Memory Corruption

Crashing of the clevis-pkcs11-afunix-socket-unlock daemon in the clevis PKCS#11 pin allows a local attacker to cause a boot-time denial of service on hosts that rely on clevis for LUKS disk decryption. When a client connects to the daemon's AF_UNIX data socket without binding a client address, an integer underflow in the getpeername() result handling corrupts memory (CWE-787) and terminates the daemon, so LUKS unlock never completes and the system cannot finish booting. The issue is availability-only (CVSS 3.1 base 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), affects clevis on Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and no public exploit has been identified at time of analysis; the vulnerable configuration is a non-default deployment choice and not present in a stock RHEL install.

Memory corruption in the Zephyr RTOS Bluetooth host ATT transmit path can be triggered by a peer in Bluetooth radio range whenever an application issues an ATT Signed Write Command over an unencrypted link. In chan_send(), the BT_ATT_OP_SIGNED_WRITE_CMD branch unrefers a net_buf it does not own after bt_smp_sign() fails (no local CSRK exists for the peer - a state the remote peer controls by pairing without requesting the signing key, pairing with No Bonding, staying unpaired, or keeping the link unencrypted); the callers honor the opposite ownership contract, so the already-freed buffer is re-queued, dereferenced and freed a second time, corrupting the ATT TX FIFO, deferred-destroy and pool free lists, while a related retry path can append a second 12-octet signature into a pooled buffer sized for one. Exploitation requires the deprecated, non-default CONFIG_BT_SIGNING build option plus a victim application that actually performs signed writes, giving CVSS 5.9 (AV:A/AC:H/PR:N, no confidentiality impact, high availability impact, low integrity impact); a vendor fix commit and GHSA-p3r4-qw98-j59m are available, and no public exploit was identified at time of analysis.

An out-of-bounds heap write in Moonlight Qt 6.1.0 and earlier allows an attacker-controlled GameStream host to corrupt memory in the Moonlight client and reliably crash it during an active streaming session. Exploitation requires the victim to voluntarily initiate a session to the malicious host and requires Moonlight to select a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC, which sends the server's H.264 SPS data through the vulnerable fixup path in app/streaming/video/ffmpeg.cpp, where a seq_parameter_set_id of 32 or greater is used unvalidated to index the 32-entry sps_table. The assessed impact is availability-only client crash and heap corruption (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H); despite metadata tags referencing RCE, code execution has not been established, and no public exploit code has been identified at time of analysis. This is a medium-severity, client-side denial-of-service issue rather than a high-priority remote compromise.

An out-of-bounds write in the SPI host command interface of Semtech's LR11xx transceiver firmware lets an attacker who already has hands-on hardware access and logical control of the SPI bus send a crafted host command with an oversized length field, causing the firmware to write up to 254 arbitrary bytes beyond an internal non-persistent memory buffer. The affected product lines are the LR1110 transceiver and modem-E, the LR1120 transceiver, and the LR1121 transceiver and modem-E; the vulnerability is rated 5.2 (CVSS 4.0) and assessed at CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, meaning integrity and availability of the transceiver can be corrupted but no confidentiality loss occurs. There is no network or remote attack vector - exploitation requires physical access to the device plus SPI bus access - and no public exploit identified at time of analysis, with no confirmed active exploitation (CISA KEV) reported. Because the corrupted buffer is non-persistent, effects may be cleared by a device reset, keeping real-world risk low to moderate.

Denial of service in ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32, where a type confusion in the INFO, JSON and YAML encoders lets a locally positioned low-privilege user crash the ImageMagick process (SIGABRT or SIGSEGV) when an image is written to a compressed or blob-backed output stream. The flaw is reached only when the write targets a non-FILE stream such as zip:, bzip2: or a blob/FIFO destination, so ordinary file, pipe and standard-stream output are unaffected; impact is limited to availability of the single process, with no confidentiality or integrity loss. This is a genuinely low-priority issue - the assessed vector is local, low-privilege and availability-only - and no public exploit identified at time of analysis, though vendor patches are available.

Use-after-free in ImageMagick's PDF writer (coders/pdf.c) can crash the process when a CMYK-colorspace image is written to PDF using JPEG2000 compression; affected releases are ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32. The attacker supplies the crafted CMYK image, but the trigger is the operator-side PDF export operation with JPEG2000 compression selected, which is not the default output mode - reading or decoding the image alone does not reach the vulnerable code path. The issue is a low-impact availability defect (no confidentiality or integrity loss), unauthenticated per the CVSS PR:N vector, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor patches exist as commits in the ImageMagick and ImageMagick6 repositories.

Use-after-free in FreeRDP's rdpsnd audio channel can crash the client: a malicious or compromised RDP server disconnects the session while asynchronous Wave2 audio playback is still draining queued PDUs, and the disconnect path frees the audio formats and device structures without joining play_thread, leaving the playback path dereferencing freed heap memory. Affected are FreeRDP client builds from 2.1.0 up to but not including 3.32.0 that negotiate the static rdpsnd channel; exploitation is non-deterministic and requires the victim to initiate the connection to an attacker-controlled server (UI:P) with the race window landing on the disconnect, so the outcome is a client-side denial of service rather than code execution. No public exploit identified at time of analysis (no CISA KEV listing).

Memory corruption in the legacy USB CDC virtual COM (vcom) driver shipped in RT-Thread through 5.3.0 lets a physically connected USB host trigger writes past the serial ring buffer and, on port close, an invalid rt_free(), causing denial of service on the affected device. Only builds that include components/legacy/usb/usbdevice/class/cdc_vcom.c and enable RT_USING_SERIAL_V2 are exposed; exploitation requires physical USB access (CVSS 3.1 AV:P, PR:N), and impact is limited to availability with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited, so this is a medium-severity, low-operational-priority item for most environments; an upstream fix exists (PR #11770 / commit ceef6e0c).

Out-of-bounds write in Samsung Android's libsmkvextractor.so media parsing library allows a local attacker to corrupt memory by supplying a crafted Matroska (MKV) file, resulting in low integrity and availability impact. Affected are Samsung devices running firmware prior to SMR Oct-2026 Release 1; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium). The attacker requires local access but no special privileges, and the flaw does not compromise confidentiality or change scope.

Out-of-bounds write in Samsung Android's libcodec2-sec-flacdec.so FLAC decoder allows a local attacker to write memory beyond the intended buffer, degrading integrity and availability of the affected device process. The issue affects devices running firmware prior to SMR Oct-2026 Release 1, and exploitation requires local access plus the ability to push attacker-controlled FLAC data into the codec path, typically through a malicious or compromised app. There is no public exploit identified at time of analysis, and the vendor-assigned CVSS 4.0 base score of 5.1 (bounded to low integrity and low availability impact with no confidentiality loss) places this in routine monthly-patch priority rather than emergency response.

An out-of-bounds stack write in the Zephyr RTOS Goodix GT9xx touch driver (drivers/input/input_gt911.c) lets a malicious or misbehaving I2C touch controller overwrite up to 112 bytes of the gt911_process() stack frame with attacker-chosen data running at kernel privilege, potentially hijacking control flow on the host microcontroller. Only systems built with the GT9xx driver are affected, and reaching the defect requires physical/local access to the I2C bus (AV:P) - there is no network, USB, or syscall path - most plausibly on boards where the panel is a pluggable display module or shield rather than a soldered part. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the fix is a small one-line clamp and the same overflow can occur non-adversarially with a GT9271-class panel or a single corrupted status byte.

