Memory Corruption

Sandbox-escaping remote code execution in Google Chrome (desktop, versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/Direct3D graphics translation layer. A remote attacker who lures a user to a crafted HTML page can execute arbitrary code outside the renderer sandbox, giving native code execution on the host. Rated CVSS 9.6 with a scope change; no public exploit is identified at time of analysis and EPSS is low (0.30%, 22nd percentile), though ANGLE/GPU bugs are historically attractive to attackers.

Remote code execution inside the Chrome sandbox affects Google Chrome prior to version 152.0.7977.65 through a use-after-free vulnerability in the Platform component, triggered when a user visits a specially crafted HTML page. An unauthenticated remote attacker can exploit this to execute arbitrary code within the browser sandbox, with full high-impact ratings on confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.

Out-of-bounds write in Chrome's ANGLE graphics layer on Windows allows remote attackers to execute arbitrary code inside the browser's renderer sandbox by directing a user to a crafted HTML page. All Google Chrome releases on Windows prior to 152.0.7977.65 are affected. No public exploit code has been identified at time of analysis, and the EPSS probability of 0.25% (16th percentile) indicates limited current exploitation activity despite the high CVSS score of 8.8.

Out-of-bounds write in ANGLE, Chrome's GPU abstraction layer, affects Google Chrome on Windows prior to 152.0.7977.65 and can be triggered by a remote, unauthenticated attacker via a crafted HTML page, potentially achieving arbitrary code execution within the Chrome sandbox. The CVSS score of 8.8 reflects high theoretical severity, though sandbox containment (S:U) limits immediate blast radius to the GPU process. No public exploit code or CISA KEV listing exists at time of analysis, and the low EPSS of 0.42% (35th percentile) signals limited near-term exploitation probability despite the high CVSS rating.

Out-of-bounds write in Google Chrome's ANGLE graphics layer allows a remote attacker who lures a victim to a crafted HTML page to potentially execute arbitrary code outside the browser sandbox, affecting all Chrome builds prior to 152.0.7977.65. The CVSS:3.1 score of 9.6 reflects a scope-changing sandbox escape requiring only user interaction (visiting a page). No public exploit is identified at time of analysis and the EPSS probability is low (0.25%, 16th percentile), and it is not on CISA KEV.

Sandbox-escaping remote code execution in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 152.0.7977.65. A remote attacker who lures a victim to a crafted HTML page can trigger an out-of-bounds write and potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.30%, 22th percentile).

Sandbox-escaping remote code execution in Google Chrome (Aura component) affects all desktop builds prior to 152.0.7977.65, where a use-after-free lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape, though exploitation requires the victim to load attacker-controlled content. No public exploit identified at time of analysis, and CISA SSVC currently marks exploitation status as none.

Sandbox-escaping remote code execution in Google Chrome's WebGL component affects all desktop builds prior to 152.0.7977.65. A crafted HTML page can trigger a use-after-free (CWE-416) whose exploitation, per the description, yields code execution outside the browser renderer sandbox - a notably severe outcome that Chrome typically confines. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.33% (25th percentile), consistent with SSVC marking exploitation as 'none' despite total technical impact.

Out-of-bounds write in Chrome's ANGLE graphics layer (versions before 152.0.7977.65) lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates it High severity; the CVSS 9.6 reflects a scope-changing sandbox escape whose only gating factor is that the user opens a malicious page. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), but the memory-corruption-to-sandbox-escape impact makes it a priority patch for desktop fleets.

Use-after-free in the WebRTC component of Google Chrome before version 152.0.7977.65 enables remote code execution confined within the browser sandbox. Exploitation requires a victim to visit a specially crafted HTML page, placing UI:R as a meaningful friction point. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog; SSVC also indicates no current exploitation activity. Despite a CVSS score of 8.8 and tags indicating RCE and memory corruption potential, the EPSS score of 0.33% at the 25th percentile reflects low observed exploitation probability relative to the broader vulnerability population.

