Memory Corruption

Remote code execution is achievable in OriginLab OriginPro through a maliciously crafted OPJU project file, exploiting an out-of-bounds write (CWE-787) in the application's file parser. OriginPro 2026 SR1 is confirmed affected per EUVD-2026-63436, with the CPE string suggesting broader version coverage may apply. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; however, ZDI discovery (ZDI-CAN-29331) indicates coordinated research disclosure, and the low attack complexity once the file is delivered makes this a meaningful risk to research and scientific computing environments.

Heap out-of-bounds write in GraphicsMagick's Photo CD (PCD) decoder enables heap memory corruption when processing a maliciously crafted PCD image. The DecodeImage() function in coders/pcd.c unconditionally advances its output pointer (q++) on every decoded Huffman delta without validating it against the end of the heap-allocated luma or chroma plane buffers, so an attacker-controlled PCD file can drive the pointer arbitrarily past the allocation boundary and overwrite adjacent heap memory. Any application invoking gm convert, gm identify, or linking against libGraphicsMagick while processing untrusted PCD files is at risk; no public exploit is identified at time of analysis.

Stack buffer overflow in GNU binutils 2.46.1 and earlier allows arbitrary code execution when a victim opens a crafted PE (Portable Executable) file using any binutils tool such as objdump or readelf. The out-of-bounds stack write (CWE-787) can corrupt return addresses, enabling attacker-controlled code execution in the victim's user context. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.8 High rating reflects full confidentiality, integrity, and availability impact if successfully exploited.

Use-after-free in libexpat before 2.8.4 enables a local low-privileged attacker to corrupt parser memory and potentially achieve arbitrary code execution by supplying a crafted XML document with custom encoding callbacks. The flaw stems from the unknown encoding callback path (convert/release handlers) bypassing the reentrancy depth-tracking guards applied to all other libexpat callbacks, allowing an attacker-controlled callback to re-enter the parser and corrupt its state. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.10% (1st percentile), though this belongs to a confirmed series of related reentrancy fixes in libexpat (CVE-2026-50219, CVE-2026-56131, CVE-2026-56412) and Red Hat has already shipped a backported errata.

Wireshark's RRC protocol dissector crashes due to an out-of-bounds write (CWE-787) in versions 4.6.0-4.6.7 and 4.4.0-4.4.18, enabling denial of service against any instance actively capturing or replaying Radio Resource Control (LTE/5G) traffic. The CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector confirms an unauthenticated network-adjacent attacker can trigger the crash by injecting a malformed RRC packet into a monitored segment. No public exploit code has been identified at time of analysis, and impact is strictly availability - no confidentiality or integrity loss.

Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.

Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets an unauthenticated network attacker run arbitrary code by supplying malicious pointers that the OS fails to validate (CWE-843 type confusion). The flaw carries a critical CVSS 9.8 and was disclosed by IBM PSIRT with no user interaction required, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because AIX/VIOS underpins production IBM Power server estates, a working exploit would give attackers full compromise of the affected operating system.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a remote attacker can trigger without authentication, per IBM PSIRT (CVE-2026-16913). With a CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) and full CIA impact, successful exploitation yields arbitrary code execution on the affected UNIX operating system or virtualization I/O server. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, unauthenticated profile makes this a high-priority patch.

Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a network-based attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise (high confidentiality, integrity, and availability impact) of Unix systems that frequently underpin enterprise and mission-critical workloads. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.

Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.

Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. Impact is scoped to the actively booting partition - other partitions and the managed system are explicitly unaffected. No public exploit or CISA KEV listing exists at time of analysis; EPSS is notably low at 0.19% (9th percentile), consistent with the narrow exploitation window.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping.

Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.

Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.

Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Arbitrary code execution in IBM Power Firmware across multiple firmware branches (FW1120.00, FW1110.x, FW1060.x, FW950.x, OP940.x) stems from a CWE-787 out-of-bounds write in the service processor mailbox interface. An authenticated attacker with service-level access to the BMC/FSP can exploit this buffer overflow to cross the trust boundary from the management processor into the host firmware runtime, gaining full control over the managed Power system. No public exploit has been identified at time of analysis; IBM has released a patch per advisory 7283236.

Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.

Use-after-free in the FreeBSD 15.1-RELEASE kernel's kqueue subsystem allows an unprivileged local user to corrupt kernel memory and escalate privileges to root. During a fork() system call, the kernel's knote copy routine fails to hold appropriate locks while reading knote state, and does not guard against a timer-based knote firing and being enqueued on the active list mid-copy, resulting in a double-enqueue of the new knote and subsequent list corruption. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 8.4 (Local/No Privileges Required) reflects a realistic, high-severity local privilege escalation path on affected systems.

Privilege escalation in FreeBSD's RACK TCP stack via a use-after-free condition allows an unprivileged local user to achieve full system compromise. The RACK setsockopt(2) handler temporarily releases the connection lock while copying option data from userspace; if a concurrent context switches TCP stacks twice during this window, the stale saved pointer to the per-connection control block references freed memory while the integrity check erroneously passes. Affected versions span FreeBSD 14.3, 14.4, 15.0, and 15.1 release branches, with vendor patches confirmed via FreeBSD-SA-26:43.tcp; no public exploit has been identified at time of analysis.

Use-after-free in the FreeBSD kernel virtual memory subsystem allows an unprivileged local user to corrupt the pager's page list by calling msync(MS_INVALIDATE) on a mapping of an unmanaged device object, then triggering a subsequent page fault. On object destruction, the affected page is freed twice, creating a kernel memory corruption primitive that may enable privilege escalation. No public exploit code has been identified and EPSS probability is very low (0.14%), but the vulnerability is confirmed by FreeBSD Security Advisory SA-26:37 with patches available for all affected release branches.

Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the browser sandbox against users running Chrome prior to 151.0.7922.169. An unauthenticated remote attacker can trigger the vulnerability by luring a victim to a crafted HTML page, making this a drive-by exploitation scenario requiring only a single user interaction. Google has released a patch in stable channel version 151.0.7922.169; no public exploit or CISA KEV listing has been identified at time of analysis, though SSVC rates the technical impact as total.

Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.

Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.

Type confusion in V8, Chrome's JavaScript engine, enables arbitrary code execution inside the Chrome renderer sandbox on any platform (Windows, macOS, Linux) when a user visits an attacker-controlled HTML page. All Chrome releases prior to 151.0.7922.169 are affected; Google has released the patched stable-channel build. No public exploit code or active exploitation has been identified at time of analysis, though the SSVC framework rates technical impact as total within the sandbox boundary.

Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.

Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.

Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. No active exploitation has been confirmed (not in CISA KEV), but the full C:H/I:H/A:H CVSS impact and the RCE/Memory Corruption tags warrant prompt patching for any TLS-configured Valkey instance.

Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.

Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.

Use-after-free memory corruption in Firefox's Canvas2D graphics component enables privilege escalation against any unpatched browser version. Remote unauthenticated attackers can achieve full confidentiality, integrity, and availability impact by delivering a malicious web page to a victim using Firefox prior to version 154 (stable) or the affected ESR releases. No public exploit identified at time of analysis, but the memory corruption class and low attack complexity make this a high-priority patch for both consumer and enterprise Firefox deployments.

Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.

Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.

Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).

Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.

Remote denial-of-service in Apple iOS, iPadOS, and macOS Tahoe exploits a use-after-free memory corruption flaw, allowing an unauthenticated remote attacker to trigger unexpected system termination without user interaction. Affected platforms include iOS and iPadOS prior to 26.6.1 and macOS Tahoe prior to 26.6.2, as confirmed by Apple security advisories. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible, zero-interaction attack surface presents a meaningful availability risk for all unpatched Apple devices.

