Denial of Service

Uncontrolled resource consumption in py-libp2p's yamux stream multiplexer allows any remote peer that completes a standard Noise handshake to permanently stall a connection using a single 12-byte frame. Affected versions 0.7.0 and earlier accept an attacker-controlled 32-bit DATA frame length before validating it against the receive window, so a frame claiming a 4 GB body with no body bytes delivered causes the sequential read loop to block indefinitely, freezing every stream on the connection. No patched release exists at time of analysis; a remediation commit is available upstream, and a proof-of-concept demonstrating the stall is documented in the GHSA advisory.

Stack-exhaustion denial-of-service in node-tar (npm package `tar`) versions up to and including 7.5.20 allows unauthenticated remote attackers to terminate any Node.js process that lists or extracts selected members from an attacker-controlled archive. The vulnerable `mapHas` recursion in `filesFilter` overflows the call stack before any depth guard can execute, and the resulting `RangeError` is uncatchable by standard `try/catch` on async and streaming consumers - the dominant server-side usage pattern. A publicly available proof-of-concept demonstrates the crash using a payload of approximately 188 bytes gzipped; no active exploitation confirmed in CISA KEV at time of analysis.

Resource exhaustion DoS in @anephenix/hub (npm) before 0.2.16 allows any unauthenticated remote client to exhaust server CPU and memory by opening WebSocket connections and ignoring all server RPC messages. Each connection triggers a 10ms setInterval polling loop and a heap entry in the RPC request queue; because the socket close handler never cancels these allocations, they accumulate without bound until the process becomes unresponsive. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v0.2.16.

Server-side template injection in the Form::Processor::Field::HtmlArea Perl module (versions 0.06 through 1.162360) lets a remote unauthenticated attacker inject Locale::Maketext bracket-notation templates through HTML::Tidy validation diagnostics. Because the default language handle enables _AUTO, unrecognized message keys are compiled as templates, so attacker-controlled attribute names/values in submitted markup become method-dispatch templates on the language handle - yielding unhandled exceptions, near-unbounded memory allocation, and, where the application's handle subclass defines side-effecting public methods, invocation of those methods with attacker-chosen arguments. Reported by CPANSec with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.40%, 33rd percentile).

Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.

Out-of-bounds read in PostGIS before 3.7.0beta2 enables low-privileged database users to disclose server process memory or crash the PostgreSQL backend by passing malformed FlatGeobuf geometry data to the extension's property metadata decoder. The decoder validates that a string length prefix is present but omits a bounds check confirming the string body falls within the supplied buffer before materializing it as a SQL-visible value, creating both a memory disclosure and denial-of-service path. A publicly available exploit demonstrates successful memory disclosure against managed PostgreSQL platforms including NeonDB and Supabase; exploitation is not confirmed in CISA KEV but the public proof-of-concept and multi-tenant exposure substantially elevate real-world risk.

CPU exhaustion in rsync receivers before 3.5.0 allows a remote sender to cause denial of service by exploiting quadratic-time worst-case behavior in the hash_search() function (CWE-407). A malicious or compromised sender delivers a carefully crafted file list - requiring only a modest number of entries - to collapse hash lookup performance and sustain receiver CPU exhaustion for the duration of the sync session. No public exploit has been identified at time of analysis, but the unauthenticated network attack vector and rsync's ubiquitous deployment in backup and file-synchronization infrastructure make patch urgency high.

Denial of service in rsync's receiver process allows a remote, unauthenticated sender to exhaust thread and memory resources by specifying the --zt short alias for --compress-threads, directly bypassing daemon-side refuse options directives that match only against long option names. Affected versions span 3.4.2 through 3.4.x prior to 3.5.0; the bypass is most damaging to operators who explicitly configured refuse options to block --compress-threads, since they believed a mitigation was in place. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.7 accurately reflects low-complexity, unauthenticated network exploitation with high availability impact.

Signed integer overflow in rsync 3.1.0 through 3.4.x allows network-accessible attackers to permanently disable connection timeouts on a daemon by injecting crafted MSG_IO_TIMEOUT messages carrying zero or negative values, ultimately enabling resource exhaustion via indefinitely held daemon slots. All deployments running the rsync daemon in the affected range are exposed; the fix is confirmed in rsync 3.5.0, released as a major security update. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-privilege, low-complexity network attack path makes unpatched internet-facing daemons a meaningful target.

