/control-plane service, which is often segmented on management VLANs or trusted networks. No public exploit code or confirmed active exploitation was identified in the provided data, and Cisco's advisory does not name a specific protocol, port, or feature beyond the hardening release.

Out-of-bounds read in the OpenVPN client before 2.7.8 can be triggered when the client establishes a TLS session with a malicious or compromised server that pushes a crafted option combination touching domain_search_list, producing an unsigned integer underflow that leads to a limited memory disclosure and a high-availability-impact client crash. The defect is client-side rather than a flaw in a server accepting inbound connections, and exploitation requires the attacker to control or impersonate the endpoint the victim connects to (the assessed CVSS 3.1 vector carries PR:L for exactly this reason). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the vendor CVSS 4.0 base score is 7.1 (VC:L/VA:H) and the vendor-released fix is OpenVPN 2.7.8.

A stack-based buffer overflow in Zephyr's Bluetooth Mesh On-Demand Private Proxy solicitation handler lets any BLE device within radio range overwrite a target node's stack with attacker-controlled bytes by sending a non-connectable advertisement carrying an oversized mesh Proxy Solicitation. Exploitation requires no pairing, bonding, provisioning, or key material because the vulnerable copy happens before decryption, but it is limited to nodes built with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV that are currently eligible to be solicited (GATT Proxy disabled, On-Demand Private Proxy enabled) and physically within BLE range (CVSS 8.8, AV:A/PR:N/C:H/I:H/A:H, unauthenticated). Impact ranges from a reliable remote denial of service to plausible remote code execution; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor fix is available.

An integer underflow in Zephyr's IEEE 802.15.4 link-layer security receive path lets any attacker within radio range drive an out-of-bounds read and in-place write of up to roughly 240 bytes into the network buffer pool. When CONFIG_NET_L2_IEEE802154_SECURITY is enabled and a security session at a level other than IEEE802154_SECURITY_LEVEL_NONE is established, a single crafted data frame whose payload is shorter than the configured authentication tag makes payload_len wrap to as large as 255, so CCM decryption reads several hundred bytes past the end of the exactly-sized receive buffer - and this happens before the tag is ever verified, so no key material, association, authentication, or user interaction is needed (CVSS 8.1, AV:A/AC:L/PR:N/UI:N). The primary impact is memory corruption and denial of service rather than information disclosure, since the out-of-bounds bytes are not attacker-chosen and the frame is dropped when tag verification fails; no public exploit code was identified at time of analysis, and exposure is limited to builds that enable this non-default, experimental security feature.

Out-of-bounds write in the TLS 1.3 client of Eclipse ThreadX NetX Duo 6.5.1.202602 allows a malicious or compromised server to corrupt memory in the session control block by sending an oversized handshake message before certificate authentication completes, potentially achieving code execution or causing denial of service. The flaw is client-side and unauthenticated from the network perspective, requiring the victim device to initiate a TLS 1.3 handshake to an attacker-controlled server; no valid server certificate is needed and certificate pinning does not prevent exploitation. No public exploit code was identified at time of analysis, but the CVSS 9.3 base score and the pre-authentication nature make this a high-priority memory-corruption issue for affected embedded deployments.

VMware Workstation and Fusion (25H2 and 26H1) carry a stack-based buffer overflow in the HGFS Host-Guest File System component used for shared folders, letting an attacker who already holds administrative privileges inside a guest VM execute code as the VMX process on the host and thereby break the guest-to-host isolation boundary. This is a VMware guest-to-host escape, a genuinely high-value class of flaw because it defeats the primary security boundary of virtualization, though the realities of exploitation are gated: the attacker needs a pre-existing local admin foothold in the guest, HGFS must be reachable, and the CVSS vector's AC:H signals that the overflow must be shaped to bypass host memory protections. Vendor-released patch is available in Workstation/Fusion 26H1u1; no CISA KEV listing and no public exploit code was identified at time of analysis, and no EPSS score was supplied in the source data, so the practical risk concentrates on multi-tenant, untrusted-guest, or shared-lab deployments rather than single-user desktops.

Guest-to-host code execution in VMware Workstation and Fusion 25H2 and 26H1 lets an attacker who already holds local administrative privileges inside a guest VM equipped with the VMXNET3 virtual network adapter escape the hypervisor isolation boundary and run code on the host. The flaw is an integer overflow (CWE-190) in the virtual NIC's device emulation and carries a CVSS 9.3 with Scope:Changed, placing it in the most severe class of hypervisor defects; it is not remotely reachable, since the attacker must first obtain a guest admin foothold and the target guest must use a VMXNET3 adapter. No public exploit code has been identified at time of analysis, and patched builds are available as 26H1u1 for both products.

Heap buffer overflow in the glamor acceleration path of the X.Org X server (and Xwayland) allows an authenticated local X client to corrupt the server's heap, with the potential for code execution or a server crash, although reliable exploitation is assessed as high-complexity. The flaw is addressed in the October 2026 X.Org security release, which fixes a bundle of XKB, Present, XInput, GLX and XFixes issues in xorg-server 21.1.25 and xwayland 24.1.14. No public exploit code and no CISA KEV entry were identified at time of analysis; no CVSS vector or EPSS score was supplied for this CVE, and the input itself does not contain a CVE-2026-93523 advisory entry, so the mapping of this identifier to the glamor size-calculation overflow is inferred from an associated upstream commit rather than confirmed by vendor text.

Heap out-of-bounds write in the X.Org X server (versions prior to xorg-server-21.1.25) and Xwayland (versions prior to xwayland-24.1.14) allows an authenticated X client to corrupt heap memory by issuing an XkbChangeKeycodeRange request that sets a keycode range where MAP_LENGTH exceeds max_key_code+1, leaving XkbAllocNames under-allocated while the subsequent memset writes MAP_LENGTH bytes. The flaw is an incomplete fix of an earlier XKB keycode-range change (commit a3171732d) and is scored locally as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must already hold an authorized X connection - a local session, a compromised GUI application on the same display, or a forwarded X session - rather than merely reaching the host over the network. No CVSS vector, EPSS score, KEV listing, or public exploit code is present in the supplied data, so this analysis rests solely on the X.Org advisory text and no public exploit has been identified at time of analysis; the same October 7, 2026 advisory bundles six further memory-safety issues (CVE-2026-88812, -93515, -93516, -93517, -93518, -93519) fixed in the same releases.

