Memory Corruption

Local privilege-relevant memory corruption in the Linux kernel's sbs-battery power supply driver (drivers/power/supply/sbs-battery) stems from a use-after-free in power_supply_changed(). Because the driver requested its IRQ via devm_ before allocating/registering the power_supply handle, devm teardown frees the handle in reverse order while the interrupt is still live, so an SMBus battery interrupt firing during device removal (or before registration during probe) invokes power_supply_changed() on a freed or uninitialized pointer, typically crashing the system or silently corrupting memory. EPSS is negligible (0.02%, 7th percentile), no public exploit is identified, and it is not on CISA KEV; the fix is upstream-committed and shipped in multiple stable releases.

Local memory corruption affects the Linux kernel's hwmon ibmpex driver, where commit 6946c726c3f4 - intended to fix a use-after-free in the high/low sysfs store handlers - instead introduced a new race condition by setting driver data to NULL before removing sensor attributes. The remediation is a revert of that flawed commit across the 6.1, 6.6, 6.12, 6.18, and 6.19 stable trees. With EPSS at 0.02% (7th percentile), no public exploit identified at time of analysis, and no CISA KEV listing, real-world risk is minimal given the obscure IBM PowerExecutive sensor hardware the driver targets.

Use-after-free in the Linux kernel's pf1550 power-supply driver (drivers/power/supply/pf1550) lets a queued hardware interrupt invoke power_supply_changed() on an already-freed power_supply handle during module/device removal, and can also dereference an uninitialized handle during probe. The flaw stems from devm-managed resource ordering: the IRQ was requested before the power_supply was registered, so devm teardown frees the power_supply first. Impact is typically a kernel crash or silent memory corruption. EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis.

Local privilege-level use-after-free in the Linux kernel's bq256xx battery charger driver (power: supply: bq256xx) allows memory corruption when a charger IRQ fires during device probe or removal, calling power_supply_changed() against a freed or uninitialized power_supply handle. The flaw stems from devm_ resources being released in reverse order, so the IRQ outlives the power_supply registration; triggering it typically crashes the system or silently corrupts kernel memory. No public exploit is identified at time of analysis and EPSS exploitation probability is negligible (0.02%, 7th percentile), with no CISA KEV listing.

Local privilege-impacting memory corruption in the Linux kernel's cpcap-battery power supply driver allows a use-after-free in power_supply_changed() triggered during device probe or removal. The driver requested its IRQ via devm_ before registering the power_supply handle, so on teardown the handle is freed while the interrupt handler can still fire, dereferencing freed memory and typically crashing the system or silently corrupting memory. EPSS is negligible (0.02%, 7th percentile) and there is no public exploit identified at time of analysis; the issue is confined to Motorola CPCAP PMIC hardware (e.g. Droid 4) rather than general-purpose servers.

Use-after-free in the Linux kernel's pm8916_bms_vm power-supply driver (for Qualcomm PM8916 battery monitoring on certain Snapdragon SoCs) lets a freed power_supply handle be dereferenced when an IRQ fires during device removal or probe, corrupting kernel memory or crashing the system. The flaw stems from devm-managed IRQ registration occurring before the power_supply handle was registered, so devm's reverse-order teardown frees the handle while the interrupt is still live. EPSS is negligible (0.02%, 5th percentile) and there is no public exploit identified at time of analysis; impact is realistically a local denial of service on the narrow set of devices using this driver.

Local privilege-level use-after-free in the Linux kernel's bq25980 battery charger power-supply driver (drivers/power/supply/bq25980.c) allows a triggered IRQ to call power_supply_changed() on a freed or uninitialized power_supply handle, typically crashing the system or corrupting memory. The flaw stems from devm-managed IRQ registration ordering relative to power_supply registration, creating a race during driver probe and removal. EPSS is negligible (0.02%, 7th percentile), there is no public exploit identified at time of analysis, and it is not on CISA KEV; the fix is committed upstream and shipped in multiple stable kernels.

Local privilege escalation potential via a use-after-free in the Linux kernel's act8945a power supply driver, where the ACT8945A PMIC IRQ is requested before the power_supply handle is registered (and torn down after it during removal), letting an interrupt invoke power_supply_changed() on a freed or uninitialized handle. Affected systems run vulnerable Linux kernel builds (pre-6.6.128, pre-6.12.75, pre-6.1.165, pre-5.15.202, pre-5.10.252, and others) with the act8945a driver bound to real Atmel/Microchip SAMA5-class hardware. There is no public exploit identified at time of analysis; EPSS is very low (0.02%, 7th percentile) and the flaw is not in CISA KEV.

