Denial of Service

Unrestricted file upload in DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final lets unauthenticated remote users push arbitrary files into the application's configured upload storage by posting directly to DotvvmFileUploadMiddleware without a valid X-DotVVM-UploadToken, enabling repeated uploads that exhaust disk space and cause denial of service. The flaw stems from the middleware storing files without verifying a per-render cryptographic token or applying the previously client-supplied type/size constraints server-side. No CISA KEV listing or public exploit code was identified at time of analysis; the vendor has released fixes and adds an optional AuthorizeFileUpload authorization hook.

A null pointer dereference in the bfd_putl64() function of GNU Binutils 2.47 (bfd/libbfd.c), reachable through the ld linker component, lets a local user crash the tool by feeding it a malformed ELF file. Publicly available exploit code exists (a GitHub write-up demonstrating a SEGV), and the upstream project was notified via a Sourceware bug report but has not responded, so no fixed release has been published. Severity is low (CVSS 4.0 base 1.9) because exploitation requires local access, yields no confidentiality impact, and is limited to integrity/availability loss of the linking process.

A local denial-of-service flaw in SSSD (System Security Services Daemon) lets an attacker who can connect to the PAM responder socket crash the responder by sending a crafted protocol request that omits the service item while the pam_app_services option is enabled, triggering a NULL pointer dereference. Only availability is affected (CVSS 5.5, C:N/I:N/A:H), but a crash of the PAM responder disrupts authentication on the host until the service is restarted. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided in the source feeds.

Local denial of service in SSSD's PAM responder occurs when a local process with access to the responder's UNIX socket negotiates legacy PAM protocol v1 and sends an empty or truncated request body. The out-of-bounds read in pam_parse_in_data() can terminate or restart the responder, causing availability loss for local authentication. This is a low-severity issue (CVSS 4.0, EPSS 0.12%, 2nd percentile) with no public exploit identified at time of analysis and no confirmed active exploitation in the provided data; exploitation requires a local foothold that can reach the socket and explicitly negotiate protocol v1.

A crafted or malfunctioning SDIO card that advertises a maximum block size of zero drives the Zephyr SDIO client API into an infinite loop inside sdio_io_rw_extended_helper(), permanently hanging the calling thread while it holds the per-card mutex. The defect affects Zephyr 3.6.0 through 4.4.1 and is reachable through public driver-facing helpers such as sdio_read_fifo() and sdio_write_fifo(), so the SDIO peripheral — and any dependent subsystem such as Wi-Fi — is denied service until the device is reset. The attack requires physical insertion of a malicious card into a removable SDIO/combo slot, so boards with soldered SDIO peripherals are not attacker-influenceable; there is no memory-safety, confidentiality, or integrity impact, only availability loss. A vendor fix is available and no public exploit code or active exploitation has been identified at time of analysis.

A use-after-free in GPAC's scene-graph handling (gf_sg_script_load path) lets a crafted MP4/VRML scene file corrupt memory when processed by MP4Box or any application embedding libgpac. Publicly available exploit code exists and the flaw is remotely deliverable, though exploitation requires the victim or an ingestion pipeline to actually open the malicious media file (UI:P). A vendor fix is available in release abi-16.23 / commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24, and the CVSS 4.0 base score is only 2.1 because confidentiality, integrity and availability impacts are all rated Low.

An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).

Use-after-free

GPAC's MP4Box (through commit f1219cde) crashes with a null pointer dereference in gf_node_list_get_child when it parses a crafted BT or XMT scene description that targets a non-child node field, giving attackers a denial-of-service against anyone who opens the malicious file. Publicly available exploit code exists (linked from the CVE references), and the vendor has already shipped a fix in release abi-16.23 (commit afca1f1181668d85941d51ed1adf647807d5d975), yet CVSS 4.0 scores the issue only 2.1 because impact is limited to availability and exploitation requires the victim to feed the file to GPAC. The CVE record has no KEV listing, so this is a PoC-level, low-severity crash bug rather than an actively exploited threat.

Use-after-free in GPAC's `gf_node_unregister` function (scenegraph/base_scenegraph.c) allows an attacker to cause a crash or limited memory corruption by supplying a crafted MP4, BT, or XMT scene file. The vulnerability arises from improper cleanup ordering of proto field default node values during scene graph teardown, with additional related issues in the BT and XMT scene loaders. A public proof-of-concept exploit exists (GitHub issue #3801 and dedicated write-up), though the CVSS 4.0 score of 2.1 and all-Low impact metrics indicate reliable code execution is unlikely - DoS via crash is the primary realistic outcome. No CISA KEV listing exists.

Plugin handler panic recovery failure in Mattermost allows authenticated users to crash installed plugins by sending a post-action request containing a field with an unexpected type. Affected versions span multiple maintained release branches (≤11.9, 11.0.9, 11.4.8, 11.7.7, 10.22.11.0) as disclosed under MMSA-2026-00701. No public exploit code or active exploitation has been identified; impact is bounded to plugin availability disruption with no confidentiality or integrity exposure.

Mattermost's server-side Markdown parser across versions 10.11.x through 11.9.0 fails to enforce a nesting depth limit, allowing any authenticated user to cause CPU resource exhaustion by posting a message containing pathologically deep blockquote or list item nesting. The vulnerability is classified CWE-407 (Inefficient Algorithmic Complexity), producing a denial-of-service condition that degrades availability for all users of the affected instance. With a vendor-confirmed CVSS of 4.3 (Medium), no active exploitation, and SSVC marking it non-automatable, this represents a moderate insider or compromised-account risk rather than an urgent external threat. No public exploit code or CISA KEV listing identified at time of analysis.

