Denial of Service

Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. It is not on CISA KEV and requires an existing renderer compromise plus user interaction, making it a second-stage bug in an exploit chain rather than a standalone entry point.

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.

Remote code execution in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Autofill component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched browser bug not yet weaponized.

Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and total confidentiality/integrity/availability impact, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with a second-stage bug that requires prior renderer compromise rather than a directly weaponizable entry point.

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. Because code execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape.

Remote code execution in Google Chrome's Loader component before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page (CWE-416 use-after-free). The flaw carries a High Chromium severity and CVSS 8.8, but code execution is confined to the sandbox and requires user interaction (visiting the page); a full-system compromise would need an additional sandbox-escape bug. No public exploit identified at time of analysis, and EPSS is low at 0.35% (28th percentile).

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8, requiring user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched, vendor-reported bug rather than one under active exploitation.

Sandbox escape in Google Chrome's Navigation component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a renderer-level foothold toward host-level code execution. Chromium rates the security severity High and the CVSS is 8.3; no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile). This is the second-stage bug in a typical Chrome exploit chain rather than a standalone remote-code-execution primitive.

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.

Sandbox escape in Google Chrome's Skia graphics library (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Google rates the Chromium severity as Critical, and CVSS is 8.3 due to the scope change (S:C) reflecting the sandbox boundary crossing. No public exploit identified at time of analysis, and EPSS probability is low (0.31%), consistent with an exploit that requires chaining from a prior renderer compromise.

Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.

Sandbox escape in Google Chrome's Compositing component (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain broader code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3 (scope-changing use-after-free, CWE-416), it is a second-stage bug that presumes an existing renderer compromise rather than a standalone entry point. There is no public exploit identified at time of analysis and EPSS is low (0.31%, 23rd percentile), consistent with CISA SSVC marking exploitation as none.

Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.

Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.

Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.

Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated attacker to crash the service by repeatedly hitting the OAuth2 login endpoint. Each /oauth/login request permanently adds an entry to an in-memory registeredStates map that was never expired, deleted, or bounded, so sustained requests grow memory until the process is killed. No public exploit is identified at time of analysis, EPSS was not provided, and this is not in CISA KEV, but the flaw is trivially triggerable when OAuth2 authentication is enabled.

Uncontrolled memory allocation in the official Model Context Protocol Ruby SDK (mcp gem) before 0.23.0 lets an unauthenticated remote attacker crash MCP servers by sending a single oversized JSON-RPC POST. The StreamableHTTPTransport read the entire request body into memory and parsed it with no size or JSON-nesting cap, so one request can allocate gigabytes and OOM-kill the worker (CVSS 7.5, availability-only impact). No public exploit identified at time of analysis, but the fix commit and 4 MiB default limit are public, making the mechanism trivially reproducible.

Denial of service in GitLab CE/EE (all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1) allows an unauthenticated attacker to exhaust server resources through insufficient throttling when the application processes merge request discussions. Vendor-reported by GitLab with no public exploit identified at time of analysis; the availability-only impact (CVSS 7.5, A:H) reflects service disruption rather than data compromise. Exploitation is conditional ('under certain conditions'), which tempers the otherwise network-reachable, no-auth attack surface.

Denial of service in Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 lets any authenticated IMAP user crash the imapd process by sending a single SEARCH command containing deeply nested parenthesized groups. Because the SEARCH parser recurses without a depth limit and Courier enforces no command-line length cap, roughly 2500 nested parentheses exhaust the 8MB default stack and trigger a SIGSEGV. There is no public exploit identified at time of analysis, but the vendor commit and advisory describe exploitation as trivial, and it affects availability only (no data exposure or code execution).

Cluster-wide ingress denial of service in Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) lets a tenant holding only namespace-scoped Secret creation rights halt all ingress configuration changes across the entire cluster. Because the embedded KIC gathers CA-certificate Secrets from every watched namespace using only a label selector - with no ingress-class or namespace scoping - an attacker can plant a Secret whose user-controlled CA-certificate ID collides with an existing one, causing Kong Gateway to reject the whole configuration document. This is a missing-authorization (CWE-862) flaw reported by Kong; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Cluster-wide ingress denial of service in Kong Kubernetes Ingress Controller (KIC) allows a tenant holding only namespace-scoped Secret creation rights to halt all ingress configuration changes across every watched namespace. Because KIC gathers CA-certificate Secrets by label selector alone - ignoring ingress-class and namespace boundaries - and derives the CA-certificate primary key from a user-supplied Secret field, a low-privileged user can create a duplicate CA-certificate ID that forces Kong Gateway to reject the entire configuration document. Reported by Kong; no public exploit identified at time of analysis and not listed in CISA KEV.