Use-after-free in the Present extension of X.Org X server before 21.1.25 and Xwayland before 24.1.14 lets an authenticated X client crash the display server and potentially expose limited process memory. An attacker with the ability to open an X display connection creates cross-window Present notify entries pointing at a separate target window and then destroys that window, so the freed per-window notify list is traversed after present_clear_window_notifies() releases the window's private data without unlinking the entries; both the Present and SYNC extensions must be enabled, which they are by default. The issue is a local, low-privilege, user-interaction-free memory-safety bug (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H), and no CISA KEV listing, EPSS score, or public exploit code was identified at time of analysis.

Heap-based buffer overflow in X.Org X server and Xwayland's glamor acceleration backend (glamor_upload_boxes) allows an authenticated local X client to cause memory corruption, potentially leading to arbitrary code execution or denial of service. The flaw occurs when a 24-bit drawable is used with a 32-bit pixmap and crafted dimensions trigger an integer overflow in size calculation, affecting X.Org X server versions prior to 21.1.25 and Xwayland versions prior to 24.1.14. No public exploit code or active exploitation has been identified at time of analysis, but the vulnerability requires a local authenticated connection and glamor hardware acceleration to be enabled.

Heap-based buffer overflow in X.Org X server and Xwayland GLX RenderLarge request handling allows an authenticated local X client to write past the allocated heap buffer, potentially achieving arbitrary code execution or causing denial of service. Affected versions are xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14; the attacker must already be able to open an X display with GLX available, which by default means local Unix-socket access rather than remote unauthenticated access. No public exploit identified at time of analysis.

Multiple memory-safety defects in X.Org X server prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14 let an authenticated X client corrupt server heap and stack memory through crafted XKB, Present, XInput2, GLX and XFixes protocol requests, causing crashes or potentially arbitrary code execution inside the X server process. The flaws include a double free in XKB SetGeometry TextDoodad handling, use-after-frees in the Present cross-window notify path and in XInput passive grabs after XIRemoveMaster, heap overflows in GLX RenderLarge and XkbResizeKeyType, an XFixes pointer-barrier event buffer overflow, and an incomplete-fix out-of-bounds write in the XKB ChangeKeycodeRange path. Exploitation requires a connection already authorized to the X server (typically a local user session, an X11-forwarded session, or a multi-seat/shared-display host); no public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Pure-Wayland deployments that do not run Xwayland are not exposed.

A use-after-free in the XInput2 passive grab handling of X.Org X server builds prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14 allows an authenticated client that can add and remove XI2 master devices to crash the server or potentially achieve arbitrary code execution. The attacker creates a passive grab whose modifierDevice points at a master device, then calls XIRemoveMaster to free that device; the grab retains a dangling DeviceIntPtr that later input processing dereferences, corrupting the heap. Reaching the vulnerable code requires a valid client connection to the X server or Xwayland (typically local, since modern X servers do not listen on TCP by default) and the XI2 extension, which is enabled by default; no public exploit code and no CISA KEV entry have been identified at time of analysis.

Heap buffer overflow in X.Org X Server versions prior to 21.1.25 and in Xwayland prior to 24.1.14 stems from an integer truncation inside XkbResizeKeyType(), where the computed key-symbol count is stored in an unsigned short and wraps for sufficiently large nTotal values, yielding an undersized allocation that subsequent writes overflow. The X.Org advisory of October 2026 states the trigger is an X client sending crafted XKB requests that resize a key type with a large nTotal; because no CVSS vector was supplied, authentication requirements are not confirmed from available data, and the advisory's own phrasing describes the actor as an authenticated X client. No CVSS score, EPSS estimate, CISA KEV listing, or public exploit code was available at time of analysis, so no public exploit identified at time of analysis; the vendor assesses the impact as heap corruption that can lead to arbitrary code execution or denial of service. This CVE is one of seven flaws disclosed together in the same X.Org security advisory.

A double free in the X.Org X server's XKB SetGeometry request handler (CVE-2026-88812) lets an authenticated X client that is already able to connect to the target display corrupt heap memory by sending a crafted XkbSetGeometry request containing a malformed TextDoodad entry, with outcomes ranging from a server crash to potential arbitrary code execution. Only builds of xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14 are affected, and the XKB extension required for the trigger is standard and enabled by default. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation presupposes an existing local/same-session X connection rather than remote or unauthenticated access, and no public exploit code, EPSS score, or CISA KEV entry appears in the supplied data, so reliable code execution additionally depends on defeating heap allocator hardening.

Heap memory corruption in the X.Org X server (prior to 21.1.25) and Xwayland (prior to 24.1.14) arises from a cluster of flaws disclosed in the October 2026 X.Org security advisory, for which CVE-2026-93524 serves as the coordinating identifier. An authenticated local X client that can already open and authenticate to the display socket can trigger double-free, use-after-free, numeric-truncation and heap buffer overflow conditions across the XKB, Present, XInput, GLX and XFixes extensions, causing server crashes and - where heap layout protections are defeated - potentially arbitrary code execution. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; no public exploit code, EPSS score or CISA KEV listing was present in the source data, so no public exploit is identified at time of analysis, and the advisory text does not state the specific trigger conditions for CVE-2026-93524 itself.