Local privilege-bounded use-after-free in the Linux kernel's CAIF serial line discipline (caif_serial / CONFIG_CAIF_TTY) lets a local attacker corrupt kernel memory by racing ldisc_close() against packet transmission. ldisc_close() drops the tty reference via tty_kref_put() while the CAIF network device is still live, so a concurrent caif_xmit()/handle_tx() can dereference the freed tty (ser->tty) and call tty->ops->write() on dangling memory, confirmed by a KASAN slab-use-after-free report. A reproducer is published, but no public weaponized exploit and no active exploitation are recorded; EPSS is 0.02% (7th percentile), consistent with a niche driver and a tight race window.

Local privilege escalation potential in the Linux kernel's GFS2 (Global File System 2) filesystem stems from a slab-use-after-free in qd_put() that corrupts the quota data LRU list during filesystem shutdown. Local authenticated users with access to a GFS2 mount could trigger the shrinker path (gfs2_qd_shrink_scan) to dereference freed objects, with EPSS at 0.02% indicating no public exploit identified at time of analysis. The flaw was introduced by commit a475c5dd16e5 which began freeing quota data synchronously without removing entries from the LRU list first.

Memory corruption in the Linux kernel's AMD GPU driver (amdgpu) arises because amdgpu_gmc_get_nps_memranges() releases buffers allocated by amdgpu_discovery_get_nps_info() with kfree() even though that memory may have been allocated via kvcalloc()/vmalloc(), corrupting the kernel allocator state. The flaw affects systems running AMD GPUs on kernels prior to the fixed stable releases (6.12.75, 6.18.14, 6.19.4, and 7.0). There is no public exploit identified at time of analysis, EPSS risk is negligible (0.02%), and the issue was found via static analysis and code review rather than in-the-wild exploitation.

Local privilege-escalation-class memory corruption in the Linux kernel's BPF arena subsystem (introduced around 6.9) allows a process holding BPF capabilities to trigger a use-after-free. When a BPF arena VMA is inherited across fork(), arena_vm_open() bumps the mmap refcount but never registers the child VMA in arena->vma_list, leaving vml->vma pointing at the parent VMA; after the parent munmaps, a child call to bpf_arena_free_pages() dereferences the dangling pointer in zap_pages(). No public exploit or active exploitation is identified (EPSS 0.02%, 5th percentile), and vendor patches are available.

Local privilege escalation and code execution in NVIDIA Virtual GPU Manager arises from a use-after-free on stack memory within the vGPU hypervisor component. Authenticated local attackers on the host or guest side of an affected vGPU deployment (vGPU branches 16.x through 20.x) can trigger memory corruption that may yield DoS, info disclosure, data tampering, or arbitrary code execution. No public exploit identified at time of analysis and EPSS is 0.01%, but SSVC rates technical impact as total.

Local privilege escalation in the NVIDIA Display Driver for Windows and Linux allows an authenticated low-privileged user to trigger an out-of-bounds write (CWE-787) in the kernel-mode driver, potentially leading to code execution, privilege escalation, information disclosure, data tampering, or denial of service. The flaw affects GeForce, RTX/Quadro/NVS, and Tesla product lines, with NVIDIA confirming the vulnerability and releasing patched driver versions. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.01%.

Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU Guest/Manager components) stems from a use-after-free memory corruption flaw (CWE-416) that a local low-privileged user can trigger to compromise the kernel-level driver. The scope-changed CVSS 8.8 score reflects that successful exploitation crosses a trust boundary, potentially yielding code execution, privilege escalation, information disclosure, data tampering, or denial of service. EPSS is 0.01% (1st percentile) and there is no public exploit identified at time of analysis, but a vendor patch is available across all affected branches.

Out-of-bounds write in Autodesk 3ds Max 2026 and 2027 enables arbitrary code execution when a user opens a maliciously crafted TIF image file, with impact ranging from process crash to data corruption to code execution in the context of the running application. The flaw requires local file handling and user interaction (UI:R), and there is no public exploit identified at time of analysis. EPSS is negligible (0.01%) and SSVC marks exploitation status as none, but the technical impact is rated total, making this a credible client-side risk for design and VFX workstations.

Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.

Heap use-after-free write in libyang before 5.2.6 enables remote authenticated attackers to crash processes or potentially execute code by submitting crafted YANG XML documents to applications using the library for parsing. The flaw resides in lyd_parser_set_data_flags, which mishandles metadata list pointers when freeing non-head default metadata entries. No public exploit identified at time of analysis, EPSS is low at 0.03%, and SSVC rates technical impact as partial with no automatable exploitation.

Remote code execution in FastNetMon Community Edition through 1.2.9 stems from an off-by-one heap write in the pervasively-used dynamic_binary_buffer_t class, reachable by anyone who can send NetFlow, sFlow, IPFIX, or BGP traffic to the DDoS-detection appliance. Because the flawed buffer is exercised during BGP encoding/decoding, NetFlow template parsing, and Flow Spec NLRI construction, an unauthenticated network attacker can corrupt adjacent heap metadata and potentially execute arbitrary code. The flaw carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), but no public exploit is identified at time of analysis and it is not listed in CISA KEV.

runAsNonRoot bypass in containerd allows crafted container images to execute as UID 0 despite Kubernetes security policies designed to prevent root execution. The flaw stems from containerd treating numeric USER directives that overflow a 32-bit integer as usernames, and if the image's /etc/passwd maps that string to root, the container runs as root. No public exploit identified at time of analysis, but the issue was responsibly disclosed by Lei Wang (@ssst0n3) and fixed in multiple containerd release branches.

