Denial of Service

Denial of service in Apache ActiveMQ Artemis and Apache Artemis message brokers allows authenticated clients holding MANAGE permission to crash broker processing threads by submitting crafted management-via-messaging requests that trigger unsafe Java deserialization. The deserializer processes method parameters the broker never actually uses, permitting gadget-chain payloads that consume excessive CPU and pin the thread pool. Both the legacy ActiveMQ Artemis lineage (1.3.0-2.44.0) and the newer Apache Artemis project (2.50.0-2.56.0) are affected; no public exploit or active exploitation has been identified at time of analysis.

Heap use-after-free in DaveGamble cJSON's cJSONUtils_MergePatch function (cJSON_Utils.c) affects all versions through 1.7.19 when the patch argument is a subtree of the target object. The function deletes the target before duplicating the patch, freeing the patch memory and causing a subsequent read of freed heap - confirmed by an AddressSanitizer-triggering test case in upstream fix PR #1065. A public exploit exists (GitHub issue #1060) and can lead to crash, potential memory disclosure, or memory corruption in any application that passes attacker-influenced JSON through this specific merge-patch call pattern.

mruby 4.0.0's Prism-based compiler front end (mrbgems/mruby-compiler) passes NULL pointers returned by zero-length allocations into memcpy() and memcmp(), so parsing a crafted Ruby source file such as an operator assignment whose write name is exactly "=" (for example eval('[.m M:+=')) causes undefined behavior and a possible interpreter crash. The impact is availability-only: an attacker who can get the target to compile or eval untrusted mruby source can interrupt the hosting process. No public exploit code or CISA KEV listing is known, EPSS is only 0.15% (5th percentile), and an upstream fix commit (c6866eed) exists, but the description's claim of a practical crash conflicts with the commit's own note that only sanitizer builds actually report the condition.

Denial of service in ZJU-FAST-Lab EGO-Planner-v2 (all versions through commit 5c99a95880401e2599638d567abc0e240396cb42) allows an attacker with access to the robot's ROS environment to crash or hang the local trajectory planner by supplying data that drives EGOReplanFSM::checkCollisionCallback() into uncontrolled resource consumption. The independently assessed vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms the attack is local-only and affects availability alone, with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis and EPSS is negligible (0.17%, 6th percentile); per our assessment this is a genuinely low-priority issue whose practical severity depends on whether an adversary already has a foothold on the ROS graph.

Bluetooth Classic L2CAP channel state confusion in Zephyr RTOS (versions 1.6.0 through pre-4.4.2) enables an adjacent unauthenticated peer to inject data PDUs into half-open L2CAP channels before configuration or security handshaking completes, forcing processing on stale or uninitialized channel fields. In the worst case, reused channel objects expose dangling _sdu reassembly buffer pointers, creating a memory-safety condition that causes channel and link teardown (denial of service) alongside unintended delivery of attacker-controlled data to upper-layer protocol handlers. No public exploit has been identified and the flaw is absent from CISA KEV; a vendor-released fix is available via Zephyr commit 2738ee9, targeting release 4.4.2.

Infinite-loop denial-of-service in Open WebUI 0.5.0-0.11.0 allows any authenticated user to permanently crash the backend service by storing id-less messages in a cyclic parent chain. The flaw in `get_message_list` (backend/open_webui/utils/misc.py) caused the chat-history traversal to never terminate, blocking the async event loop and consuming memory until the process died - with the condition persisting across restarts until an operator manually removes the offending messages or upgrades. No public exploit or active exploitation has been identified, but the low barrier (any login) and persistence across restarts make this an operationally impactful issue for self-hosted deployments.

Denial-of-service in Open WebUI versions 0.10.0 through 0.11.0 allows any authenticated user to permanently block all server-side request processing by submitting a cyclic chat message tree and then triggering the message-deletion endpoint. The DELETE /api/v1/chats/{id}/messages/{message_id} API delegates to a Python helper that traverses childrenIds in a while loop without recording visited node identifiers, entering an infinite loop that occupies the server's request thread indefinitely until the process is forcibly killed. No active exploitation or KEV listing is recorded, but the attack requires only a valid user session and no special configuration, making it a credible insider or compromised-credential threat for any multi-user deployment. Vendor-released patch is available in version 0.11.1.

Infinite CPU and memory exhaustion in Open WebUI 0.10.0-0.11.0 allows any authenticated user to trigger a persistent server-side denial of service by exploiting missing cycle detection in the folder tree API. The folder parent-update endpoint accepted self-referential or descendant-referential reparenting requests, storing a circular linked structure in the database. Subsequent folder operations - delete and read traversals - followed parent pointers indefinitely, consuming server resources until the cycle was manually repaired in the database. No public exploit code beyond the patch PR has been identified at time of analysis.

Denial of service in GPAC's ROUTE/LCT demuxer (src/media_tools/route_dmx.c) is triggerable when the framework processes a crafted ROUTE session, causing uncontrolled resource consumption that ends in a crash or hang. Affected builds include the source tree at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3, with the flaw fixed upstream in commit 3c4e6c5b3e0c6fa9b16d55599701a08354538fab. Exploitation is not confirmed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is only 0.14% (4th percentile), so real-world urgency is modest despite the 6.2 CVSS base score.