Buffer overflow in X.Org X Server's XFixes extension (and Xwayland) allows an authenticated local X client to trigger a stack or heap overflow by creating more than 100 pointer barriers and generating pointer motion events, potentially leading to arbitrary code execution or denial of service. The flaw, tracked as CVE-2026-93519, affects X.Org X server versions prior to 21.1.25 and Xwayland versions prior to 24.1.14. No public exploit code or active exploitation has been identified at time of analysis; independent assessment assigns a CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

A stack-based buffer overflow in ASUS router firmware modules lets an attacker who already holds administrative credentials on the device and is connected to the same local or Wi-Fi network segment execute arbitrary code by uploading a crafted configuration file that exceeds an expected buffer size. The flaw is rated CVSS 4.0 9.3 (Critical) and assessed as CVSS 3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, because successful exploitation yields full compromise of confidentiality, integrity and availability of the router, although the adjacent-network (AV:A) and high-privilege (PR:H) requirements exclude anonymous Internet-wide attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; vendor guidance is available through the ASUS Security Advisory.

Gitea instances up to and including 1.27.3 can be crashed by a repository administrator who configures an external issue tracker link format whose regular expression uses alternation with separate capture groups; the resulting invalid slice index triggers a Go runtime panic that terminates the Gitea process, and because rendering is triggered on later page views (for example a README containing matching text), the crash hits every user of the instance, not just the configurator. Exploitation requires an actor able to edit a repository's external issue tracker settings - on instances that permit self-service repository creation this effectively means any authenticated user on their own repository - so the practical barrier is configuration privilege rather than anonymity. Independent signals are moderate and partly conflicting: EPSS is only 0.16% (4th percentile), CISA SSVC rates exploitation as 'none' with partial technical impact, no CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor fix ships in Gitea 28.0.0.

Buffer overflow in the HPE Aruba ClearPass Policy Manager OnGuard agent lets an authenticated local user execute arbitrary code with elevated privileges or crash the agent, disrupting endpoint posture enforcement. Exploitation requires an existing low-privileged session on the endpoint where the agent is installed and running and cannot be triggered remotely, since the attack vector is local (AV:L, PR:L) while the privilege gain is High across confidentiality, integrity, and availability. HPE has published a vendor advisory, but no public exploit code has been identified at time of analysis; at CVSS 7.8 this is a credible but not emergency-level priority, most relevant to hosts where unprivileged local users and the OnGuard agent coexist.

Unauthenticated remote attackers can trigger buffer overflows in an interface of HPE Aruba AOS-S (ArubaOS-Switch) that is not named in the advisory, allowing them to expose sensitive memory contents and crash the device for a denial of service. The flaw is rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), so no credentials or user interaction are required, although realistic attacker reach is heavily conditioned on whether the specific vulnerable interface is exposed to untrusted networks. No public exploit code has been identified and the CVE is not in CISA KEV, so it is not confirmed actively exploited at time of analysis.

An unauthenticated buffer overflow in HPE Aruba AOS-S switch software lets an attacker who already sits on an adjacent Layer 2 network segment read out sensitive memory contents and crash the device, producing a denial of service. The flaw carries a CVSS 3.1 base score of 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H), meaning no credentials or user interaction are needed, but the attacker must be able to reach the switch from an adjacent network rather than across the internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is real and high-severity for organizations running Aruba/HPE switching infrastructure yet bounded by the adjacent-network attack vector. The HPE security advisory (hpesbnw05156en_us) is the authoritative source for affected builds and fixed firmware.

Memory corruption flaws in HPE Aruba Networking AOS-S switch firmware allow an unauthenticated attacker who is positioned on the same Layer-2/adjacent network segment to corrupt memory and potentially execute arbitrary code on the switch (CVSS 9.6, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation requires network adjacency - a directly connected device, a compromised host on the same VLAN/broadcast domain, or an attacker already inside the local network - but within that position no credentials and no user interaction are needed, and attack complexity is low, so default-configured, unpatched switches are exposed by sending crafted traffic to the vulnerable handler. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the primary exposure limiter is physical/logical access to the switch segment rather than remote internet reachability.

Unauthenticated remote code execution affects the AOS-S switch firmware line from HPE Aruba, where a buffer overflow in a network-facing interface can be triggered by a remote attacker without credentials, user interaction, or a privileged network position (CVSS 9.8, AV:N/AC:L/PR:N/UI:N, full confidentiality, integrity, and availability impact). The practical barrier to exploitation is reachability of the specific affected interface on the switch rather than any authentication control, so switches whose management or service interfaces are exposed beyond a segmented management network carry the highest risk. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the advisory does not name the vulnerable service, port, protocol, or the affected and fixed firmware versions, so defenders must confirm exposure against HPE bulletin hpesbnw05156en_us.

Memory corruption in the wired-uplink network endpoints of Arista Wi-Fi access points lets an unauthenticated attacker who already sits on the same Layer-2 segment as the AP's wired uplink crash the sensor service and, under specific preconditions, potentially achieve remote code execution. No authentication or user interaction is required, but the vulnerability is scored adjacent-network (AV:A) with an explicit attack precondition (AT:P in the CVSS 4.0 vector), so the dependable outcome is a denial-of-service crash of the sensor service while full code execution is condition-dependent; no public exploit code has been identified at time of analysis. Because exploitation demands Layer-2 adjacency to the uplink segment, segmentation of management/uplink VLANs is the single most effective exposure reducer.

Unauthenticated adjacent-network attackers can crash or potentially execute arbitrary code on Arista Wi-Fi access points when the packet-capture service is running in an uncommon non-default streaming mode. The flaw is a stack-based buffer overflow (CWE-121) triggered by a crafted packet to the capture service; no authentication or user interaction is required, but the attacker must have Layer-2/adjacent access and the target must already have the non-default streaming mode enabled, so default-configured devices are not exposed. No public exploit code was identified at time of analysis, and this is a conditional priority rather than a drop-everything emergency because exploitation depends on that deliberately enabled configuration.

Unauthenticated attackers within radio-frequency (RF) proximity can crash the WIPS sensor service on affected Arista access points or potentially achieve remote code execution by sending a crafted frame. The vulnerability, an out-of-bounds write (CWE-787), affects APs with Wireless Intrusion Prevention System (WIPS) enabled and requires no wireless association, authentication, or user interaction. No public exploit has been identified at time of analysis; the CVSS 4.0 score is 8.7, and while not a mass-internet-exploitation emergency, it is an operational-priority issue for Arista wireless environments because successful exploitation disables WIPS monitoring and may allow code execution on the AP.