Remote code execution in Google Chrome on Windows (versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES abstraction layer used for GPU rendering. A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU process and potentially execute arbitrary code outside the browser sandbox, giving control of the underlying host. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape; there is no public exploit identified and EPSS is low (0.30%), indicating no confirmed active exploitation yet.

Use-after-free in Google Chrome's Accessibility component (versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code outside the browser's renderer sandbox through social engineering. Exploitation requires user interaction with a malicious webpage or crafted UI element, making phishing or malvertising the likely delivery mechanism. A vendor patch is available in stable channel version 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.23% (14th percentile), suggesting opportunistic exploitation is not currently observed.

Remote code execution in Google Chrome's Chromecast component (versions prior to 152.0.7977.65) stems from a use-after-free memory corruption flaw that enables remote attackers to execute arbitrary code within Chrome's renderer sandbox. Exploitation requires a victim to visit a crafted HTML page, making it network-reachable but not fully automated. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, with EPSS indicating low observed exploitation probability despite the high CVSS score.

Remote code execution in Google Chrome desktop before 152.0.7977.65 lets an unauthenticated attacker escape the renderer sandbox and run arbitrary code on the host when a victim opens a crafted web page. The bug is a use-after-free in the Views UI framework, rated High by Chromium and carrying a CVSS 9.6 due to a scope change (sandbox escape). No public exploit has been identified at time of analysis, and the EPSS probability is low (0.33%, 25th percentile).

Use-after-free in the Mobile component of Google Chrome on iOS prior to 152.0.7977.65 enables remote code execution outside the browser sandbox via crafted network traffic, requiring no user interaction. The sandbox escape elevates the severity beyond a typical renderer bug, as successful exploitation grants attacker-controlled code execution in a context beyond Chrome's sandboxed process. No public exploit identified at time of analysis, and the low EPSS score (0.28%, 20th percentile) suggests exploitation has not yet been observed in the wild despite the high CVSS rating.

Sandbox-escaping remote code execution in Google Chrome (Views UI component) before 152.0.7977.65 allows a remote attacker to run arbitrary code on the host after luring a victim to a crafted HTML page. The flaw is a CWE-416 use-after-free rated High by Chromium and CVSS 9.6 due to the scope change (sandbox escape), but requires user interaction (visiting an attacker-controlled page) and has no public exploit identified at time of analysis. EPSS is modest (0.46%, 38th percentile) and CISA SSVC reports no known exploitation.

Use-after-free in the Bluetooth component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox. Exploitation requires the attacker to socially engineer a victim into installing or triggering a crafted Chrome extension, after which the memory corruption in the Bluetooth subsystem is leveraged to escape Chrome's sandbox and achieve code execution at the OS level. No public exploit identified at time of analysis, and EPSS places this in the 20th percentile, suggesting limited active exploitation despite the high CVSS severity.

Use-after-free in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows enables a remote attacker who has already compromised the renderer process to escape Chrome's sandbox and execute arbitrary code at the browser or OS level via crafted network traffic. All Chrome versions prior to 152.0.7977.65 on Windows are affected. No public exploit code or CISA KEV listing exists; EPSS is low at 0.28% (20th percentile), but the scope-changing, full-CIA-impact sandbox escape warrants rapid deployment of the available patch.

Use-after-free in the Chromoting (Chrome Remote Desktop) component of Google Chrome on Windows prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside Chrome's sandbox via crafted network traffic. The sandbox-escape outcome is the most critical aspect, elevating the real-world impact beyond a typical renderer flaw to full host-level code execution. No public exploit code has been identified at time of analysis; EPSS places exploitation probability at 0.28% (20th percentile), though the network vector and no-auth-required CVSS signal warrant prompt patching.

Sandbox escape via use-after-free in Google Chrome's Chromecast component lets a remote attacker who has already compromised the renderer process execute arbitrary code in the higher-privileged browser process, breaking out of the site-isolation sandbox. It affects Chrome desktop before 152.0.7977.65 and is triggered by luring a victim to a crafted HTML page (UI:R). No public exploit identified at time of analysis; EPSS is low at 0.33% (25th percentile) and CISA SSVC records exploitation status 'none'.