A crafted series of RTSP and HTTP requests sent to LIVE555 Streaming Media 2026.02.26 triggers a use-after-free in SocketDescriptor::tcpReadHandler1 (liveMedia/RTPInterface.cpp), crashing the media server and terminating all active streams. The flaw is reachable over the network without credentials, and because LIVE555 is embedded in IP cameras, streaming appliances and media servers, one crash can disrupt many downstream viewers at once. No public exploit code and no CISA KEV entry were identified at time of analysis, EPSS places exploitation probability at roughly 0.15% (5th percentile), and the supplied references do not state an exact fixed build number.

Denial of service in Wings3D v.2.4.1 allows a local attacker to crash the application by convincing a user to open a specially crafted Wavefront OBJ file. The vulnerability is availability-only, with no confidentiality or integrity impact, and requires user interaction to trigger. No public exploit code or active exploitation has been identified at time of analysis.

Denial-of-service via unvalidated kernel pointer in the Thesycon DPC Latency Checker Windows driver (dpc.sys) through version 1.4.0 allows any local unprivileged user to crash the host system. The driver's IOCTL handler at code 0x81772008 accepts a user-supplied pointer, dereferences it without validation, and passes the resulting value to the kernel API ExSetTimerResolution - causing an arbitrary kernel memory access that triggers an immediate BSOD. No public exploitation in the wild or CISA KEV listing has been identified, but a public researcher writeup with supporting materials exists on GitHub.

Path traversal in LF Edge eKuiper's plugin installation endpoint (POST /plugins/*) allows high-privileged management API users to delete arbitrary files and directories on the host by embedding traversal sequences such as `../../` in the plugin `name` parameter. Affected versions are all eKuiper releases prior to 2.4.1 (Go module github.com/lf-edge/ekuiper/v2). A proof-of-concept is published in the GitHub security advisory GHSA-c23q-fw86-9h5x, demonstrating deletion of arbitrary host paths via `os.RemoveAll`; the advisory explicitly confirms exploitation is bounded to file deletion only - no code execution, file creation, or data exfiltration is achievable.

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 expose a CWE-377 insecure temporary file flaw that a low-privileged remote attacker can exploit to cause denial of service and tamper with data. The vulnerability stems from unsafe temporary file handling - likely predictable naming or insecure permissions - enabling race-condition or symlink attacks against the storage platform. No public exploit or CISA KEV listing has been identified; Dell has released patches in the 9.13.1.1 and 9.15.0.0 branches.

In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pci_ecam_create() maps each bus segment separately and relies on the ->add_bus callback (pci_ecam_add_bus) to populate the per-bus mapping in cfg->winp[]. pci_ecam_map_bus() then uses that mapping as the base for every config access. The generic ECAM ops (pci_generic_ecam_ops) already provide the ->add_bus and ->remove_bus callbacks, but the CAM (legacy) ops in pci-host-generic.c do not. As a result, on a 32-bit host using "pci-host-cam-generic" the per-bus mapping is never set up and the first config read dereferences a NULL base, crashing during bus enumeration: Unable to handle kernel NULL pointer dereference at virtual address 00000800 Oops [#1] CPU: 0 PID: 1 Comm: swapper Not tainted 6.9.7+ #43 Hardware name: Digilent Nexys-Video-A7 RV32 (DT) epc : pci_generic_config_read+0x40/0xb0 ra : pci_generic_config_read+0x2c/0xb0 [<c038db9c>] pci_generic_config_read+0x40/0xb0 [<c038da04>] pci_bus_read_config_dword+0x50/0xb0 [<c0391e94>] pci_bus_generic_read_dev_vendor_id+0x3c/0x1ec [<c039245c>] pci_scan_single_device+0xa4/0x11c [<c0392570>] pci_scan_slot+0x9c/0x23c [<c039388c>] pci_scan_child_bus_extend+0x58/0x2f4 [<c0393db0>] pci_scan_root_bus_bridge+0x64/0xe8 [<c0393e54>] pci_host_probe+0x20/0xc8 [<c03bc6f4>] pci_host_common_probe+0x144/0x1e4 Fix this by giving the CAM ops the same ->add_bus/->remove_bus callbacks. Since pci_ecam_add_bus() and pci_ecam_remove_bus() are static to ecam.c, move the CAM ops definition there as pci_generic_cam_ops (mirroring pci_generic_ecam_ops) and export it for pci-host-generic.c to reference. [mani: removed timestamp from log]

In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on PREEMPT_RT syzbot is reporting KCOV state corruption on PREEMPT_RT kernels, for the temporary storage used for saving/restoring remote KCOV state is currently allocated as the per-CPU area. On PREEMPT_RT kernels, softirq handlers run as preemptible task threads (e.g., ksoftirqd). If a softirq context preempts a task running a remote KCOV session, it safely saves the task's state into the per-CPU area. However, if that softirq thread is subsequently preempted by a higher- priority softirq thread on the same CPU, the second softirq will overwrite the same per-CPU area, permanently destroying the original task's KCOV state. Fix this data corruption by moving the temporary storage from the per-CPU area to the per-thread area. Since each softirq thread now owns its own task context, nested softirq preemption no longer causes data overwrites. Note that while the temporary storage is now on a per-thread basis, the per-CPU kcov_percpu_data.lock must be retained, for we need to ensure that kcov_remote_start() and kcov_remote_stop() operate atomically without racing against asynchronous interrupts that manipulate the current task's KCOV state. It is likely that GFP_KERNEL allocation by vmalloc_node() in kcov_init() has already called panic() before returning NULL, for there will be no OOM-killable userspace processes when __init function of built-in module runs. But this patch also fixes crashing the kernel when vmalloc_node() in kcov_init() returned NULL, for kcov_init() left per-CPU irq_area == NULL but kcov_remote_start() depends on per-CPU irq_area != NULL, resulting in (1) doing vmalloc() in kcov_remote_start() despite !in_task() context (2) out-of-array-bounds access if (1) succeeded but kcov->remote_size < CONFIG_KCOV_IRQ_AREA_SIZE (3) always leak memory allocated by (1), eventually killing all OOM-killable userspace processes problems.