Unauthenticated, network-adjacent attackers can crash - and potentially execute arbitrary code on - Arista Wi-Fi access points by sending a crafted packet to the wireless gateway service, provided the captive portal or application firewall feature is enabled on at least one SSID. The flaw is a stack-based buffer overflow (CWE-121) rated 9.4 under CVSS 4.0 (AV:A/AC:L/PR:N/UI:N with all impact metrics High and scope change), and because the wireless gateway service restarts automatically after a crash, an attacker can retry indefinitely. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not listed in CISA KEV); exposure is limited to devices where a vulnerable feature is actually enabled and to attackers within wireless range or on an adjacent network segment.

Heap-based buffer overflow in HDF5 (The HDF Group) before 2.2.0 lets an attacker who supplies a crafted HDF5 file corrupt heap memory in any application linked against the library, causing a crash and potentially achieving arbitrary code execution. The flaw lives in H5VM_array_fill() (src/H5VM.c) and is triggered when a dataset's unallocated/unwritten chunks are read: H5D__fill_init() derives the fill-value buffer from datatype and dataspace metadata stored in the file, and when that metadata is inconsistent with the buffer's allocated size the write overruns the buffer with attacker-controlled fill-value bytes. Exploitation is not network-reachable - it requires a victim to open or automatically process the malicious file (AV:L, UI:P per CVSS 4.0; UI:R in the 3.1 assessment), so risk is highest in data-ingest, HPC and ML pipelines that parse untrusted HDF5 inputs without an interactive user; no public exploit code has been identified at time of analysis and there is no KEV listing, though the CVSS 4.0 base score of 8.5 reflects high confidentiality, integrity and availability impact.

Heap-based buffer overflow in GIMP's DirectDraw Surface (DDS) loader allows attackers to corrupt memory and potentially execute arbitrary code by convincing a user to open a crafted .dds image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and requires local file access plus user interaction (opening the malicious file) with no authentication required per the CVSS vector (PR:N). No public exploit code has been identified at time of analysis, and exploitation is limited to the privileges of the user running GIMP.

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript or EPS document, chaining memory corruption in document parsing with a runtime bypass of the -dSAFER sandbox. The flaw affects Ghostscript as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no privileges are required but a victim or automated pipeline must render the malicious file, with the malicious document first reaching the processing system. Publicly available exploit code exists, including a GitHub proof-of-concept, but the provided data does not confirm CISA KEV active exploitation, so -dSAFER should not be treated as a protective mitigation for affected versions.

Sandbox escape in Google Chrome before 155.0.8059.39 via a heap-based buffer overflow (CWE-122) in ANGLE, Chrome's graphics translation layer: a remote attacker who has already compromised a sandboxed renderer process can use a crafted HTML page to execute arbitrary code outside the sandbox. It is a second-stage primitive rather than an initial-access bug - the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H (8.3) reflects high attack complexity, a required pre-existing renderer exploit chain, and active user interaction (UI:R), with the scope change S:C capturing the crossing of the sandbox boundary, even though Chromium rates the underlying bug Low severity. No public exploit code was identified at time of analysis and CISA's SSVC data records no observed exploitation, so the headline 8.3 should be weighed against the significant preconditions.

An out-of-bounds write in the Media component of Google Chrome before 155.0.8059.39 lets a remote attacker corrupt memory and potentially achieve arbitrary code execution outside the browser sandbox when a victim opens an attacker-crafted HTML page containing malicious media content. The attack is fully remote and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is gated by user interaction (UI:R) - the victim must visit the malicious or compromised page - and the 'outside the sandbox' outcome implies defeating Chrome's process sandbox, which is materially harder in practice than the 9.6 base score suggests. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build.

Heap-based buffer overflow in Google Chrome's font-handling code (CWE-122) lets an attacker who has already compromised the renderer process execute arbitrary code outside the sandbox when a victim renders a crafted HTML page containing malicious font data. All Chrome builds prior to 155.0.8059.39 on default configurations are affected; exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) and a pre-existing renderer compromise, so it functions as a sandbox-escape chain component rather than a standalone drive-by, and is rated high complexity (AC:H) despite a CVSS base of 8.3 (S:C). No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no exploitation, but the vendor has shipped a fix in 155.0.8059.39.

Heap corruption and process termination in SixLabors ImageSharp 3.0.0 through 4.1.0 can be triggered by decoding a crafted tiled TIFF that uses CCITT fax compression (T4, T6, or Modified Huffman) with a TileWidth smaller than ImageWidth. Because DestinationBuffer is sized by TileWidth while TiffDecompressorsFactory.Create instantiates the fax decompressor with the full frame width, attacker-controlled scanlines overflow the tile buffer, producing out-of-bounds writes and CWE-787 heap corruption. The flaw is remotely reachable, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), and is scored availability-only. No public exploit code has been identified at time of analysis, and the issue is fixed in version 4.1.1.

Heap buffer overflow in SixLabors ImageSharp (all versions from 3.0.0 up to but excluding 4.1.1) is triggered when the library decodes a strip-organized TIFF file that uses CCITT Group 3 (T4) or Modified Huffman compression: attacker-controlled run lengths are written into the strip buffer before the current row width is validated, corrupting heap memory and terminating the host process. Exploitation is remote and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), but the realistic outcome is denial of service - a crash - rather than data disclosure or modification, and no public exploit code was identified at time of analysis. The issue is fixed in ImageSharp 4.1.1 via the vendor advisory GHSA-jj3q-cwqj-842r and pull request #3176.