Reachable assertion in the flatcc FlatBuffers schema compiler (versions 0.6.0-0.6.3) crashes the compiler process when a crafted schema file containing duplicate symbol declarations is processed. The `align_order_members` function in `src/compiler/semantics.c` proceeds into member-ordering logic after the parser has already recorded a failure state due to duplicate symbols, violating the function's internal invariant that no duplicates exist and triggering an assertion abort (CWE-617). A proof-of-concept exploit is publicly available via GitHub issue #387, enabling reliable reproduction of the crash with no public exploit code beyond a malformed schema file.

Reachable assertion in the flatcc FlatBuffers compiler (versions 0.6.0-0.6.3) allows remote attackers to crash the compiler process by supplying a crafted schema file containing circular struct references. The `analyze_struct()` function in `semantics.c` proceeds into assertion-protected code paths even after the parser has already flagged a failure state, triggering an abort. No public exploit identified at time of analysis is contradicted by the input: a publicly available proof-of-concept exists on the project's GitHub issue tracker. Impact is limited to denial-of-service of the compiler itself, with no code execution or data exfiltration possible.

Denial-of-service in vLLM's Rust-based tiktoken tokenizer allows a local low-privileged attacker to crash the vLLM process by supplying a crafted vocab file containing duplicate token ranks. The TiktokenTokenizer::new() function in the Rust tokenizer backend previously panicked unconditionally when parsing a tiktoken file with two tokens sharing the same rank value, rather than returning a graceful error. A public proof-of-concept exploit is available via GitHub Gist; no patch has been merged as the fixing pull request remains open.

Denial-of-service in Gitlawb openclaude (all versions up to 0.30.0) arises from improper resource handling in the `waitForCallback` function of the xAI OAuth Callback Handler (`src/services/api/xaiOAuthCallback.ts`), where a manipulated Error argument causes availability degradation. The attack is network-reachable but requires user interaction (CVSS 4.0 UI:P), resulting in a low availability impact with no confidentiality or integrity consequences. A publicly available proof-of-concept exists as GitHub issue #2101; the vendor has been notified but has not yet responded to the disclosure.

The Microsoft Calendar plugin in Mattermost fails to validate null entries in incoming Microsoft Graph webhook payloads, enabling any unauthenticated remote attacker to crash the plugin process by sending a single crafted POST request to the public webhook endpoint. Affected are Mattermost versions 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22. No public exploit code or active exploitation has been identified; however, SSVC classifies this as automatable, meaning the denial-of-service condition can be triggered reliably and at scale without special tooling.

Use-after-free in Open5GS AMF component versions 2.0.x through 2.7.x allows network-reachable attackers to corrupt memory in the Access and Mobility Management Function process by triggering the old AMF discovery fallback handler with a crafted interaction. The root cause is premature deallocation of the SBI transaction structure (`ogs_sbi_xact_remove`) before the `discovery_option` argument derived from that structure is fully consumed; the fix relocates the free call past all dependent uses. No public exploit code has been identified; an upstream patch commit is available.

The Boards plugin in Mattermost fails to validate the data type of `fields.properties` during block creation, enabling any authenticated user holding editor-level access on a board to crash the Boards plugin worker via a malformed child block. Four release branches are affected (10.11.x, 11.7.x, 11.8.x, 11.9.x). No public exploit has been identified, SSVC rates exploitation as none and the attack as non-automatable, and the CVSS 4.3 Medium score is consistent with a bounded, privilege-gated availability impact.

Mattermost server crashes or becomes unavailable when an authenticated user sends multiple SDP messages compressed with zlib that decompress to arbitrarily large sizes, exploiting the absence of any decompressed-size cap. Affected are all Mattermost instances running versions 11.9.0, 11.8.4 and earlier in the 11.8.x line, 11.7.7 and earlier in the 11.7.x line, and 10.11.22 and earlier in the 10.11.x line. No public exploit code has been identified at time of analysis, and the CVE has not been added to the CISA KEV catalog.

Unbounded memory allocation during image decoding in Mattermost 10.11.x through 11.9.x allows any authenticated user to trigger a denial-of-service condition against the server. By uploading a specially crafted image - such as a decompression bomb - through any of several upload surfaces (profile picture, channel file attachment, team icon, or custom brand image), an attacker can cause the Mattermost server process to exhaust available memory. No public exploit code or active exploitation has been identified at time of analysis; the vendor addressed this under advisory MMSA-2026-00719.

Authenticated local attackers on Windows systems running ASRock Polychrome SYNC/RGB can crash the operating system by submitting a specially crafted IOCTL request to the product's installed kernel-mode driver, which dereferences an attacker-supplied pointer without validation (CWE-822). Both the Motherboard (MB) and VGA variants of the software are affected, as confirmed by TWCERT. No public exploit code or active exploitation has been identified; impact is strictly denial of service with no confidentiality or integrity dimension, consistent with the CVSS 4.0 vector scoring VA:H with all other impact metrics at N.

Mattermost's server-side Markdown autolink parser processes autolinks with unmatched trailing closing parentheses in superlinear time, enabling any authenticated user with post-creation rights to cause excessive CPU consumption and degrade availability for all users on the instance. Affected release trains are 11.9.x through 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22 across both cloud and self-hosted deployments. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the low exploitation barrier - any authenticated account - means insider threat or compromised-account scenarios are the primary realistic risk.