Use-after-free in GPAC's filter queue (gf_fq_pop in filter_core/filter_queue.c) allows an attacker who supplies a crafted MP4/media file to crash or corrupt memory in MP4Box builds through 26.07.0. Exploitation is not confirmed in the wild (no CISA KEV entry), but publicly available exploit code exists (the PoC archive linked from the VulDB report), and per the independent assessment the realistic attack path is local/UI-driven: the victim or an automated transcoding pipeline must feed the malicious file to MP4Box, with the impact limited to Low confidentiality, integrity and availability (crash or constrained memory corruption, not confirmed code execution). Because there is no listening network service and user interaction is required, this is a low-priority issue despite the 'remote' framing used in the vendor-style CVSS 4.0 vector.

Use-after-free in GPAC's MP4Box media packaging tool (all builds through 26.07.0) can be triggered when the utility parses a malformed or attacker-supplied media file, corrupting memory in the affected process. The fault lives in the gf_mx_v() helper in utils/os_thread.c and is reached through the file-parsing path, not through any listening network service, so exploitation requires someone or an automated pipeline to run MP4Box on the hostile input. Publicly available exploit code exists (a PoC archive is linked from the advisory), the vendor was contacted early but did not respond, and there is no indication of active exploitation (no CISA KEV listing); impact is limited to availability of the processing process rather than confidentiality or integrity of the host.

MongoDB C Driver contains an off-by-one heap write in its BSON bulk document writer that can corrupt adjacent memory or crash the process when a serialized document ends at a precise buffer boundary. This medium-severity (CVSS 4.0 base 5.9) issue requires an embedding application to use the BSON bulk-writer API and an attacker to influence document sizes to hit that exact cumulative boundary; the local, unauthenticated attack is difficult to trigger and writes only a single zero byte, so the realistic impact is process termination or limited heap corruption rather than code execution. No public exploit code or active exploitation has been identified at the time of analysis.

Heap out-of-bounds write in Mutt's convert_file_from_to() charset conversion routine can be triggered when a user adopts an attacker-supplied email message as a composition template, letting a crafted Content-Type header drive the conversion past the end of an allocated buffer. Exploitation is local and user-driven: the victim must deliberately invoke the template workflow on the malicious message (CVSS 3.1 AV:L/AC:H/PR:N/UI:R, base score 2.5; the internal assessment results in the same base metric group with a Low rather than None availability impact), and favorable memory conditions are needed for the out-of-bounds write to occur reliably. Mutt versions up to and including 2.4.2 are affected per EUVD, no public exploit has been identified at time of analysis, and no vendor-released patch version is confirmed in the available data.

Out-of-bounds memory access in the phalFelica module of NXP NXPNfcRdLib on RC663-based NFC reader deployments (versions through 07.14.00_Pub) can corrupt or expose memory when an API caller supplies values that the library fails to bounds-check, resulting in limited loss of confidentiality, integrity, and availability. Exploitation requires local access with high privileges and high attack complexity per the assessed CVSS vector (AV:L/AC:H/PR:H), so there is no remote or unauthenticated path, and no public exploit has been identified at time of analysis. The issue is rated low severity (CVSS 3.9) and is remediated in NXPNfcRdLib 07.18.00 and later, making patching straightforward for teams able to update the library.

Heap use-after-free in m17n-lib's input-method handling allows a local user who supplies specially crafted text to an application using m17n-based input engines to crash that application, producing a denial of service; arbitrary code execution is described as a potential, unverified outcome rather than a demonstrated one. The flaw is rated CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so exploitation is local with no privileges required (PR:N) and no user interaction, and the only confirmed impact is availability loss with no confidentiality or integrity effect. Red Hat tracks the issue for Red Hat Enterprise Linux 6 through 10, and no public exploit code or confirmed active exploitation was identified at time of analysis.

A use-after-free (CWE-416) in Qualcomm Snapdragon's DMA buffer management allows a local attacker with low privileges to corrupt kernel memory by triggering a race condition between concurrent DMA buffer allocation and deallocation, potentially leading to code execution or privilege escalation. The vulnerability is not remotely exploitable and requires winning a timing window (AC:H). No public exploit code or active exploitation has been identified at time of analysis; the vendor rates the required privileges as high (PR:H), but independent assessment indicates low privileges (PR:L) may be sufficient.

Memory corruption in the Qualcomm Snapdragon camera driver path that handles operations during driver updates allows a locally positioned attacker who already holds high privileges to trigger an out-of-bounds write (CWE-787) and corrupt memory, with the potential for high confidentiality, integrity, and availability impact on the affected device. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), this is a moderate-severity local privilege/memory-corruption issue rather than an internet-facing emergency; there is no public exploit identified at time of analysis and no CISA KEV listing, and exploitation is gated by the strict prerequisites of local access plus pre-existing elevated privileges and a driver-update code path. Exact affected chipset families and driver configurations are not enumerated in the available data, so Qualcomm's October 2026 security bulletin should be treated as the authoritative scope statement.

Local attackers with high privileges can trigger an out-of-bounds write in the Qualcomm Snapdragon camera CRE (Camera Request Engine) driver, causing memory corruption during hardware update preparation. Tracked as CVE-2026-25272, the flaw requires local access and elevated permissions (PR:H) to invoke the vulnerable driver operation, but successful exploitation yields high confidentiality, integrity, and availability impact confined to the affected device subsystem (scope unchanged). No public exploit code or confirmed active exploitation has been identified at time of analysis.

Out-of-bounds write in the Qualcomm Snapdragon Android Camera driver allows a locally privileged process to corrupt memory by submitting command buffer requests carrying invalid length parameters, potentially achieving code execution or memory corruption within the driver's execution context on affected devices. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires local access and an already-privileged process capable of reaching the camera driver interface, making this realistically a post-compromise privilege-escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis. The CPE entry (cpe:2.3:a:qualcomm,_inc.:snapdragon:*) carries no version constraint, so the exact affected chipset and firmware coverage must be resolved from Qualcomm's October 2026 security bulletin.

Memory corruption in the Qualcomm Snapdragon camera subsystem can be triggered by processing camera requests with excessive batch and IO buffer configurations that exceed allocated memory, resulting in an out-of-bounds write (CWE-787). All versions of Qualcomm Snapdragon platforms are affected according to the vendor CPE. Exploitation requires local access with high privileges (PR:H) and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis, making this a moderate-priority issue for systems where an attacker already has privileged on-device code execution.

Qualcomm Snapdragon kernel driver IOCTL handling contains a memory corruption (out-of-bounds write) that a local attacker with low-privilege code execution can trigger by supplying invalid parameters, leading to potential integrity impact and denial of service. This is a moderate-severity local issue (CVSS 6.6) rather than a drop-everything priority. No public exploit code or active exploitation has been identified at time of analysis.