Uncontrolled resource consumption in Node.js HTTP/2 implementation allows unauthenticated remote attackers to exhaust server memory and cause denial of service by sending crafted requests that bypass session-level header memory accounting. Affected is Node.js v22.x LTS ('Jod' line) prior to v22.23.2, fixed in the security release published 2026-07-29. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) reflects realistic network-level exploitability with no authentication barrier.

Denial of service in cJSON (DaveGamble's C JSON parser) through version 1.7.19 lets a remote attacker crash any application that applies an untrusted RFC 6902 JSON Patch through cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). By combining add and copy operations that graft duplicated subtrees, an attacker inflates document nesting far beyond the parser's 1000-level limit, and the unbounded recursion in cJSON_Delete() (plus a permissive CJSON_CIRCULAR_LIMIT of 10000 in cJSON_Duplicate()) exhausts the thread stack. Reported by VulnCheck with a public technical write-up; there is no public exploit identified at time of analysis and it is not on CISA KEV.

Denial-of-service in the nanoid JavaScript library (versions before 5.1.16) lets an attacker hang a Node.js/browser thread by supplying a negative size to the customAlphabet or nanoid functions of the non-secure module (nanoid/non-secure). Because the internal loop counter is decremented from a negative starting value, it never satisfies its termination condition and spins forever, consuming CPU and blocking the event loop. Reported by VulnCheck with a patch shipped in 5.1.16; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Denial-of-service in nanoid (Nano ID) versions before 5.1.6 lets an attacker hang a Node.js/JavaScript thread by supplying a size value of 0 to the customAlphabet or customRandom generator functions, triggering an unbounded internal loop (CWE-835). Only applications that forward an unvalidated, attacker-controlled size parameter to these functions are exposed. A vendor patch exists (5.1.6) and the issue was reported by VulnCheck, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution, denial of service, and data compromise affect a Schneider Electric industrial product exposing a Modbus TCP interface, where improper handling of unusual or exceptional Modbus conditions (CWE-754) lets a network attacker crash the device or run arbitrary code. The CVSS 4.0 base score of 9.3 with a network, no-privilege, no-interaction vector indicates unauthenticated remote exploitation is feasible. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of protocol exposure and full confidentiality/integrity/availability impact makes it a serious OT concern.

Denial of service in Apache Traffic Server's prefetch plugin allows remote attackers to crash the caching proxy by supplying malicious input that the plugin fails to validate. Affected releases span the 8.x (8.0.0-8.1.9), 9.x (9.0.0-9.2.14), and 10.x (10.0.0-10.1.3) branches, and exploitation impacts only availability with no data exposure or code execution. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 8.2.

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from the ts_lua plugin mishandling initialization, transform context, and per-instance state, allowing remote unauthenticated attackers to exhaust or corrupt resource state and crash or hang the proxy (CVSS 4.0 base 8.2, availability-only impact). Exploitation carries an attack requirement (AT:P), meaning a specific condition beyond the attacker's control must hold, and only deployments that actually load the ts_lua scripting plugin are affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; treat it as a serviceability/uptime risk to Lua-enabled ATS proxies.

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated attackers to crash the proxy by triggering NULL pointer dereferences and dangling references during TLS and SNI processing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a network-reachable, low-complexity availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is Apache-reported and patched in 9.2.15 and 10.1.4.

Memory-exhaustion denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy drops its per-stream buffer cap while dechunking HTTP/2 or HTTP/3 responses. A remote, unauthenticated attacker acting as a deliberately slow client can force unbounded buffering and exhaust server memory, degrading or crashing the caching proxy. This is a pure availability issue (CWE-400) with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated attackers crash the proxy or exhaust its resources by sending abusive HTTP/2 framing and flow-control sequences. The flaw is availability-only (no data disclosure or code execution), carries a CVSS 4.0 base score of 8.7, and has no public exploit identified at time of analysis. The Apache HTTP Server project has released fixed builds (9.2.15 and 10.1.4).

