Memory Corruption

Local privilege escalation in MediaTek's geniezone Trusted Execution Environment component affects 17 Android chipsets through a use-after-free memory corruption flaw. Exploitation requires an attacker who has already obtained System-level privilege on the device, allowing them to escalate further - potentially to kernel or TEE privilege - with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; the September 2026 MediaTek security bulletin addresses this with Patch ID ALPS10900510.

Use-after-free in the MediaTek GPU kernel driver on chipsets MT6991 and MT8799 allows a local attacker with standard user privileges to read freed kernel or GPU memory, potentially exposing sensitive data such as pointers, credentials, or cryptographic material. The same condition may cause a full system crash, consistent with the Denial of Service tag and the 'system crash' language in the description. No public exploit has been identified and SSVC rates exploitation status as none, placing this in a lower real-world priority bracket despite the C:H rating.

Memory corruption via use-after-free in the Android SurfaceFlinger graphics compositor, present on specific MediaTek chipsets (MT6881, MT6993, MT6858, MT8668), enables a local attacker who has already obtained System-level privilege to escalate to higher privileges - potentially root or kernel - without any user interaction. Reported by MediaTek in the September 2026 Security Bulletin under Patch ID ALPS11123860 and Issue ID MSV-8890. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none and automatable as no, consistent with the high-privilege prerequisite.

Privilege escalation in MediaTek's Power Hardware Abstraction Layer (Power HAL) allows an attacker who has already obtained System-level privilege on an Android device to further escalate to higher privilege through a type confusion vulnerability (CWE-843). The flaw spans a broad range of MediaTek chipsets - over 40 SoC variants - meaning it affects a wide swath of Android smartphones, tablets, and embedded devices. No public exploit has been identified and SSVC exploitation status is confirmed as 'none' at time of analysis, though the technical impact is rated 'total' by CISA's decision framework.

Local privilege escalation in the MediaTek Audio Hardware Abstraction Layer (HAL) allows an attacker who has already obtained System-level privilege to further escalate to higher privileges via a use-after-free condition (CWE-416). The vulnerability affects over 65 MediaTek chipset models spanning Android smartphones, tablets, IoT, and connected-device SoCs. No public exploit code or CISA KEV listing exists at time of analysis; however, the broad chipset surface across Android device families makes this relevant for any organization managing large Android fleets.

Privilege escalation via use-after-free in MediaTek's Android Audio Hardware Abstraction Layer (Audio HAL) affects over 65 distinct chipset families spanning mobile, tablet, and IoT SoCs. An attacker who has already obtained System-level privilege on a device running an affected MediaTek chipset can trigger the UAF condition to escalate further - gaining full control over confidentiality, integrity, and availability without any user interaction. No public exploit or active exploitation has been identified at time of analysis; the patch is available through MediaTek's September 2026 product security bulletin.

Use-after-free in PX4 Autopilot through v1.17.0 permits adjacent attackers with shell access to corrupt the autopilot's heap by racing task spawning against object deletion in the temperature calibration subsystem. The root cause is that `TemperatureCalibration::start()` stores the spawned task handle in an instance member variable; if the object is freed before the spawned task begins execution, the task writes into dangling heap memory, corrupting adjacent allocator metadata or unrelated objects. The upstream fix in PR #28487 promotes the task handle to a local variable, eliminating the lifecycle coupling. No public exploit code or CISA KEV listing exists at time of analysis.