SSSD's NFS idmap plugin contains an out-of-bounds write (CWE-787): when a cached user or group name is larger than the destination buffer it is copied into, the size check fires but the copy proceeds anyway. An authenticated, low-privileged local attacker can request identity lookups that resolve to such oversized cached entries, crashing the identity-mapping service (denial of service) and potentially corrupting adjacent process memory; the attack is local-only and depends on the oversized-cache precondition, giving it high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, 5.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.

Boot-time arbitrary code execution is possible on AMD Versal Adaptive SoCs and related Alveo accelerator cards, but only when USB boot mode has been enabled through physical board modifications - a configuration AMD explicitly describes as non-default. A crafted boot image delivered over USB can trigger an out-of-bounds write (CWE-787) that overflows a buffer and overwrites an active function pointer, yielding high confidentiality, integrity, and availability impact confined to the boot process. Because exploitation requires both physical access to the device and a deliberately modified board, plus a non-trivial (high-complexity) overflow, realistic risk is limited to supply-chain, manufacturing, or evil-maid scenarios; no public exploit identified at time of analysis, and no confirmed in-the-wild activity, though the vendor bulletin AMD-SB-8028 documents the issue.

Zabbix Server and Proxy can be crashed by a crafted binary item value containing a NULL byte, causing loss of monitoring availability on deployments that use MySQL or MariaDB as the Zabbix backend database. Exploitation is not anonymous: the CVSS vector (PR:L) indicates an authenticated, low-privileged user able to submit binary item values is required, and the attack additionally depends on a specific input condition (AT:P), which is why the vendor-assigned severity is low (CVSS 4.0 base 2.3) and our independent assessment matches at CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); impact is confined to availability, with no confirmed data exposure, integrity loss, or code execution.

Out-of-bounds write in vgmstream up to r2117 lets a crafted TXTP playlist (or a related TXTH/VAB config or name-table file) overflow fixed-size stack buffers when parsed, corrupting memory in any vgmstream-based player, plugin, or library build that loads the file. The flaw sits in the parse_params/txtp_parse routines of src/meta/txtp_parser.c, where sscanf conversions used unbounded '%[^...]' scans without field-width limits; the trigger is an over-length key, value, or command token. Exploitation is unauthenticated but requires the victim to deliberately open the malicious file (UI:P per CVSS 4.0, UI:R per the assessed CVSS 3.1 vector), and no public exploit code has been identified at time of analysis; the issue is rated 5.3 (CVSS 4.0) and low-to-moderate priority, consistent with a client-side parsing fault that exposes no network service.

Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.

Local privilege escalation in MediaTek's mtee (MediaTek TEE) allows an attacker who already holds System privilege to exploit a missing bounds check, causing an out-of-bounds write that can elevate privileges on affected MediaTek chipsets. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and affects 25 listed MediaTek chipset models including MT8196, MT6768, MT6769, MT6833, MT6877, MT8186, and MT8188. No public exploit code or active exploitation has been identified at time of analysis.

Local privilege escalation in MediaTek mtee allows a local attacker who already holds Android System privilege to exploit a CWE-843 type confusion and elevate code execution on affected MediaTek chipsets; user interaction is not required. The flaw is local-only (AV:L) and requires high privileges (PR:H), so it cannot be used for initial access or remote compromise and is primarily useful as a chain component after an attacker has already obtained a System-level foothold. MediaTek has published Patch ID ALPS11383899 in its October 2026 bulletin, and no public exploit identified at time of analysis.

Local privilege escalation in MediaTek's vdec (video decoder) component allows an attacker who already holds System privilege on an affected chipset to supply crafted input that triggers a type-confusion-driven out-of-bounds write, corrupting memory and achieving high confidentiality, integrity, and availability impact at a higher privilege level. The issue affects 24 MediaTek SoCs including MT8395, MT6833, MT6789, MT8195, MT6877, MT8189, MT8391, MT8676, MT8678, MT8793, MT8799, MT6855, MT8367, MT8781, MT8196, MT8910, MT8668, MT8188, MT8792, MT6769, MT6768, MT8186, MT8788E, and MT2718, across mobile, tablet, and embedded platforms. Exploitation is local only, requires the System-privilege prerequisite, and needs no user interaction; the CVSS 3.1 base score is 6.7 (MEDIUM) and no public exploit was identified at time of analysis, so the practical risk is a post-compromise escalation primitive rather than a remote entry point.

Local privilege escalation in MediaTek's meta component affects numerous MediaTek chipsets (including MT6789, MT6895, MT6985, MT8195, and others listed in EUVD-2026-92196) and allows an attacker with physical access to the device to trigger an out-of-bounds write due to a missing bounds check, achieving high confidentiality and integrity impact. No authentication, existing execution privileges, or user interaction are required once physical access is obtained. No public exploit has been identified at time of analysis; the physical access prerequisite limits remote exploitation and confines realistic abuse to scenarios such as lost or stolen devices, border inspection, or supply-chain tampering.

Use-after-free memory corruption in MediaTek's apusys driver allows a local attacker who has already obtained Android System privilege (uid system) to escalate to kernel-level code execution on affected devices, with no user interaction required once that foothold exists. The flaw affects firmware running on a broad set of MediaTek SoCs - including MT6897, MT6899, MT6989, MT6991, MT8196, MT8678 and the other MT-series chipsets listed in MediaTek's October 2026 bulletin - and is addressed by Patch ID ALPS11076799 (Issue ID MSV-8143). Because the CVSS vector carries PR:H and AV:L, this is a second-stage privilege-escalation link that presupposes a prior System-level compromise rather than a standalone remotely reachable bug; no public exploit code or confirmed active exploitation was identified at time of analysis.

Local privilege escalation in MediaTek AIDL on affected chipsets is possible via a use-after-free memory corruption, but only after an attacker has already obtained Android System privilege and local access. Successful exploitation requires no user interaction and can yield high confidentiality, integrity, and availability impact within that privileged context. No public exploit identified at time of analysis; the vendor patch ID ALPS11185225 and the October 2026 MediaTek security bulletin address the issue.

Local privilege escalation in the aidl component shipped on a defined set of MediaTek chipsets (MT6899, MT6991, MT8910, MT8781, MT6881, MT8668, MT6989, MT8188, MT6878, MT6993, MT8695, MT8189, MT8696) allows a process that already holds Android System privilege to trigger a use-after-free, corrupt memory, and gain higher-integrity code execution with high confidentiality, integrity, and availability impact. The attack is local (AV:L) and needs no user interaction, but the PR:H prerequisite means it cannot be used for initial access and only functions as a follow-on escalation from an already-compromised privileged context. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS data was not supplied for this CVE. MediaTek has published a fix under Patch ID ALPS11242428 in its October 2026 Product Security Bulletin.

Local privilege escalation in the MediaTek display component lets a process that already holds System privilege trigger an out-of-bounds write in a display-path buffer, corrupting memory and potentially escalating to higher-level code execution with high impact to confidentiality, integrity, and availability. The defect is a missing bounds check (CWE-787) reachable without user interaction and with low attack complexity, but only from an existing System-privileged, on-device context (CVSS 3.1 6.7 Medium, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it functions as a second-stage escalation primitive rather than an initial-access or remote vector. Affected hardware spans a broad set of MediaTek chipsets including MT6991, MT6993, MT2718, MT8168-class MT8668/MT8678, MT8171, MT8188, MT8189, MT8196, MT8793, and MT8126; MediaTek has issued Patch ID ALPS11292777 (issue MSV-9195) and no public exploit code has been identified at time of analysis.

Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT6768, MT6853, MT6893, MT6991, MT8186, MT8188 and MT8196) allows an attacker who already holds System privilege to trigger an out-of-bounds write through a missing bounds check, yielding high impact to confidentiality, integrity and availability. No user interaction is required once System access is held, and the flaw is reachable in default configurations of the listed chipsets, making it a post-compromise escalation rather than an initial foothold; the CVSS 6.7 score is dominated by the PR:H prerequisite. A vendor patch is available under MediaTek's October 2026 Product Security Bulletin (patch ID ALPS11276677, issue MSV-9217), and no public exploit code or confirmed active exploitation has been identified at time of analysis.

An out-of-bounds read/write flaw in MediaTek's ccci (cross-core/modem control) component allows an authenticated local attacker who already holds System privilege to corrupt memory, potentially leading to information disclosure, crashes, or further privilege escalation. Exploitation requires local access and, per the vendor description, user interaction - though the vendor CVSS vector omits UI:R - and is limited to specific MediaTek chipsets (MT6880, MT6890, MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988, MT2735, MT2737). No public exploit code has been identified, SSVC reports exploitation: none and not automatable, making this a high-severity but low-urgency issue due to its high-privilege prerequisite.

Heap-based out-of-bounds write in the boks_ksllogsd logging daemon of Fortra BoKS Manager / BoKS Server allows an authenticated KSL client to corrupt memory by placing an oversized but OpenSSL-recognized digest name in the MD field of a KSL start message. The daemon validates that OpenSSL recognizes the supplied digest name but does not confirm that the name fits the fixed 16-byte checksum context field before copying, so an over-long value is written past the end of the heap allocation (CWE-787; CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Because the attacker must already hold KSL client credentials and the written content is constrained to valid digest-name strings, the practical result is a crash or memory corruption of the logging service rather than reliable remote code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a moderate-priority availability risk pending a vendor fix.

Heap-based buffer overflow in the tnef command-line TNEF (winmail.dat) extractor allows a crafted TNEF file with a large number of colliding attachment filenames to overflow the numeric-suffix counter used by find_free_number(), producing a crash and denial of service; arbitrary code execution is theoretically possible but unproven. The bug only triggers under a non-default configuration in which numbered backups are enabled while file overwriting is disabled, and it requires the victim to actually run tnef against the malicious file (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L, base 3.1), so no public exploit code has been identified at time of analysis and real-world risk is low despite the RCE and memory-corruption tags attached to this report. Impact is limited to availability; there is no confidentiality or integrity impact in the assessed vector.

Extracting a specially crafted Transport Neutral Encapsulation Format (TNEF, "winmail.dat") file that contains multiple message bodies can crash the tnef utility through a use-after-free and double-free in its memory handling. The flaw is remotely reachable without credentials (PR:N), but exploitation depends on the malicious file actually reaching a tnef parsing step, which requires user interaction such as opening an email attachment or an automated mail gateway decoding it (UI:R). Impact is confined to availability - our independent assessment rates this as a modest-severity denial of service (A:L) rather than the vendor's higher 6.5 score, and no public exploit code and no confirmed active exploitation were identified at time of analysis.

A heap buffer overflow in Mozilla Thunderbird occurs when a user opens an email message of 2GB or larger in size, allowing the overflowing write to corrupt memory and crash the client. The assessed CVSS vector (6.1, AV:L/AC:L/PR:N/UI:R) shows the attack is local and requires the victim to actively open the oversized message, with impact limited to availability (crash) and low integrity, and no confidentiality loss; no public exploit code or confirmed active exploitation (CISA KEV) is associated with this issue, and EPSS is low at 0.19% (8th percentile). The flaw is fixed in Thunderbird 157, and the real-world risk is further constrained because mail servers and gateways typically reject or truncate messages of that size before they ever reach the client.

Use-after-free in the NVIDIA GPU Display Driver kernel module (CVE-2026-47586) allows an attacker with local access to the GPU device on Windows or Linux to corrupt kernel memory, with potential outcomes including code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vendor CVSS vector (AV:P/AC:H/PR:N) is anomalous - designating physical access and no privileges - while the independent assessment uses AV:L/AC:H/PR:L, indicating that exploitation is not remotely triggerable and instead depends on winning a timing/command-sequence race after obtaining local low-privileged access to the driver. No public exploit code or confirmed active exploitation is identified at time of analysis, and exploitation signals point to a low-to-moderate real-world priority despite the memory-corruption impact.

An out-of-bounds write in the firmware component of the NVIDIA GPU Display Driver for Windows and Linux lets a local attacker who already holds administrator or root privileges corrupt memory, with potential outcomes spanning code execution, escalation of privileges, denial of service, information disclosure and data tampering. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-787), the flaw affects GeForce, RTX/Quadro/NVS and Tesla products; exploitation requires local access to the host plus high existing privileges, and no public exploit code was identified at time of analysis, so real-world risk is moderate rather than urgent. No user interaction is required and there is no network attack path, which rules out remote exploitation entirely.

Out-of-bounds write in the NVIDIA GPU Display Driver for Linux kernel mode layer allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, potentially achieving code execution, privilege escalation, denial of service, information disclosure, or data tampering. Affected driver branches cover GeForce, RTX/Quadro/NVS, and Tesla products below the fixed versions listed in NVIDIA's advisory, and the attack surface is local-only, so real-world risk is assessed as MODERATE-LOW. No public exploit identified at time of analysis.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, with the potential for code execution, privilege escalation, information disclosure, denial of service, and data tampering. Affected installations are those running GeForce, RTX/Quadro/NVS, or Tesla display drivers at versions below the fixed release for their branch (for example prior to 610.88, 582.78, 616.92, or 580.178.04), on either Windows or Linux. The CVSS 3.1 base score of 6.7 reflects the non-network, high-privilege access prerequisite rather than broad exposure; no public exploit code has been identified at time of analysis.

A kernel-mode out-of-bounds write in the NVIDIA GPU Display Driver for Linux lets a local attacker who already holds high privileges corrupt kernel memory in the driver's kernel mode layer, which the vendor states may lead to code execution, denial of service, privilege escalation, information disclosure and data tampering. The flaw carries a CVSS 3.1 base score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is strictly local and requires pre-existing elevated/administrative access on the host; there is no network attack vector and no user interaction is needed. Affected systems are Linux hosts running GeForce, RTX/Quadro/NVS or Tesla driver branches below the fixed releases published in NVIDIA security bulletin 5861, and there is no public exploit identified at time of analysis.

Kernel-mode out-of-bounds write in NVIDIA GPU Display Driver for Windows and Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) allows a local attacker with high privileges to corrupt kernel memory, potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering. No public exploit has been identified at time of analysis. Affected driver branches include GeForce prior to 595.91.07, RTX/Quadro/NVS prior to 596.86, Tesla prior to 616.92, and vGPU guest drivers prior to vGPU 19.5/20.1, among others.