Remote denial of service in gotd/td versions before 0.145.1 allows unauthenticated attackers to exhaust memory and CPU by sending a crafted MTProto unencrypted packet with a maliciously inflated dataLen field, causing excessive allocation before length validation. No authentication or session is required, and the vulnerability is reachable during the handshake phase. There is no evidence of active exploitation and no public exploit has been identified.

Denial of service in IBM WebSphere Application Server 9.0, 8.5 and Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to consume server resources via malicious HTTP requests exploiting unbounded resource allocation. This can render the service unavailable. No active exploitation or public exploit has been identified.

Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to cause service disruption via uncontrolled heap allocation, resulting in high availability impact. No public exploit or active exploitation reported; vendor patch is available.

QTI Neon's relay service amplifies RECONNECT_REQUEST packets to the host, enabling unauthenticated attackers to cause denial of service on the host. The vulnerable handleReconnectRequest function in all three implementations (Java, Python, TypeScript) forward every request without bounding or deduplication, bypassing per-source rate limiting via spoofed IPs. No public exploit or KEV listing exists, but the attack is trivial to execute if a valid session ID is known.

Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.

Denial of service in rouille 0.1.6 through 3.6.2 allows remote unauthenticated attackers to crash the server

Denial of service via null dereference in Let's Chat 0.4.0 through 0.4.8 allows authenticated users to crash the server by sending a crafted request with a non-existent room ID. The vulnerability is remotely exploitable with no user interaction, and publicly available proof-of-concept code exists. No evidence of active exploitation or CISA KEV inclusion was identified at the time of analysis.

Heap-based buffer overflow in ESP32-audioI2S version 3.4.5 allows remote code execution, information disclosure, denial of service, or privilege escalation when processing a malicious WAV file. The flaw resides in the read_WAV_Header() function due to lack of bounds checking on chunk size and bytes-to-skip values, enabling heap corruption. A public proof-of-concept exists (CISA SSVC 'poc'), but no active exploitation has been confirmed in CISA KEV.

Denial of service and information disclosure in NVIDIA DCGM Exporter allows remote unauthenticated attackers to consume server resources and potentially read runtime profiling data. The vulnerability resides in the /debug/pprof endpoints, which lack resource limits, enabling concurrent profiling requests to exhaust CPU and memory. No active exploitation has been observed, but the attack vector is network-accessible without credentials, earning a CVSS 8.2 score.

Authentication denial of service in Pterodactyl Panel 1.7.0–1.12.4 allows an unauthenticated remote attacker to lock out all users from login and two-factor authentication by exhausting a single shared rate-limit bucket with approximately 10 requests per minute. The attacker can sustain the lockout indefinitely, preventing legitimate access including administrative login. A proof-of-concept is publicly available, though no active exploitation has been reported via CISA KEV.

Denial of service in GitHub MCP Server versions below 1.1.0 allows any unauthenticated attacker to crash the server by sending a malformed completion/complete JSON-RPC request with missing parameters. The nil pointer dereference occurs before authentication checks, making exploitation trivial. Publicly available exploit code exists, enabling immediate termination of the process.

Uncontrolled recursion in Pivotick's graph traversal and JSON viewer allows remote attackers to crash the user's browser tab by supplying crafted graph data with long paths, deep nesting, or circular references. No confidentiality or integrity impact exists - only client-side denial of service. A patch replaces recursive algorithms with iterative implementations and adds depth/cycle guards.