Connection slot exhaustion in rsync daemon versions 2.0.0 through 3.4.x allows unauthenticated remote attackers to deny service to legitimate clients by stalling the protocol handshake across two distinct vectors. Pre-module-selection stalls are unconditionally effective because the daemon applies no timeout in that phase; post-module-selection, attackers can trickle data just above the I/O timeout floor to hold slots indefinitely while never completing the handshake. No public exploit identified at time of analysis, though the attack is trivially scriptable and requires no authentication or prior access.

CPU exhaustion denial of service in Netty's XmlFrameDecoder allows an unauthenticated remote attacker to hang a server's EventLoop thread by trickle-feeding repeated `</` byte sequences to any port where XmlFrameDecoder is in the pipeline. Because the decoder fails to save parser state between `decode()` invocations, each new call rescans the entire accumulated buffer from scratch, producing O(n²) CPU growth that can fully pin a thread with as little as 1 MB of malformed XML data. No public exploit code has been identified at time of analysis, though the GitHub Security Advisory GHSA-v74w-7mr3-4qg3 supplies sufficient technical detail to reproduce the attack. Vendor-released patches are available as Netty 4.1.136.Final and 4.2.16.Final.

Denial of service in the Silicon Labs BT122 Bluetooth module is triggered by an adjacent unauthenticated attacker who transmits a forged, unencrypted 'pause encryption request' control message, causing the module to crash or become unresponsive. The flaw, cataloged as vulnerability B-E10 in academic research (arXiv:2409.02905), exploits the module's failure to enforce encryption state validation on incoming link-layer control messages. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation is bounded by Bluetooth radio adjacency.

Buffer over-read and under-run vulnerabilities in the s390/zcrypt subsystem of the Linux kernel allow a local low-privileged user on IBM Z (mainframe) hardware to crash the kernel or expose adjacent kernel memory by submitting malformed CCA key token structures with attacker-controlled length fields. The affected functions cca_check_sec*token() and cca_gencipherkey() failed to validate the token's internal len field against actual buffer boundaries or minimum structure sizes before use in memory operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS score of 7.1 reflects genuine high-severity impacts in affected environments.

QUIC server listener in OpenSSL 3.5.x through 4.0.x allows remote unauthenticated denial of service through unbounded memory growth when processing QUIC Initial packets. Remote peers can flood the listener with Initial packets carrying novel Destination Connection IDs faster than the application drains the queue via SSL_accept(), causing per-channel state objects to accumulate without limit and exhausting process memory. No public exploit code or CISA KEV listing has been identified; vendor-confirmed patches are available in OpenSSL 3.5.8, 3.6.4, and 4.0.2.

CPU exhaustion in @fastify/busboy 3.1.0-3.2.0 allows a remote unauthenticated attacker to stall the Node.js event loop by sending a single crafted multipart request. The parser's vendored streaming search algorithm stores its Boyer-Moore-style skip table in a fixed 256-entry byte array; supplying a boundary of exactly 252 bytes causes the computed search needle to reach 256 bytes, collapsing the skip distance to zero and converting an O(n) search into an unbounded CPU-bound loop. Because Node.js is single-threaded and event-driven, one stalled core prevents all other requests from being processed by the same worker, achieving denial of service with minimal bandwidth. No public exploit has been identified at time of analysis, but the attack primitive is trivially reproducible from the advisory.

Unauthenticated denial of service in @fastify/busboy versions 1.0.0 through 3.2.0 allows any network attacker to crash the Node.js process by submitting a multipart form with a header whose name collides with a prototype-inherited JavaScript property such as __proto__ or constructor. The internal header store uses a plain object inheriting from Object.prototype, so the inherited property resolves to a truthy non-array value that triggers a synchronous TypeError when array methods are invoked on it; in direct write/end usage paths this exception propagates uncaught and terminates the process. No public exploit code has been identified at time of analysis, but the attack is trivially constructable given the detailed advisory.

Polynomial regular expression denial-of-service in the crmne/ruby_llm Ruby gem allows remote unauthenticated attackers to exhaust CPU resources by submitting a crafted, excessively long class, agent, or tool name that triggers the inefficient regex in RubyLLM::Utils.underscore. The vulnerability is constrained to Ruby 3.1.x environments due to engine-specific regex behavior at that commit. A public proof-of-concept exists (hosted as a GitHub Gist), though no active exploitation has been confirmed by CISA KEV.