Denial of service on IBM i versions 7.3 through 7.6 is achievable by exploiting an off-by-one write in the LPD (Line Printer Daemon) queue name parser, corrupting adjacent memory and crashing the affected service. The vendor description specifies a local authenticated attacker as the threat actor, yet IBM's own submitted CVSS vector (AV:N/AC:L/PR:N/UI:N) characterizes this as an unauthenticated network-reachable flaw - a direct contradiction that materially affects risk prioritization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Heap buffer out-of-bounds write in the MongoDB C Driver's BSON-to-JSON conversion helpers allows an unauthenticated party who supplies document content to corrupt a small number of bytes past the end of a heap-allocated buffer. The overflow is triggered specifically when a binary BSON field is being encoded and the caller has configured a maximum output length that causes the conversion to be cut short. Impact is limited to a low-integrity write of a few bytes adjacent to the buffer - no confidentiality loss and no confirmed availability impact - but heap corruption in native C applications can have unpredictable downstream effects depending on allocator layout. No public exploit code and no CISA KEV listing exist at time of analysis.

Out-of-bounds write in Samsung TizenFX's MediaBufferBase component allows a local low-privileged attacker to corrupt memory by supplying unchecked array indices through the Tizen.Multimedia media buffer API. The vulnerable indexer property in `Tizen.Multimedia.Common.Internal.MediaBufferBase` lacked all bounds validation prior to fixes introduced in upstream PRs #7814 and #7815, admitting negative or oversized index values. Under high-complexity conditions, successful exploitation can produce high integrity and availability impact - crashing the multimedia subsystem or enabling controlled memory corruption - on Tizen-based devices such as Samsung Smart TVs and Galaxy Watch wearables. No public exploit exists and no active exploitation has been confirmed.

Remote code execution in Rockwell Automation FactoryTalk® Historian Machine Edition allows an adjacent-network attacker holding low-privilege credentials to fully compromise the historian host via a memory corruption flaw. The root cause is CWE-787 (Out-of-bounds Write), consistent with a buffer overflow in the historian's network-facing service, yielding full confidentiality, integrity, and availability impact on the affected device. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at the time of analysis.

Use-after-free in Firefox's DOM Core & HTML component allows network-reachable attackers to achieve limited memory disclosure and DOM integrity impact against users running Firefox below version 155 or Firefox ESR below 153.2. Exploitation requires user interaction - a victim must visit or be redirected to attacker-controlled content - but no authentication or elevated privileges are needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Mozilla has released patched versions addressing the flaw.

Use-after-free memory corruption in Firefox's DOM Core and HTML component allows a remote attacker to achieve limited confidentiality and integrity impact against users running unpatched Firefox versions by directing them to a crafted webpage. All Firefox releases prior to version 155, ESR 140.15, and ESR 153.2 are affected; Mozilla has shipped fixes across all three release channels. No public exploit code or active exploitation has been identified at time of analysis.

Use-after-free in Firefox's Audio/Video media pipeline allows unauthenticated remote attackers - requiring only user interaction - to read or modify limited browser memory content. Affected releases span Firefox stable prior to 155 and both ESR tracks prior to 140.15 and 153.2, covered by three separate Mozilla security advisories (MFSA2026-82, MFSA2026-84, MFSA2026-85). No public exploit code exists at time of analysis and SSVC exploitation status is 'none,' though the CWE-416 class carries inherent escalation risk beyond the partial impact Mozilla scored.

Use-after-free in Firefox's JavaScript garbage collector (GC) component exposes users to partial memory disclosure and corruption when visiting attacker-controlled web pages. Both the standard release line (Firefox 155) and the extended support release (Firefox ESR 153.2) are patched. No public exploit or active exploitation is confirmed; SSVC exploitation status is none and the vulnerability is absent from CISA KEV.

Use-after-free in Firefox's Audio/Video component exposes users running Firefox prior to version 155 and affected ESR branches to potential heap memory disclosure and limited data modification when processing attacker-controlled media. The vulnerability is network-reachable but requires user interaction - visiting a malicious or compromised page that triggers media playback - and carries a CVSS score of 5.4 reflecting bounded C:L/I:L impact with no availability loss. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation status as none and the vulnerability as non-automatable.