We are tasked to produce a comprehensive analysis JSON for CVE-2026-62432. We must synthesize all provided data: CVE description, CVSS, tags, SSVC, references, etc. The output must be plain-text strings per field, no arrays, no markdown. First, parse the input: - CVE ID: CVE-2026-62432 - Description: "The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer." - CVSS: 7.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) - Reported by: security@xen.org - Tags: Denial Of Service, Race Condition - SSVC: Exploitation: none, Automatable: yes, Technical Impact: partial - ENISA EUVD ID: EUVD-2026-49785 - References include xenbits advisory, NVD, oss-security. No listed KEV status, no POC mention, no explicit patch version. The patch data is missing (we need to check references? Not provided explicitly. We must infer from multiple sources. The description mentions xen and hypercall, so it's a Xen hypervisor vulnerability. We need to fill out each field. Let's systematically analyze. - product_name: From description, "EVTCHNOP_expand_array hypercall" implies Xen hypervisor. The vulnerability is in Xen's event channel mechanism. So product is "Xen Hypervisor". Could also say "Xen", but "Xen Hypervisor" is 2 words. According to rule "1-3 words ONLY", "Xen Hypervisor" fits. - summary: Must be 2-3 sentence plain-language synthesis. Not copy description. Start with impact verb and product. Example: "Race condition in Xen Hypervisor can lead to denial of service via NULL pointer dereference." But also mention what attacker can do. The CVSS suggests partial impacts in C/I/A, so maybe more than DoS? But tags say Denial Of Service, Race Condition, and description says dereferencing NULL pointer, so likely denial of service (sys

Denial of service in Xen hypervisor running PV guests without hardware-assisted paging (HAP) or shim allows a malicious guest or remote attacker to monopolize CPU via long-running shadow paging operations, impacting host availability. This issue has been deprecated rather than patched, as modern alternatives (HAP, PVH, shim) eliminate

Denial of service in Quick.CMS allows an authenticated administrator to delete the primary language by sending a direct HTTP request to the language-deletion API endpoint, bypassing the UI restriction, which renders the application unusable. The vendor deems a fix unnecessary due to very low exploitation likelihood, but chaining with a separate Cross-Site Request Forgery vulnerability (CVE-2026-1468) enables an unauthenticated remote attacker to craft a malicious link that, if visited by an authenticated admin, triggers the same DoS condition.

Memory exhaustion in cowlib (from 2.0.0 up to but not including 2.19.0) lets an unauthenticated remote HTTP/2 or HTTP/3 peer drive the Erlang VM into memory exhaustion and a denial of service by supplying a header with a non-terminating HPACK or QPACK prefixed-integer continuation. The decoder in cow_hpack_common:dec_big_int/3 keeps consuming continuation octets while building ever-larger Erlang bignums, so a single maximal indexed representation carried in one HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the header-table index is rejected as invalid, with repeated or concurrent connections multiplying the pressure. Exploitation is availability-only, requires no authentication or user interaction, and is fully automatable against any default-configuration endpoint that accepts HPACK or QPACK from an untrusted peer, including Cowboy servers and the RabbitMQ management plugin; at time of analysis no public exploit code was identified and no confirmed active exploitation exists (EPSS is 0.29%, 21st percentile, and CISA SSVC records exploitation as none with partial technical impact).

Heap-based buffer overflow in ESP32-audioI2S 3.4.5’s ID3v2 APIC frame parser lets remote attackers execute arbitrary code or crash vulnerable devices by supplying a crafted MP3 file. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.

Heap-based buffer overflow in ESP32-audioI2S 3.4.5 allows remote attackers to cause denial of service, information disclosure, or arbitrary code execution via a crafted MP3 file. Public exploit code is available but no active exploitation is confirmed.

Heap-based buffer overflow in schreibfaul1 ESP32-audioI2S library version 3.4.5 allows remote unauthenticated attackers to corrupt PSRAM memory, leading to denial of service and potential arbitrary code execution. An unchecked unsigned integer overflow when allocating a buffer for audio processing results in an undersized allocation; subsequent read/write operations overrun the heap. A proof-of-concept exploit is publicly available, but the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Use-after-free vulnerability in Safari’s web content processing allows remote attackers to execute arbitrary code on affected Apple devices when a user visits a malicious website. Affected versions include Safari prior to 26.6, iOS and iPadOS prior to 26.6, macOS Tahoe prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6. No public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.13%).

Remote denial-of-service in Apple macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows unauthenticated attackers to disrupt system availability through an input validation weakness. No active exploitation or public exploit code has been identified; EPSS indicates low probability of widespread attacks.

Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe/tvOS/visionOS/watchOS before 26.6 - where a use-after-free (CWE-416) lets a locally installed app crash the system. There is no public exploit identified at time of analysis and the NVD CVSS 9.8 (C:H/I:H/A:H) conflicts with Apple's own description, which states only 'unexpected system termination' (availability impact), suggesting the true impact is a DoS crash rather than full compromise. EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.

Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected system termination. Affected versions include iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. While the NVD assigns CVSS 9.8, the actual impact is limited to availability; no active exploitation or public exploit code is identified, and EPSS indicates very low exploitation probability (0.17%).

Unexpected system termination in iOS and iPadOS prior to 26.6, as well as in certain versions of macOS, tvOS, and visionOS, resulting from a use-after-free memory corruption. Apple's description indicates a local denial-of-service where a malicious app can crash the system, while the NVD-assigned CVSS 9.8 erroneously implies unauthenticated remote code execution. A patch is available, no active exploitation has been reported, and EPSS suggests a very low probability of wide exploitation.

Use-after-free memory corruption in Apple's core operating-system platforms - iOS/iPadOS, macOS Tahoe, tvOS, and watchOS before version 26.6 - allows a locally installed and executed application to crash or unexpectedly terminate the system. Exploitation requires the victim to run attacker-supplied code as an app on an unpatched device; there is no remote attack surface, and the demonstrable impact is availability only (system termination/reboot), with no data disclosure, modification, or code execution established - meaning the publicly circulated CVSS 9.8 network vector materially overstates the real reachability and impact of this bug. No public exploit identified at time of analysis, EPSS is low at 0.16% (6th percentile), CISA SSVC records Exploitation: none with total technical impact if reached, and Apple has shipped fixes in 26.6 across all four platforms.

Use-after-free memory corruption in Apple's iOS 26.6-era platform family lets an already-installed app crash the operating system kernel or a system service, producing an unexpected system termination (denial of service). Affected software spans iOS/iPadOS before 26.6, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, macOS Tahoe before 26.6, and tvOS, visionOS and watchOS before 26.6; exploitation requires the attacker's app to run locally on the device, since the flaw is only reachable from within an executing process. The headline input score of CVSS 9.8 (AV:N) overstates the issue - Apple's own advisory describes impact limited to a crashing app, EPSS is a low 0.17% (6th percentile), CISA SSVC records no exploitation and no public exploit code exists, and no KEV listing or POC is associated with CVE-2026-43822.

A use-after-free vulnerability in Apple operating systems allows a malicious app to cause unexpected system termination or write to kernel memory. The issue affects iOS

Denial of service in Apple iOS, macOS, and related operating systems due to a use-after-free flaw could allow a malicious app to crash the device. Apple's advisory only confirms unexpected system termination, but an independent CVSS score of 9.8 suggests potential for full system compromise; however, the CVSS vector appears inconsistent with the vendor description. The vulnerability is patched in versions 26.6 for all affected OSes, and no active exploitation or public exploit code is known.

A use-after-free memory-corruption flaw in Apple's mobile and desktop operating systems lets an app already running on the device trigger an unexpected system termination - a denial-of-service condition affecting availability only. The issue is fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6, meaning every device running an earlier build of those platforms is exposed. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none) and no public exploit code has been identified; EPSS is just 0.16% (6th percentile), and the widely circulated CVSS 9.8 AV:N/PR:N vector is grossly inflated relative to the assessed AV:L/AC:L/PR:N/UI:N impact of C:N/I:N/A:H.

A use-after-free vulnerability in macOS allows a local application to cause a denial-of-service by crashing the system or a key service. The flaw affects multiple macOS versions prior to the Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 updates. Despite an assigned CVSS score of 9.8 suggesting remote pre-authentication full compromise, the Apple advisory explicitly describes only a local denial-of-service impact, and the EPSS exploitation probability is very low (0.16%). No active exploitation or public proof-of-concept has been reported, and a vendor patch is available.

Kernel memory corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows a malicious app to cause system termination or corrupt kernel memory. A use-after-free issue in the kernel’s memory management could be triggered by an app, leading to unexpected system behavior or potential code execution. Patches are available across all affected operating systems; no active exploitation has been observed.