Out-of-bounds heap write in the Linux kernel's IPv6 RPL Source Routing Header (SRH) processing path allows local attackers with raw IPv6 socket access to corrupt memory beyond the skb buffer. The flaw in ipv6_rpl_srh_rcv() occurs when a recompressed SRH grows larger than the received one and consumes unchecked headroom, causing skb_mac_header_rebuild() to wrap a u16 offset and trigger a ~64KiB out-of-bounds memmove. EPSS is very low (0.02%) and no public exploit identified at time of analysis, but the bug is reachable from unprivileged userspace via a single crafted AF_INET6/SOCK_RAW packet over loopback per the reporter's KASAN reproduction.

Local privilege escalation and potential memory corruption in the Linux kernel's rtmutex (real-time mutex) subsystem stems from remove_waiter() incorrectly operating on the current task instead of waiter::task during proxy-lock rollback in futex_requeue() paths. Exploitation can leave a dangling pi_blocked_on pointer primed for a use-after-free, with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflecting local low-privileged access. EPSS is 0.02% (7th percentile) and no public exploit identified at time of analysis, but the UAF primitive is a known building block for kernel privilege escalation.

Local privilege-level data corruption in the Linux kernel's accel/ivpu driver (Intel VPU accelerator) allows authenticated local users to trigger incorrect device access and memory corruption by re-exporting imported GEM (Graphics Execution Manager) buffer objects via the DMA-BUF prime interface. The flaw stems from the missing validation that allowed buffer flag settings to be lost on re-export, and while CVSS rates it 7.8 High due to local high-impact effects, EPSS is only 0.02% and no public exploit identified at time of analysis.

Use-after-free in the Linux kernel's udlfb (DisplayLink USB framebuffer) driver allows a local user with access to the framebuffer device to retain read/write access to freed kernel memory pages after a USB disconnect or framebuffer reallocation. The dlfb_ops_mmap() function maps vmalloc-backed framebuffer pages to userspace without installing vm_ops callbacks, so the kernel cannot track active mappings and vfree() is called on pages still referenced by user PTEs. No public exploit identified at time of analysis, EPSS is very low (0.02%), and the issue is not listed in CISA KEV.

Local privilege escalation in FreeBSD via the ptrace(PT_SC_REMOTE) interface allows an unprivileged user with debug access to a process to trigger arbitrary kernel code execution by abusing improperly validated parameters in syscall(2) and __syscall(2) meta-system calls. Affected releases include FreeBSD 14.3, 14.4, and 15.0 prior to their respective patch levels, and no public exploit identified at time of analysis. EPSS exploitation probability is low (0.02%) but the CVSS base score of 8.4 reflects high impact across confidentiality, integrity, and availability once a foothold exists.

Local privilege escalation in the FreeBSD kernel (14.3, 14.4, and 15.0 release branches) lets an unprivileged local user obtain superuser privileges through a use-after-free in the poll(2)/select(2) subsystem. When a file descriptor is closed while a thread is still blocked waiting on it, certain descriptor types fail to unlink the sleeping thread from the object's wait queue before the object is freed, so the later wakeup dereferences freed kernel memory. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, but technical impact is rated total.

Heap-based buffer overflow in MediaArea MediaInfoLib's LXF (Leitch eXchange Format) element parser allows attackers to achieve arbitrary code execution when a victim opens a maliciously crafted LXF media file. The flaw, disclosed by Cisco Talos as TALOS-2026-2371 and assigned CWE-823, requires user interaction and local file access but no privileges, and at the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.

Out-of-bounds write in Netatalk versions 2.0.4 through 4.4.2 stems from a missing o_len bounds check in the pull_charset_flags() character-set conversion routine, enabling remote attackers with low privileges to corrupt memory and potentially compromise confidentiality, integrity, and availability of the AFP file server. The flaw is addressed in Netatalk 4.4.3, and no public exploit has been identified at time of analysis.

Out-of-bounds write in Netatalk versions 2.0.4 through 4.4.2 affects the convert_charset() routine during null termination handling, exposing the AppleTalk/AFP server implementation to memory corruption. Authenticated remote attackers can trigger heap or stack corruption that threatens confidentiality, integrity, and availability of the host. No public exploit identified at time of analysis, and the vendor has shipped a corrective release in 4.4.3.