Remote denial-of-service in PocketMine-MP before 5.42.1 allows unauthenticated network attackers to degrade server performance by sending LoginPackets whose clientData JWT bodies contain large numbers of arbitrary junk properties. The server's JsonMapper iterates over and logs a warning for every unexpected property, enabling log flooding and unbounded CPU waste with no authentication required. A publicly available proof-of-concept exists via the vendor's own GitHub security advisory; no active exploitation in the CISA KEV has been reported.

Resource exhaustion in PocketMine-MP before 5.25.2 allows unauthenticated Bedrock clients to degrade server availability by submitting crafted packets containing excessive delimiter characters across sign editing, JWT login, and command parsing endpoints. The root cause is PHP `explode()` being called without a limit parameter in multiple packet-handling paths, causing the server to allocate unbounded memory arrays proportional to delimiter count in attacker-controlled input. No CISA KEV listing exists, but a proof-of-concept is publicly available via the vendor's GitHub security advisory (GHSA-g274-c6jj-h78p); vendor assessment notes real-world impact is partially mitigated by existing packet decompression size limits already enforced upstream.

Race condition in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to cause denial of service by exploiting improper synchronization of shared resources. Both the Appliance and Application deployment forms are affected across versions prior to 5.36.00.16 and 5.36.00.00 respectively, as confirmed by Dell advisory DSA-2026-382. No public exploit code has been identified at time of analysis.

Dell Secure Connect Gateway (SCG) 5.0 is affected by a network-exploitable TOCTOU race condition (CWE-367) that an unauthenticated remote attacker can leverage to cause denial of service. The appliance and application variants are both affected, with fixed versions at 5.36.00.16 and 5.36.00.00 respectively per Dell advisory DSA-2026-382. Notably, the vendor's CVSS vector includes low confidentiality and integrity impact metrics (C:L/I:L/A:L) beyond what the published description's DoS-only framing suggests, implying possible additional undisclosed effects from successful race exploitation.

Race condition in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to trigger denial of service against both the Appliance and Application deployment variants by exploiting improper synchronization of shared resources under concurrent access (CWE-567). Affected versions are Appliance prior to 5.36.00.16 and Application prior to 5.36.00.00, with fixes detailed in Dell advisory DSA-2026-382. Notably, the vendor-supplied CVSS 3.1 vector records C:L/A:N, which conflicts with the stated denial-of-service impact - a likely metadata error, as availability impact is the primary concern here. No public exploit code or active exploitation has been confirmed at time of analysis.

Exploitation of a TOCTOU race condition in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance and Application variants - allows a remote unauthenticated attacker to cause denial of service, with marginal confidentiality and integrity impact as reflected in the CVSS vector (C:L/I:L/A:L). The High Attack Complexity rating (AC:H) indicates reliable exploitation requires precise timing to win the race between the check and use operations. No public exploit code or CISA KEV listing has been identified, placing this in the category of a vendor-disclosed race condition with moderate real-world exploitability.

Null pointer dereference in mrubyc through 4.0.0 allows an attacker who can supply untrusted .mrb bytecode to crash any application embedding the VM. The op_enter() handler in src/vm.c fails to validate execution context before dereferencing, and OP_ENTER instructions placed at the top level of a crafted bytecode file - where no call frame exists - trigger the dereference and terminate the embedding application. No public exploit or active exploitation has been identified at time of analysis, and real-world risk is bounded by the requirement to feed attacker-controlled bytecode to the target application.

Unsynchronized multithreaded access in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to cause denial of service and potentially minor data integrity or confidentiality impact. Both the Appliance variant (fixed in 5.36.00.16) and Application variant (fixed in 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis.

Permission control vulnerability in the app management module of Huawei HarmonyOS and EMUI allows a local unprivileged attacker to disrupt device availability without requiring any user interaction or elevated privileges. Affected platforms span nine versions across both HarmonyOS (4.0.0 through 4.3.3) and EMUI (14.0.0 through 16.0.0), covering a broad swath of active Huawei consumer devices. No public exploit has been identified at time of analysis, and Huawei has disclosed this through their September 2026 security bulletin.

Remote denial-of-service in Tor before 0.4.9.12 allows any unauthenticated network peer to crash a Tor relay or client by transmitting a CC_RESPONSE congestion-control extension without a prior CC_REQUEST, corrupting the node's internal congestion-control state. Affected releases span 0.4.9.3-alpha through 0.4.9.11; the Tor Project patched this in 0.4.9.12 (TROVE-2026-032) with a ChangeLog entry and source commit. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Unbounded heap growth in MCP Kotlin SDK versions 0.7.0-0.12.0 allows an attacker-controlled byte-stream producer to OOM-kill the hosting JVM process via the stdio transport. The ReadBuffer.append() method writes all incoming data into a kotlinx.io.Buffer with no size cap, and frame extraction only triggers on newline arrival - a peer that never sends a newline causes indefinite accumulation. Both StdioServerTransport and StdioClientTransport compound the exposure by using Channel.UNLIMITED queues with no backpressure, amplifying heap consumption before any size guard could intervene. No public exploit identified at time of analysis; vendor-released patch available in version 0.13.0.