Denial of service in the Linux kernel XDP generic receive path allows a NULL pointer dereference and kernel panic when a bond slave interface is released while XDP redirect processing is in flight. The affected code, xdp_master_redirect() in net/core/filter.c, guards only on netif_is_bond_slave() but dereferences the master device that bond_upper_dev_unlink() has already cleared, faulting on master->flags at offset 0xb0. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; the issue is a race-window crash rather than a memory-disclosure or code-execution bug.

Information disclosure and denial of service in GIMP's file-icns plugin allow local attackers to leak heap memory contents via a crafted ICNS image file. When processing a truncated mask resource, the plugin performs an out-of-bounds read, leaking heap data as alpha channel pixel values or crashing the application. User interaction is required to open the malicious file.

Arbitrary code execution in GIMP when opening a crafted FITS file due to an integer overflow in the file-fits plugin that leads to a heap buffer overflow. An attacker can achieve memory corruption and potentially execute arbitrary code with the user's privileges. No public exploit or active exploitation has been identified at time of analysis.

Denial-of-service in facil.io 0.6.0 through 0.7.6 permits unauthenticated remote attackers to permanently disable the server by sending a specially crafted multipart/form-data request with a partial closing boundary. The flaw triggers an infinite loop in the multipart parser, consuming 100% CPU on all worker processes and requiring a manual restart to recover. A public proof-of-concept is available, though no active exploitation has been confirmed by CISA KEV.

Denial of service in Erlang/OTP's TLS handshake allows remote unauthenticated attackers to crash the BEAM VM by sending a crafted X.509 certificate chain. The vulnerability affects OTP versions 26.2 through 29.0.3 and specific patch releases of 27 and 28, exploiting unbounded growth of the policy tree during path validation. No active exploitation or public exploit code is known at this time, but the attack is automatable and has a high CVSS score.

Erlang/OTP nodes that decode External Term Format (ETF) from untrusted sources can be aborted outright by a single malformed term, in versions from OTP 27.0 up to but not including the fixed releases OTP 29.0.4, 28.5.0.4 and 27.3.4.15 (erts 15.0 up to 17.0.4, 16.4.0.4 and 15.2.7.11). The BIT_BINARY_EXT tag (77) handler accepts an encoding with zero length and zero trailing bits, causing an unsigned underflow in the computed bitstring size; the resulting value near 2^64 is handed to the allocator, which terminates the entire VM with an abort rather than raising a catchable Erlang exception. The vulnerability is unauthenticated (CVSS 4.0 vector PR:N) but requires the target application to feed attacker-controlled bytes into binary_to_term/1,2 or enif_binary_to_term(), an application-design precondition reflected as AT:P in the vendor vector and assessed as AC:H in our CVSS 3.1 evaluation; impact is availability-only (C:N/I:N/A:H). There is no indication of active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.32% (24th percentile), and no public exploit code has been identified at time of analysis. Vendor-released patches are available.

Remote code execution and denial of service are possible against Erlang/OTP nodes that run the megaco application with the optional flex C-driver scanner, because a single text-encoded H.248/Megaco message carrying an oversized property parm name overflows a fixed 512-byte error buffer and corrupts live pointers inside the scanner driver struct. Affected are OTP releases from 17.0 up to the 29.0.4, 28.5.0.4 and 27.3.4.15 fixes (megaco 3.17.1 through 4.9.1, 4.8.3.1 and 4.7.2.2) where {scanner, flex} is configured; exploitation requires only network reachability to the megaco transport port, with no authentication or user interaction (vendor CVSS:4.0 8.3; independent assessment CVSS:3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:H). Reliable code execution is not confirmed and depends on struct/heap-layout grooming, builds compiled with _FORTIFY_SOURCE abort with SIGABRT (denial of service only), no public exploit code was identified at time of analysis, EPSS is 0.73% (51st percentile), and CISA SSVC rates exploitation as none with automatable as no.

Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows remote attackers to exhaust memory and crash the BEAM node. Affects OTP versions 23.2 to before 27.3.4.15, 28.5.0.4, 29.0.4 (ssl 10.2 to before 11.2.12.11, 11.6.0.4, 11.7.4). No user interaction or authentication required, making this a pre-authentication denial-of-service risk for any TLS

Use-after-free in SQLite 3.41 allows remote attackers supplying crafted SQL to trigger memory corruption during parsing, leading to denial of service, sensitive information leakage, and potential arbitrary code execution.