Remote code execution in Google Chrome versions prior to 148.0.7778.179 allows a remote attacker to execute arbitrary code within the renderer sandbox via a crafted HTML page that triggers a use-after-free in the DOM implementation. The flaw requires user interaction (visiting a malicious page) but no authentication, and while Chromium rates its security severity as Medium, the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Remote code execution in Google Chrome versions prior to 148.0.7778.179 stems from a use-after-free flaw in the WebRTC component, enabling a remote attacker to run arbitrary code when a victim visits a crafted HTML page. Chromium rates the severity as High and the CVSS 3.1 score is 8.8, but exploitation requires user interaction (UI:R); no public exploit identified at time of analysis.

Remote code execution in Google Chrome on Windows prior to 148.0.7778.179 stems from a use-after-free flaw in the XR (WebXR) component, enabling a remote attacker to run arbitrary code in the renderer process by enticing a user to visit a crafted HTML page. Chromium rates the issue High severity and CVSS scores it 8.8; no public exploit identified at time of analysis and SSVC reports exploitation status as none. A vendor patch is available via the Stable Channel update referenced in the Chrome Releases advisory.

Sandbox escape in Google Chrome (Linux and ChromeOS) prior to 148.0.7778.179 allows a remote attacker who has already compromised the renderer process to break out via a crafted video file processed by the GFX component. The flaw is a type confusion (CWE-843) rated High severity by Chromium, with no public exploit identified at time of analysis and SSVC indicating exploitation has not been observed. It requires user interaction and chained exploitation of a prior renderer compromise, which raises the bar despite the High CVSS of 7.5.

Remote code execution in Google Chrome versions prior to 148.0.7778.179 stems from a use-after-free condition in the QUIC networking stack, allowing remote attackers to execute arbitrary code within the browser sandbox via malicious network traffic. Exploitation requires user interaction (visiting a malicious site or processing attacker-controlled QUIC traffic), and no public exploit has been identified at time of analysis. Chromium rates this as High severity, and a vendor patch is available.

Remote code execution in Google Chrome on Windows prior to version 148.0.7778.179 stems from a use-after-free condition in the GPU component, enabling a remote attacker to run arbitrary code within the renderer sandbox after the victim loads a crafted HTML page. Google has rated the issue High severity and shipped a fix; no public exploit identified at time of analysis and SSVC indicates exploitation status 'none' despite total technical impact.

Remote code execution in Google Chrome on Linux before 148.0.7778.179 stems from a use-after-free flaw in the WebRTC component, allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code in the renderer process. Chromium rates the severity as Critical and a vendor patch is available, though there is no public exploit identified at time of analysis and SSVC indicates no observed exploitation. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with required user interaction (visiting a page).

Out-of-bounds write in NVIDIA TensorRT prior to version 10.16.1 allows an attacker to corrupt memory and tamper with data during inference processing. The flaw affects the TensorRT SDK/runtime used for high-performance deep-learning inference on NVIDIA GPUs, and per the vendor CVSS the impact is limited to integrity (data tampering) with no confidentiality or availability loss. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.04%), but CISA SSVC flags the issue as automatable.

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CWE-416) by interacting with the DoH endpoint, affecting BIND 9.20.0-9.20.22, 9.21.0-9.21.21, and the 9.20.9-S1-9.20.22-S1 subscription builds; the older 9.18.x branch is explicitly not affected. The vendor scores it CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), implying unauthenticated remote impact, though CISA's SSVC rates technical impact as only 'partial' and exploitation as 'none'. There is no public exploit identified at time of analysis and EPSS is very low (0.02%, 7th percentile), indicating no observed exploitation activity.

Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an attacker controlling a DNSSEC-signed domain to crash the resolver process with a single crafted query. The DNSSEC validator uses an incorrect counter when computing write offsets for ADDITIONAL section rrsets while building chase-reply messages, leaving an uninitialized pointer that is later dereferenced. No public exploit identified at time of analysis, and the issue is fixed in Unbound 1.25.1.

Use-after-free in the DNSSEC validator of NLnet Labs Unbound resolver versions 1.19.1 through 1.25.0 allows remote attackers to crash the daemon or potentially achieve arbitrary code execution by serving a malicious signed zone to a vulnerable resolver. The flaw stems from a struct-assignment bug during deep copying of response messages when DS sub-queries suspend validation under NSEC3 computational budget exhaustion. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.1 with network attack vector and no required privileges or user interaction makes this a high-priority patching target for any operator running a recursive Unbound resolver.

Heap buffer overflow write in libheif (versions ≤ 1.21.2) lets a crafted HEIF/AVIF file write 64 bytes of attacker-controlled data past a chroma-plane heap allocation during grid tile compositing. Any application using libheif to decode untrusted images - image viewers, file managers, browsers, mobile OS thumbnailers - is exposed, with CVSS 8.8 reflecting likely code execution after user-triggered file open. No public exploit identified at time of analysis, but the deterministic 64-byte fully-controlled overflow is highly favorable for exploitation.