Arbitrary file read and write in HP Web Jetadmin (WJA) is achievable by unauthenticated remote actors via a DLL hijacking mechanism, carrying a CVSS 4.0 score of 8.9. The flaw exposes full confidentiality, integrity, and availability of the WJA host - an attacker can exfiltrate sensitive configuration and credential files or overwrite system files to achieve persistent access. Proof-of-concept exploit code exists (CVSS 4.0 E:P), elevating real-world risk, though active exploitation has not been confirmed by CISA KEV at time of analysis.

Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.

Privilege escalation via a deterministic use-after-free in Zephyr RTOS's dynamic kernel-object disposal path affects any firmware build compiled with both CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled. An unprivileged user thread can arm a dynamically-allocated k_timer, then release its last permission - causing unref_check() to free the timer's backing storage while the embedded struct _timeout dnode remains linked in the global _timeout_q; when the timer subsequently fires, z_timer_expiration_handler() dereferences and writes the freed - and potentially reallocated - kernel heap at ISR privilege. The bug constitutes a reliable sandbox-escape memory-corruption primitive scored CVSS 8.8 with scope change (S:C), and no public exploit has been identified at time of analysis.

Kernel memory corruption in KUNBUS piControl version 2.6.2 allows a local authenticated attacker with device configuration access to write beyond process-image buffer boundaries, corrupting adjacent kernel memory and causing denial of service. The vulnerability resides in process-image management functionality and is triggered by supplying crafted device configuration data and crafted input through the piControl character device. No public exploit code or active exploitation has been confirmed at time of analysis, though the industrial OT context and kernel-level impact elevate operational priority for RevPi deployments.

Stack-based buffer overflow in the Native IBM i JSSE (Java Secure Socket Extension) provider enables local authenticated attackers with low privileges to execute arbitrary code or crash the JVM process on IBM i versions 7.3 through 7.6. The flaw is triggered during TLS session establishment via improper bounds checking against a fixed-length stack buffer. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.22% (12th percentile) and SSVC exploitation status is 'none' - but a vendor patch is available and should be applied given the high-impact code execution potential.

Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.

Out-of-bounds write (CWE-787) in IBM i versions 7.3 through 7.6 enables remote unauthenticated attackers to crash affected systems and cause denial of service. The CVSS 3.1 base score of 8.6 is backed by a network-reachable, zero-prerequisite attack vector spanning all four currently supported IBM i release lines, making the exposed attack surface broad. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available and should be applied promptly given the unauthenticated network vector.

Denial of service via buffer overflow in IBM i 7.3 through 7.6 exposes all supported release lines of IBM's midrange operating system to remote disruption. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that an unauthenticated remote attacker can trigger the flaw with low complexity and no user interaction, resulting in high availability impact and limited integrity impact - consistent with an out-of-bounds write that can crash or destabilize a targeted component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Out-of-bounds write in IBM i 7.3 through 7.6 enables a local low-privileged attacker to execute arbitrary code, with scope change (S:C) indicating the exploit crosses a security boundary into a higher-privileged component - achieving full confidentiality, integrity, and availability impact. The CVSS score of 8.8 reflects the severity of privilege escalation potential despite requiring local access. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.

Heap-based buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to execute arbitrary code with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 3.1 base score of 8.8 and is network-accessible with low attack complexity, making it a high-priority remediation target for IBM Power Systems environments. No public exploit code or active CISA KEV-listed exploitation has been identified at time of analysis; a vendor patch is available via IBM's support portal.

IBM i 7.6 exposes a remotely exploitable denial-of-service condition via an out-of-bounds write (CWE-787) that can be triggered by an unauthenticated remote attacker over the network without user interaction. The vulnerability produces high availability impact with no confidentiality or integrity consequence, consistent with a crash or resource exhaustion outcome rather than code execution. No public exploit or active exploitation has been identified at time of analysis; a vendor patch has been released.

Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.

Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by any user holding the low-privilege ML model upload and deploy permission. By crafting a model that embeds an operation computing a memory address from an attacker-controlled offset, a low-privileged authenticated user can cause the native inference subprocess to read and write outside its allocated heap, reliably crashing that process or, under controlled heap layout conditions, executing arbitrary code within it. No active exploitation or public proof-of-concept has been identified at time of analysis, but the CVSS 8.8 rating, network-accessible vector, and explicit RCE potential in the vendor description place this in the urgent-remediation tier for any organization running Elasticsearch with ML features delegated to non-admin users.