Uncontrolled recursion in Google go-attestation's Windows SIPA event log parser allows an unauthenticated remote attacker to crash any verifier application built on versions up to and including 0.6.1. The `readELAMAggregation` function in `attest/win_events.go` recurses for every nested `elamAggregation` sub-event without enforcing a maximum depth, and a size-guard bypass on recursive execution paths means even bounded input can drive unbounded stack growth. Submitting a crafted Windows event log with deeply nested ELAM headers exhausts the goroutine call stack, triggering an unrecoverable Go runtime panic that immediately terminates the verifier process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though a working proof-of-concept test case is embedded in the upstream fix PR.

Out-of-bounds memory read in the stb library's stbsp_vsnprintf function (stb_sprintf.h) at commit 31c1ad3 enables a denial-of-service condition when a consuming application passes attacker-controlled input to the function. The nothings/stb project is Sean Barrett's widely-vendored, public-domain, single-file C library suite embedded across game engines, imaging tools, and embedded systems. No public exploit code and no CISA KEV listing exist at time of analysis; the local attack vector and high attack complexity in the CVSS vector further limit practical exploitability.

Divide-by-zero in GPAC v26.07.0's DASH client crashes the process when parsing a crafted MPD SegmentTimeline containing a zero-duration segment entry, enabling a remote attacker to cause a Denial of Service against any application using GPAC to process MPEG-DASH content. The affected function gf_dash_get_timeline_duration divides by ent->duration without guarding against zero; the upstream fix commit (2fd5a06a) is confirmed available but a tagged patched release has not been independently verified. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Out-of-bounds read in stb_truetype's stbtt_GetGlyphShape function enables denial of service against any application that parses attacker-supplied TrueType font files using the nothings/stb library at commit 31c1ad3. The affected function reads glyph outline data from a crafted TTF without sufficient bounds validation, causing an abnormal read that crashes the host application. No public exploit code or CISA KEV listing was identified at time of analysis; CVSS 4.3 with UI:R reflects the realistic, user-triggered exposure.

Out-of-bounds read in GPAC v26.07.0's HTTP download subsystem (gf_dm_data_received in downloader.c) enables remote denial of service when a victim user processes a crafted HTTP response containing a malformed or pathologically large chunk-size value. The upstream fix commit confirms two root causes: absence of an upper-bound cap on parsed chunk sizes and an unchecked integer overflow in the nbBytes + hdr_size computation that causes accounting to wrap around before the out-of-bounds read occurs. Impact is limited to application crash with no confidentiality or integrity consequences; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Out-of-bounds read in GPAC's HTTP chunked-transfer downloader (src/utils/downloader.c) crashes the application when processing a server-supplied chunked HTTP response whose declared chunk size exceeds safe bounds. Affected versions include GPAC v26.07.0; the upstream fix introduces a 1 GB chunk-size ceiling and a pre-allocation integer-overflow guard in gf_dm_data_received. No public exploit has been identified at time of analysis, and CVSS UI:R confirms that exploitation requires a user to initiate a connection to an attacker-controlled media source.

Heap out-of-bounds read in gdk-pixbuf's ICNS decompression routine allows an attacker to crash GNOME applications or disclose adjacent heap memory by supplying a crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS data, lacks bounds validation on the source buffer during decompression. Exploitation requires user interaction - the target must open or preview the malicious file - but thumbnail-rendering paths in file managers such as Nautilus may reduce that barrier. No public exploit or KEV listing has been identified at the time of analysis.

Uncontrolled resource consumption in Adobe Acrobat Reader and Acrobat 2024 enables application-level denial of service when a victim opens a specially crafted document. Affecting Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, the flaw (CWE-400) allows a malicious file to exhaust system resources and crash or freeze the application. Adobe has released patches via advisory APSB26-141; no public exploit or CISA KEV listing has been identified at time of analysis.

Uncontrolled resource consumption in Adobe ColdFusion 2025 (≤Update 12) and ColdFusion 2023 (≤Update 23) allows an unauthenticated adjacent-network attacker to exhaust system resources, resulting in a full application denial-of-service condition. The vulnerability requires no user interaction and no privileges, making it straightforward to trigger from within the same network segment. This issue is patched under Adobe advisory APSB26-119, which also addresses a higher-severity authenticated SQLi/RCE flaw (CVE-2026-75746) in the same product.

Improper cryptographic signature verification in OpenDDS 3.33.x's SignedDocument module allows a local, low-privileged attacker to crash the DDS participant process via a crafted signed document, causing a denial of service. The flaw (CWE-347) resides in the verify() function within the SSL/SignedDocument.cpp component of the DDS Security implementation. A proof-of-concept exists per SSVC data, though EPSS is very low at 0.15% and active exploitation has not been confirmed by CISA KEV.

Out-of-bounds read in Skype for Business Server enables authenticated network attackers to crash the service, causing a denial of service. Affected are on-premises deployments of Skype for Business Server 2015, 2019, and the Subscription Edition - all unpatched below the versions specified in Microsoft's July 2026 advisory. No public exploit code has been identified and CISA has not placed this in the KEV catalog, placing it in the lower-priority tier despite the network-accessible attack vector.