Use-after-free in SQLite 3.41 expression parsing leads to memory corruption, allowing remote attackers to crash applications and leak sensitive memory contents via crafted SQL queries. Public proof-of-concept exists but there is no evidence of active exploitation. The vulnerability is triggered by sending malicious SQL statements that cause the parser to access a freed expression object.

Use-after-free in SQLite 3.41's expression-evaluation path lets an attacker who can submit a crafted SQL statement crash the process, leak adjacent memory, or potentially achieve code execution. The flaw stems from sqlite3ReleaseTempReg() prematurely freeing a temporary register that exprComputeOperands() then dereferences. Rated CVSS 7.5 (AV:N/AC:H/PR:L); publicly available exploit code exists per the CISA SSVC 'poc' determination, but it is not on the CISA KEV list and EPSS is low (0.24%, 16th percentile), indicating no evidence of widespread active exploitation.

Memory corruption in SQLite 3.41's ORDER BY parsing allows remote attackers to crash the database process or leak sensitive data via crafted SQL queries. A use-after-free in ExprList handling, triggered by an ORDER BY clause with many items, can also lead to arbitrary code execution under specific memory conditions. A public advisory exists, but no active exploitation (KEV) or EPSS data is available.

Remote denial of service and heap memory leak in SQLite 3.41 via the json_remove() function allows attackers with the ability to execute SQL queries to crash the database process or leak sensitive heap data. A use-after-free in jsonRemoveFunc is triggered by malformed JSON and a deep path parameter; publicly available proof-of-concept code exists, and low EPSS risk indicates limited exploitation likelihood.

Out-of-bounds array read and missing initialization flaw in the Linux kernel's drm/hyperv virtual display driver affect Linux VMs running under Microsoft Hyper-V. A SYNTHVID_RESOLUTION_RESPONSE message carrying resolution_count exceeding 64 causes the guest kernel driver to walk past the end of the 64-entry supported_resolution[] array, potentially disclosing adjacent guest kernel heap memory to the Hyper-V host. A separate missing-initialization defect in the WIN10-to-WIN8 protocol fallback path leaves screen dimension fields at zero, causing drm_internal_framebuffer_create() to reject every userspace framebuffer with -EINVAL and effectively disabling virtual display. No public exploit exists and EPSS is 0.21%; exploitation of the OOB read requires host-level control over Hyper-V VMBus messaging.

Heap corruption in the Linux kernel's IIO ad_sigma_delta driver allows a local attacker with low privileges to overflow the kernel heap, potentially achieving privilege escalation or causing denial of service. The flaw stems from improper handling of registerless sigma‑delta ADC devices when no ready GPIO is assigned and the reset clock count is zero. EPSS modelling indicates low exploitation likelihood (0.21%), and no active exploitation is reported; patches are available from the vendor.

Use-after-free in the Linux kernel TCP Authentication Option (TCP-AO

Use-after-free in the Linux kernel's cros_ec driver enables a local low-privileged attacker to potentially escalate privileges or compromise system integrity on devices with ChromeOS Embedded Controller hardware. The flaw stems from dev_set_drvdata() being called too early in ec_device_probe(), allowing sub-drivers like cros_ec_typec to access a stale pointer after probe failure. No public exploit code or active exploitation has been identified, and EPSS is low (0.22%).

Out-of-bounds read in the Linux kernel's Bluetooth L2CAP configuration option parser allows an adjacent attacker to crash the system or leak up to 4 bytes of kernel memory. The vulnerability arises from a validate-after-use bug where an attacker-controlled option length is dereferenced before checking bounds, affecting all Bluetooth-enabled kernels prior to the fix

The Linux kernel writeback subsystem crashes with a use-after-free during container exit due to a race between cgroup_writeback_umount() and inode_switch_wbs(). An in-flight writeback-context switch can pass the SB_ACTIVE check and take an inode reference before the filesystem unmount clears SB_ACTIVE, but delay queuing its work item - causing the umount path to flush a workqueue that has nothing pending, destroy percpu counters via put_super(), and then have the deferred switch work invoke percpu_counter_dec() on freed memory, triggering a BUG_ON or silent UAF. No public exploit is identified at time of analysis; EPSS stands at 0.21% (12th percentile) with no CISA KEV listing.