Off-by-one out-of-bounds write in Zephyr RTOS's LwM2M JSON formatter allows a LwM2M server peer to corrupt one byte of memory adjacent to a STRING resource buffer by sending a WRITE payload whose string length exactly equals the buffer size. Affected devices are Zephyr LwM2M clients with the JSON content formatter enabled (cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*). The overflow deterministically writes a NUL byte past the buffer boundary, enabling potential crash or silent data corruption depending on memory layout; no public exploit has been identified at time of analysis, but the fix commit and security advisory are publicly visible.

Use-after-free and double-free memory corruption in the Silicon Labs SiWx917 WiFi driver for Zephyr RTOS enables an adjacent unauthenticated attacker to corrupt the kernel networking buffer pool and crash the device. The driver's siwx91x_send() incorrectly releases a net_pkt owned by the L2 ethernet stack, causing use-after-free reads and a double-free when the caller accesses and unrefs the same packet; under concurrent network load, the trailing unref corrupts a live packet's reference count drawn from the recycled slab slot. No public exploit has been identified at time of analysis, but the vulnerable code path is compiled in by default and is exercisable via ordinary WiFi traffic that any adjacent-network peer can induce.

Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's History Backend by sending crafted requests targeting the `UA_DataValue_backend_copyRange` function in the in-memory history data plugin. The impact is availability loss only - no confidentiality or integrity compromise. A public proof-of-concept exists via a GitHub issue, and the project closed the disclosure report on procedural grounds rather than issuing a formal security advisory.

Use-after-free in Systerel S2OPC OPC UA stack up to version 1.7.3 allows remote low-privileged attackers to crash the OPC UA server by supplying a crafted EventFilter argument to the subscription monitored-item handler, resulting in a denial of service against industrial communication endpoints. No confirmed active exploitation (not in CISA KEV), though a proof-of-concept is publicly available per the referenced GitLab work item, materially lowering the exploitation barrier. In OT/ICS environments, even a VA:L crash impact can carry significant operational consequences by halting process monitoring or control communications.

Use-after-free (CWE-416) in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to crash the browser through a crafted webpage, resulting in a denial-of-service condition. Critically, the CVE description claims code execution capability, but the CVSS vector (C:N/I:N/A:L, score 4.3) directly contradicts this - a genuine RCE would produce C:H/I:H impact in the 8-9+ range; this discrepancy should be verified against the full MSRC advisory. No active exploitation has been confirmed and no public POC has been reported; a vendor patch is available via the Microsoft Security Response Center.

Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-2025-40843 remediation: the safe_strcpy() call at ldlogger-tool-gcc.c:129 receives destination pointer fullPath + 2 but the full PATH_MAX (4096) as its size bound, causing a deterministic 2-byte overwrite past the 4094 bytes that actually remain on every invocation of the GCC logger component. The overflow is unconditional and input-independent; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric, though no active exploitation (CISA KEV) has been confirmed.

Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.

Heap buffer overflow in GNU C Library (glibc) 2.45 and earlier triggers when an effectively empty string is passed via the ,ccs= mode-argument extension to fopen(), enabling limited heap memory corruption in applications that expose this code path to externally controlled input. The vendor-assigned CVSS 3.1 score of 4.9 (Medium) with a local attack vector and high complexity accurately reflects the narrow preconditions required. No public exploit code has been identified at time of analysis, and the glibc advisory itself explicitly notes this vulnerable usage pattern is absent from mainstream GNU/Linux applications.

Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. No active exploitation has been identified (no CISA KEV listing), and no public exploit code is known at time of analysis, but the availability-only impact and user-interaction requirement make this a realistic denial-of-service risk in desktop and server image-processing contexts.

Out-of-bounds write in Adobe DNG Software Development Kit versions 1.7.1 2502 and earlier allows memory corruption when a victim opens a maliciously crafted DNG file, causing the consuming application to crash or become unresponsive. The flaw (CWE-787) is constrained to a local, user-interaction-dependent attack path, limiting automated exploitation. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.