Resource exhaustion in Mattermost's file processing pipeline allows any authenticated user with file upload permissions to spawn unbounded goroutines by continuously uploading large files, degrading or blocking the file indexing service for all other users. Affected versions span the 10.11.x, 11.7.x, 11.8.x, and 11.9.x release trains. The vulnerability stems from two compounding defects: absence of a concurrent-file-processing cap and improper handling of failed file ingestion, together enabling goroutine accumulation in Mattermost's Go runtime. No public exploit code exists and no active exploitation has been identified at time of analysis.

Disk space exhaustion in multer 2.2.0-2.3.0 allows a remote unauthenticated attacker to repeatedly start and abort multipart/form-data uploads, leaving orphaned temporary files that accumulate until the host disk partition is exhausted. The race condition arises when asynchronous disk writes complete after multer's abort cleanup routine has already run, so those files escape deletion entirely. No authentication is required and no special server configuration beyond the default disk storage engine is needed; the issue is fixed in multer 2.4.0.

Disk exhaustion via zip bomb in Eclipse OpenVSX allows a publisher to cause persistent service disruption on any OpenVSX server instance. A publisher uploads a small, highly compressed VSIX (zip bomb) that the server decompresses without size limits when any client requests a file via /vscode/unpkg/; the decompressed content is cached to java.io.tmpdir under an entry-count eviction policy with no total-size bound, enabling repeated disk exhaustion through new filenames or versions. Impact includes HTTP 500 errors for all uncached resources, publishing failures with 'Failed to read extension file', and a poisoned cache entry that blocks future requests to the same path. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided input.

Use-after-free in GPAC's scene graph management allows remote attackers to cause memory corruption via a crafted multimedia scene file. The flaw exists in `gf_node_changed_internal` within `base_scenegraph.c` and is triggered when GPAC's BT/XMT scene loaders fail to properly track node lifecycle, leaving dangling references to freed nodes in `def_nodes` lists and proto field structures. A public proof-of-concept exploit has been disclosed and the vendor has released a fix in tag abi-16.23. No confirmed active exploitation (KEV) is recorded at time of analysis.

Reachable assertion failures in GPAC's MP4Box tool through commit f1219cde allow a local attacker to crash the process by supplying a crafted MP4 or MPEG-4 BIFS scene graph file. The flaw originates in gf_node_get_field_count (scenegraph/base_scenegraph.c), where hard gf_assert() calls - and a structural field-ordering mismatch in nodes_mpeg4.h between adjacent MPEG-4 node type definitions - allow malformed input to reach an assert that aborts the process. A proof-of-concept has been publicly published; the vendor-released fix is available in the abi-16.23 tagged release.

Reachable assertion in GPAC MP4Box up to commit f1219cde causes a process abort when a crafted LASeR/MP4 file is processed with MP4Box. The flaw resides in lsr_exec_command_list() in laser/lsr_dec.c, where gf_assert(!codec->bs) fires unconditionally if the codec bitstream handle is already open at command list entry, triggering an abort rather than a graceful error return. A local, low-privileged user with user interaction required can crash the MP4Box process by supplying a malformed input file. A public exploit write-up exists, and the vendor has released a patch in version abi-16.23.

Reachable assertion in GPAC MP4Box's scenegraph node unregistration function allows a local attacker to crash the application by supplying a crafted MP4 file. The vulnerability exists in `gf_node_unregister()` within `scenegraph/base_scenegraph.c`, where a hard `gf_assert(pNode->sgprivate->num_instances)` fires when processing scene graph structures with zero instance counts - a state reachable through malformed MPEG-4 BIFS scene data. No confidentiality or integrity impact exists; impact is limited to availability of the MP4Box process. A public proof-of-concept and a vendor-released patch are both available.

Null pointer dereference in GNU libredwg 0.13.4's Layer table encoding function allows a local attacker to crash any application built on the library by supplying a DWG file whose LAYER entity has no material handle assigned. The root cause is commit 27118c40 (

Untrusted pointer dereference in the camera driver of Samsung Exynos 1580 and 2500 mobile processors allows a local low-privileged attacker to cause denial of service or leak limited kernel information across security boundaries by sending a malformed message to the driver. The scope-changed CVSS vector (S:C) indicates impact extends beyond the immediate process context into privileged system components. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Out-of-bounds write in the Wi-Fi interface kernel driver of Samsung Exynos mobile and wearable processors enables a local low-privileged user to cause a denial of service through a crafted ioctl command. Affected SoCs include the Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000, covering a broad range of Samsung Galaxy smartphones and Galaxy Watch devices. No public exploit has been identified, and the impact ceiling is a recoverable availability disruption with no confidentiality or integrity exposure.

GPAC's MP4Box media packager crashes on a crafted MP4 file due to a reachable assertion in stbl_GetSampleInfos() (src/isomedia/stbl_read.c), which fires when a malformed sample-to-chunk table causes firstSampleInCurrentChunk to exceed the current sampleNumber. All GPAC releases up to commit f1219cde are affected. A public exploit writeup exists; however, exploitation is limited to local denial-of-service-crashing the MP4Box process-with no confidentiality or integrity impact. The vendor has released a patch in tag abi-16.23 replacing the bare gf_assert with a graceful error-return path.