Remote denial-of-service in IBM i 7.3 through 7.6 allows unauthenticated network attackers to crash a host server by submitting malformed requests that trigger an out-of-bounds write (CWE-787) in the server's client data validation logic. The CVSS vector confirms no credentials or user interaction are required, making the attack straightforward to attempt against any network-reachable IBM i host server. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support portal.

Remote code execution in IBM i 7.3 through 7.6 is achievable by any authenticated network attacker via an out-of-bounds write (buffer overflow) triggered over the network. The vulnerability requires only low-level credentials, making it accessible to any valid user account on an internet- or network-exposed IBM i system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor has confirmed the flaw and released a patch via IBM Support.

Remote code execution in IBM i (formerly OS/400) releases 7.3 through 7.6 stems from a buffer overflow (out-of-bounds write) that a remote, unauthenticated attacker can trigger to run arbitrary code on the host. IBM has published a fix, and while the CVSS base score is 9.8, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.37% (30th percentile). CISA's SSVC framing rates exploitation as none and the vulnerability as not automatable, tempering the raw-score urgency.

Heap buffer overflow in IBM i 7.3 through 7.6 enables remote, unauthenticated attackers to crash affected systems via a network-reachable code path, resulting in a complete denial of availability. The vulnerability is rooted in CWE-787 (out-of-bounds write) and carries a CVSS 3.1 base score of 7.5 (High) with a fully unauthenticated network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch through its support portal.

Out-of-bounds write in the PostGIS address_standardizer extension through 3.7.0 allows a low-privileged database user to trigger memory corruption in the PostgreSQL server process by supplying a malicious rules table to the standardize_address() function. Missing bounds validation on the classification Type field in gamma.c permits values outside the valid range to be used as raw array indices into an internal output-link table, writing attacker-influenced data to adjacent memory. Publicly available exploit code demonstrates successful exploitation against managed cloud PostgreSQL environments including NeonDB and Supabase; no CISA KEV listing is present at time of analysis.

Out-of-bounds heap write in rsync 3.0.1 through 3.4.x allows a malicious sender to corrupt adjacent heap memory by crafting an argument list that exactly fills the argv allocation in read_args(), causing the trailing NULL terminator to land one slot beyond the allocation boundary. Any rsync client performing a pull operation against an attacker-controlled or compromised server is exposed; heap corruption at this boundary can produce a crash (high availability impact) or potentially a write-what-where condition depending on heap layout. No public exploit code and no CISA KEV listing have been identified at time of analysis; rsync maintainers designated v3.5.0 a major security release, confirming patch availability.

Out-of-bounds write in rsync 3.0.0 through 3.4.x enables remote memory corruption when a peer sends file entries with the FLAG_HLINKED flag set against a receiver with hard-link preservation disabled. The missing F_SUM field in the file_struct layout permits writes beyond the allocated structure boundary, corrupting adjacent heap or stack data and likely causing denial-of-service or potentially enabling code execution. Vendor-released patch v3.5.0 is available; no public exploit or CISA KEV listing has been confirmed at time of analysis.

Heap out-of-bounds write in rsync 3.2.5 through 3.4.x allows remote unauthenticated attackers to corrupt heap memory by supplying a crafted files-from entry to any exposed rsync daemon module. Critically, the flaw is exploitable against read-only daemon modules - a configuration commonly treated as a safe exposure boundary - by providing a path containing both an interior and trailing backslash, causing add_implied_include() to under-size its destination buffer and write one attacker-controlled byte past the allocation end. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.8 reflects the unauthenticated network attack vector and high availability impact.