An out-of-bounds write in U-Boot's Android boot method (boot/bootmeth_android.c) lets someone with physical access to a device boot from crafted media whose boot image header declares a size larger than the containing partition, causing U-Boot to write past its load buffer into bootloader memory before 2026.10-rc3. Only devices that actually use the Android bootmeth and do NOT have Android Verified Boot (AVB) enabled are exposed, since AVB rejects the tampered image; authentication requirements are not confirmed from available data, but the assessed vector is CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H and there is no public exploit identified at time of analysis, nor any CISA KEV listing. The practical risk is low-priority: exploitation is gated on physical possession of the device plus an unprotected boot chain, and impact is limited to integrity and availability of the bootloader rather than confidentiality or a remote attack path.

Out-of-bounds write in the U-Boot bootloader's RLE8-compressed BMP decoder (video_display_rle8_bitmap in drivers/video/video_bmp.c) lets an attacker who can place or modify a crafted splash/logo image write past the framebuffer, corrupting adjacent memory and crashing the bootloader. All U-Boot versions through 2026.10-rc5 are affected per the wildcard CPE, but exploitation is genuinely constrained: the platform must actually route an attacker-controlled BMP through the BMP display path, which in typical deployments means write access to boot media, the splash partition, or the environment-configured image source, and the outcome is primarily availability loss with only limited integrity impact and no confidentiality exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is moderate rather than critical despite the headline score.

Memory corruption in PyPy's pyexpat module can be triggered by a crafted XML document processed through an external-entity sub-parser, because the child parser keeps a raw C back-pointer to a parent parser struct that PyPy's tracing garbage collector may free while the child is still in use, causing bundled libexpat to dereference freed memory on parsed tokens. Affected builds are PyPy releases prior to 3.11.16 and 3.12.14; the flaw is remotely reachable and unauthenticated (CVSS vectors carry PR:N), but exploitation depends on a specific application coding pattern - creating ExternalEntityParserCreate sub-parsers without retaining a reference to the parent parser - and on that code path processing attacker-supplied XML, which is the AT:P attack requirement in the CVSS 4.0 vector. That prerequisite is why the CVSS 4.0 score is 6.3 Medium with only integrity-low impact recorded, and no public exploit code or confirmed active exploitation was identified at time of analysis; vendor-released patches exist.

Mozilla Firefox before 157 can disclose sensitive process memory to a remote, unauthenticated attacker who persuades a user to load a crafted JavaScript page, because the browser's JavaScript JIT compiler can miscompile code and trigger a type-confusion condition. Exploitation requires user interaction (the victim must visit or be redirected to attacker-controlled content), and impact is limited to confidentiality within the content process; Mozilla fixed the issue in Firefox 157, and no public exploit code has been identified at the time of analysis, with EPSS at 0.15% (4th percentile).

Denial of service in Wireshark 4.6.0 through 4.6.8: a use-after-free in the ZigBee ZCL (ZigBee Cluster Library) protocol dissector causes the application to crash when a malformed ZCL packet is dissected. The attack vector is local and requires user interaction - an analyst must open a crafted capture file or live-dissect malicious ZigBee traffic (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), and impact is limited to availability, with no code execution, data disclosure, or tampering reported. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is constrained by the need for the malformed packet to actually reach the ZigBee/ZCL dissector on a machine running an affected build.

An out-of-bounds write in the printf builtin of the dash shell allows a local user to corrupt one or two bytes past a four-byte reservation when a crafted Unicode \u or \U escape expanding to a five- or six-byte token is processed, including via 'dash -c' with the escape passed as a positional argument to printf or 'echo %b'. The flaw affects dash as shipped in Red Hat Enterprise Linux 6 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_6) and is rated CVSS 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No public exploit code was identified at time of analysis, and the bounded write stays within the caller's own shell process, so it provides no inherent privilege escalation.

Repeated network-interface link-down events can crash or reset devices running Zephyr RTOS v4.3.0 that keep a listening TCP socket open, because the BSD-socket layer parks a pending errno value in the net_context user_data field while the TCP core simultaneously expects that field to hold a parent context pointer; a second interface-down event forwards the stale integer to zsock_accepted_cb(), which dereferences it as a pointer and writes through it, producing a wild-pointer access and a kernel fatal error (denial of service, not attacker-directed memory corruption). The flaw is reachable by unauthenticated adjacent attackers who can force the link down repeatedly (CVSS 3.1 AV:A/AC:L/PR:N/UI:N, 6.5, availability-only impact), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Zephyr v4.3.1 and v4.4.x carry a follow-up change that clears the accept callback after the error path, reducing the issue to a narrow handshake-versus-interface-down race plus an unconditional getsockopt(SO_ERROR) read-back of the kernel pointer stored in user_data, so those lines are far less practically exploitable than v4.3.0.

Out-of-bounds write in FastStone Image Viewer through 8.3 lets an attacker corrupt memory - and potentially achieve code execution - when a victim opens or previews a crafted 1bpp RLE image, with impact rated Low across confidentiality, integrity, and availability (CVSS v3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerable component is the viewer's 1bpp RLE decoder, reachable remotely only through user-initiated file opening, so exploitation requires social engineering or a drive-by download against Windows desktop users rather than any server-side reach; the CVSS v4.0 vector carries an exploit-maturity metric of Proof-of-Concept (E:P), meaning publicly available exploit code exists per that metric, although the independent assessment found no linked working exploit and the issue is not listed in CISA KEV. The vendor was contacted early but did not respond and no patch is available, so priority is LOW-to-MEDIUM with risk mitigated primarily by user-interaction requirements, client-side-only triggering, and consumer desktop deployment.

Out-of-bounds write in FastStone Image Viewer up to version 8.3 allows remote attackers to corrupt memory when a user opens or previews a crafted TGA image file. The vulnerability requires user interaction (UI:P/UI:R) and is rated CVSS 4.0 5.3 (moderate severity). Publicly available exploit code exists (indicated by E:P in the CVSS vector), but no evidence of active exploitation in the wild; the vendor was contacted but did not respond, and no patch is available.

Memory-safety defect in Meta's Proxygen C++ HTTP library lets the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream callbacks return stream handles that the stream handler had already freed, after which HQSession installs those stale handles as transport read callbacks and can read through freed memory. Only servers built on affected releases (v2024.10.28.00 up to but not including v2026.09.28.00) that actually enable and terminate WebTransport over HTTP/3 are exposed; remote, unauthenticated peers able to drive that stream-setup path can trigger the fault, but the assessed impact is availability only (CVSS 5.3, A:L, no C/I loss) and reliable triggering depends on winning the free-then-reuse timing window. No public exploit code has been identified and there is no confirmed active exploitation; EPSS is very low at roughly 0.14% (3rd percentile).