Sandbox escape in Mozilla Firefox via a use-after-free (CWE-416) in the Disability Access (accessibility) APIs lets a remote attacker who lures a user to malicious web content break out of the content sandbox and gain total control over confidentiality, integrity, and availability. The flaw affects Firefox before 151, Firefox ESR before 115.36, and Firefox ESR before 140.11, and is fixed in those releases. No public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 9.6 rating and scope-changing sandbox escape make it a high-severity patch priority.

Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker to trigger a use-after-free (CWE-416) by serving crafted web content, potentially leading to information disclosure or memory-corruption-based control-flow effects. The flaw affects Firefox before 151 and the ESR 115.x and 140.x branches, and is patched in Firefox 151, ESR 115.36, and ESR 140.11. No public exploit identified at time of analysis; EPSS probability is very low (0.05%) and CISA SSVC records no known exploitation.

Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) allows attackers to corrupt memory by inducing buffer overflows through crafted JavaScript. Exploitation requires local execution of attacker-supplied script content with user interaction, but successful triggering yields high impact to confidentiality, integrity, and availability (CVSS 7.8). No public exploit identified at time of analysis and the issue is not on the CISA KEV list.

Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) enables pointer manipulation when processing crafted JavaScript content, with CVSS 7.8 reflecting high-impact local exploitation requiring user interaction. The affected codepaths include evaluator error handling, TypedArray copyWithin operations on resizable buffers, DataView coercion, and array fast-mode transitions - all triggerable by attacker-controlled script. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Out-of-bounds write in OpenHarmony v6.0 and earlier enables a local low-privileged attacker to corrupt memory and trigger an unrecoverable denial-of-service condition on affected devices. The flaw was disclosed by the OpenHarmony project itself, and no public exploit identified at time of analysis. Although CVSS scores it 8.4 (High) due to scope change and high confidentiality/integrity impact, the vector indicates local-only access with low privileges already required.

Arbitrary code execution in OpenHarmony v6.0 and earlier enables remote attackers with low privileges to execute code within pre-installed apps via an out-of-bounds write (CWE-787). The CVSS 8.8 vector reflects network-reachable exploitation with low complexity and no user interaction once minimal privileges are obtained, yielding high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Heap out-of-bounds write in the Crypt::OpenSSL::PKCS12 Perl module (versions up to and including 1.94) allows attackers who can supply a malicious PKCS12 file processed via info() or info_as_hash() to corrupt heap memory and potentially achieve remote code execution. The flaw stems from an integer overflow when an OCTET STRING or BIT STRING attribute on a SAFEBAG is >= 1 GiB in size, causing an undersized allocation followed by an OOB write. No public exploit identified at time of analysis, but the upstream patch and oss-security disclosure are public.

Memory corruption in radare2 6.1.5's GDB client allows remote attackers to crash the application or potentially execute code through malformed thread information responses. The vulnerability triggers when the GDB remote protocol's qsThreadInfo command fails after qfThreadInfo has allocated memory, causing a use-after-free condition. While no public exploits have been identified, the CVSS 8.7 score reflects the potential for remote unauthenticated denial of service impact.

Remote attackers can trigger memory corruption in radare2 6.1.5 through its GDB remote debugging interface, causing denial of service or potentially achieving code execution. The use-after-free vulnerability in gdbr_threads_list() occurs when processing a valid qfThreadInfo response followed by a malformed qsThreadInfo response, leading to improper memory management. VulnCheck reported this issue and vendor patch commit c213ad6894a1eb9086ac8bf5fae35757e9e1683c addresses the vulnerability.

Out-of-bounds read and buffer overflow in the Linux kernel's ksmbd SMB server allows authenticated remote attackers to corrupt memory or read past allocated buffers by sending a malformed inheritable ACE with an inflated num_subauth value. The flaw resides in smb_inherit_dacl() and smb_set_ace(), where the variable-length SID is not bounds-checked during DACL inheritance, enabling heap corruption with potential for remote code execution against any SMB server using ksmbd. EPSS is very low (0.02%) and no public exploit identified at time of analysis, but the vendor patch is available across multiple stable branches.

Arbitrary code execution in Google Chrome on macOS (versions prior to 148.0.7778.168) stems from a use-after-free in the browser's Extensions subsystem, allowing an attacker who convinces a user to install a malicious extension to run arbitrary code through a crafted Chrome extension. Chromium rates the severity Medium, but the CVSS 3.1 base score is 8.8 (High) because the flaw yields full confidentiality, integrity, and availability impact once triggered. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and the EPSS probability is negligible (0.02%, 5th percentile), indicating no observed real-world exploitation to date.

Arbitrary code execution in Google Chrome's GPU component (prior to 148.0.7778.168) lets a remote attacker run code inside the renderer/GPU sandbox by luring a victim to a crafted HTML page. The flaw is a CWE-416 use-after-free that Chromium rates Medium, though CVSS scores it 8.8 (High). No public exploit is identified and there is no CISA KEV listing; EPSS is very low at 0.08%, indicating no observed exploitation activity at time of analysis.