Out-of-bounds heap writes in the ImageSharp TIFF CCITT Group 4 (T6) fax encoder, affecting versions 2.1.0 through 4.1.1, allow attacker-supplied image data to corrupt memory and terminate the process. The encoder allocates only Width × rowsPerStrip bytes for a strip while T6BitCompressor.CompressStrip can emit encoded row data plus two 12-bit end-of-facsimile-block codes beyond that capacity, and TiffCcittCompressor.WriteCode performs the writes without bounds checks; a decode-and-re-encode flow that inherits TiffCompression.CcittGroup4Fax and one-bit bilevel metadata from the input reaches this path, giving unauthenticated remote attackers a denial-of-service primitive (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H). Impact is confined to availability - no confidentiality or integrity effect - and there is no public exploit code identified at time of analysis and no CISA KEV listing; the issue is fixed in version 4.1.2.

Denial of service in SixLabors ImageSharp (2.0.0 up to but not including 4.1.2) lets a remote, unauthenticated attacker terminate an image-processing process by supplying a crafted 32-bit floating-point TIFF. The attack only succeeds when the consuming application decodes that TIFF into an Image<HalfVector4> and then applies the global HistogramEqualization processor, at which point a non-finite or out-of-range BT.709 luminance value is consumed as an unchecked histogram offset in GrayscaleLevelsRowOperation.Invoke, producing an out-of-bounds access (CWE-787) and process termination. Impact is availability-only (CVSS 7.5, C:N/I:N/A:H); Adaptive Histogram Equalization and AutoLevel are explicitly unaffected, and no public exploit code or CISA KEV listing was identified at time of analysis.

Memory corruption in SixLabors ImageSharp 4.0.0 through 4.1.1 allows an unauthenticated remote attacker to crash or destabilize a host process by supplying an image whose embedded ICC profile declares more than four LUT16 input/output channels, causing out-of-bounds writes past a four-float internal buffer. The flaw is only reachable when an application has explicitly set DecoderOptions.ColorProfileHandling to Convert, since the default Preserve mode does not run ICC conversion; the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only impact rather than data disclosure or modification. No public exploit code was identified at time of analysis, and the issue is fixed in version 4.1.2.

TIFF encoding in SixLabors ImageSharp 2.0.0 through 4.1.1 can write past the end of an undersized compressed-data buffer when CCITT Group 3 fax compression is used on narrow 1-bit images, corrupting process memory and typically terminating the process. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) only when the host application either explicitly selects TiffCompression.CcittGroup3Fax during encoding or inherits that compression setting from attacker-supplied TIFF metadata in a decode-and-re-encode flow; the impact is limited to availability (denial of service), with no confidentiality or integrity loss assessed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 4.1.2.

Heap buffer overflow in libmikmod's Oktalyzer (.okt) loader lets a crafted module corrupt heap memory and potentially achieve code execution, because a 16-bit track-count field (numtrk = numpat * numchn) can be made to wrap while pattern data is still written for the full, unwrapped track count. Any application linked against libmikmod before 3.3.14 is affected, and exploitation requires the victim to open or otherwise process an attacker-supplied .okt file, matching the independently assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R (7.8) rather than a remotely reachable condition. No public exploit identified at time of analysis, and the 3.3.14 release rejects overflowing track counts outright.

Heap buffer overflow in libmikmod before 3.3.14 is triggered when an application linked against the library parses a crafted DSM module whose numchn and numpat header fields produce a product that overflows the 16-bit UWORD truncation in DSM_Load(), corrupting heap memory and potentially enabling code execution. The issue is local and file-based: an attacker must deliver a malicious DSM file and a victim must open or play it, so it is not a drive-by remote threat; no authentication or special privileges are required, and no public exploit has been identified at time of analysis. A vendor-released patch is available in libmikmod 3.3.14.

Out-of-bounds kernel memory writes in the WibuKey driver for Windows below version 6.72 allow an authenticated, locally logged-on low-privileged user who can send input to the driver (for example via a device IOCTL) to crash the affected system and, under unfavorable kernel heap layouts, modify adjacent kernel memory. Because the flaw requires local access and authentication and depends on uncontrolled kernel memory layout, reliability is limited primarily to denial of service, with adjacent-memory modification explicitly conditional rather than a guaranteed outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is local-only with no network vector.

Out-of-bounds read and write in the Linux kernel's RDMA Soft-RoCE (rxe) driver (CVE-2026-98365) lets an unauthenticated peer on an already-established RDMA queue pair send a crafted RDMA-Write or RDMA-Read RETH whose iova+length wraps to zero, bypassing the mr_check_range() bounds check and causing a kernel oops (and possible memory corruption) in rxe_mr_copy_xarray(). No public exploit code was identified at time of analysis and EPSS is low at 0.17% (5th percentile), but realistic exposure is gated by configuration: the rdma_rxe module must be loaded and the host must expose Soft-RoCE on a reachable interface, which is not the default Linux setup. Vendor-released patches are available in stable kernels 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.

Memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) allows a local user with write access to a mounted share to trigger out-of-bounds writes and a massive heap/stack overflow by creating a native symlink whose absolute target lacks an NT drive prefix. Affected code ships in mainline Linux from 6.15.6 onward and is patched in 6.16, with stable backports in 7.2.8 and 7.3-rc4 per EUVD; exploitation requires a Linux client to have mounted a share using default settings (symlinkroot unset) and an attacker able to place a crafted symlink on that share, matching the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector. Impact is high confidentiality, integrity and availability loss through kernel memory corruption, though EPSS is only 0.16% (5th percentile) and no public exploit code has been identified at time of analysis - no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Memory corruption and scope-changing host impact in the Linux kernel's PowerPC IOMMU TCE handling affect ppc64 systems where a local low-privileged actor can invoke multi-page TCE hypercalls such as H_STUFF_TCE or H_PUT_TCE_INDIRECT with npages greater than 1. The flaw is in iommu_tce_check_ioba(), which used a hardcoded page count of 1 instead of the caller-supplied npages, so the intended bounds check can be bypassed and the TCE table capacity may be exceeded, yielding the assessed full confidentiality, integrity, and availability impact on the host under a scope-changing vector. No public exploit identified at time of analysis, no CISA KEV entry was provided, and EPSS is low at 0.18% (7th percentile); vendor patches are available.