Cross-tenant DNS hijacking and denial of service in OpenStack Designate before 22.0.1 allows an authenticated tenant to bypass zone-ownership and duplicate-zone checks. Because the `_is_subzone`, `_is_superzone`, and duplicate-zone database constraint are evaluated only against the target pool, a user can schedule a zone to a different pool via the AttributeFilter scheduler and create a zone that overlaps another tenant's, redirecting DNS traffic to attacker-controlled IPs or forcing NODATA responses. Fixed versions (22.0.1, 21.0.1, 20.0.2) are available from the vendor; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Memory exhaustion in Red Hat Advanced Cluster Management for Kubernetes 2's search-v2-api component allows unauthenticated remote attackers to crash the search-api pod by submitting HTTP requests with unique random bearer tokens. Each unique token creates a permanent, uncleaned entry in the unbounded tokenReviews cache; sustained submission accumulates entries until the pod exhausts available memory and is killed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated exploitability with no prerequisites. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity makes automated exploitation straightforward.

Remote unauthenticated denial of service and sensitive information disclosure in IBM i 7.3 through 7.6 stems from an integer underflow (CWE-125 out-of-bounds read) reachable over the network without authentication. An attacker sending a crafted request can crash an affected service and read portions of process memory, yielding both high availability impact and limited confidentiality exposure. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated attack vector makes it a meaningful risk for internet-exposed IBM i systems.

Memory exhaustion in etcd's TLS acceptor loop allows unauthenticated network attackers to crash etcd clusters - and the Kubernetes control planes they back - without completing a TLS handshake. The vulnerable code path in `client/pkg/transport/listener_tls.go` spawns a goroutine per inbound TCP connection with no timeout, meaning connections that never send a ClientHello block indefinitely inside `tls.Conn.Handshake()` and accumulate in an unbounded `pending` map. Exploitation is trivially automatable: no special protocol knowledge is needed beyond initiating TCP connections. No public exploit code or CISA KEV listing exists at time of analysis, but the Kubernetes control plane dependency elevates real-world blast radius well beyond a standalone etcd outage.

Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake to exhaust the server JVM heap and trigger an OutOfMemoryError, crashing the blaze selector thread. Any Scala application built on BlazeServerBuilder that exposes WebSocket routes is affected without any non-default configuration - the existing maxWebSocketBufferSize setting bounds only individual frames, not the aggregate. No public exploit has been identified at time of analysis, but exploitation is trivially low-complexity: a single connection sending a stream of continuation frames that never assert FIN is sufficient.

Denial of service in NextAuth.js's getToken() helper allows unauthenticated remote attackers to crash any API route, middleware, or server-side handler that calls getToken() directly by sending a single HTTP request with a malformed Authorization: Bearer header containing invalid percent-encoding. The vulnerability affects next-auth 4.0.6-4.24.14, next-auth 5.0.0-beta.0-5.0.0-beta.31, and @auth/core 0.1.0-0.41.2, and is fixed in next-auth 4.24.15, next-auth 5.0.0-beta.32, and @auth/core 0.41.3. No public exploit code has been identified at time of analysis, but the trigger condition is trivially constructible from the public advisory description alone.

Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, including container deployments) enables authenticated administrative attackers to send crafted HTTP requests to the management interface, triggering uncontrolled format string processing. Successful exploitation produces high confidentiality impact through stack memory disclosure and high availability impact through service crashes, with CVSS scope change indicating potential downstream effect on identity services beyond the management component. No public exploit is identified at time of analysis; this is a vendor-confirmed finding reported directly by IBM PSIRT.

Denial of service in IBM Security Verify Access and IBM Verify Identity Access - including container editions - allows remote unauthenticated attackers to crash or indefinitely stall authentication services by triggering an infinite loop (CWE-835). All versions from 10.0 through 10.0.9.2 (Security Verify Access) and 11.0 through 11.0.3 (Verify Identity Access) are affected across both appliance and container deployments. IBM has released a patch; no public exploit code exists and no active exploitation has been recorded by CISA at time of analysis.

Quadratic-time CPU exhaustion in Shescape's flag-protection loop allows any attacker who can supply untrusted input to the escape, escapeAll, quote, or quoteAll APIs to cause denial of service without authentication or special configuration. Affected npm package versions 2.1.11-2.1.13 and 3.0.0 are vulnerable by default because flagProtection is enabled in the default configuration. The GHSA advisory includes a working proof-of-concept demonstrating approximately 20 seconds of processing time for a 32,000-repeat null-dash payload, and patched releases 2.1.14 and 3.0.1 are available; no active exploitation has been confirmed (not in CISA KEV).