Linux kernel real-time scheduling on non-PREEMPT_RT builds (kernel 4.1 through multiple stable branches) can be livelocked on large multi-CPU systems via the RT_PUSH_IPI mechanism. When a CPU is saturated with softirqs in hardirq context and simultaneously targeted by repeated IPIs from other CPUs attempting to pull overloaded RT tasks, the IPI flood degrades softirq performance until the CPU can never return to task context, permanently removing it from the scheduler. No public exploit exists; EPSS is 0.22% (13th percentile), and no KEV listing is present, reflecting the workload-specific nature of the condition.

Use-after-free in the Linux kernel USB gadget UDC subsystem exposes systems with DWC3-based USB controllers to a race condition between usb_del_gadget() and gadget_match_driver(), enabling a NULL pointer dereference that can crash the kernel or enable privilege escalation on unpatched systems. The flaw affects all major Linux stable branches from 5.15.x through 7.1.x prior to the patched releases, and is particularly relevant for embedded Linux, Android-based devices, and IoT hardware that use USB gadget/device mode. No public exploit has been identified at time of analysis, and EPSS remains at 0.21% (12th percentile), reflecting current low exploitation interest.

Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory by sending crafted binary protocol messages that lack a string size limit when the non-strict path is used. Successful exploitation can crash the affected service. No active exploitation or public exploit code is currently reported.

Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger infinite loops when processing malformed varint input, affecting Python, Go, PHP, and Java bindings before version 0.24.0. Exploitation can exhaust CPU resources, making the service unresponsive; no active exploitation or public exploit code is known at this time.

Uncontrolled memory allocation in FFmpeg through 8.1.2 allows a remote attacker to exhaust process memory by supplying a crafted IAMF media file as small as 17 bytes. The IAMF demuxer's mix_presentation_obu() function calls av_calloc() with an attacker‑controlled count_label value before validating input data, causing an amplification of approximately 126 million bytes per input byte. Although the CVSS 4.0 score is 7.1 and no active exploitation has been observed (EPSS 0.28%), the vulnerability can be triggered with minimal user interaction, making it a credible denial‑of‑service risk in media processing pipelines.

CPU exhaustion in bandit 1.11.0 to 1.12.0 allows unauthenticated remote denial-of-service via WebSocket fragment reassembly. An attacker can send millions of tiny continuation frames per connection, triggering quadratic (O(n²)) buffer length recalculation that pins a CPU core for minutes to hours without requiring any authentication. No active exploitation has been confirmed (KEV), but a public proof-of-concept exists, and the EPSS score is low (0.39%).

Denial of service in the Linux kernel's x86/ftrace dynamic trampoline mechanism causes a kernel panic when CONFIG_CALL_DEPTH_TRACKING is enabled on retbleed-affected platforms (e.g., Skylake) using retbleed=stuff. An attacker with local privileged access to configure ftrace can trigger a crash by setting up a kprobe event and invoking the traced function. No active exploitation or public exploit has been reported, and the EPSS probability is 0.16% (5th percentile), indicating low real-world risk.

Unlocked concurrent writes to the mlx5e ICOSQ (Internal Completion Queue Send Queue) in the Linux kernel's AF_XDP path allow a race condition during CPU affinity changes to corrupt work-queue state, producing bad CQEs and kernel warnings observed in production on Mellanox/NVIDIA ConnectX interfaces. Two distinct races exist: mlx5e_trigger_irq() racing with mlx5e_xsk_alloc_rx_mpwqe() across CPUs after NAPI completion, and mlx5e_trigger_irq() racing with mlx5e_trigger_napi_icosq() on the same path. The vulnerability manifests as an availability impact - corrupt ICOSQ entries trigger hardware-level error CQEs - with no public exploit code and EPSS at 0.15% (5th percentile), reflecting its operational rather than adversarial trigger.

Denial of Service in React Router 7.x (Framework Mode) allows unauthenticated attackers to send crafted requests to the manifest endpoint, causing heavy server load and degraded response times. This is a follow-up CWE-400 vulnerability to GHSA-8x6r-g9mw-2r78, affecting only Framework Mode applications using react-router versions 7.0.0 through 7.17.x. A patch is available in version 7.18.0.