Reachable assertion in GPAC's MP4Box tool (up to commit f1219cde) causes process abort when processing a crafted MPEG-4 scene file: `gf_sm_dump_command_list()` in `scene_manager/scene_dump.c` fires `gf_assert(!sdump->current_com_list)` if the command-list pointer is already populated at dump time, crashing MP4Box. A local attacker with standard user privileges who can supply input to the MP4Box binary can trigger this denial of service. No public exploit confirmed in CISA KEV, but a publicly available proof-of-concept exists; vendor-released patch abi-16.23 is available.

Denial of service in GPAC MP4Box (up to commit f1219cde) triggers a process abort via an unconditional reachable assertion (`gf_assert(0)`) inside `xmt_parse_element` in `scene_manager/loader_xmt.c` when parsing a crafted XMT scene file. Local, low-privilege users can crash the process by feeding malformed input to the MP4Box command-line tool; no code execution or data leakage is possible. A public proof-of-concept is documented and the vendor has released a fix in version abi-16.23.

Null pointer dereference in GPAC MP4Box up to commit f1219cde causes a local denial-of-service when processing crafted VRML/MPEG-4 scenegraph content via the MP4Box tool. The crash originates in scenegraph/vrml_tools.c, specifically in the cyclic traversal flag logic where a node pointer is dereferenced without a NULL guard. A publicly available proof-of-concept exploit exists, and the patch was merged in release abi-16.23. No public exploitation activity (KEV) has been observed; this is a low-severity, locally-exploitable tool crash with no confidentiality or integrity impact.

NULL pointer dereference in the 5G NR baseband of Samsung Exynos processors and modems causes a denial-of-service condition when a malformed RRC Reconfiguration message is received from the network. Sixteen Exynos chip variants are affected, spanning Samsung flagship, mid-range, and wearable devices - including Exynos 850, 1080, 2100, 2200, 2400, W920, W930, W1000, Modem 5410, and others. An attacker capable of injecting or spoofing RRC layer signaling (e.g., via a rogue base station) can trigger a crash in the L2/RRC processing stack, disrupting cellular connectivity. No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds write in the camera driver of Samsung Exynos processors (1330, 1380, 1480, 2400, 1580, and 2500) can be triggered by a local low-privileged attacker writing a malformed message to the debug sysfs entry `test_msg`, causing a denial-of-service condition in the camera subsystem. The vulnerability crosses a privilege boundary (scope changed) from user space into the camera driver, but impact is limited to availability and does not affect confidentiality or integrity. No public exploit code has been identified at time of analysis, and Samsung has published a security advisory addressing the issue.

Out-of-bounds memory read in Withsecure Atlant's Capricorn scanning engine allows remote unauthenticated attackers to crash the antivirus engine by submitting a crafted document file for processing, resulting in a denial of service. All Atlant deployments running a Capricorn engine build prior to 2025-01-20_02 are affected. No public exploit code has been identified and no active exploitation is recorded; the low CVSS score of 3.7 reflects high attack complexity and a limited, partial availability impact.

NULL pointer dereference in the datasets library (likely HuggingFace datasets or a similar data-processing package) crashes the host process when parsing unexpected or malformed NDJSON (Newline Delimited JSON) files. Any application or pipeline that loads attacker-influenced NDJSON data through the affected library is exposed to a denial-of-service condition. No public exploit has been identified at time of analysis, and no CVSS or CWE data has been assigned yet by NVD.

Unbounded transmit (tx) buffer growth in the Linux kernel's DHCP subsystem can exhaust system memory when traffic is unidirectional. The defect allows the kernel's DHCP-related transmit path to accumulate resources indefinitely - packets or descriptors are enqueued without corresponding release when bidirectional flow acknowledgment is absent. Systems running DHCP client or server functionality via the affected kernel subsystem are exposed to denial-of-service through memory exhaustion. No public exploit has been identified at time of analysis.

Baseband crash in Samsung Exynos mobile processors and modems allows a nearby attacker operating a rogue 5G base station to remotely crash the cellular modem by sending malformed, unauthenticated downlink NR RRC Setup messages. The flaw affects a wide range of Exynos chipsets - from Exynos 1080 through 2500, W1000, and Modem 5300/5400/5410 - used in Samsung Galaxy smartphones and tablets. Exploitation results in loss of cellular connectivity (DoS) on the affected device; no public exploit code has been identified at time of analysis.

Heap overflow via TOCTOU race in the Exynos DRM HDR Driver affects Samsung Mobile Processors across nine Exynos SoC generations (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600), enabling a local low-privileged attacker to crash the kernel. The race condition occurs in the Display Processing Unit's HDR handling path, where a check-then-use window can be exploited to corrupt kernel heap memory, resulting in a denial-of-service condition. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.

Use-After-Free in the Samsung Exynos DRM HDR kernel driver causes a kernel crash on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 SoCs. The defect lies in the error-handling path of the HDR driver: when a vmap() call fails, cleanup does not properly invalidate the freed mapping, leaving a dangling reference that is subsequently dereferenced, crashing the kernel. The CVSS vector (AV:L/AC:H/PR:L) indicates a local low-privileged attacker can trigger this under specific error conditions, crossing into kernel scope (S:C). No public exploit code or active exploitation has been identified at time of analysis.

Heap memory exhaustion in Zephyr RTOS mcumgr SMP settings handlers allows unauthenticated attackers to trigger a monotonic heap leak by sending settings read, write, or delete commands that the application access hook rejects, ultimately depleting the kernel heap until the device must be rebooted. The three affected handlers - settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c - allocate buffers via k_malloc() but execute a direct return bypassing the end: cleanup label whenever CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK rejects a request via MGMT_CB_ERROR_RC. The vulnerability is availability-only with no memory corruption or information disclosure; no public exploit code or CISA KEV listing exists at time of analysis.