Storage quota bypass in Canonical LXD (5.0.x before 5.0.8, 5.21.x before 5.21.6, and 6.0 before 6.10) lets an authenticated user exceed the disk and volume limits an administrator configured on a project. The flaw stems from two code paths - cross-project volume moves (storagePoolVolumeTypePostMove) and volume snapshot restores with a nil config - that skip the AllowVolumeCreation/AllowVolumeUpdate limit checks, enabling over-allocation of storage. Reported by Canonical with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Denial of service in GitLab CE/EE (versions 18.5 through pre-19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2) allows unauthenticated remote attackers to exhaust server resources through improper input validation, rooted in CWE-770 (resource allocation without throttling limits). Exploitation is conditional - the description explicitly qualifies 'under certain conditions' - which is reinforced by SSVC classifying the attack as non-automatable despite a CVSS PR:N/AC:L rating. A publicly available proof-of-concept exists via a HackerOne disclosure, though EPSS sits at only 0.41% (34th percentile) and CISA has not listed this in the KEV catalog, suggesting exploitation remains opportunistic rather than widespread.

Denial of service in IBM i 7.3 through 7.6 allows an unauthenticated remote attacker to crash or render unavailable affected system services by sending input that bypasses server-side size validation. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), and the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no special conditions, and no user interaction. IBM i systems typically host irreplaceable mission-critical business workloads in sectors such as banking and manufacturing, making availability disruption disproportionately impactful despite the absence of code execution; no public exploit or CISA KEV listing has been identified at time of analysis.

IBM i versions 7.3 through 7.6 expose their TCP/IP stack to a remotely-triggered denial of service when processing zero-length TCP option fields. Classified as CWE-835 (Loop with Unreachable Exit Condition), the flaw causes the TCP stack to enter an infinite or unrecoverable processing loop upon receipt of malformed TCP options, exhausting CPU or thread resources and disrupting hosted business services. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N CVSS vector means any network-reachable IBM i system is exploitable without credentials or special conditions.

SQL injection in IBM i 7.3 through 7.6 enables a local authenticated attacker to cause a denial of service - and potentially achieve broader data confidentiality and integrity impact - by submitting SQL commands containing improperly neutralized special elements. The flaw (CWE-89) is exploitable without user interaction once local access is obtained. No public exploit code has been identified and CISA has not listed this in KEV; a vendor patch is available.

Local kernel privilege escalation and denial of service in NetBSD's hdaudio(4) driver arise from two compounding flaws: the /dev/hdaudioN device nodes enforce no access control, allowing any unprivileged local user to invoke HDAUDIO_FGRP_SETCONFIG, and the detach path in hdafg_detach() is not race-safe against concurrent DMA activity. A two-thread attack - one repeatedly reconfiguring the audio function group, one keeping DMA and IRQs live - wins a use-after-free race where a latched DMA interrupt dereferences a freed callback pointer, producing outcomes from audio-subsystem crashes and kernel panics to potential kernel-level privilege escalation. A public proof-of-concept is available, and no specific patched release version has been confirmed, leaving remediation dependent on source-level kernel rebuilds.

Kernel heap corruption via a double-fetch race condition in Zephyr RTOS's unprivileged socket syscall verifiers allows a local low-privilege attacker to achieve kernel privilege escalation or trigger a kernel denial of service. The flaw exists in z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() within subsys/net/lib/sockets/sockets.c, where msg_iovlen is read twice from live user memory - once to size the kernel heap shadow buffer and once as the iovec copy-loop bound - enabling a cooperating attacker thread to inflate the field between those reads and drive an out-of-bounds write into adjacent kernel heap objects. No public exploit has been identified at time of analysis; an upstream patch commit is confirmed available via the Zephyr project security advisory.

Use-after-free in Blink, Google Chrome's rendering engine, allows remote unauthenticated attackers to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. All Chrome releases prior to 151.0.7922.137 are confirmed affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score and memory corruption class reflect serious exploitation potential.

Remote code execution within Chrome's renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.137 due to a use-after-free flaw in the HTML subsystem. An unauthenticated remote attacker can exploit this by inducing a victim to visit a crafted HTML page, triggering heap corruption that results in arbitrary code execution scoped to the sandboxed renderer process. No public exploit code has been identified at time of analysis, and EPSS stands at a low 0.31% (23rd percentile), suggesting limited attacker uptake despite the high CVSS score of 8.8.