A supervisor-mode out-of-bounds write exists in the Zephyr RTOS 802.15.4 L2 transmit path: ieee802154_send() copies packet data into a fixed 125-byte frame buffer without validating the packet length on the unfragmented code path. On builds with CONFIG_NET_L2_IEEE802154_FRAGMENT (enabled by default with CONFIG_NET_6LO), local code that opens a NET_AF_PACKET socket (NET_SOCK_RAW, which skips the 6LoWPAN encoder, or NET_SOCK_DGRAM, which returns early on the address-family check) bound to an 802.15.4 interface can send a payload larger than IEEE802154_MTU and corrupt memory adjacent to the transmit buffer pool, causing a crash or further compromise of kernel state. The flaw is not reachable from the radio because ieee802154_6lo_encode_pkt() length-checks IPv6 packets and forces fragmentation; in a CONFIG_USERSPACE build an unprivileged thread can reach it through the zsock_socket()/zsock_sendto() syscalls, though the overrun is bounded to roughly ll_hdr_len + 3 bytes with the default fixed-size net_buf configuration. No public exploit code was identified at time of analysis and the vendor patch is available (commit 3d4c6177d2dbd77d12d9b14cd75a00cdbd826227).

Out-of-bounds write in Trusted Domain Project OpenDKIM through 2.11.0 allows remote, unauthenticated attackers to corrupt memory by sending a crafted DKIM-Signature header whose h= signed-headers tag is manipulated before it reaches dkim_canon_selecthdrs during canonicalization. The practical impact is expected to be a milter crash or mail-flow denial of service, with confirmed memory corruption rather than proven code execution, and the independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L while the supplied CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N. Publicly available exploit code exists for this issue, and no vendor-released patch was identified at time of analysis; the vendor was contacted and reportedly did not respond.

Heap use-after-free in wolfSSL's (D)TLS shutdown path can crash or corrupt memory in applications that leave decrypted application data buffered (typically after a wolfSSL_read() with a small user buffer), then call wolfSSL_shutdown() for a bidirectional close, then call wolfSSL_read() again while the peer keeps sending data during shutdown. All builds that use (D)TLS, including default builds, are affected per the vendor's own advisory scope, and the defect was confirmed by wolfSSL in fix PR #10863, which ships a dedicated regression test (test_wolfSSL_shutdown_pending_data_uaf) reproducing the exact sequence. Impact is availability-only - no confidentiality or integrity effect is assessed - and the vendor rates it low severity (CVSS 4.0 2.3, with AC:H and AT:P), consistent with the independent assessment of CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:L; exploitation requires induced timing/state and an attacker who is the connected TLS peer (or a MITM positioned to keep sending during shutdown), and no public exploit identified at time of analysis.

Decompiling an attacker-crafted x86-64 binary in NSA Ghidra through version 12.1.4 can crash the decompiler helper process via a heap use-after-free in Funcdata::opInsertAfter, denying service to analysts and automated analysis pipelines. The vulnerability is triggered only when a victim actively loads and decompiles a malicious sample containing a specific instruction sequence that leaves stale INDIRECT effect-op references in the decompiler's internal P-code model; it is a local, user-interaction-required issue (CVSS 4.0 4.8; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:N/I:N/A:L) with no confidentiality or integrity impact. No public exploit code has been identified and there is no indication of confirmed active exploitation; the practical risk is a restartable crash of the helper process, not code execution or data compromise. Vendor patch data is available (upstream fix commit), and the flaw is classed as CWE-416 (use-after-free).

Use-after-free in the drag-and-drop source path of the kitty terminal emulator (versions 0.47.0 up to but not including 0.49.0) allows any program that controls the terminal's output byte stream to make the terminal read from and write to freed heap memory while the user is actively dragging content out of the window. The flaw lives in drag_remote_file_data() in kitty/dnd.c, which keeps a DragRemoteItem pointer into an array that the error path's cancel_drag()/drag_free_offer() teardown frees, then continues to dereference and write through it; per the assessed vector this is a local, user-interaction-required issue (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) with integrity and availability impact only and no confidentiality impact, matching the vendor's low 4.6 CVSS 4.0 base score. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV); a vendor patch is available in kitty 0.49.0.

Opening a crafted Gnumeric workbook can trigger a heap use-after-free (CWE-416) during XML parsing of a malformed SheetObjectComponent element, crashing the application and causing a denial of service. This affects GNOME Gnumeric across versions (CPE: cpe:2.3:a:gnome:gnumeric:*:*:*:*:*:*:*:*). The vulnerability requires local access and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), and no public exploit identified at time of analysis.

A stack (or heap) out-of-bounds write in kitty terminal versions 0.40.0 up to but not including 0.49.0 allows any program that can emit escape sequences to the terminal to corrupt a fixed-size four-codepoint buffer while rendering an OSC 66 text-sizing sequence, crashing the kitty process and taking down every window, tab, and child process with it. The flaw is in screen_handle_multicell_command(), which appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without a capacity check in the natural-width branch of the text sizing protocol; a payload carrying a grapheme cluster longer than four codepoints writes one 32-bit value past the buffer for each additional codepoint. Exploitation is local and requires the user to view attacker-influenced terminal output (PR:N, UI:R); the impact is confined to availability - no confidentiality or integrity effect and no evidence of code execution. Vendor-released patch: 0.49.0; no public exploit identified at time of analysis.

A use-after-free in the Linux kernel's drm/msm driver (Qualcomm Adreno GPU support) can be triggered when a hung GPU submit is retired before hardware recovery completes, freeing buffer objects that the GPU may still be actively reading and producing GPU pagefaults and a kernel crash. Affected are Linux systems built with the msm DRM driver - predominantly Android devices and ARM/Snapdragon Linux platforms - where a locally authenticated user able to submit GPU command buffers can drive a submit into the hang path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5, availability-only). There is no public exploit identified at time of analysis, EPSS is a low 0.15% (4th percentile), and the issue is not listed in CISA KEV; vendor fixes exist in Linux 6.18.52, 7.2.6, and 7.3-rc1.

An out-of-bounds write in the Linux kernel's mt76 driver for MediaTek MT7921 Wi-Fi chipsets (wifi: mt76: mt7921 CLC record validation) allows a local attacker with existing privileges to corrupt kernel memory by supplying a malformed CLC firmware image whose region count or per-record length is attacker-controlled. The bug is a missing-bounds-check issue (CWE-787) during CLC region parsing on firmware load: the region-table pointer can be forced to precede the firmware buffer, the record loop can fail to advance, or an index can run past the end of phy->clc. The assessed impact is availability-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) with EPSS of 0.16% (4th percentile) and no public exploit identified at time of analysis; it is not listed in CISA KEV, and a vendor patch is available.

Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network segment to submit crafted command data that writes past the bounds of an allocated buffer, potentially corrupting authentication state or terminating the affected process so the device restarts. The result is a temporary denial of service - the device becomes briefly unavailable while it reboots - with no demonstrated path to code execution, privilege escalation, or data disclosure (CVSS 4.0 base 6.9; availability-only impact, adjacent vector, low privileges required, no user interaction). No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the KEV catalog; the issue is reported by ICS-CERT in advisory ICSA-26-267-01.