Remote code execution in PostgreSQL's portal/cursor subsystem allows any authenticated database user to execute arbitrary code as the OS-level process owner (typically 'postgres') by re-creating a named cursor with an incompatible result type. All actively supported major branches are affected - versions prior to 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and minimal authentication requirement (any valid login) make this a critical patch priority for the ubiquitous open-source RDBMS.

Remote code execution in PostgreSQL 18.x (all minor versions before 18.5) is achievable by any authenticated object creator through a type confusion flaw in pg_restore_attribute_stats(), which conflates range and multirange values to corrupt memory and gain code execution as the OS user running the database process. The CVSS 8.8 score reflects a low-privilege, low-complexity network exploit path with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis, but the RCE primitive combined with the low privilege bar makes this a high-priority patch target for all PostgreSQL 18 deployments.

Type confusion in PostgreSQL's 'internal' pseudo-type enforcement enables any authenticated database user to execute arbitrary code as the operating system user running the database process. The vulnerability arises because access controls blocking SQL-layer callers from invoking C-language functions that accept 'internal' arguments contained coverage gaps, allowing a crafted function call to corrupt memory and achieve OS-level code execution. Fixed versions are PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24; no public exploit or CISA KEV listing has been identified at time of analysis.

Type confusion in PostgreSQL's 'refint' contrib module enables any low-privileged database user with object creation rights to execute arbitrary code as the operating system user hosting the PostgreSQL service. Affected are all active PostgreSQL branches prior to versions 18.5, 17.11, 16.15, 15.19, and 14.24. Notably, the fix was silently committed to the PostgreSQL git repository under the subject 'refint: Remove plan cache.' without a CVE assignment, meaning vulnerable installations may have remained unpatched far longer than typical because administrators had no security signal to act on. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

PostgreSQL's ctid data type selectivity estimator mishandles non-ctid input through a type confusion flaw (CWE-843), enabling any low-privileged database user with object-creation rights to read approximately 4 bytes of arbitrary server memory per query. All supported major versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor explicitly acknowledges that substantial memory value recovery is possible.

Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the client application performing data reads through the connector. The driver fails to validate destination buffer size when converting floating-point column values to their string representations, enabling memory corruption when sufficiently large float values are encountered. No public exploit code has been identified at time of analysis, and a vendor-confirmed fix is available in version 1.4.9.

Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 arises from a stack-based buffer overflow that lets a remote attacker run arbitrary code on the host operating system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high impact to confidentiality, integrity, and availability, scoring 9.8 (Critical). IBM has published a fix, but there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Remote code execution in IBM i 7.3 through 7.6 is exploitable by a remote authenticated attacker via improper bounds checking (CWE-787: Out-of-bounds Write). The high integrity impact (I:H) in the CVSS vector confirms that successful exploitation allows an attacker to overwrite memory and achieve arbitrary code execution on the affected IBM Power Systems platform. No public exploit identified at time of analysis, and IBM has released a vendor patch; however, the low-privilege authentication requirement (PR:L) broadens the attacker pool to any valid system user.

Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to run arbitrary code via an out-of-bounds write (CWE-787) memory-corruption flaw. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), indicating unauthenticated network exploitation with no user interaction against affected releases. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so the 9.8 rating reflects potential impact rather than confirmed exploitation.

Use-after-free in Blink, Google Chrome's rendering engine, allows remote unauthenticated attackers to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. All Chrome releases prior to 151.0.7922.137 are confirmed affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score and memory corruption class reflect serious exploitation potential.

Remote code execution within Chrome's renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.137 due to a use-after-free flaw in the HTML subsystem. An unauthenticated remote attacker can exploit this by inducing a victim to visit a crafted HTML page, triggering heap corruption that results in arbitrary code execution scoped to the sandboxed renderer process. No public exploit code has been identified at time of analysis, and EPSS stands at a low 0.31% (23rd percentile), suggesting limited attacker uptake despite the high CVSS score of 8.8.