Unconstrained memory allocation in TooTallNate Java-WebSocket 1.6.0-1.6.1 allows remote unauthenticated attackers to exhaust server heap memory by sending WebSocket frames with arbitrarily large declared payload lengths. The Draft_6455 fragmentation handler initialized maxFrameSize to Integer.MAX_VALUE (~2 GiB), so the library attempts to allocate the full declared frame size before any payload data is actually received. A publicly available proof-of-concept exists via GitHub issue #1508; the upstream fix is in PR #1509 but has not yet shipped in a tagged release.

Uncontrolled resource consumption in evanchiu/serverless-todo (versions 1.0.3 and 2.0.0) allows remote unauthenticated attackers to exhaust compute or memory resources by sending crafted payloads to the API Todo Endpoint's saveTodos function. The vulnerability stems from unsanitized processing of the event.body argument in src/index.js without input size or rate limits. A public proof-of-concept is available via a GitHub issue; no patch has been released and the maintainer has not responded to the disclosure.

Use-after-free in GPAC's MP4Box multimedia tool (all versions through commit f1219cde) allows a local low-privileged attacker to corrupt heap memory via the gf_list_count function in utils/list.c, resulting in application crashes and potentially limited code execution within the process. The fix released in abi-16.23 (commit 49dee5cad329) addresses multiple interrelated UAF and null-dereference conditions across the scenegraph manager, BIFS memory decoder, and AV1 reframer subsystems. A public proof-of-concept exploit exists; no active exploitation has been confirmed via CISA KEV.

Null pointer dereference in GPAC's MP4Box scenegraph engine crashes the application when processing malformed MPEG-4 BIFS scene data. The flaw resides in gf_node_list_add_child within base_scenegraph.c, reachable when node registration encounters a zero instance count or a null node pointer in gf_node_unregister() and gf_node_get_name_and_id(). A public proof-of-concept exploit exists and a vendor-released patch (abi-16.23) is available; no active exploitation is recorded in CISA KEV.

Null pointer dereference in GPAC's MP4Box tool crashes the process when parsing crafted MPEG-4/VRML scene graph data containing a malformed MFURL field, triggering the flaw inside gf_sg_mfurl_del() during scene graph cleanup. Local, low-privileged users can cause a denial of service by feeding MP4Box a specially crafted file; there is no confidentiality or integrity impact. A public proof-of-concept is available and the CVSS 4.0 vector confirms Exploit maturity of Proof-of-concept (E:P), making this straightforward for local attackers to reproduce, though impact remains limited to application crash.

Null pointer dereference in Systerel S2OPC through version 1.7.3 enables authenticated remote clients to crash the OPC-UA server by inducing heap allocation failures during subscription publish cycles. The defect in `msg_subscription_publish_bs__alloc_notification_message_items()` silently overwrites a NULL returned by a failed DataChangeNotification allocation with the result of a subsequent EventNotificationList allocation, masking the first failure and causing a deferred NULL dereference that terminates the server process. No public exploit or active exploitation has been identified; a vendor patch is available via GitLab commit 8848f051.

IURegistryFilter.sys, the kernel-mode registry filter driver bundled with IOBit Uninstaller 15.5.0.11, can be crashed by any local low-privileged user by sending a crafted IOCTL to the sub_11838 dispatch handler, which dereferences a null pointer in kernel context and produces a system-wide crash (BSOD). The attack surface is broader than a single product: the advisory explicitly states that the identical IURegistryFilter.sys driver ships across multiple other IObit product families, meaning all such products on an affected host are vectors. A published proof-of-concept exploit exists (CVSS 4.0 E:P), and no vendor patch is available - the vendor did not respond to coordinated disclosure.

Unbounded audio extraction in vLLM 0.10.2-0.27.x enables remote denial of service against NanoNemotronVL model deployments. The root cause is an asymmetric protection gap: `_extract_audio_from_videos` in `nano_nemotron_vl.py` calls `load_audio_pyav` without the size or duration guard parameters enforced on the direct audio upload path, bypassing the `VLLM_MAX_AUDIO_DECODE_DURATION_S` and `VLLM_MAX_AUDIO_DECODE_BYTES` environment variable limits entirely. An attacker submitting a maliciously compressed video via the multimodal inference API forces the server to allocate gigabytes of memory during audio decoding, crashing the service. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch is available in vLLM 0.28.0.

Unauthenticated service disruption in Flowise before 3.1.4 allows any network attacker to forcibly abort active chatflow predictions belonging to other users. The /api/v1/text-to-speech/abort endpoint accepts caller-supplied chatflowId and chatId without verifying ownership, enabling targeted interruption of in-progress AI workflow sessions. No active exploitation (KEV) or public exploit code is confirmed at time of analysis; the attack is trivially low-complexity but requires a running target session and knowledge of valid identifiers.

Stack-based buffer overflow in ArduinoCore-avr versions prior to 1.8.8 allows an attacker who can influence float or double values passed to Arduino String concatenation methods to corrupt stack memory on AVR-based Arduino boards, causing denial of service and - under specific conditions - arbitrary code execution on the microcontroller. The flaw resides in `String::concat(float)` and `String::concat(double)` in `WString.cpp`, where a fixed 20-byte stack buffer is insufficient for values near the extremes of the float or double range when processed by `dtostrf()`. A vendor-released patch is available in version 1.8.8; no public exploit has been identified at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereferences. Make the branch cover the PI verification as well - while fs_bio_integrity_verify works without an integrity payload, it requires one to actually do useful work.