Use-after-free and out-of-bounds pointer handling in the Linux kernel CIFS/SMB client (cifs.ko) lets a malicious or man-in-the-middle SMB server corrupt kernel memory on a connecting client by returning crafted encrypted compound PDUs. The defect sits in receive_encrypted_standard(), where a stale next_buffer pointer retained on error paths and unvalidated NextCommand/next_cmd offsets taken from pre-decryption length can lead to use-after-free and reads beyond the reassembly buffer, affecting confidentiality, integrity and availability of the host. Exploitation requires the victim to act as an SMB client and mount or connect to an attacker-controlled share, with SMB3 encryption/sealing negotiated and attacker-controlled server responses; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and vendor-released patches exist for the affected stable trees.

Stack-based buffer overflow in the Tenda AC5 router's web management interface allows an authenticated remote attacker to corrupt memory and potentially execute code by submitting an oversized wifiPwd argument to /goform/setWifi on firmware 02.03.01.111_multi. Exploitation requires network reachability to the device's HTTP management interface plus a valid low-privilege administrative session (CVSS vector PR:L), meaning fully unauthenticated attackers cannot trigger it against a hardened default configuration unless the management port is openly exposed. Publicly available exploit code exists (a detailed write-up has been published on GitHub), and the vulnerability carries a CVSS 4.0 base score of 8.6 with high confidentiality, integrity and availability impact; there is no CISA KEV listing indicating confirmed active exploitation, and no vendor patch has been identified from the available references.

Memory corruption - specifically a use-after-free (CWE-416) - in Qualcomm Snapdragon components lets a locally-positioned attacker holding low privileges corrupt memory while the platform processes service requests, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: the attacker must already have a foothold on the device, such as a malicious or compromised application capable of reaching the affected Qualcomm service interface, and no user interaction is needed once that foothold exists. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, and because the available data does not name the specific service, chipset model, or configuration, the precise triggering interface should be verified against the Qualcomm October 2026 security bulletin.

Memory corruption in Qualcomm Snapdragon system service routines allows a locally installed, low-privileged application to trigger a use-after-free by supplying a malformed input buffer, potentially achieving code execution at the privilege level of the affected service and thereby compromising confidentiality, integrity, and availability. The flaw is scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is access-gated: the attacker must already be executing code on the device with low privileges and must be able to reach and invoke the vulnerable routine - there is no remote or network vector, and no user interaction is required once that code runs. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliable exploitation would generally require heap grooming of the target service, and actual exposure depends on the specific Snapdragon chipset and firmware build listed in Qualcomm's October 2026 security bulletin.

Memory corruption via a use-after-free in the FastRPC implementation on Qualcomm Snapdragon platforms allows a local attacker with low-privilege code execution to escalate privileges and compromise confidentiality, integrity, and availability of the affected device. Triggering the bug requires a pre-existing foothold - code able to open the FastRPC driver interface and drive DSP invocations - plus concurrent asynchronous threads that race shared performance counter data, so successful exploitation depends on winning a timing window rather than a deterministic primitive. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; because the vector is local-only (AV:L) with no network reachability, this is a genuine but not emergency-grade priority.

A transient denial-of-service condition affects Qualcomm Snapdragon firmware when it processes a continuous receive command containing a zero-sized global configuration override, causing a buffer over-read that temporarily disrupts the device. Per the independent assessment, exploitation requires an attacker to reach the firmware command-processing interface, likely from adjacent radio range or a position on the relevant communication channel, with no authentication or user interaction required and low complexity. The impact is limited to a self-recovering availability loss, with no data exposure or code execution, and no public exploit has been identified at time of analysis; risk is moderate rather than top-tier urgency.

Memory corruption in Qualcomm Snapdragon graphics command-list processing allows a local low-privileged attacker to corrupt GPU driver memory by submitting draw objects of an incorrect type, scored CVSS 7.8. Exploitation requires the ability to execute code locally on a Snapdragon device and submit graphics command lists to the GPU driver, typically achievable by any installed application or a compromised process with access to the graphics/rendering stack; no user interaction is required. There is no remote network path, and no public exploit identified at time of analysis, though exact affected Snapdragon chipset and driver versions should be confirmed against the Qualcomm October 2026 bulletin.

Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Use-after-free memory corruption affecting Qualcomm Snapdragon platforms lets a local, low-privileged attacker (PR:L, AV:L, UI:N) trigger concurrent operations on shared memory page lists that are not properly synchronized, potentially reusing freed memory and gaining high impact to confidentiality, integrity, and availability. Because the root cause is a race condition (CWE-416), exploitation is timing-dependent and may require repeated attempts; the attacker must already have code running on the device, so there is no remote or network attack path. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor advisory is the October 2026 Qualcomm security bulletin. Note that the independent assessment rates this as AC:H (high attack complexity; score 7.0) rather than the submitted CVSS 7.8 with AC:L, reflecting the difficulty of reliably winning the race.

Memory corruption in the Qualcomm Snapdragon boot chain allows an attacker who already controls the non-secure loader to rewrite page tables during the narrow window before secure memory is initialized, corrupting memory used by secure-world setup and bypassing an authorization boundary (CWE-862) with high confidentiality, integrity, and availability impact. Exploitation is strictly local (AV:L) and requires pre-existing privilege in the boot chain (PR:L), with no remote or unauthenticated path, which limits this to attackers who have already compromised or can influence the device boot process. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Qualcomm published the fix details in its October 2026 security bulletin.

An out-of-bounds write in Oracle VM VirtualBox before 7.2.8 lets a user with a foothold inside a guest VM corrupt memory in the host-side hypervisor process through the emulated PCNet (Am79C970A) network adapter. The flaw sits in pcnetReceiveNoSync in DevPCNet.cpp, and because the write crosses the guest-to-host boundary it can lead to host memory corruption and potential code execution in the VirtualBox process, though integrity and availability impacts are the primary outcomes. Exposure is materially narrower than the vendor-supplied 9.1 network-vector score implies: the vulnerable code path is only reachable when the VM is explicitly configured with the legacy PCNet NIC rather than VirtualBox's modern Intel PRO/1000 or virtio-net defaults, and the attacker must already have local user-level access in the guest. No public exploit has been identified at time of analysis, SSVC records exploitation as none, and there is no CISA KEV listing.