Null pointer dereference in Microsoft Skype for Business Server allows any authenticated low-privilege user to crash the server over the network, causing a complete denial of communications service. Three on-premises product lines are affected: Server 2015 CU13, Server 2019 CU8, and Subscription Edition CU1. No active exploitation is confirmed - SSVC rates exploitation as none and the attack is not automatable - but the low authentication bar (any valid SfB user account) makes this a credible insider threat or compromised-credential scenario.

Persistent denial of service in Android's multipart header parsing function `parsePartHeaders` affects Android 14 through 17 due to improper input validation (CWE-20). A low-privileged remote attacker can send specially crafted multipart data to trigger the flaw with no user interaction required, causing a persistent system-level availability outage. The September 2026 Android Security Bulletin addresses this across all affected major releases. No public exploit code or KEV listing has been identified at time of analysis.

Integer overflow in Android's HEIF image parsing code causes a temporary remote denial of service against Android 15 through 17. The flaw resides in `convertCleanApertureToRect` within `HeifCleanAperture.cpp`, where malformed HEIF clean-aperture metadata triggers an integer overflow that crashes the media processing component. With PR:L and no user interaction required, an attacker with a low-privilege account can deliver a crafted HEIF file to trigger the crash remotely. No public exploit exists and EPSS sits at 0.16%, consistent with a moderate-severity DoS with no code execution pathway.

Persistent local denial of service in Android's VoiceInteractionManagerService affects versions 14 through 17 via resource exhaustion in the initForUserNoTracing method. A low-privilege local attacker - such as a malicious installed app - can exhaust system resources without any user interaction, rendering the device persistently unavailable. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with limited real-world exploitation interest.

Persistent denial-of-service in Android's WifiNetworkSuggestionsManager affects versions 15 through 17, including 16-QPR2. The `add` method in WifiNetworkSuggestionsManager.java fails to enforce resource consumption limits (CWE-400), allowing a low-privileged local application to exhaust system resources and render the device unresponsive or degraded without any user interaction. No confidentiality or integrity impact exists; the risk is purely availability-based, but the 'persistent' characterization implies the DoS survives reboots or normal recovery paths.

Permanent local denial of service in Android's GameManagerService affects devices running Android 14 through 16-qpr2, exploitable by any low-privilege application without user interaction. The vulnerable code path - `parseInterventionFromXml` in `GameManagerService.java` - fails to bound resource consumption during XML parsing of game mode intervention data, allowing a locally installed app to exhaust system resources and render the service permanently unavailable until device reboot. No public exploit has been identified; the September 2026 Android Security Bulletin addresses this vulnerability.

Permanent local denial-of-service in Android's PackageInstallerService allows a low-privilege local attacker to irreversibly disable an affected device through a logic error in the createSessionInternal session-creation path. Affected releases are Android 16-qpr2 and Android 17, as confirmed by Google's September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the monthly Android security update.

Use-after-free in Windows Distributed File System (DFS) enables an authenticated network attacker to crash the DFS service, resulting in denial of file-sharing access across affected Windows client and server versions. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but constrains exploitation to low-privilege authenticated accounts under high-complexity conditions. Microsoft has released patches covering the full affected range from Windows 10 1607 through Windows Server 2025; no public exploit code or active exploitation has been identified at time of analysis.

Denial of service against Active Directory Federation Services (AD FS) on multiple Windows Server and Windows 10 builds is achievable by unauthenticated remote attackers via unthrottled resource allocation (CWE-770). High attack complexity (AC:H) limits trivial or automated exploitation, and SSVC assessment confirms no active exploitation and non-automatable attack patterns. Only availability is impacted; confidentiality and integrity are unaffected. Vendor patch is available through Microsoft MSRC; no public exploits have been identified.

Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.

Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.

Null pointer dereference in Windows Schannel - Microsoft's native TLS/SSL security package - allows an authenticated network attacker to crash the affected service on Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. The CVSS vector (AV:N/AC:H/PR:L) places this as a moderate-severity denial-of-service requiring valid credentials and non-trivial triggering conditions, with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.

Memory exhaustion via crafted DHCP packets in Windows 11 and Windows Server 2025 allows an unauthenticated adjacent-network attacker to crash or degrade the DHCP client service. The root cause is CWE-401 (missing memory release after effective lifetime), meaning the DHCP client allocates memory when processing incoming DHCP messages but fails to free it, making the system vulnerable to progressive memory exhaustion. Impact is availability-only; no confidentiality or integrity breach is claimed. No public exploit or KEV listing has been identified at time of analysis.

Memory exhaustion in the Windows DHCP Server role across Windows Server 2012 through 2025 allows a low-privileged network-authenticated attacker to crash or render the DHCP service unresponsive, denying IP address assignment to all network clients. The root cause (CWE-401) is a failure to release allocated memory after its effective lifetime during DHCP request processing, enabling gradual heap exhaustion. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing exists at time of analysis.

Unthrottled resource allocation in the Windows SMB Server component (CWE-770) allows a low-privilege authenticated attacker to exhaust server resources over a network connection, causing a denial of service. Affected platforms span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across both standard and Server Core installations. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.

Decompression bomb (CWE-409) in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and deny service by submitting highly compressed HTTP payloads that expand disproportionately during server-side processing. Affected releases span .NET 8.0, 9.0, and 10.0 runtimes, all corresponding ASP.NET Core versions, and Visual Studio 2022/2026 which embed affected runtimes. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected version lines.