Incorrect type casting in the Perl DBI module's internal DBI::sql_type_cast routine can cause incorrect conversion results, a crash, or a limited memory over-read when an affected application invokes that routine on a Perl scalar holding an internal integer (IV) or numeric/double (NV) value that an attacker can influence. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates a local, high-complexity attack requiring low privileges and no user interaction, with only low confidentiality, integrity and availability impact, and no public exploit code was identified at time of analysis. The entry is extremely data-sparse - no CVSS score or vector, no CWE, no EPSS, no CISA KEV listing and no POC were supplied - so the only substantive artifacts are a commit-message-style fix title ('Fix DBI::sql_type_cast on IV/NV') and a vendor report from Ubuntu, meaning exploitability depends entirely on whether a specific DBD driver or application actually reaches the affected code path with attacker-controlled input.

Parsing attacker-controlled iCalendar data containing a parameterized property in libical 4.0.6 can terminate the consuming process, because icalparameter_string_to_kind() passes an incompatibly-cast comparator to bsearch(); the same defect exists in the libicalvcard path via vcardparameter_string_to_kind(). No authentication is required (CVSS PR:N) and no user interaction is encoded (UI:N), but exploitation hinges on the target being built with Control Flow Integrity enforcement or a function-pointer-type sanitizer, since type-confusion callbacks usually execute without aborting on ordinary non-hardened distro builds, and in practice a library needs to be fed untrusted calendar content by an application that parses it automatically or on user action. Independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (input data lists 6.2 at AV:L), EPSS is only 0.17% (5th percentile), and no public exploit code has been identified at time of analysis; the issue is best characterized as a low-priority, high-noise type-confusion defect rather than a broadly exploitable denial-of-service vector.

Out-of-bounds write in BusyBox's passwd and group applets allows an authenticated attacker with high privileges (PR:H) to corrupt heap memory via a stale endpoint pointer after field trimming. The vulnerability (CVSS 6.7, CWE-787) is local-only (AV:L), requires no user interaction (UI:N), and is confined to the host (S:U), meaning a would-be attacker must already hold root or equivalent privileges to supply the malformed passwd/group entry. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was provided; the primary limiting factor is the PR:H requirement, which makes this a defense-in-depth hardening issue rather than a remotely reachable attack.

Heap-based out-of-bounds write in Foxit PDF Editor/Reader allows attackers to corrupt memory when a victim opens a PDF containing a crafted WebP image, potentially leading to code execution or a crash. The flaw stems from improper handling of bitmap stride and target buffer formats (CWE-787) and requires user interaction to open the malicious file (CVSS 7.8, AV:L/PR:N/UI:R). No public exploit code or active exploitation has been identified at time of analysis.

Opening a maliciously crafted PDF in Foxit PDF Reader or Foxit PDF Editor can crash the application through a use-after-free of an internal page object, because JavaScript that triggers reentrant page-event processing during annotation enumeration can free the page while a reference to it is still held. The vendor-approved CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is local, requires no authentication, and mandates user interaction - the victim must open the file - while our independent assessment scores the demonstrated impact as availability-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), i.e. a denial-of-service/crash rather than demonstrated code execution. Exposure depends on PDF JavaScript being enabled in the reader, a common default but a configurable setting; no public exploit code has been identified and the issue has not been added to CISA KEV, so this is not confirmed active exploitation.

Stack buffer overflow in LibreOffice's font subsetting path can crash the application and corrupt memory when a document containing an embedded CFF font is exported to PDF. The vulnerable routine converts CFF (Compact Font Format) glyphs to Type 1 operators during subsetting and writes them into a fixed-size stack buffer without verifying remaining capacity, so a glyph that emits many operators overflows the buffer (CWE-787). Exploitation is local and requires the victim to open an attacker-supplied document and trigger the subsetting code path (typically a PDF export); the CVSS v4.0 base score is 5.4 with PR:N and UI:P, and despite a proof-of-concept maturity rating (E:P) indicating publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV). The most likely outcome is an application crash (VA:H) with limited confidentiality and integrity impact; headless or server-side document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.

Stack-based out-of-bounds write in LibreOffice's CFF font hint parser allows an attacker to corrupt memory and crash the application when a victim opens a document that embeds a maliciously crafted font. Affected are LibreOffice versions before the fix that checks the hint count against the array's actual capacity; exploitation requires the victim to open the crafted file (local vector, user interaction) and no authentication, with confirmed impact limited to a crash plus limited confidentiality/integrity effects-reliable arbitrary code execution is not demonstrated. No CISA KEV listing indicates active exploitation, but the CVSS 4.0 exploit maturity metric E:P indicates publicly available exploit code exists, so patching should be prioritized for users who handle untrusted documents.

Heap buffer overflow in LibreOffice Draw's PDF import path allows a crafted PDF to corrupt heap memory and crash the application when a victim opens or imports the document; the independent assessment rates confidentiality and integrity impact as low but availability impact as high, making denial of service the most realistic outcome. Exploitation requires local delivery and mandatory user interaction, and no authentication or non-default configuration is needed because PDF import is a standard feature. Publicly available exploit code exists per the CVSS 4.0 E:P metric, but there is no confirmed active exploitation (no CISA KEV entry); no EPSS score was provided.

Heap-based buffer overflow in LibreOffice's PDF import filter, reachable through LibreOffice Draw, can crash the application or corrupt heap memory when a victim opens a specially crafted encrypted PDF whose encryption dictionary declares a decryption-key length larger than the fixed-size key buffer the importer fills. Exploitation is local and requires user interaction (AV:L, UI:P/UI:R, PR:N per the CVSS 4.0 vector; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), so there is no remote or unauthenticated network trigger and only encrypted PDFs reach the flawed code path; the impact skews heavily toward availability (VA:H) with limited confidentiality and integrity effects. There is no CISA KEV listing indicating confirmed active exploitation, but the supplied CVSS 4.0 vector carries an exploit-maturity metric of E:P, meaning publicly available exploit code exists at proof-of-concept level. This is a moderate-priority memory-corruption bug, not an urgent one, because delivery requires convincing a user to open a malicious encrypted file locally.

Heap buffer overflow in LibreOffice's WMF graphics import path affects documents embedding a crafted Windows Metafile, allowing a local attacker to corrupt memory when the victim opens the file. The flaw arises in a text record that carries its own character advance widths, where the count of advance values and the text length are read independently and need not agree, so rendering walks the advance array past its end when the array is shorter than the text. No public exploit code has been identified at time of analysis, and the impact profile is crash-dominant (confidentiality and integrity Low, availability High), making realistic outcomes denial of service rather than reliable code execution. EPSS is not provided, but exploitation requires the victim to open a malicious document (AV:L, UI:P), so real-world priority is assessed as low despite the MEDIUM CVSS of 5.4.

Use-after-free in Envoy's HTTP external-authorization (ext_authz) client crashes the proxy process with a SIGSEGV-class fault when the authorization response is processed after the request callback owner has already been destroyed. Envoy deployments running releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 that have enabled the HTTP ext_authz filter are affected; per the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9) an unauthenticated remote client needs only to send traffic that the external authorization service rejects, with triggering gated on a request-rejection-then-stale-callback timing window rather than a single deterministic request. Exploitation is not confirmed actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis; impact is availability-only, with no data exposure or code execution demonstrated.