Unauthorized code execution during the boot process is possible on AMD Zynq UltraScale+ MPSoC, Zynq UltraScale+ RFSoC, and Kria SOM devices when an attacker with physical or local USB access can drive oversized Device Firmware Upgrade (DFU) download requests while the device is held in USB boot mode. The flaw is an out-of-bounds write (CWE-787) in the USB boot-mode DFU path: missing boundary validation allows the download to overflow the DDR receive buffer and corrupt adjacent First Stage Boot Loader (FSBL) memory before the FSBL hands off to later boot stages. AMD rates this 7.5 (CVSS 4.0 AV:L/AC:L/AT:P/PR:N/UI:N with High confidentiality, integrity, and availability impact to the device); no public exploit code and no confirmed active exploitation were identified at time of analysis, and practical exposure is limited to devices whose boot configuration actually permits USB boot rather than QSPI/eMMC/SD.

Remote denial of service in Google Android 14, 15, 16, 16 QPR2, and 17 allows an unauthenticated attacker to crash the device's message-parsing path and cause persistent disruption by sending a crafted MMS/WAP PDU that PduParser.java decodes without an adequate bounds check. Because MMS PDUs are parsed automatically upon receipt, no user interaction or credentials are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); the only practical precondition is that the attacker can route an MMS to the victim's handset, which normally implies knowing the phone number and having carrier MMS reachability. CISA's SSVC evaluation records exploitation as none with no public exploit identified at time of analysis, although the flaw is classified as automatable, and impact is confined to availability (crash / persistent denial of service) with no confidentiality, integrity, or privilege gain.

Local privilege escalation in Google Android 14 through 17 (including 16-qpr2) arises from type-confusion memory corruption in multiple platform locations, letting a process that already has a low-privilege foothold on the device gain high-privilege code execution with confidentiality, integrity, and availability impact. Based on the CVSS vector (AV:L/AC:L/PR:L/UI:N), exploitation requires the attacker to already run code locally in a low-privileged context - a malicious or compromised app in its sandbox - and needs no user interaction and no special configuration; the flaw is reachable in default builds of the affected versions. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the issue as not automatable, and a vendor-released fix is available through the October 2026 Android Security Bulletin (patch level 2026-10-01), so this is a genuine but not emergency-grade priority - the key limiting factor is the need for an existing on-device foothold rather than remote reachability.

Heap-based out-of-bounds write in Android's Bluetooth stack, specifically the cfg2prop routine in btif_storage.cc, can be triggered when the Bluetooth subsystem converts attacker-influenced bonded/stored device configuration data into Bluetooth properties, potentially leading to remote code execution. Affected builds are Android 16, Android 16-qpr2, and Android 17; the assessed vector requires low privileges (PR:L, consistent with a pairing/component-level context) and no user interaction, and real-world reachability is expected to be radio-adjacent (a nearby, paired, or spoofed Bluetooth device) rather than arbitrary internet access, even though the vendor-assigned vector carries AV:N. No public exploit code has been identified and SSVC records exploitation as none at time of analysis, but the flaw is memory-corruption class with total technical impact, so it warrants priority patching on devices where Bluetooth is enabled and pairing is common.

Local privilege escalation in Google Android (versions 14, 15, 16, 16-qpr2, and 17) allows an attacker who already holds a local foothold to write outside intended memory bounds and elevate privileges to a higher-privileged context. The flaw is an incorrect bounds check producing an out-of-bounds write (CWE-119) in multiple locations, rated CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - exploitable by an unprivileged app on the device, with high complexity of preconditions but low attack complexity once a foothold exists, and no user interaction required. Exploitation is not automatable per the CISA SSVC assessment, no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing).

Local privilege escalation in Google Android 17 arises from an out-of-bounds write in the stpropnci_process function of stpropnci.cc, where an incorrect bounds check lets a low-privileged local process corrupt memory, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the attacker to already have local code execution on the device - an ordinary low-privileged app able to reach the vulnerable function and supply triggering input - after which no additional execution privileges and no user interaction are needed; there is no network-facing or remote trigger, so a foothold must first be obtained or the flaw chained behind a separate remote bug. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), making this a genuine but second-tier priority relative to remotely reachable Android flaws.

Memory corruption in Google Android 16, Android 16-qpr2, and Android 17 lets an attacker who already has low-privilege code executing on the device - for example a malicious or compromised installed app - turn uninitialized-memory handling into an out-of-bounds write and escalate to full privileges with no further execution privileges and no user interaction. The weakness is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which requires a pre-existing local foothold rather than a purely network-reachable entry point, and exploitation is only possible on builds that have not applied the 2026-10-01 Android security patch. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a high-priority patch item rather than an emergency, and it is not listed in CISA KEV.

Local privilege escalation in Google Android 14, 15, 16, 16 QPR2 and 17 is possible through an out-of-bounds write in the qsort routine of libufdt_sysdeps_vendor.c, which occurs when the device-tree (ufdt) parsing path is driven into resource exhaustion with attacker-influenced input. An attacker who already holds a local, low-privileged foothold on the device - for example a malicious installed app or a process that can feed data into the ufdt parsing path (PR:L) - can trigger the flaw with no user interaction and no additional execution privileges, achieving high confidentiality, integrity and availability impact within the platform (CVSS 7.8). No public exploit identified at time of analysis, and the issue is addressed through the October 2026 Android Security Bulletin.

Local privilege escalation on Android 14, 15, 16, 16-qpr2, and 17 stems from an out-of-bounds read in MessageQueueBase.h caused by an incorrect bounds check, allowing an attacker with low-privilege local code execution to gain elevated privileges with high impact to confidentiality, integrity, and availability (CVSS 7.8). Exploitation requires a locally installed malicious or compromised app and no user interaction, and no public exploit has been identified at the time of analysis.