Use-after-free in Google Chrome's Extensions subsystem prior to version 151.0.7922.137 enables an attacker to execute arbitrary code inside the Chrome sandbox by convincing a target to install a crafted malicious extension. The vulnerability class (CWE-416) indicates improper memory management in the extension handling code, where a freed memory reference is later dereferenced, corrupting heap state in a way an attacker can direct toward code execution. No public exploit or CISA KEV listing is identified at time of analysis; exploitation requires deliberate social engineering to achieve extension installation.

Sandbox escape in Google Chrome on macOS exploits a use-after-free condition in the TabStrip browser component, enabling a renderer-level attacker to break out of Chrome's security sandbox. Affected are all Chrome for Mac versions prior to 151.0.7922.137. Critically, this vulnerability is a second-stage exploit primitive - it requires the renderer process to already be compromised via a separate, chained vulnerability before this UAF can be weaponized for full sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Chrome's V8 JavaScript engine (versions prior to 151.0.7922.137) enables remote code execution inside the browser sandbox when a victim visits a crafted HTML page. The vulnerability carries a CVSS 8.8 score reflecting its network-reachable, low-complexity attack path requiring only a single user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Chromium security team rated severity as High and issued an emergency stable-channel update.

Out-of-memory denial-of-service in ffuf prior to v2.2.0 allows a malicious HTTP server to crash the fuzzer by returning a decompression bomb - a tiny compressed payload that expands to gigabytes - because the response-size guard in pkg/runner/simple.go checked only the compressed Content-Length while io.ReadAll consumed the fully decompressed stream without any byte cap. Any ffuf user fuzzing a hostile endpoint is affected; no special configuration is required. The issue is fixed in v2.2.0 via io.LimitReader; no public exploit has been identified and it is not listed in CISA KEV.

Heap and stack buffer overflow in CivetWeb's read_websocket() function (through commit 4a4f0c95) allows unauthenticated remote attackers to corrupt memory by sending crafted compressed WebSocket frames, but only against instances compiled with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES build flags. Attackers negotiate permessage-deflate during the WebSocket handshake and send an RSV1-flagged frame that triggers a 4-byte zlib sync trailer write past the allocated buffer boundary, corrupting heap metadata and enabling denial of service or potential code execution (per VulnCheck tagging). No public exploit code is confirmed and this CVE does not appear in CISA KEV at time of analysis, but the deterministic 4-byte overwrite primitive is a credible research target; the non-default build configuration substantially limits the real-world exploitable population.

MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.

Out-of-bounds read in MongoDB Server's geospatial query processing permits an authenticated user with write privileges to store malformed geometry documents that bypass validation at ingestion time, with the memory access violation occurring later during query execution. Affected deployments span all tracked versions per NVD CPE data (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*), and the dual impact - server crash and limited process memory disclosure - makes this a moderate-to-high priority for any MongoDB deployment where untrusted authenticated users have write access. No public exploit code and no CISA KEV listing have been identified at time of analysis.

MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation bar warrants prompt patching once available.

Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. This affects sharded cluster deployments specifically - when mongos crashes, all client connections routed through that instance are severed, effectively taking down the database routing layer until the process is restarted. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent.

Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.

Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.

Out-of-bounds memory read in MongoDB Server's aggregation framework allows an authenticated attacker to crash the database server or expose limited memory contents by submitting a specially crafted numeric parameter within a specific aggregation pipeline stage. The CVSS 4.0 score of 7.1 reflects dual impact: high availability loss from server crash (VA:H) and low-level confidentiality exposure from adjacent memory leakage (VC:L). Self-reported by MongoDB (responsible disclosure), with no public exploit code or CISA KEV listing identified at time of analysis.

MongoDB Server crashes under certain authenticated query operations against time-series collections, allowing any low-privileged user with write access to terminate the mongod process and cause a denial of service. Affected across three active release lines (7.0, 8.0, 8.3), this flaw is rooted in CWE-617 (Reachable Assertion), where a malformed query predicate against a collection's metaField violates an internal invariant and aborts the server. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); vendor-released patches are available for all affected branches.

Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.