Null pointer dereference in Windows Active Directory Domain Services (AD DS) enables a low-privileged, authenticated network attacker to crash the service and deny domain authentication. The flaw affects a broad range of Windows Server versions from Windows Server 2012 through Windows Server 2025 as well as Windows 10 and Windows 11 client platforms configured with the AD DS role. Microsoft has issued patches; no public exploit code or CISA KEV listing has been identified at time of analysis.

Authenticated denial of service in Fortinet FortiOS, FortiPAM, and FortiProxy allows a high-privileged network attacker to crash the httpsd daemon by sending specially crafted HTTP requests, exploiting a NULL pointer dereference (CWE-476). The vulnerability spans FortiOS 7.2.x and 7.4.x, FortiProxy 7.2 through 7.6.6, and every FortiPAM release from 1.0.0 through 1.9.0. No active in-the-wild exploitation is confirmed, but the CVSS temporal metric E:P indicates proof-of-concept code exists; Fortinet has released an official fix under advisory FG-IR-26-173.

Denial of service in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 is achievable by a low-privileged remote attacker exploiting a use of uninitialized variable (CWE-457) flaw. A confirmed proof-of-concept exists per the CVSS temporal vector (E:P), and an official remediation is available per the Fortinet PSIRT advisory FG-IR-26-172. The CVE description contains a verbatim placeholder ('<insert attack vector here>') instead of the specific triggering mechanism, reducing technical precision; however, the CVSS vector (AV:N/AC:L/PR:L) confirms network-reachable exploitation requiring only low-privilege credentials. No confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Use-after-free in MongoDB Server's cursor management component allows an authenticated remote attacker to crash the mongod server process, causing a denial of service. Under specific timing conditions during cursor lifecycle events, a stale pointer to a freed resource is retained and later dereferenced during cursor cleanup, producing undefined behavior and a process crash. Affected branches are MongoDB 7.0.x before 7.0.41, 8.0.x before 8.0.30, and 8.3.x before 8.3.9; vendor-patched releases are available, and no public exploit code is identified at time of analysis.

Denial of service in MongoDB Server allows any authenticated user - including those with only read-only privileges - to crash the mongod process by exploiting an internal aggregation expression that was incorrectly registered as user-accessible rather than restricted to internal cluster operations. Submitting a malformed index specification within this expression triggers an assertion failure (CWE-617) in the index key generation code path. In affected build configurations, this assertion failure terminates the mongod process, severing all active client connections. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low privilege requirement (read-only user) makes this a realistic insider or compromised-credential threat.

Heap use-after-free in MongoDB Server's text index query parser allows authenticated users with readWrite privileges to crash the server process through deliberate concurrent operations. By combining upsert retry text-search queries with concurrent index lifecycle operations (create/drop) on the same collection, an attacker can trigger a race window where a raw pointer to freed text index metadata structures is dereferenced, aborting the mongod process and causing denial of service for all connected clients. No public exploit has been identified; vendor patches are available for all three affected release lines (7.0.x, 8.0.x, 8.3.x).

OpenBSD's 802.11 TKIP implementation deauthenticates all wireless clients and blocks reassociation for up to 90 seconds when an attacker within RF range sends two malformed TKIP frames separated by more than 60 seconds. The root cause is an inverted comparison operator in ieee80211_michael_mic_failure() that reverses the 60-second MIC failure countermeasure window: out-of-window failures incorrectly trigger the IEEE 802.11i countermeasure (a DoS), while in-window failures that should trigger the countermeasure are silently discarded, leaving active TKIP key-recovery attacks completely undetected. A publicly available exploit exists per the Argus Systems advisory; no KEV listing at time of analysis.

Repeated external URL scheme invocations from a malicious webpage can flood Firefox for iOS with system confirmation prompts or trigger cascading external application launches, rendering the browser temporarily unusable. All Firefox for iOS versions prior to 155.1 on Apple iOS devices are affected. No active exploitation has been identified; Mozilla released the fix in Firefox for iOS 155.1, and exploitation requires the user to visit the attacker-controlled page.

Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows a local non-privileged process to access already-freed GPU memory through otherwise-valid GPU memory processing operations. The flaw spans a wide range of driver releases across all three GPU families - covering most modern Arm Mali GPU generations deployed in Android SoCs from r41p0 onward. No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), and the vulnerability is not listed in the CISA KEV catalog.

Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows an unprivileged local process to access already freed kernel memory, leaking limited sensitive data. The flaw is triggered through valid GPU memory processing operations, requiring no special privileges beyond local code execution - a realistic threat on mobile devices running affected Mali GPU firmware. With EPSS at 0.14% and no public exploit or KEV listing, active exploitation is not currently observed, but the breadth of affected versions across three GPU families and many Android SoC generations elevates overall exposure.

Use-after-free memory access in Arm's Valhall and 5th Gen GPU Architecture userspace drivers allows a non-privileged local process - including browser-hosted WebGL or WebGPU workloads - to read and write already-freed GPU memory regions, yielding limited confidentiality and integrity compromise. Arm reported this issue internally; no active exploitation has been identified. The wide deployment of Arm Mali GPU hardware in mobile and embedded SoCs makes the affected driver versions relevant across a large device population, though the limited CVSS impact scores constrain severity.

Resource exhaustion in vgmstream up to revision r2117 allows a remote attacker to trigger application unresponsiveness or crash by supplying a crafted TXTP playlist file containing adversarial range_start/range_end values to the add_entry parser function in src/meta/txtp_parser.c. A public proof-of-concept exists (GitHub issue #1973) and an upstream patch has been merged (commit 4b6a02dd1aff6428255db912563d77d4cb0a143e). The CVSS 4.0 score of 2.1 and low availability impact rating reflect that no public exploit indicates active exploitation, user interaction is required, and there is no confidentiality or integrity impact.