Sandbox escape in Google Chrome's Mojo IPC layer allows a remote attacker who lures a victim to a crafted HTML page to exploit a use-after-free (CWE-416) and potentially break out of the renderer sandbox on versions prior to 148.0.7778.168. Google fixed the flaw in the stable desktop channel (148.0.7778.168), and there is no public exploit identified at time of analysis (EPSS 0.07%, not in CISA KEV). Note a signal conflict: the CVSS base score is 9.6 (Critical) while Chromium's own triage rated the severity only Medium, so real-world exploitability is likely lower than the raw score implies.

Sandbox escape in Google Chrome desktop before 148.0.7778.168 lets an attacker who already controls a compromised renderer process leverage a use-after-free in the browser UI component to break out of the renderer sandbox via a crafted HTML page. This is the second-stage bug in a typical browser exploit chain and Chromium rates it Medium severity; there is no public exploit identified at time of analysis and EPSS estimates only a 0.07% exploitation probability. Google has released a fixed stable-channel build, and Red Hat and SUSE have picked it up for their Chromium packages.

Sandbox escape in Google Chrome on Windows before 148.0.7778.168 stems from a use-after-free in the browser's Core component, allowing an attacker who has already compromised the renderer process to break out of the sandbox and potentially execute code in the more privileged browser process via a crafted HTML page. Google rates it Medium severity internally, though the assigned CVSS is 8.3 due to the scope change and total impact. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and SSVC records exploitation status as none.

Sandbox escape in Google Chrome for macOS (versions prior to 148.0.7778.168) stems from an out-of-bounds write in the browser's media codec handling, letting a remote unauthenticated attacker who lures a victim into opening a crafted video file corrupt memory and potentially break out of the renderer sandbox. The flaw carries a CVSS 8.3 rating driven by a scope-changing, full-triad impact, though Chromium internally rated the security severity only Medium. There is no public exploit identified at time of analysis, EPSS is very low at 0.07%, and CISA SSVC records exploitation as none.

Privilege escalation in Google Chrome desktop before 148.0.7778.168 lets an attacker who has already compromised the renderer process abuse a use-after-free in the Accessibility component to break out of the sandbox and gain elevated privileges via a crafted HTML page. Rated High by Chromium and scored CVSS 7.5, it is a second-stage exploit primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low at 0.07%.

Remote code execution in Google Chrome on Windows before 148.0.7778.168 stems from a use-after-free in the GTK component, letting a remote attacker run arbitrary code when a victim opens a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable channel build; no public exploit is identified at time of analysis, EPSS risk is low (0.08%), and CISA SSVC marks exploitation status as none.

Remote code execution in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free (CWE-416) in the Downloads component, letting a remote attacker who lures a victim into performing specific UI interactions run arbitrary code via a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw was reported internally by the Chrome team and is patched in the Stable channel update. No public exploit identified at time of analysis, and EPSS is low at 0.08%.

Remote code execution in Google Chrome's Media component (versions prior to 148.0.7778.168) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a use-after-free (CWE-416); Google has shipped a fixed Stable channel build. There is no public exploit identified at time of analysis, EPSS is low (0.08%), and CISA SSVC records exploitation as none - though memory-corruption bugs in Chrome's media stack are historically attractive to attackers.

Sandbox escape in Google Chrome's Media component (versions prior to 148.0.7778.168) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. This is an out-of-bounds write (CWE-787) rated High by Chromium and CVSS 8.3, but exploitation is gated on chaining from a prior renderer compromise, and there is no public exploit identified at time of analysis. EPSS is very low (0.07%, 21st percentile) and CISA SSVC lists exploitation status as none.

Remote code execution in Google Chrome's Media component (versions prior to 148.0.7778.168) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8; no public exploit identified at time of analysis, and SSVC records no observed exploitation with a low EPSS of 0.08%. Exploitation requires user interaction (visiting a malicious page) and, because code runs inside the sandbox, a separate sandbox-escape bug would be needed for full host compromise.

Sandbox escape in Google Chrome on Windows before 148.0.7778.168 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain code execution at higher privilege on the host. The flaw is a use-after-free (CWE-416) in Chrome's Core component, triggered via a crafted HTML page; Google rates it High severity. No public exploit has been identified at time of analysis, and EPSS is very low (0.07%, 21st percentile), consistent with an internally reported bug not yet weaponized.

Remote code execution in Google Chrome's V8 JavaScript engine before 148.0.7778.168 allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a type confusion bug and requires user interaction (visiting a malicious page); no public exploit identified at time of analysis and EPSS probability is very low (0.08%). Google has shipped a patched Stable channel release.