Relay port pool exhaustion in Coturn prior to 4.17.0 permits authenticated TURN clients to permanently consume relay ports by issuing EVEN-PORT Allocate requests with the R (reservation) bit cleared to zero. The `turnports_allocate_even()` function in `src/apps/relay/turn_ports.c` unconditionally marked the odd sibling port as TPS_TAKEN_ODD regardless of R bit value; with R=0 no RTCP socket is ever bound to that port, so no release code path is ever triggered - each such allocation permanently removes one port from the relay pool until the pool is drained and subsequent allocations fail with STUN error 508. No active exploitation has been confirmed; a vendor-released patch is available in version 4.17.0.

Memory exhaustion in Coturn's DTLS listener allows unauthenticated remote attackers to crash or degrade the TURN/STUN service by flooding it with fragmented DTLS ClientHello messages before cookie validation occurs. All Coturn deployments prior to version 4.16.0 are affected, as both dtls_server_input_handler() and create_new_connected_udp_socket() in dtls_listener.c retain OpenSSL reassembly state for attacker-declared inflated handshake lengths without first completing RFC 6347 cookie exchange. No public exploit has been identified at time of analysis, but the attack requires only UDP connectivity to the listener and no credentials whatsoever, making it accessible to any internet-facing adversary.

Unbounded in-memory caches in Browserslist prior to 4.28.7 allow unauthenticated remote denial-of-service via Node.js out-of-memory crash when an attacker can influence repeated query values passed to browserslist() at runtime. Both the query-result cache and the parseQuery AST cache grew as plain JavaScript objects with no size cap, TTL, or eviction - the `since <year>-<month>-<day>` syntax provides a practically infinite key space ideal for flooding. The caller-controlled BROWSERSLIST_DISABLE_CACHE environment variable is ineffective as a compensating control because it only suppresses the result cache, not parseCache. No public exploit code has been identified and the vulnerability is not in CISA KEV; the vendor-released fix is version 4.28.7.

Use-after-free memory corruption in Microsoft Office Word enables local code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a social-engineering-dependent attack - no system privileges are required, but the victim must open a malicious file, making phishing or drive-by document delivery the likely delivery mechanism. All three impact dimensions (Confidentiality, Integrity, Availability) are rated High, yielding a 7.8 CVSS score; no public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.

Remote code execution via use-after-free memory corruption in Windows DNS enables unauthenticated network attackers to achieve full system compromise against exposed DNS servers. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network-reachable, zero-privilege exploitation, though high attack complexity signals that reliable triggering requires precise memory state manipulation rather than simple packet delivery. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Privilege escalation in Windows Desktop Window Manager (DWM) is possible via a use-after-free memory corruption flaw exploitable by a locally authenticated low-privileged attacker. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected system, consistent with elevation to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.

Local privilege escalation in Windows Autopilot on Windows 11 (versions 24H2 and 25H2) allows a low-privileged authenticated local attacker to achieve full system compromise through a use-after-free memory corruption flaw (CWE-416). The CVSS vector (AV:L/AC:H/PR:L) confirms local access with elevated complexity - consistent with a race condition or specific heap state requirement inherent to UAF exploitation. Microsoft has released patches at builds 10.0.26100.9168 and 10.0.26200.9168; no public exploit or CISA KEV active exploitation listing has been identified at time of analysis.

Privilege escalation via use-after-free in Windows Autopilot on Windows 11 allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level or elevated access. The vulnerability stems from improper memory management in the Autopilot provisioning component, where a freed memory region can be referenced again under a race condition (AC:H). Affected builds span both Windows 11 24H2 and 25H2 prior to the 9168 patch revision; no public exploit or CISA KEV listing has been identified at time of analysis.

Use-after-free memory corruption in Windows Autopilot on Windows 11 (24H2 and 25H2) enables a locally authenticated, low-privileged user to escalate privileges, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The attack requires local access and high complexity (AV:L/AC:H/PR:L), meaning an attacker must meet specific memory state or race conditions - reducing opportunistic risk but not eliminating it for determined local threat actors. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Autopilot on Windows 11 (versions 24H2, 25H2, and 26H1) is caused by a use-after-free memory corruption flaw (CWE-416) that allows a locally authenticated low-privileged attacker to achieve SYSTEM-level access. The CVSS 7.0 score reflects full CIA impact offset by a strictly local attack vector and high attack complexity, consistent with a race condition or heap manipulation requirement rather than a trivial trigger. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Autopilot on Windows 11 versions 24H2 and 25H2 arises from a use-after-free memory corruption flaw, enabling a local low-privileged attacker to achieve full SYSTEM-level access with complete confidentiality, integrity, and availability impact. High attack complexity (AC:H) constrains opportunistic exploitation, making this most relevant to insider threat and post-breach lateral movement scenarios rather than broad automated attacks. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Privilege escalation via use-after-free in Windows Win32K (win32k.sys) affects Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core installations. An authenticated local attacker exploiting CWE-416 memory corruption in the Win32K kernel subsystem can elevate from low-privileged user to SYSTEM-level access. No public exploit or CISA KEV listing has been identified at time of analysis; however, Microsoft has released a patch addressing all affected build ranges.

Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.

Windows iSCSI Target Service across multiple Windows Server and Windows 10 versions contains a null pointer dereference that enables an unauthenticated remote attacker to crash the service, resulting in denial of service. Affected systems span Windows Server 2016 through 2025 and Windows 10 versions 1607 and 1809, all below their respective patched build numbers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated network vector makes it straightforward to exploit once the target service is reachable.

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.

Use-after-free memory corruption in Microsoft Office enables an attacker to execute arbitrary code in the context of the victim user, scoring CVSS 7.8 (High). Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. Exploitation requires a victim to open a specially crafted Office document - a delivery mechanism trivially achieved via phishing - and no public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft Office's ubiquitous enterprise footprint and adversary interest in document-borne malware elevate this beyond a theoretical risk.

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.

Remote code execution in Windows Deployment Services (WDS) allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on the affected server. The flaw spans virtually every supported Windows Server release (2012 through 2025) plus Windows 10 clients running the WDS role, and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released patches; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low-complexity, no-auth network vector makes this a high patch priority.

Privilege escalation in the Windows Capability Access Management Service (camsvc) allows a local authenticated attacker to gain SYSTEM-level access via a use-after-free (UAF) memory corruption flaw. The vulnerability spans a wide surface including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2019, 2022, and 2025, covering both standard and Server Core installations. No public exploit code or active exploitation has been confirmed at time of analysis; however, the breadth of affected builds and the high CIA impact upon successful exploitation make patching a priority for organizations with multi-user or shared Windows environments.

Privilege escalation in Windows Desktop Window Manager (DWM) Core Library via a use-after-free memory corruption flaw allows a locally authenticated, low-privileged attacker to achieve full SYSTEM-level code execution. Affected systems span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core), representing a broad cross-section of the active Microsoft OS estate. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide version coverage make patching a near-term priority.

Remote code execution in Microsoft Active Directory Certificate Services (AD CS) is achievable by low-privileged authenticated network attackers through a use-after-free (CWE-416) memory corruption flaw. All supported Windows Server versions from 2012 through 2025 are affected, along with Windows 10 versions 1607 and 1809. Microsoft has released patches via the MSRC update guide; no public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version coverage make this a high-priority remediation item.

Remote code execution in Microsoft's QUIC transport implementation (MsQuic) allows an unauthenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) in the QUIC protocol handler across supported Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 builds. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical, reflecting no authentication or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Remote code execution in Windows LDAP (Lightweight Directory Access Protocol) affects a broad swath of Microsoft Windows desktop and server editions, from Windows 10 through Windows 11 and Windows Server 2012 through 2025. A use-after-free memory corruption flaw (CWE-416) in the LDAP client implementation allows a network-accessible, unauthenticated attacker to achieve arbitrary code execution with high confidentiality, integrity, and availability impact, contingent on user interaction - most likely the victim system initiating or being induced to make an LDAP connection to an attacker-controlled server. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS score of 8.8 and the breadth of affected Windows versions make this a high-priority patching target.

Privilege escalation via use-after-free in the Windows Kernel affects Windows 11 (versions 23H2, 24H2, 25H2, and 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to elevate to SYSTEM-level control. The CWE-416 root cause combined with high attack complexity (AC:H) indicates exploitation likely requires precise timing or race-condition engineering rather than a trivial one-shot trigger. Vendor patches are available via MSRC; no active exploitation has been confirmed by CISA KEV at time of analysis.

Remote code execution via use-after-free in the Windows DNS service allows an authenticated, network-based attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025 and is exploitable over the network, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit identified at time of analysis; vendor-released patches with specific build targets are available via the Microsoft Security Response Center.