Unbounded resource allocation in jackson-coreutils 2.0 exposes any Java application using the library's JSON Pointer parser to remote denial of service. The `TreePointer.tokensFromInput` method in the JSON Pointer parsing component fails to enforce limits on resource allocation when processing attacker-controlled input, allowing a remote unauthenticated attacker to trigger excessive memory or CPU consumption. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure, and no patch is available at time of analysis.

Arbitrary memory freeing in the ASUS Armoury Crate kernel driver allows a local low-privileged user to trigger system crashes (BSOD) and corrupt kernel data structures. The driver's IOCTL handling fails to validate pointer references before releasing memory, and an attacker can bypass this verification to free arbitrary kernel memory via a crafted IOCTL request. No public exploit or KEV listing exists at time of analysis; the CVSS 4.0 score of 5.8 reflects the local, high-complexity attack surface.

Memory exhaustion denial-of-service in ASUS Armoury Crate allows a local authenticated user to bypass the kernel-mode driver's authentication mechanism and issue unlimited memory allocation requests, saturating available system memory. The vulnerability is classified CWE-770 (Allocation of Resources Without Limits or Throttling) and is scoped to local availability impact only - no confidentiality or integrity loss occurs. No public exploit code or active exploitation has been identified at time of analysis.

Local denial-of-service in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly invoke the driver's System Management Interrupt (SMI) triggering capability, a function classified under CWE-749 as an exposed dangerous method. Repeatedly calling this function forces the CPU into System Management Mode in rapid succession, producing brief but repeatable system stalls that can escalate into a denial-of-service condition. No public exploit code exists and the vulnerability is not listed in CISA KEV, but ASUS has released a security advisory with an available fix.

Uncontrolled resource consumption in java-json-tools jackson-coreutils 2.0 allows remote unauthenticated attackers to trigger a denial-of-service condition by submitting crafted input that causes BigDecimal.toPlainString() in JacksonUtils.java to exhaust CPU or memory resources. The root cause is CWE-400 (Uncontrolled Resource Consumption), a well-understood class of vulnerability in Java BigDecimal handling where specially constructed numeric values - such as those with extremely large scale or unscaled value - produce pathologically long string representations. No public exploit has been incorporated into the CISA KEV catalog, though exploit code was publicly disclosed via a GitHub issue report. The maintainer has not responded to responsible disclosure.

Denial of service in Bestechnic BES2300 Bluetooth audio SoC firmware v3.x and earlier, where a crafted SBC audio frame overflows a buffer in SBC_DecodeFrames() and crashes the decoder. Attackers within Bluetooth radio range who can deliver audio to the device can render it unresponsive, with no confidentiality or integrity impact per the CVSS vector (C:N/I:N/A:H). EPSS is only 0.19% (9th percentile) and there is no CISA KEV listing or public exploit code identified at time of analysis.

Uncontrolled resource consumption in java-json-tools json-patch up to version 1.13 allows remote unauthenticated attackers to trigger service degradation by sending crafted JSON Patch documents to the JsonPatch.apply() handler. The vulnerability resides in the Patch Operation Handler component and carries no confidentiality or integrity impact - purely availability. A public proof-of-concept has been disclosed via a GitHub issue report, though no KEV listing indicates active exploitation at this time.

Unauthenticated remote denial-of-service in llama.cpp's RPC server allows a remote attacker to crash the server process by sending a crafted tensor descriptor with a manipulated `ne` (number-of-elements) argument to `rpc_server::deserialize_tensor`, triggering a reachable assertion (CWE-617) and aborting the process. Affected versions span llama.cpp up to 0.4.0 when the optional RPC server component is compiled and active. No patch has been released; the upstream GitHub issue was closed automatically due to inactivity, and no public exploit or CISA KEV listing exists at time of analysis.

Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through at least 2.8.x, enabling remote unauthenticated denial of service against PHP applications that convert untrusted Markdown to XML. The renderer emits depth-proportional indentation for every XML tag, causing O(n²) byte growth in both output size and memory allocation for deeply nested structures - reachable with as little as a single line of nested blockquotes. No public exploit has been identified at time of analysis, and exploitation is limited to applications using the opt-in XmlRenderer or MarkdownToXmlConverter code path.

Heap-use-after-free in ImageMagick's PerlMagick Layer method allows an attacker supplying a crafted list of images to trigger memory access after deallocation, causing a crash. Affected versions include ImageMagick before 7.1.2-30 and the 6.9.x branch before 6.9.13-55. Impact is limited to denial of service (crash); no confidentiality or integrity compromise is possible from this flaw. No public exploit code or active exploitation has been identified at time of analysis.

Heap-use-after-free in ImageMagick's PerlMagick Perl binding crashes the host process via a crafted call to the GetList method. Affected versions span the 6.9.x branch before 6.9.13-55 and the 7.x branch before 7.1.2-30. Impact is limited to denial of service (process crash); no confidentiality or integrity compromise has been demonstrated. No public exploit code or active exploitation is identified at time of analysis.

Memory exhaustion in ImageMagick's MSL image decoder affects versions before 7.1.2-30 (v7 branch) and 6.9.13-55 (v6 branch), enabling unauthenticated network attackers to degrade or crash image-processing services by submitting crafted MSL files that trigger unbounded heap allocation without deallocation. The root cause (CWE-400, Uncontrolled Resource Consumption) lies in the MSL decoder's failure to free allocated memory on certain code paths, allowing cumulative heap exhaustion across repeated requests. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.3 (Medium) reflects limited availability-only impact with elevated attack complexity.