Isochronous OUT stream handling in usbredir can leave a stream's single transfer buffer permanently unsubmitted when a transfer count of 1 is used, which defeats the bounds check in usbredirhost_iso_packet() and lets a usbredir peer write beyond the end of the packet descriptor array on every subsequent isochronous packet. The flaw is an out-of-bounds write (CWE-787) affecting usbredir as shipped in Red Hat Enterprise Linux 6 through 10, and the published CVSS:3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H, score 4.1) reflects a local, high-complexity, privileged trigger path whose dominant impact is availability loss rather than code execution. No public exploit identified at time of analysis, and the bug is not listed as confirmed actively exploited (CISA KEV); the realistic risk is materially lower than the raw memory-corruption classification suggests.

An out-of-bounds write of up to 895 bytes into static (.bss) memory can be triggered in Zephyr RTOS's Intel SEDI IPM driver (drivers/ipm/ipm_sedi.c) when the peer processor sets a doorbell payload length larger than the 128-byte incoming_data_buf. The vulnerable path is reachable when an application has registered an IPM receive callback via ipm_register_callback(), the driver's normal mode of use, and requires a local, highly privileged attacker (CVSS PR:H) with host-side ISH driver-level or raw BAR access to the device's memory-mapped register window, plus a production image built without CONFIG_DEBUG so the HAL's DBG_CHECK length guard is compiled away. The result is kernel data-structure corruption and a crash primitive - the overflow clobbers the driver context's k_sem and k_mutex and adjacent static data - but the flaw is platform-specific and locally scoped, so it is a moderate, defense-in-depth-relevant issue rather than an urgent internet-facing emergency; no public exploit identified at time of analysis, and an upstream fix commit is available.

A use-after-free memory-safety flaw in Exim before 4.100.1 can crash the mail transfer agent process when the daemon is compiled against the GnuTLS TLS backend and configured with certain non-default TLS settings; once a vulnerable server is reachable over the network, no authentication (PR:N) or user interaction (UI:N) is required, but the CVSS vector reflects high attack complexity (AC:H) because the triggering configuration is unusual and non-default. The assessed impact is availability-only (C:N/I:N/A:L) - a crash or degraded service rather than code execution or data exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so practical risk is confined to the narrow subset of Exim deployments using GnuTLS with the specific triggering TLS options.

An out-of-bounds write in Exim versions before 4.100.1 occurs when the MTA is built and configured to use Proxy-Protocol (the hosts_proxy option) and accepts a PROXY header from an attacker-controlled or spoofed proxy, allowing remote memory corruption (CWE-787) with high integrity impact and low confidentiality/availability impact. The flaw is remotely reachable but unauthenticated only in the sense that no credentials are needed (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, vendor score 7.0); the high attack complexity reflects that Proxy-Protocol is off by default and the attacker must be positioned on, or able to spoof, the trusted-proxy path in front of Exim. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided; a fixed release, Exim 4.100.1, exists and is the primary remedy.

Denial of service in Vinyl Cache releases before 9.0.2 (and in the related Varnish Cache lineage, per the affected CPEs): when the deployed VCL calls the .upper() or .lower() string methods on an attacker-influenced value, a carefully sized request string can overrun the remaining worker-thread workspace at that call site, causing the child process to segfault or trip an assertion and then restart. Reachability is gated by a non-default prerequisite - the VCL must actually apply these methods to request-derived data - and the attacker must know that VCL logic well enough to size the string to land in the narrow window between filling the remaining workspace and the http_req_size / http_req_hdr_len request limits, so this is a deliberately low-priority memory-corruption issue rather than a general-purpose remote attack. No public exploit code has been identified at time of analysis, and the impact is a transient, self-healing outage rather than a persistent one, with no effect on confidentiality or integrity.

An out-of-bounds write in osmo-ggsn 1.14.0 allows a remote, unauthenticated sender of GTP signalling to corrupt process memory by delivering a PDP context whose GSN-Address sub-field is malformed; the decoder writes length-driven data without adequately bounding it to the destination buffer. The practical impact is availability-oriented - the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) indicates a low-complexity remote trigger that can crash or destabilise the GGSN, with a limited integrity effect, rather than a confirmed confidentiality breach. No public exploit code identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC records Exploitation as 'none', though Automatable is 'yes'. Vendor/reference commit-level fix code is available upstream.

An integer-wraparound in Cockpit's do_lastlog() login-accounting routine on ILP32 (32-bit) builds allows a low-privileged but authenticated local user holding an administrator-provisioned abnormally large UID to read and modify other users' lastlog records, producing low confidentiality and low integrity impact (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a 32-bit build, a deliberately created large-UID account, and local access to the host; 64-bit LP64 builds do not overflow and are unaffected, and no public exploit code has been identified at time of analysis.

Memory corruption in ImageMagick's ImagesToBlob blob-conversion routine can crash an affected process on 7.x releases before 7.1.2-31 and 6.x releases before 6.9.13-56. The flaw is a use-after-free (CWE-416) in which a pointer is not updated correctly, and exploitation requires a crafted image to reach a local ImageMagick process or library call (CVSS 4.0 AV:L/AC:H/AT:P, PR:N), so no authentication is required but the attack surface is local and the trigger is difficult to satisfy reliably. Impact is confined to availability (VC:N/VI:N/VA:L) with no evidence of code execution or data exposure, and no public exploit identified at time of analysis; vendor patches are available.

Heap memory corruption in snappy-java 1.1.10.8 and earlier allows remote attackers to write attacker-influenced bytes past the bounds of the output array when an application decompresses untrusted compressed data through the typed Snappy.uncompress*Array APIs (such as uncompressIntArray, uncompressFloatArray, or uncompressDoubleArray), which size their result array using the uncompressed length divided by element size while forwarding the undivided length to the native JNI layer. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:L) no authentication or user interaction is needed, but exploitation is conditional: the consuming application must expose the typed decompression path to attacker-controlled input, and applications that only use the generic byte[] uncompress path are not exposed. Impact is currently rated Low integrity and Low availability (heap corruption and crash) with no confirmed confidentiality loss or demonstrated code execution, and no public exploit was identified at time of analysis; this is a genuine memory-corruption flaw but a moderate, not top-tier, priority, and no vendor-released fixed version is identified in the available data.

Out-of-bounds write in vgmstream (through r2117) lets an attacker corrupt heap memory when a crafted EA SCHl audio file is decoded, triggered inside vadpcm_read_coefs_be in src/coding/vadpcm_decoder.c via a manipulated coefficient entry/entries count. The vulnerable code path is reached from any application embedding the library - media players and game-audio converters that use vgmstream - but exploitation requires the victim to open or load the malicious file (passive user interaction); there is no network service to hit and no public exploit identified at time of analysis. The vendor rates it CVSS 4.0 5.3, while this assessment maps it to CVSS 3.1 AV:L/AC:L/PR:N/UI:R with Low confidentiality, integrity and availability impact and no demonstrated path to code execution.

Heap buffer overflow in an unspecified Ubuntu utility's duplicate_legacy_root_dir function can lead to high confidentiality, integrity, and availability impact when a local attacker convinces a user or automated job to process a crafted input, such as a malicious filesystem image or legacy-format file. The assessed CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local access, no privileges required, and user interaction as the primary limiting factor, but the exact product, affected versions, and trigger condition are unconfirmed due to the record lacking product name, CWE, EPSS, KEV, and POC data. No public exploit identified at time of analysis.