Use-after-free in Google Chrome's Script engine allows remote code execution confined to the renderer sandbox on all desktop platforms running versions prior to 152.0.7977.65. Exploitation requires only that a user visit a crafted HTML page - no authentication or special configuration is needed - making the attack surface broad wherever Chrome remains unpatched. No public exploit has been identified at time of analysis and CISA has not added this to KEV, but the CVSS 8.8 rating and SSVC 'total' technical impact designation warrant prompt patching across managed fleets.

Sandbox escape via type confusion in Google Chrome's Accessibility component on Windows enables arbitrary code execution outside the browser sandbox. Affecting all Chrome versions prior to 152.0.7977.65 on Windows, the flaw requires an attacker to have already compromised the renderer process - making this a critical second-stage exploit in a multi-step attack chain. No public exploit identified at time of analysis, and EPSS sits at 0.27% (19th percentile), consistent with the high technical bar required for exploitation despite the 8.3 CVSS score.

Sandbox-escaping remote code execution in Google Chrome (desktop, versions before 152.0.7977.65) stems from a use-after-free in Aura, Chromium's UI/windowing framework. A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code outside the browser sandbox, giving full control of the host process rather than just the renderer. Google rates the Chromium severity Critical; there is no public exploit identified at time of analysis, and EPSS exploitation probability is currently low (0.33%, 25th percentile).

Remote code execution in Google Chrome on macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Safe Browsing component that lets a remote attacker escape the renderer sandbox and run arbitrary code on the host. Exploitation requires luring a victim to a crafted HTML page (social engineering / user interaction), and Chromium rates the flaw Critical. There is no public exploit identified and the EPSS probability is low (0.57%), but a vendor patch is already available.

Sandbox-escaping remote code execution in Google Chrome for macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Views UI framework, letting a remote attacker run arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page. Google rates the Chromium severity Critical and CVSS is 9.6, but there is no public exploit identified at time of analysis and EPSS is a low 0.41%. A vendor patch is available in the Stable channel update.

Remote code execution in Google Chrome desktop before 152.0.7977.65 lets a remote attacker escape the renderer sandbox and run arbitrary code on the host after a victim opens a crafted HTML page. The flaw is a use-after-free in Aura, Chromium's UI/windowing layer, and Google rates its Chromium security severity as Critical (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.46%, 38th percentile), but the sandbox-escape impact makes it a high-priority patch.

Sandbox escape via use-after-free in Chrome's Chromecast component allows remote code execution outside the browser sandbox on all platforms running Chrome prior to 152.0.7977.65. This is a chained exploit: an attacker must first compromise the renderer process, then leverage the Chromecast UAF to pivot into the browser process and escape Chrome's sandbox via a crafted HTML page. No public exploit code has been identified at time of analysis; Google has released a confirmed fix in version 152.0.7977.65.

Use-after-free in Google Chrome's Chromecast component allows a remote attacker who has already compromised the renderer process to escape the sandbox and execute arbitrary code on the underlying system via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at a low 0.46%, but SSVC rates technical impact as total given the sandbox-escape outcome.

Sandbox-escaping remote code execution in Google Chrome desktop before 152.0.7977.65 stems from a use-after-free in Aura, Chromium's UI/windowing framework. A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code outside the browser sandbox, giving full control of the renderer host process. Google rates the Chromium severity Critical; there is no public exploit identified at time of analysis and it is not in CISA KEV, though the class of bug is historically high-value.

Sandbox-escaping remote code execution in Google Chrome for Android (versions before 152.0.7977.65) stems from a use-after-free in ANGLE, Chrome's graphics translation layer. A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code outside the renderer sandbox, giving control at the browser-process privilege level. Chromium rates the flaw Critical; no public exploit has been identified at time of analysis, and the EPSS probability is low (0.35%).

Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution within the current user's security context via a maliciously crafted file. The flaw (CWE-787) is triggered during file parsing, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Out-of-bounds write in Adobe Substance 3D Painter enables arbitrary code execution under the privileges of the current user when a victim opens a specially crafted malicious file. The flaw (CWE-787) resides in file-parsing logic and delivers full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing is identified at time of analysis, but the file-delivery vector makes this a credible threat for spear-phishing campaigns targeting creative and game-development professionals.

Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the current user when a victim opens a specially crafted file. All versions are listed as affected per the wildcard CPE string, and the CVSS 7.8 High score reflects low-complexity exploitation once the file is opened, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted file. All versions covered by CPE cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:* are listed as affected, with Adobe addressing the issue via advisory APSB26-121. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, though the file-open delivery mechanism fits common phishing and supply-chain vectors targeting creative professionals.

Out-of-bounds write in Adobe Substance 3D Sampler (all versions per CPE) enables arbitrary code execution under the victim's user account. Exploitation is contingent on a victim opening a specially crafted malicious file, introducing a mandatory social engineering dependency. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

Out-of-bounds write (CWE-787) in Adobe Substance 3D Sampler enables arbitrary code execution within the context of the authenticated local user when a victim opens a specially crafted file. All versions of the product are flagged as potentially affected per the CPE string cpe:2.3:a:adobe:adobe_substance_3d_sampler:*:*:*:*:*:*:*:*, with exact version ranges detailed in Adobe advisory APSB26-121. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit code has been identified in the provided intelligence data.

Out-of-bounds write in Adobe Substance 3D Sampler enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. The vulnerability is rooted in CWE-787 memory corruption during file parsing, a classic attack surface in creative content tools where complex format parsers frequently handle untrusted input. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the full CIA triad impact and straightforward delivery mechanism (malicious asset file) make this a credible risk for creative professionals targeted via spearphishing or poisoned asset repositories.

Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution in the context of the current user when a specially crafted file is opened. The flaw is a CWE-787 memory corruption in the application's file-parsing pipeline - a class that reliably yields code execution primitives when exploited. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the file-delivery attack surface makes it a credible vector for spear-phishing campaigns targeting game developers, VFX artists, and product designers who routinely exchange project files.

Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted project or material file. The vulnerability carries a CVSS 7.8 score with high confidentiality, integrity, and availability impact, and the CPE wildcard indicates all tracked versions may be affected. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Out-of-bounds write in Adobe Substance 3D Designer enables arbitrary code execution in the context of the authenticated local user when a malicious file is opened. The vulnerability is rooted in a memory corruption flaw (CWE-787) triggered during file parsing, giving an attacker full control over code flow within the victim's user session. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a victim opens a specially crafted VI (Virtual Instrument) file. The root cause is CWE-787 (Out-of-bounds Write), indicating a write operation beyond the bounds of an allocated buffer during VI file parsing. No public exploit code or active exploitation has been identified at time of analysis, but the file-borne delivery model is realistic in engineering and research environments where LabVIEW projects are routinely shared.

Out-of-bounds and use-after-free memory writes in OpenEXR's FlatImageChannel row() API expose rendering pipelines and image-processing services to denial-of-service and potential memory corruption when handling untrusted EXR files. Affected versions include all releases before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13; the flaw is triggered specifically when an application calls FlatHalfChannel::row() on an EXR image with a nonzero dataWindow.min value. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis.

Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The CWE-787 out-of-bounds write root cause combined with the high-impact CVSS 4.0 score of 8.5 places this in a serious tier for LabVIEW deployments across engineering, scientific, and industrial automation environments. No public exploit code has been identified at time of analysis, but the user-interaction trigger (social engineering via malicious VI file) is a well-understood threat model for desktop engineering tools.

Out-of-bounds write in NVIDIA DGX Spark system firmware enables a privileged local attacker to corrupt memory and achieve code execution, privilege escalation, denial of service, information disclosure, or data tampering. The CVSS scope-change indicator (S:C) is the critical risk amplifier here - successful exploitation can breach the firmware's security boundary and affect components outside it, including potentially the host OS or hypervisor layer. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Out-of-bounds write in NVIDIA DGX Spark system firmware permits a locally authenticated, highly privileged attacker to corrupt firmware memory in a way that crosses the firmware's isolation boundary into the broader system. Successful exploitation may yield arbitrary code execution, privilege escalation beyond the initial firmware context, denial of service, information disclosure, and data tampering - all stemming from a single CWE-787 write primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature of the CVSS vector (S:C) elevates the potential blast radius significantly for affected AI compute infrastructure.

Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code incorrectly passes a non-Node argument to the protected internal `Node#initialize_copy_with_args` method. The method backs the public `Node#dup` and `#clone` APIs and, prior to 1.19.4, unwraps its argument directly as a libxml2 `xmlNode` struct without verifying the object's type, causing it to misread an `xmlNs` (Namespace) struct out of bounds. Critically, the vendor explicitly confirms this cannot be triggered by untrusted external input - only by a programming error in application code - making the provided CVSS 4.0 score of 8.7 (AV:N/PR:N) a significant overstatement of real-world risk. No public exploit has been identified at time of analysis.

Heap corruption in OpenSSL's CMS decryption path allows a remote unauthenticated attacker to crash any application invoking CMS_decrypt() on attacker-supplied ciphertext. The AES-WRAP-PAD unwrap primitive writes and cleanses up to the full input length on its integrity-failure path, while the CMS layer allocates a buffer sized only for the expected output - producing a fixed-size, fixed-value (zero) 8-byte overwrite immediately past the heap allocation. No public exploit has been identified at time of analysis, but the CVSS 7.5 rating and SSVC automatable classification indicate this can be reliably triggered at scale against any service that processes externally sourced CMS messages.

Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.

Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute arbitrary code within the process context of the application. Exploitation requires a victim to open a specially crafted FLT (OpenFlight) file, placing this firmly in the file-borne, socially engineered delivery category. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of the current user process when a victim opens a maliciously crafted ABC file. The vulnerability carries a CVSS 7.8 High score with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the combination of low attack complexity and full process-context code execution potential makes this a credible risk for 3ds Max users who routinely open externally sourced scene files.

Use-after-free memory corruption in WebKitGTK exposes Red Hat Enterprise Linux 6 through 9 systems to potential arbitrary code execution when users process attacker-controlled web content. The flaw (CWE-416) stems from improper memory management in the web engine's content rendering pipeline, where a freed heap allocation is subsequently accessed, enabling heap corruption. No public exploit code or CISA KEV listing has been identified at time of analysis; operational urgency derives from the CVSS 8.8 score, the broad RHEL deployment footprint, and the well-understood exploitability of use-after-free conditions in browser engines.

Heap buffer overflow in RustDesk's Windows clipboard redirection (wf_cliprdr.c) allows a malicious or compromised remote peer to overwrite heap memory in the local paste consumer process (typically explorer.exe) when the local user pastes clipboard file contents offered by the remote side. The OLE paste consumer calls IStream::Read with a buffer of cb bytes, but CliprdrStream_Read blindly copies req_fsize bytes - taken verbatim from the peer's CLIPRDR FileContentsResponse - before the only bounds check (req_fsize < cb) is ever evaluated, meaning an oversized peer response writes attacker-controlled data past the end of the caller's heap allocation. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed; however, an upstream fix PR (#15515) exists and the root cause is precisely documented, lowering the bar for exploit development. The identical defect was fixed in the upstream FreeRDP library as CVE-2026-68579 in FreeRDP 3.30.0, providing a public reference implementation of the fix.

Heap out-of-bounds write in DBD::Pg 3.21.0, the Perl DBI driver for PostgreSQL, lets an attacker corrupt heap memory by passing special floating-point literals (NaN, Inf, +Inf, -Inf, Infinity, and signed variants) to the quote_float() routine, reachable through the common $dbh->quote(value, DBI::SQL_NUMERIC) path. The bug is a 2-byte overwrite (a single quote plus a NULL terminator) introduced by the 3.21.0 quote.c rewrite and fixed in 3.21.1. No public exploit identified at time of analysis; EPSS is low (0.23%, 14th percentile) and CISA SSVC records exploitation status as none.

Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. No public exploit code or CISA KEV listing exists; Amazon (AWS), who reported the issue, has released a fix in version 11.3.1.

Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV; vendor-released patch V11.3.1 is available.

Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-privileged user to corrupt or crash TrustZone secure-world memory by invoking the SVC handler for secure context deallocation without privilege verification. The missing privilege check permits normal-world code to trigger deallocation of already-freed secure-world memory regions, producing high integrity and availability impact on the secure execution environment - a severe outcome in security-sensitive embedded deployments. No public exploit has been identified at time of analysis; vendor-released patch V11.3.1 is available via Amazon's security bulletin and the FreeRTOS GitHub repository.

Stack-based out-of-bounds write in the TP-Link TL-MR6400 v7 administrative web interface login handler allows an unauthenticated attacker with adjacent network access to crash the web management service by sending a specially crafted malformed HTTP request. The vulnerability (CWE-787) is confined to the login request parsing path and requires no authentication or user interaction, though exploitation is bounded by the adjacent network attack vector. Impact is limited to a denial-of-service condition - temporary loss of management interface access - with no confirmed confidentiality or integrity impact; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands to GPU Firmware, triggering writes outside the guest's virtualized GPU memory boundary (CWE-823). Affected are multiple DDK release trains including versions 25.1 RTM2 through 25.3 RTM, 24.2 RTM2, 23.2 RTM2, and 1.18 RTM2. No public exploit code exists and CISA has not added this to KEV; however, SSVC assesses total technical impact given successful exploitation yields full C/I/A compromise of the guest environment.

Kernel-stack out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local attacker with low-privilege shell access to corrupt kernel memory by causing the kernel to parse a crafted filesystem image during directory reads. Successful exploitation can crash the system or escalate privileges to root, yielding full system compromise. No public exploit code has been identified and EPSS remains very low at 0.16% (6th percentile), though SSVC rates technical impact as total, reflecting the severity of a successful local privilege escalation on IBM Power infrastructure.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated exploitation, and IBM PSIRT has published a support advisory. There is no public exploit identified at time of analysis, EPSS is modest (0.61%, 47th percentile), and CISA SSVC rates exploitation as 'none' with technical impact 'total'.

Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated privileges by exploiting an out-of-bounds write (CWE-787) memory corruption flaw. The vulnerability affects IBM's enterprise Unix operating system and its virtualization platform, with full confidentiality, integrity, and availability impact confirmed by the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, and EPSS rates the exploitation probability at just 0.17% (6th percentile), consistent with the SSVC assessment of exploitation status as none.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise of the affected Unix host or virtualization I/O server. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.41%, 35th percentile), with CISA SSVC recording no observed exploitation.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger over the network without authentication or user interaction. Per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the flaw is critical (9.8) with total confidentiality, integrity, and availability impact, though the description does not name the specific network service or daemon that parses the malformed input. There is no public exploit identified at time of analysis, and EPSS is low (0.41%, 35th percentile), consistent with CISA SSVC scoring exploitation as 'none'.

Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.

Local privilege escalation via buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an attacker with low-privileged local access to execute arbitrary code with a changed scope, meaning impact can extend beyond the vulnerable component - particularly significant in VIOS hypervisor environments where guest-to-host or cross-partition compromise may be achievable. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) reflects low-friction exploitation once local access is established, with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and EPSS is very low at 0.18% (8th percentile), but SSVC rates technical impact as total, warranting prioritization in Power Systems environments.

Remote code execution is possible in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 via a stack-based buffer overflow exploitable by a remote attacker holding low-privilege credentials. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with a network attack vector and no user interaction required beyond authentication. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS of 0.56% (44th percentile) indicates limited current exploitation activity despite high potential impact.