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to kthread_stop() event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel. Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() In uvcg_video_init(), if kthread_run_worker() fails, the error logged uses uvcg_err(), however, the pointer it uses: video->uvc is not assigned at this point, triggering a null pointer dereference. Fix this by directly using uvc->func which is assigned already.

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure param_set_charp() stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released before the replacement allocation succeeds. If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter left as NULL. Failing zswap's compressor update before zswap is initialized can later trigger: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:strcmp+0x10/0x30 Call Trace: zswap_setup+0x3b1/0x490 zswap_enabled_param_set+0x5b/0xa0 param_attr_store+0x93/0xe0 module_attr_store+0x1c/0x30 kernfs_fop_write_iter+0x116/0x1f0 Allocate and copy the replacement first, then replace the parameter value only after allocation succeeds.

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg_mr that cannot be passed through the ioctl. They also assume that the udata cannot be NULL, so failing to pass a valid udata can trigger a NULL udata crash in those drivers. This never happens in real systems since in rdma-core ibv_cmd_reg_mr_ex() does not accept a udata and those three drivers don't use it, however a malicious userspace could trigger it.

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclnt_locks_init_private() installs NLM file lock operations even when nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc() then returns -ENOMEM, but the VFS still tears down the partially initialized file_lock and calls locks_release_private(). That invokes nlmclnt_locks_release_private(), which dereferences fl->fl_u.nfs_fl.owner and crashes because the owner was never installed. Clear fl_ops before attempting to initialize the NLM private state, and install the NLM lock operations only after a lockowner has been allocated successfully.

In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- <command>' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu_cf_events at first event initialization. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online create an event for CPUs 0,2-X. Since the events are created with task-context, the scheduler will eventually schedule the program on CPU1. This CPU has not created and initialized any per CPU event infrastructure as that CPU was not online at the time of the perf invocation. Thus when the scheduler runs stress-ng on CPU1, the function cpumf_pmu_add() refers to a NULL pointer: struct cpu_cf_events *cpuhw = this_cpu_cfhw(); This function call is invoked after the task stress-ng has been made runnable on CPU1. And this_cpu_cfhw() returns NULL. The result is a panic: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 0000000000000483 .... Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80) .... Call Trace: [<000003ef8291fd0c>] cpumf_pmu_add+0x3c/0x80 [<000003ef82bb5e3e>] event_sched_in+0xae/0x190 [<000003ef82bb60d6>] merge_sched_in+0x1b6/0x390 [<000003ef82bb65b8>] visit_groups_merge.constprop.0.isra.0+0x308/0x5b0 [<000003ef82bb689a>] pmu_groups_sched_in+0x3a/0x50 [<000003ef82bb6a30>] ctx_sched_in+0x180/0x260 [<000003ef82bb780c>] perf_event_context_sched_in+0x11c/0x2d0 [<000003ef82bb79ee>] __perf_event_task_sched_in+0x2e/0xc0 [<000003ef82994834>] finish_task_switch.isra.0+0x1a4/0x250 .... Last Breaking-Event-Address: [<000003ef8291f1d8>] this_cpu_cfhw+0x38/0x40 The issue arises only in per-task context when the CPUMF facility is used and the scheduler picks a random CPU for such a process to run on. The scheduler enables the CPUMF infrastructure via PMU callback functions pmu::add() and pmu::del(). Introduce a CPU hotplug prepare/dead callback pair which creates and removes the per CPU counter data while the CPU is offline. Count the users which track every CPU (cpu == -1), that is perf_event_open() events with task context and /dev/hwctr device sessions, in the new counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex. This ensures the infrastructure is available when new CPU is selected to run the per-task context process. In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference pointer to data structures is set to NULL before the data is freed to prevent interrupt handlers to access stale data. [gor@linux.ibm.com: change commit message]

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device->private, either directly or through the DASD_DEFINE_ATTR() macro. During dasd_generic_set_online() the discipline is assigned before check_device() allocates device->private, so an unprivileged read of one of these world-readable attributes in that window dereferences a NULL pointer and panics. Guard the dereference inside each callback that actually touches device->private.

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate_password_input() computes length = strlen(buf) and then checks buf[length - 1] to strip a trailing newline, without checking that length is nonzero first. Writing an empty string (a bare '\n') to current_password or new_password gives length == 0, and buf[length - 1] reads buf[-1], one byte before the heap allocation holding the copied input. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] Read of size 1 at addr ffff88811bd8da9f by task sh/13740 ... store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] current_password_store+0x14/0x20 [hp_bioscfg] ... The buggy address is located 23 bytes to the right of allocated 8-byte region [ffff88811bd8da80, ffff88811bd8da88) Reproduced identically via new_password_store. Execution continues past the bad read (the garbage byte only affects whether "length" is decremented by one), so the write completes and returns success; this is a pure information read past the buffer, not a crash, but it is still an out-of-bounds access KASAN correctly flags. Fix by only checking buf[length - 1] when length is nonzero.