Sandbox escape in Google Chrome desktop before 148.0.7778.168 lets a remote attacker who has already compromised the renderer process break out of the sandbox by triggering a use-after-free in the Accessibility component via a crafted HTML page. Rated High by Chromium and scored CVSS 8.3, it is a second-stage exploit primitive rather than a standalone remote break-in. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 21st percentile), consistent with the SSVC exploitation status of 'none'.

Sandbox escape in Google Chrome on Windows before 148.0.7778.168 lets an attacker who already controls a compromised renderer process break out of the browser sandbox by triggering a use-after-free in the Network component via a crafted HTML page. It is a second-stage bug that chains onto a prior renderer compromise rather than a standalone entry point, carrying High Chromium severity and CVSS 8.3. There is no public exploit identified at time of analysis, and EPSS is very low at 0.07% (21st percentile).

Out-of-bounds write in the WebRTC component of Google Chrome before 148.0.7778.168 lets a remote attacker achieve arbitrary code execution inside the renderer sandbox when a victim opens a crafted HTML page. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis, EPSS is low (0.07%), and CISA SSVC lists exploitation as none, indicating no observed in-the-wild activity yet.

Out-of-bounds write in Google Chrome's WebAudio component (versions prior to 148.0.7778.168) lets a remote attacker achieve arbitrary code execution within the renderer sandbox when a victim opens a crafted HTML page. Google rates the Chromium severity as High and has shipped a fixed Stable channel build; there is no public exploit identified at time of analysis and the EPSS score is very low (0.07%). Because execution is confined to the sandbox, real-world impact typically requires chaining a separate sandbox-escape bug.

Renderer-sandboxed remote code execution in Google Chrome's Fonts component (versions prior to 148.0.7778.168) lets a remote attacker run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a CWE-787 out-of-bounds write reported internally by the Chrome team. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile), consistent with the CISA SSVC assessment of no known exploitation.

Sandbox escape in Google Chrome desktop versions prior to 148.0.7778.168 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, abusing a use-after-free in the Mojo IPC layer. Rated High by Chromium and CVSS 8.3, it enables a scope change from the low-privilege renderer to the more-privileged browser process. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.07%), indicating no observed exploitation.

Remote code execution in Google Chrome on macOS prior to 148.0.7778.168 stems from a use-after-free in the Downloads component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the browser process. Rated Critical by Chromium and CVSS 8.8, it requires user interaction (visiting the page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.08%), consistent with SSVC exploitation status of 'none'.

Remote code execution in Google Chrome's Tab Groups component (versions prior to 148.0.7778.168) stems from a use-after-free (CWE-416) that a remote attacker can trigger via malicious network traffic, per Google's Chrome Releases advisory rated Chromium-Critical. Successful exploitation yields arbitrary code execution in the affected browser process with total technical impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and CISA SSVC records exploitation status as none.

Renderer-side arbitrary code execution in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free in the Blink rendering engine, letting a remote attacker who lures a victim to a crafted HTML page run code within the browser's renderer sandbox. Chromium rates the flaw Critical severity; however, exploitation still requires the user to open a malicious page (UI:R), the code executes inside the sandbox (scope unchanged), and there is no public exploit identified at time of analysis. EPSS is low (0.08%, 23rd percentile) and CISA SSVC records exploitation as 'none', so this is a high-severity but not yet actively exploited issue.

Sandbox escape in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free in the WebHID implementation, letting a remote attacker who lures a victim into specific UI gestures on a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. Chromium rates the severity Critical, though no public exploit is identified and EPSS is very low (0.07%). Exploitation requires user interaction and is not automatable, indicating a high-skill rather than mass-exploited threat.

Sandbox escape in Google Chrome's Aura windowing subsystem (versions prior to 148.0.7778.168) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, it is a use-after-free (CWE-416) that serves as the second stage of an exploit chain rather than an initial entry point. There is no public exploit identified at time of analysis, and EPSS is very low (0.07%), consistent with a patched, chain-dependent bug.

Sandbox escape in Google Chrome for Android before 148.0.7778.168 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Input component to break out of the sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, this is a second-stage bug requiring an existing renderer compromise rather than a standalone remote exploit. EPSS is very low (0.07%) and there is no public exploit identified at time of analysis; SSVC records no observed exploitation.

Sandbox escape in Google Chrome desktop before 148.0.7778.168 stems from a use-after-free in the FileSystem component, letting a remote attacker who serves a crafted HTML page and coaxes the victim into specific UI gestures corrupt memory and break out of the renderer sandbox. Chromium rates it Critical, and the CVSS:3.1 8.3 score reflects a scope change (S:C) with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.07% (21st percentile).

Sandbox escape in Google Chrome's UI layer, driven by a use-after-free (CWE-416) reachable before version 148.0.7778.168, lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox. Google rates the Chromium severity Critical and has shipped a fix; there is no public exploit identified at time of analysis, and EPSS is low (0.07%, 21st percentile), so this is a high-severity but not-yet-exploited memory-safety bug. SSVC lists exploitation as none with total technical impact.