Use-after-free in Google Chrome's Extensions subsystem prior to version 151.0.7922.137 enables an attacker to execute arbitrary code inside the Chrome sandbox by convincing a target to install a crafted malicious extension. The vulnerability class (CWE-416) indicates improper memory management in the extension handling code, where a freed memory reference is later dereferenced, corrupting heap state in a way an attacker can direct toward code execution. No public exploit or CISA KEV listing is identified at time of analysis; exploitation requires deliberate social engineering to achieve extension installation.

Sandbox escape in Google Chrome on macOS exploits a use-after-free condition in the TabStrip browser component, enabling a renderer-level attacker to break out of Chrome's security sandbox. Affected are all Chrome for Mac versions prior to 151.0.7922.137. Critically, this vulnerability is a second-stage exploit primitive - it requires the renderer process to already be compromised via a separate, chained vulnerability before this UAF can be weaponized for full sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Chrome's V8 JavaScript engine (versions prior to 151.0.7922.137) enables remote code execution inside the browser sandbox when a victim visits a crafted HTML page. The vulnerability carries a CVSS 8.8 score reflecting its network-reachable, low-complexity attack path requiring only a single user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Chromium security team rated severity as High and issued an emergency stable-channel update.

Heap and stack buffer overflow in CivetWeb's read_websocket() function (through commit 4a4f0c95) allows unauthenticated remote attackers to corrupt memory by sending crafted compressed WebSocket frames, but only against instances compiled with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES build flags. Attackers negotiate permessage-deflate during the WebSocket handshake and send an RSV1-flagged frame that triggers a 4-byte zlib sync trailer write past the allocated buffer boundary, corrupting heap metadata and enabling denial of service or potential code execution (per VulnCheck tagging). No public exploit code is confirmed and this CVE does not appear in CISA KEV at time of analysis, but the deterministic 4-byte overwrite primitive is a credible research target; the non-default build configuration substantially limits the real-world exploitable population.

MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.

MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation bar warrants prompt patching once available.

Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.

Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.

Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.

Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in the context of the logged-in user when a crafted malicious file is opened. Tagged as Memory Corruption, RCE, and Buffer Overflow by Adobe PSIRT, this is a file-parsing flaw rooted in CWE-787. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, Adobe has released patch version 15.5 via advisory APSB26-94.

Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens a specially crafted malicious file, exploiting an out-of-bounds write flaw in the application's file parsing logic. The vulnerability executes at the privilege level of the current user, meaning full compromise of user-accessible data and processes without requiring elevation. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, file-based delivery against creative professionals - a population that routinely opens files from clients, stock libraries, and external collaborators - represents a realistic social-engineering attack surface.

Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user when a victim opens a specially crafted file. All releases from 15.2 through 15.4.1 are confirmed affected; Adobe has released version 15.5 as the fix per advisory APSB26-94. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of a concrete patch release and high CVSS impact warrants prompt remediation for any organization with creative or photography workflows.

Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security context of the current user through a maliciously crafted file. The flaw, classified under CWE-787 (Memory Corruption / Buffer Overflow), resides in file-parsing logic and requires no elevated privileges on the attacker's side - only that a victim opens the weaponized file. No public exploit code or active exploitation has been confirmed at time of analysis; vendor-released patch 15.5 is available.

Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted file. Tagged as Memory Corruption, RCE, and Buffer Overflow by Adobe PSIRT, the vulnerability carries a CVSS 7.8 (High) rating. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-based attack vector makes it suitable for phishing and malicious download campaigns targeting creative professionals.

Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a crafted malicious file is opened. The vulnerability is rooted in improper memory boundary validation during file parsing (CWE-787), yielding full confidentiality, integrity, and availability impact per CVSS. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE-class severity and file-delivery vector make this a meaningful phishing or watering-hole risk for creative professionals.

Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in the context of the logged-in user when a specially crafted file is opened. Adobe's PSIRT reported the issue under advisory APSB26-94, and the ENISA EUVD tracks it as EUVD-2026-56829. No public exploit or CISA KEV listing has been identified at time of analysis, though the CWE-787 memory corruption class combined with a confirmed high C/I/A impact triad warrants prompt patching across all affected release branches.