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration try_smi_init() allocates new_smi->si_sm and later calls ipmi_register_smi_mod(), which maps to ipmi_add_smi(). During ipmi_add_smi(), the upper IPMI message handler obtains the initial BMC device information through __bmc_get_device_id(). This can fail if the BMC does not return a successful response to the Get Device ID command. When the BMC returns a nonzero completion code, the device-id helper retries the command and eventually returns -EIO if the device ID still cannot be fetched. On this failure path, ipmi_add_smi() logs "Unable to get the device id" and goes to out_err_started, where it invokes the lower driver's shutdown callback. try_smi_init() then logs the returned registration failure: ipmi_si IPI0001:00: IPMI message handler: Unable to get the device id: -5 ipmi_si IPI0001:00: Unable to register device: error -5 For ipmi_si, the shutdown callback is shutdown_smi(), which cleans up the SI state machine data, frees smi_info->si_sm, and sets smi_info->si_sm and smi_info->intf to NULL. However, intf->in_shutdown is not set on this failed-registration rollback path. Therefore, the asynchronous redo_bmc_reg work item can still retry BMC device-id probing after the lower driver has already cleared its SI state machine data. In the observed case, that retry path reached start_next_msg(), which passed the NULL smi_info->si_sm pointer to the selected KCS state machine handler: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 Workqueue: events redo_bmc_reg [ipmi_msghandler] RIP: start_kcs_transaction+0x2c/0x190 [ipmi_si] Call Trace: start_next_msg+0x50/0x80 [ipmi_si] check_start_timer_thread.part.9+0x3b/0x50 [ipmi_si] sender+0x69/0x80 [ipmi_si] i_ipmi_request+0x2ac/0x9d0 [ipmi_msghandler] __get_device_id.isra.29+0xaa/0x180 [ipmi_msghandler] __bmc_get_device_id+0xef/0x950 [ipmi_msghandler] redo_bmc_reg+0x52/0x60 [ipmi_msghandler] process_one_work+0x1a7/0x360 Set intf->in_shutdown on the out_err_started path before invoking the lower driver's shutdown callback. This prevents later redo_bmc_reg retries from using an interface whose lower driver state has been cleaned up, and applies the same shutdown state to other IPMI interfaces as well.

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code jumps to the "out" label and calls dm_stat_free. dm_stat_free does "for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);", which crashes with NULL pointer dereference if s->stat_percpu[cpu] is NULL. This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before using it.

Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.

Uncaught TypeError in hbs 4.3.0 crashes the Node.js process when an async Handlebars helper resolves to an object with a truthy but non-callable `toHTML` property. Handlebars' `escapeExpression` unconditionally invokes `toHTML()` on any value that exposes it; because async helper substitution executes on a later event-loop tick, the resulting TypeError falls outside the render function's try/catch and becomes a fatal uncaught exception, terminating the entire process without sending a response. The flaw is remotely triggerable when the async helper's resolved value is influenced by attacker-controlled input such as parsed JSON. No public exploit code has been identified at time of analysis, and the issue is fixed in hbs 4.3.1.

Out-of-bounds read in Qt's NFC connectivity module (qtconnectivity) exposes applications to denial of service or limited process memory disclosure when parsing crafted NFC tags with malformed language code length fields. All Qt versions fall within the affected CPE scope, with the flaw residing in NDEF Text Record parsing logic invoked when a user scans a malicious tag. No active exploitation has been confirmed and no public exploit code exists, but the zero-privilege requirement lowers the bar for a physically proximate adversary.

Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.

Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.

IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.

Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.

Use-after-free in Suricata 8.0.0-8.0.4 causes an engine crash when a malicious detection rule chains decompress transforms (gunzip or zlib_deflate with max-size exceeding 4096) after another transform, allowing the pipeline to read from a freed inspection buffer during subsequent network traffic processing. The net effect is a reliable denial-of-service: once the offending rule is loaded, any matching network traffic will crash the Suricata process regardless of traffic content. No public exploit or active KEV listing exists at time of analysis. Vendor-released patch is available in version 8.0.5.

Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a valid mTLS certificate - but no ACL token - to crash or severely degrade Consul servers by exhausting server memory before ACL authorization is evaluated. Both open-source Consul and Consul Enterprise are affected across multiple release tracks. Vendor-released patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4; no public exploit or CISA KEV listing has been identified at time of analysis.

Remote denial-of-service in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated network attacker to degrade service availability by sending a specially crafted request that triggers uncontrolled resource consumption (CWE-400). The CVSS A:L metric indicates partial rather than complete service disruption, limiting but not eliminating operational impact. IBM has released a patch via advisory 7286610; no public exploit code or active exploitation has been identified at time of analysis.

Integer overflow in the MongoDB C Driver's SASL authentication path allows an abnormally large username to bypass a size check via arithmetic wrap-around, writing past the end of a fixed-size buffer and crashing the embedding application. Only applications compiled with the optional external SASL backend and configured to use it are reachable; the impact is limited to availability with no confidentiality or integrity consequence per CVSS VC:N/VI:N. No public exploit has been identified at time of analysis.

NoSQL injection in the MongoDB Rust Driver's GridFS component allows an authenticated, low-privileged user to supply a crafted file identifier that is evaluated as a query predicate rather than a literal scalar value. Depending on the operation targeted, this can expose GridFS file content belonging to unintended records within the bucket, or - in the most destructive path - cause all file chunks in the affected bucket to be deleted, permanently rendering stored file content unreadable. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue is acknowledged by MongoDB via JIRA issue RUST-2469.

Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a crafted .traineddata model file. The deserialization path in Plumbing::DeSerialize fails to reject a zero-length network stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layer types; subsequent initialization in Series::CacheXScaleFactor unconditionally dereferences stack_[0] on the now-empty vector, producing a deterministic crash via an invalid virtual method call through a dangling Network pointer. No public exploit is identified at time of analysis, and no fixed release has been issued - only an upstream commit fix is available.