Heap buffer overflow in OpenImageIO's SGI image decoder allows arbitrary code execution via specially crafted .sgi files. Affects versions before 3.0.18.0 and 3.1.13.0 when processing malicious SGI images with invalid RLE compression parameters. Publicly available exploit code exists (SSVC POC status confirmed). Attack requires local file access and user interaction to open the malicious file, but CVSS 8.4 reflects high impact potential (code execution) in VFX/animation production environments where SGI format handling is common. EPSS data unavailable, not listed in CISA KEV.

Heap buffer overflow in OpenImageIO versions before 3.0.18.0 and 3.1.13.0 allows local attackers to corrupt up to 65,535 bytes of memory via malicious Softimage .pic files. The vulnerability arises when processing RLE-compressed images where run-length validation is missing in two code paths (softimageinput.cpp lines 469 and 345), though the raw packet path correctly implements bounds checking. EPSS data not available. Not listed in CISA KEV. Patches released by Academy Software Foundation in versions 3.0.18.0 and 3.1.13.0.

Remote code execution and denial-of-service in Palo Alto Networks PAN-OS software stems from a buffer overflow in the IKEv2 processing path, allowing unauthenticated network attackers to either crash the firewall or run arbitrary code with elevated privileges. The flaw affects multiple PAN-OS branches (11.1.x, 11.2.x, and 12.1.x) while Panorama, Cloud NGFW, and Prisma Access remain unaffected. There is no public exploit identified at time of analysis, EPSS sits at a low 0.06% (19th percentile), and CISA SSVC currently lists exploitation as 'none'.

Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles on virtual servers. Remote unauthenticated attackers can crash TMM using undisclosed malicious traffic patterns, causing complete service disruption. CVSS 7.5 High severity with network vector and low complexity. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. Vendor patch available per F5 K000160945.

Remote denial-of-service in F5 BIG-IP Policy Enforcement Manager (PEM) allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM) via undisclosed traffic patterns when PEM-specific iRules are configured on a virtual server. The vulnerability is a use-after-free memory corruption issue (CWE-416) affecting CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and urlcatquery iRule commands. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates straightforward remote exploitation with high availability impact. EPSS data not provided, but F5 has released a vendor patch (K000160875). No public exploit or CISA KEV listing identified at time of analysis.

Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or mapreduce map functions) with subsequent JavaScript engine invocations ($where, $function, mapreduce reduce stages), triggering a use-after-free condition. Affects MongoDB Server 7.0 (prior to 7.0.34), 8.0 (prior to 8.0.23), 8.2 (prior to 8.2.9), and 8.3 (prior to 8.3.2). Vendor-released patches available for all affected branches. No public exploit identified at time of analysis; EPSS score of 0.05% (16th percentile) suggests low observed exploitation probability despite 7.7 CVSS score. The CWE-416 use-after-free root cause requires precise sequencing of JavaScript operations, limiting exploitability.

Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authenticated users with database write privileges. Affects all active release branches (5.0 through 8.3) when exploiting field-name-to-index mapping inconsistencies in the time-series bucket catalog. EPSS score of 0.06% (20th percentile) suggests low widespread exploitation probability despite high CVSS 8.7, but requires authentication and database privileges, limiting attack surface to insider threats or compromised application credentials. No public exploit code or CISA KEV listing identified at time of analysis.

Arbitrary code execution in Adobe Substance 3D Painter versions 12.0.2 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, executing code in the context of the current user. The flaw was reported by Adobe PSIRT and is fixed per advisory APSB26-55; there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.03%. Exploitation is local and requires user interaction, limiting it to social-engineering-driven file-opening attacks rather than remote automated compromise.

Arbitrary code execution in Adobe Substance 3D Painter (versions 12.0.2 and earlier) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, so exploitation is file-borne and requires user interaction. There is no public exploit identified at time of analysis, KEV does not list it, and the EPSS score is very low (0.03%), indicating no observed or expected mass exploitation.

Arbitrary code execution in Adobe Illustrator 29.8.6, 30.3 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running code in the context of the current user. Only local file-open exploitation applies (CVSS 7.8, AV:L), and there is no public exploit identified at time of analysis; EPSS is very low at 0.03% (7th percentile) and CISA SSVC lists exploitation as none, indicating no observed attacks despite total technical impact.

Local privilege escalation in Intel QuickAssist Technology (QAT) software drivers for Windows before version 1.13 lets an authenticated, unprivileged local user escalate to higher privileges via an out-of-bounds write (CWE-787) in Ring 3 user-application code. The flaw carries a CVSS 4.0 base score of 8.5 with total technical impact but is not known to be exploited - CISA's SSVC framework rates exploitation as 'none' and EPSS is negligible at 0.01% (3rd percentile), with no public exploit identified at time of analysis.