Remote code execution in IBM AIX 7.2 and 7.3 (and IBM PowerVM VIOS 4.1) stems from a stack-based buffer overflow that lets a remote attacker overwrite memory and run arbitrary code on the host. IBM PSIRT rated it CVSS 9.8, and the vector indicates network-reachable, unauthenticated exploitation requiring no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE on an enterprise Unix platform makes it a high-priority patch.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code on affected IBM Power-based Unix systems. The flaw was reported by IBM's own PSIRT and carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and privileged role of these platforms make it a high-priority patching item.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger without authentication or user interaction, yielding full compromise of the affected system. IBM PSIRT rates it CVSS 9.8, reflecting complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-787) that a remote attacker can trigger to run arbitrary code with no authentication or user interaction, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 Critical. IBM PSIRT is the reporting source. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patching target for AIX and VIOS operators.

Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a use-after-free (CWE-416) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 9.8). IBM has released a fix and there is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787, out-of-bounds write). The CVSS 3.1 base score is 9.8 with a network vector and no privileges or user interaction required, but there is no public exploit identified at time of analysis and EPSS estimates only a 0.32% 30-day exploitation probability. IBM has published an advisory and a patch is available from the vendor.

Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.

Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.

Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.

Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.

Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.

Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.

Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.

Out-of-bounds write in The Tor Project's tor daemon (0.2.8.2-alpha through versions before 0.4.9.9) can be triggered when the software parses a consensus document or detached signature containing an unexpected signature digest type (TROVE-2026-019, CWE-787). The flaw is minor for most Tor roles but potentially severe for directory authorities, which routinely exchange detached signatures. Fixed in 0.4.9.9; EPSS is low (0.19%, 9th percentile) and no public exploit identified at time of analysis.

Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.

Remote code execution outside the browser sandbox is possible in Google Chrome's Chromoting component (Chrome Remote Desktop protocol) prior to version 151.0.7922.173, exploitable by a remote attacker via crafted network traffic with user interaction. The root cause is a use-after-free (CWE-416) in Chromoting, enabling full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC reports exploitation as 'none', though the CVSS base score of 8.8 and sandbox-escape impact class the severity as Critical per Chromium's own rating.

Remote code execution in GStreamer's rtpsbcdepay plugin is achieved when a user processes a crafted RTP stream containing malformed SBC audio payload, triggering a use-after-free that corrupts heap memory and redirects execution to attacker-controlled code within the affected process. The flaw exists in all GStreamer installations where the rtpsbcdepay element is exercised, covering a broad surface area including Linux media players, VoIP clients, and Bluetooth audio gateways. No public exploit has been identified at time of analysis, but coordinated disclosure by ZDI (ZDI-CAN-29787) confirms technical reproduction, and a vendor security advisory (SA-2026-0051) has been published.

Remote code execution via malicious MRF media files affects GStreamer across all versions tracked under CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The MRF file parser fails to validate user-supplied input bounds, allowing a heap out-of-bounds write (CWE-787) that corrupts memory and redirects execution to attacker-controlled code within the victim process. Exploitation requires user interaction - opening a crafted file or visiting a page that triggers GStreamer parsing - and no public exploit or CISA KEV listing has been identified at time of analysis, though ZDI coordinated disclosure (ZDI-CAN-29510) and an upstream vendor advisory (sa-2026-0050) are both present.

Remote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted OPJ project file, triggering an out-of-bounds write in the file parser that corrupts memory and redirects execution to attacker-controlled code. The vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29336) and carries a CVSS 7.8 score with full confidentiality, integrity, and availability impact scoped to the user process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Out-of-bounds write in OriginPro's OGG file parsing component enables arbitrary code execution in the context of the current user's process when a crafted OGG file is opened. Affected installations include OriginPro 2026 SR1, as confirmed by ZDI (ZDI-CAN-29333 / ZDI-26-549) and EUVD-2026-63438. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though user interaction is the sole barrier to exploitation once a malicious file is delivered.

Out-of-bounds write in OriginPro's OPJ project file parser enables remote attackers to execute arbitrary code when a user opens a specially crafted OPJ file. The flaw, disclosed by Zero Day Initiative as ZDI-CAN-29332, results from insufficient validation of user-supplied data during file parsing - allowing a write past the end of an allocated data structure and full compromise of the target process. No public exploit code and no active exploitation (CISA KEV) has been identified at time of analysis, but ZDI coordinated disclosure typically reduces the time-to-exploit development once advisories publish.