Memory budget exhaustion in ImageMagick's OpenPixelCache allows remote unauthenticated attackers to cause a process-level denial of service by repeatedly triggering internal cache operation failures. Affected versions span both the 7.x branch (before 7.1.2-30) and the legacy 6.x branch (before 6.9.13-55), covering a large installed base of web services that process user-supplied images. The vulnerability stems from improper cleanup of memory accounting state on error paths, making the failure accumulative rather than self-correcting. No public exploit or CISA KEV listing has been identified at time of analysis.

Use-after-free (CWE-415/416) in the OpenVPN ovpn-dco-win Windows kernel Data Channel Offload driver versions 2.5.0 through 2.8.6 enables a local authenticated user to trigger a system crash by sending crafted control messages to the driver. Because the flaw resides in a kernel-mode driver, successful exploitation causes a full system crash (BSOD), affecting availability of the entire host. No public exploit code or active exploitation has been identified at time of analysis.

HCL MyXalytics is susceptible to a low-severity denial-of-service condition via unrestricted character input in user-facing fields. Authenticated users can submit arbitrarily long strings into application inputs, potentially degrading system performance or availability due to absent input-length controls. No public exploit code exists and no active exploitation has been observed; the vendor CVSS score of 3.5 (Low) reflects limited real-world impact.

Integer overflow in Samsung Walrus WebAssembly runtime's Memory::init() source-bounds check allows an attacker who supplies a crafted WebAssembly module to trigger a 32-bit unsigned wrap-around that bypasses source-bounds validation, causing an out-of-bounds heap read and process crash (denial of service). The affected product is Samsung Walrus at commit ff3bf5ff5c4878f8e5572c9593d303f6bc997443 across all platforms. Publicly available exploit code exists in the form of a proof-of-concept .wast module (stream-read-oob-poc.wast) included in the upstream fix PR #482.

Local privilege escalation in MediaTek's geniezone Trusted Execution Environment component affects 17 Android chipsets through a use-after-free memory corruption flaw. Exploitation requires an attacker who has already obtained System-level privilege on the device, allowing them to escalate further - potentially to kernel or TEE privilege - with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; the September 2026 MediaTek security bulletin addresses this with Patch ID ALPS10900510.

Use-after-free in the MediaTek GPU kernel driver on chipsets MT6991 and MT8799 allows a local attacker with standard user privileges to read freed kernel or GPU memory, potentially exposing sensitive data such as pointers, credentials, or cryptographic material. The same condition may cause a full system crash, consistent with the Denial of Service tag and the 'system crash' language in the description. No public exploit has been identified and SSVC rates exploitation status as none, placing this in a lower real-world priority bracket despite the C:H rating.

Memory corruption via use-after-free in the Android SurfaceFlinger graphics compositor, present on specific MediaTek chipsets (MT6881, MT6993, MT6858, MT8668), enables a local attacker who has already obtained System-level privilege to escalate to higher privileges - potentially root or kernel - without any user interaction. Reported by MediaTek in the September 2026 Security Bulletin under Patch ID ALPS11123860 and Issue ID MSV-8890. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none and automatable as no, consistent with the high-privilege prerequisite.

Local privilege escalation in the MediaTek Audio Hardware Abstraction Layer (HAL) allows an attacker who has already obtained System-level privilege to further escalate to higher privileges via a use-after-free condition (CWE-416). The vulnerability affects over 65 MediaTek chipset models spanning Android smartphones, tablets, IoT, and connected-device SoCs. No public exploit code or CISA KEV listing exists at time of analysis; however, the broad chipset surface across Android device families makes this relevant for any organization managing large Android fleets.

Privilege escalation via use-after-free in MediaTek's Android Audio Hardware Abstraction Layer (Audio HAL) affects over 65 distinct chipset families spanning mobile, tablet, and IoT SoCs. An attacker who has already obtained System-level privilege on a device running an affected MediaTek chipset can trigger the UAF condition to escalate further - gaining full control over confidentiality, integrity, and availability without any user interaction. No public exploit or active exploitation has been identified at time of analysis; the patch is available through MediaTek's September 2026 product security bulletin.

MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5.

Remote denial-of-service in MediaTek Modem firmware affects 19 chipset variants spanning the MT6xxx and MT8xxx families - when a device embedding an affected chipset connects to an attacker-controlled rogue base station, a missing bounds check (CWE-617: Reachable Assertion) in the modem subsystem triggers a system crash, causing loss of connectivity. The CVSS score of 5.3 (AV:A/AC:H) reflects the elevated operational complexity of deploying rogue cellular infrastructure to exploit this flaw. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.

Remote denial of service against MediaTek modem firmware affects 57+ chipset variants spanning the MT6xxx and MT8xxx series when a user equipment (UE) connects to an attacker-controlled rogue base station, triggering a missing bounds check (CWE-617 reachable assertion) that crashes the modem subsystem. The attack requires no privileges or user interaction on the victim device, though the adjacent network vector (AV:A/AC:H) demands the attacker operate specialized RF equipment in physical proximity. No public exploit code has been identified, CISA KEV is not listed, and SSVC rates exploitation as none and automatable as no - consistent with a moderate real-world risk despite the broad chipset deployment footprint.