Local privilege escalation in the Windows Kernel affects Windows 11 (23H2 through 26H1) and Windows Server 2025, exploitable by any authenticated local user to gain SYSTEM-level access. The root mechanism is a use-after-free condition triggered through a race condition in kernel memory management, classified under CWE-362. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis; however, the kernel-level impact (C:H/I:H/A:H) makes it a high-priority patch target in enterprise and server environments.

Privilege escalation in Windows Schannel via a use-after-free (CWE-416) memory corruption flaw allows a locally authenticated, low-privileged attacker to elevate privileges - likely to SYSTEM - on Windows 11 and Windows Server 2025 systems. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects reliable, low-complexity exploitation requiring only a standard user account and no user interaction. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Privilege escalation via use-after-free in the Windows DNS service exposes a broad range of Windows Server and Windows 10 systems to network-based attacks by unauthenticated adversaries. The race condition root cause (CWE-362) forces high attack complexity, as an attacker must win a precise timing window to corrupt freed memory and gain elevated privileges, reflected in the CVSS 8.1 score. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the full C/I/A impact across thirteen distinct product versions from Windows Server 2012 through Server 2025 warrants prompt patching.

Privilege escalation in the Windows Graphics Kernel exposes a use-after-free condition that allows a low-privileged local user to achieve SYSTEM-level code execution. Affected products span Windows 10, Windows 11, and Windows Server 2016 through 2025 across 15 distinct version ranges, making the blast radius extremely broad. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all affected builds via the MSRC advisory.

Privilege escalation in Windows Kerberos via a use-after-free memory corruption flaw allows a locally authenticated attacker to gain SYSTEM-level access on affected Windows systems. The vulnerability spans nearly all current Microsoft Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis; Microsoft has released patches addressing all affected builds.

Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 installations. The flaw (CWE-416) involves kernel memory mismanagement where freed memory can be accessed under specific high-complexity timing conditions, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all affected versions.

Privilege escalation in Windows Telephony Service (TAPI) via a use-after-free memory corruption flaw enables a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected hosts. The vulnerability spans a broad range of Microsoft Windows versions from Server 2012 through Windows 11 26H1 and multiple Windows Server 2022/2025 builds, confirmed by Microsoft MSRC and catalogued under EUVD-2026-56640. No public exploit code or active exploitation has been identified at time of analysis, though the pervasive Windows deployment footprint makes patch deployment a meaningful operational priority.

Local privilege escalation via use-after-free (CWE-416) in the Windows Telephony Service (TAPI) affects every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized low-privileged local attacker can trigger improper memory lifecycle management in the privileged tapisrv process, achieving full confidentiality, integrity, and availability impact on the compromised system. No public exploit code has been identified at time of analysis and high attack complexity constrains opportunistic mass exploitation, but vendor-released patches are available and should be prioritized given the ubiquitous deployment footprint.

Privilege escalation via use-after-free memory corruption in the Windows Telephony Service (TAPI) affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An authorized local attacker with low-privilege credentials can exploit a race condition to corrupt freed memory within the telephony service process, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed by CISA KEV, and no public exploit has been identified at time of analysis; Microsoft has released patched builds for all affected platforms.

Local privilege escalation in the Windows Telephony Service (TAPI) allows an already-authenticated, low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans a wide range of Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the availability of a vendor patch make patching urgent in environments where Telephony Service is active.

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects a broad spectrum of Windows client and server releases, from Windows Server 2012 through Windows 11 25H2. An authenticated local attacker can exploit this flaw with low complexity and no user interaction to achieve full SYSTEM-level privileges (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, but the low-complexity local exploitation profile - combined with the near-universal deployment footprint of Windows - makes this a high-priority patch for both endpoint and server environments.

Privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged local attacker to gain SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The root cause is CWE-416 (Use After Free), a memory-safety flaw in the MDM component where a freed memory object is dereferenced, enabling controlled memory corruption that can redirect execution to attacker-supplied code. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV entry is identified at time of analysis.

Remote denial-of-service in the Windows Graphics Kernel allows unauthenticated network attackers to crash affected systems by triggering a null pointer dereference in kernel mode, impacting availability across Windows 10, Windows 11, and Windows Server 2022/2025. The CVSS Scope:Changed flag indicates the resulting crash propagates beyond the Graphics Kernel subsystem itself, consistent with a full system halt (BSOD). No public exploit has been identified at time of analysis, and Microsoft has released patches establishing fixed build numbers for all confirmed affected versions.