Infinite-loop denial of service in zstd-jni versions 1.4.8-4 through 1.5.7-13 allows thread starvation by passing negative length values to ZstdInputStreamNoFinalizer.read(). Because the method is declared synchronized, the spinning loop holds the stream monitor indefinitely, blocking every other thread that attempts to call any synchronized method on the same stream object. Fixed in v1.5.7-14; no public exploit identified at time of analysis.

Kernel denial-of-service in Silicon Labs' silabser.sys Windows 8 driver for CP210x USB-to-UART bridge devices allows any local unprivileged user to trigger a kernel crash by supplying incorrect driver settings. The root cause is CWE-369 (Divide by Zero) inside a kernel-mode driver, meaning exploitation produces a Blue Screen of Death (BSOD) and full system reboot. No public exploit code or active exploitation has been identified at time of analysis.

Denial of service in rclone prior to 1.75.1 allows unauthenticated remote attackers to crash individual HTTP or WebDAV connections by sending a Range request with an offset exceeding a symlink target's length. When `--links` or `links=true` is enabled, symlinks are exposed as `.rclonelink` pseudo-objects whose content is the target path string; the `openTranslatedLink` function sliced that string using a caller-controlled offset without bounds validation, producing a deterministic Go slice-bounds panic. Go's `net/http` recovers panics per connection rather than per process, limiting impact to request-level denial of service. No public exploit has been identified and the vendor-released fix is available in version 1.75.1.

HTTP/3 read timeout non-enforcement in Traefik allows unauthenticated remote attackers to exhaust upstream backend connection pools by trickling request body data indefinitely over QUIC streams. Versions 2.8.2 through 2.11.55 and 3.x through 3.7.11 fail to apply the configured `readTimeout` to HTTP/3 entrypoints because that timeout is enforced at the TCP connection layer and QUIC streams have no corresponding deadline. Attackers with access to an exposed HTTP/3 endpoint can hold upstream connections open without triggering any server-side timeout, progressively exhausting backends with bounded connection pools. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.

Type confusion in the Sierra Wireless HL78xx GNSS driver within Zephyr RTOS (4.4.0-4.4.1) allows an adjacent, unauthenticated attacker with GNSS signal-spoofing capability to drive the kernel-side NMEA parser into writing satellite data through a wild/garbage pointer, most likely crashing the device. The root defect is a struct member ordering invariant violation: the generic NMEA0183 match helper casts user_data directly to struct gnss_nmea0183_match_data, but hl78xx_gnss_data placed match_data as the second member (after const struct device), causing GGA/RMC callbacks to write fix data at wrong offsets and the GSV satellite callback to dereference a pointer constructed from non-pointer bytes. No public exploit exists; a vendor-released patch is available in Zephyr 4.4.2.

Suricata 8.0.0 through 8.0.4 fails to consistently enforce the configured Lua sandbox memory ceiling (`security.lua.max-bytes`), allowing certain Lua allocation patterns to grow unbounded and exhaust host memory. The root cause (CWE-770) is an incomplete enforcement path for new allocations in the sandbox, introduced in the 8.0.0 branch. An attacker whose traffic is inspected by a sensor with Lua rules enabled can craft packets that trigger the vulnerable allocation patterns, causing a denial-of-service condition; no public exploit has been identified at time of analysis.

HTTP/3 read timeout enforcement is entirely absent in Traefik v2.8.2-v2.11.55 and v3.0.0-v3.7.11, enabling any unauthenticated remote client to hold connections open indefinitely by slowly trickling request body bytes over QUIC. Because QUIC streams cannot accept the TCP-level deadline used to enforce the default 60-second readTimeout, the HTTP/3 server was constructed with no timeout at all; each stalled request occupies one upstream connection. Repeated exploitation exhausts bounded backend connection pools and causes denial of service against proxied applications. Fixed in v2.11.56 and v3.7.12; no public exploit identified at time of analysis.

Buffer overflow in Bosch Sensortec COINES SDK versions 2.0 through 2.11 allows a malicious or compromised sensor evaluation board, connected to a host machine via USB or BLE, to overflow the host application's heap or stack by streaming an excessive volume of sensor samples. The root cause is that `coines_read_stream_sensor_data()` unconditionally performs a `memcpy` of the full ring buffer content without verifying whether the caller-provided destination buffer can accommodate it, because the internal `comm_intf_process_stream_response()` silently discards the requested `number_of_samples` bound. No public exploit has been identified at time of analysis, but successful exploitation could yield arbitrary code execution on the host developer machine.

Uncontrolled recursion in Red Hat Service Interconnect 2's skupper-router AMQP field parser allows a remote unauthenticated attacker to crash the router by sending a specially crafted network message, resulting in denial of service for all services relying on the interconnected network. The vulnerability stems from an absent recursion depth limit during AMQP message parsing, causing stack memory exhaustion. No public exploit code has been identified at time of analysis, and the CVSS AC:H rating reflects the need to craft a payload that precisely triggers the unbounded recursion path.

Denial of service in Apache ActiveMQ Artemis and Apache Artemis allows an authenticated client to exhaust shared broker thread resources by attaching a consumer with a crafted wildcard message selector that triggers excessive computational evaluation during message delivery. Affected versions span Apache ActiveMQ Artemis 1.0.0-2.44.0 and Apache Artemis 2.50.0-2.56.0, with a vendor-confirmed fix released in version 2.57.0 on September 9, 2026. No public exploit code or active exploitation has been identified at time of analysis.