Local privilege escalation in Google Android 14 through 17 (including 16 QPR2) lets a low-privilege local actor trigger an integer overflow inside the NFC Type 4 Tag read/write path (rw_t4t_update_file in rw_t4t.cc) that produces an out-of-bounds write, yielding code execution in a higher-privileged context. Per the assessed vector (AV:L/AC:L/PR:L/UI:N), the attacker must already have local code execution or app presence on the device but needs no user interaction, and exploitation requires attacker-controlled NFC Type 4 Tag data to reach the reader/writer code path on an unpatched build. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the CVSS score is 7.8 and the practical constraint is the local-only attack vector, making this a genuine fleet-patching priority rather than an emergency.

An out-of-bounds write in Android's NFC Execution Environment (NFCEE) action handling code (nfa_nfcee_act.cc) lets a locally installed low-privilege application corrupt memory in the NFC stack and escalate to system-level privileges. Per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, the attacker must already be able to run code on the device as a low-privilege app (PR:L) and the flaw is not reachable over the network (AV:L), with no user interaction required; devices running unpatched Android 16, 16-qpr2, or 17 builds are affected, while those with the October 2026 security patch are not. Exploitation is not observed in the field - SSVC records Exploitation:none and there is no KEV listing or public exploit code identified at time of analysis - and EPSS is low at 0.11% (1st percentile), so this presents as a genuine but non-urgent local privilege-escalation issue rather than a remotely exploitable emergency.

An out-of-bounds write in Android's wpa_supplicant Robust AV / SCS action-frame handler (wpas_handle_robust_av_scs_recv_action in robust_av.c) can be turned into remote code execution on Android 14 through 17 (including 16-qpr2) devices that receive a crafted SCS action frame. Exploitation is sharply constrained: per the CVSS vector PR:H, the attacker must already hold System-level execution privileges on the target before the malformed frame is processed, and the independently assessed vector (AV:A) places the attacker in Wi-Fi/adjacent range rather than on arbitrary internet-routable paths. User interaction is not required (UI:N), and no public exploit code or CISA KEV entry has been identified at time of analysis; combined with the vendor score of 7.2 and the adjacent-vector reassessment, this rates as a moderate, not emergency, priority.

An out-of-bounds heap read in libexpat's XML_ParseBuffer (expat/lib/xmlparse.c) allows disclosure of adjacent heap memory to the calling application when the caller-supplied len exceeds the remaining capacity of the parse buffer. The vulnerable path is reachable only when a parse buffer already exists - created by a prior XML_GetBuffer call (or a prior XML_Parse call that allocates one internally), otherwise the function returns XML_ERROR_NO_BUFFER - and when the embedding application passes a length that does not match the buffer it actually filled; default parsing where len equals the buffer contents is not affected, and the CVSS 4.0 vector (AV:N/PR:N, no privileges required) confirms this is unauthenticated from the network perspective. Successful reads can disclose heap pointers, libc function pointers and code pointers, undermining ASLR, but exploitation is contingent on application-specific misuse of the API, so no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status is reported. Note that the official CVSS 4.0 score is 8.3 (AT:P reflects the buffer-must-exist precondition), while an independent assessment scored it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. information disclosure with no integrity impact and only a low availability impact.

Stack-based buffer overflow in the TOTOLINK A3002MU router's QoS Rule Handler allows remote attackers to corrupt memory on the device by supplying oversized addQos, comment, or entry_name arguments to /boafrm/formIpQoS, with high confidentiality, integrity, and availability impact. Only firmware 1.0.0-B20230403.1455 is identified as affected, and publicly available exploit code exists (a published proof-of-concept gist), so anyone who can reach the management interface can attempt it. The published CVSS 4.0 vector scores 9.3 as network-reachable, low-complexity, and unauthenticated (PR:N/UI:N); note however that TOTOLINK /boafrm/ handlers commonly require an authenticated web session, so the realistic risk is concentrated where the admin interface is exposed to the WAN or reachable from an untrusted LAN segment.

Zephyr RTOS builds that enable CONFIG_USERSPACE and include an I3C controller driver allow an unprivileged user-mode thread with a grant on the I3C controller device object to escalate to supervisor privilege. The syscall verifier z_vrfy_i3c_do_ccc() checked the outer i3c_ccc_payload, the broadcast data buffer and the targets.payloads[] array but never validated the per-target data pointers carried inside each struct i3c_ccc_target_payload, and it validated the caller's live structure rather than a snapshot, so the driver dereferences an attacker-chosen kernel address; a read CCC turns this into an arbitrary-length out-of-bounds kernel write and a write CCC into a kernel memory disclosure (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-822). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is strictly local - there is no remote or network attack path. An upstream fix commit exists that snapshots the payload, copies the target array into kernel memory and validates every per-target buffer with K_SYSCALL_MEMORY(), but no tagged release version containing it was independently confirmed from the provided data.

Out-of-bounds kernel memory writes in the NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) of Zephyr RTOS let a local user-mode thread that has already been granted the ADC device object corrupt memory beyond an undersized buffer it supplies to the adc_read()/adc_read_async() syscalls. Exploitation of the privilege boundary requires a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC with the GAU ADC devicetree node enabled; the attack vector is localized (CVSS 3.1 8.4, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) and the caller must already hold a device-object grant, but the scope change (S:C) and high integrity/availability impact reflect a genuine userspace-to-kernel privilege escalation path capable of kernel memory corruption or a crash. No public exploit code and no confirmed active exploitation were identified at time of analysis; builds without CONFIG_USERSPACE or on SoCs other than RW61x with the GAU ADC node enabled are not exposed to the privilege boundary and only suffer a silent overflow when the application itself passes an undersized buffer.

Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.

Local privilege escalation in the MediaTek APU (AI Processing Unit) driver allows an attacker with existing code execution on affected devices to trigger a use-after-free, achieving full compromise of confidentiality, integrity, and availability (CVSS 8.4). The flaw affects MediaTek chipsets MT8781, MT6993, MT6899, MT8668, MT8910, and MT8793, and requires no additional privileges or user interaction once local access is obtained. No public exploit code or active exploitation is confirmed at time of analysis.