Improper content-type caching in the Avro component of Spring Cloud Stream can produce incorrect content-type metadata on processed messages, creating a low-severity information-disclosure and data-integrity risk. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release trains. Exploitation requires network access, high privilege level, high attack complexity, and user interaction, making real-world impact minimal; no public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds write in the SmiFlash SMM (System Management Mode) module affects ASUS FA507NU and FA507NV laptop BIOS firmware across all versions. A local administrator can dispatch a crafted Software SMI (SW SMI) request with an oversized length value, causing the SmiFlash handler to write beyond its allocated SMRAM buffer boundary, resulting in a system crash (BSOD) or irreversible BIOS flash corruption. The affected models are designated 'unsupported-when-assigned,' meaning these products were already outside active vendor support when this CVE was issued; no public exploit has been identified at time of analysis.

SMM buffer overflow in InsydeH2O's IHISI command handler for FMTS command 0x32 allows a physically-present, highly-privileged attacker to trigger out-of-bounds writes in System Management Mode firmware. The vulnerable function FMTSWriteUseIntelLib performs read and write operations without validating buffer sizes, enabling potential firmware-level memory corruption in Ring -2 execution context. No active exploitation has been identified and no public exploit exists; the combination of physical access, high privilege, high attack complexity, and required user interaction makes real-world risk extremely low despite the sensitive SMM execution environment.

Type confusion in BlueZ's SDP XML parser (sdp-xml.c) allows a low-privileged local caller to crash the bluetoothd daemon by submitting a crafted nested ServiceRecord via the RegisterProfile() D-Bus API. The parser stack is corrupted so scalar union data is misread as a sequence pointer, causing an invalid dereference and process termination - a local denial-of-service with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Out-of-bounds write in OpenEXR's B44 decompression path on ILP32 (32-bit) builds allows an attacker to corrupt heap memory and crash any application that opens a crafted EXR file, affecting the C++ libraries, CLI tools, and PyOpenEXR bindings across versions 3.1.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. When a malformed B44-compressed scanline image triggers integer truncation in the scratch buffer size calculation before allocation, uncompress_b44_impl() subsequently writes using the full attacker-controlled channel width into the undersized buffer, producing a heap out-of-bounds write. Patches are confirmed available in 3.2.11, 3.3.13, and 3.4.14; no public exploit is identified at time of analysis.

Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.

Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.

Out-of-bounds write in Zephyr RTOS's ext2 filesystem driver enables supervisor-mode memory corruption when a device mounts a crafted ext2 image from a physical storage medium such as an SD card. The driver's superblock validation function omits bounds-checking the s_log_block_size field, allowing an attacker-controlled value to produce an inflated block size that silently misconfigures the kernel memory slab allocator beyond its static backing buffer, with impact ranging from denial of service to potential code execution in kernel mode. No confirmed active exploitation or public POC is identified at time of analysis; a vendor patch is available as upstream commit f270f4bd0e59585da31e1fbaa79c5abf73f1364b.

Heap out-of-bounds write in OpenEXR's DeepImage API affects all versions prior to 3.2.10, 3.3.12, and 3.4.13, exploitable by processing a crafted deep image EXR file. A coordinate axis confusion bug in `Imf_4_0::SampleCountChannel::set()` uses `dataWindow.min.x` instead of `dataWindow.min.y` when computing a target Y coordinate, causing memory writes before the allocated `_numSamples` heap buffer when `min.x ≠ min.y`. No public exploit identified at time of analysis; SUSE Linux Enterprise distributions have received vendor-released patches confirming active remediation.

Privilege escalation from userspace to kernel level is possible in Google's Fuchsia OS via a Use-After-Free condition in the Zircon kernel pager proxy component, affecting Android F30.1.1. An attacker with low-privileged code execution on the device can exploit the memory corruption flaw to gain kernel-level control, achieving full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current active exploitation.

Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by submitting crafted CBOR-encoded data to any network-accessible endpoint using the LECP CBOR parser. The root cause is a dual defect in `lecp_parse` and `report_raw_cbor` within `lib/misc/lecp.c`: an equality-only bounds check (`== sizeof(ctx->cbor)`) fails to catch cases where `cbor_pos` has already exceeded the buffer limit, and `cbor_pos` was reset after rather than before the flush callback, creating a window for sequential over-increment. No public exploit identified as confirmed active exploitation (CISA KEV), but a public proof-of-concept is confirmed at the referenced GitHub repository, and a patch commit has been issued upstream.

Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local, low-privileged attacker to crash the affected system, resulting in a denial of service. The CVSS scope-change metric (S:C) is particularly significant in the PowerVM context: a crash of the VIOS host can simultaneously disrupt I/O services for all co-hosted guest logical partitions (LPARs) sharing that VIOS, amplifying the blast radius well beyond the directly exploited node. No public exploit code and no confirmed active exploitation have been identified at time of analysis.

Heap-based buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local authenticated attacker with high privileges to execute arbitrary code on affected systems. The vulnerability is rooted in improper memory management (CWE-787) and carries a CVSS 3.1 score of 6.7, reflecting the local access requirement and elevated privilege prerequisite that constrain real-world exploitability. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privileged caller to crash the hosting process by inducing a locking failure. When evhttp_start_ws_ succeeds but bufferevent_enable_locking_ subsequently fails, the cleanup function evws_connection_free calls TAILQ_REMOVE on a list the session was never inserted into, dereferencing an invalid pointer. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in 2.2.2-alpha.

Type confusion in the Lean 4 proof assistant kernel allows a malicious metaprogram to produce a proof of False carrying no axioms, from which any proposition can be derived, completely breaking kernel soundness. The vulnerability arises from two related defects in src/kernel/inductive.cpp: projection expressions do not verify that the named structure matches the projected value's type, and environment::add_inductive fails to type-check the parametric arguments of nested inductive applications after they are replaced by auxiliary types, letting those arguments escape kernel verification entirely - exploitable through the normal maximum-kernel-checking addDecl path without sorry, unsafeCast, or unsafe annotations. Publicly available exploit code exists at multiple repositories; this CVE is not listed in CISA KEV.

Out-of-bounds write in Kenwood DNR1007XR firmware enables physically present, unauthenticated attackers to execute arbitrary code at root privilege via the tchdr_bytestream_read function. The device - an in-vehicle infotainment/navigation unit - fails to bounds-check user-supplied data during bytestream parsing, resulting in a heap or stack write past the allocated buffer. No public exploit or active CISA KEV listing has been identified at time of analysis, and real-world impact is materially constrained by the physical access prerequisite.

Wireshark's CMS (Cryptographic Message Syntax) protocol dissector crashes due to a use-after-free (CWE-416) condition when processing malformed CMS packet data, affecting versions 4.6.0-4.6.7 and 4.4.0-4.4.18 and resulting in denial of service. The CVSS vector (AV:L/UI:R) confirms exploitation requires a user to open a specially crafted capture file or analyze malicious live traffic, limiting remote risk. No public exploit code or CISA KEV listing is identified at time of analysis, making this a realistic but not critical-priority issue outside environments where analysts regularly open untrusted capture files.

Denial of service in Wireshark's 3GPP phone log file parser affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18, crashing the application when a specially crafted log file is opened. The root cause is CWE-787 (out-of-bounds write), consistent with a buffer overflow in the parser's memory handling. No active exploitation is confirmed and no public exploit code has been identified, keeping real-world risk moderate despite the high availability impact on the local process.

Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.

Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local, high-privileged attacker to execute arbitrary code. The vulnerability is rooted in a memory corruption flaw (CWE-787) that can corrupt adjacent memory regions during a write operation. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.

Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by an unauthenticated adjacent-network attacker exploiting an out-of-bounds write (CWE-787) in a network-accessible component. Successful exploitation crashes or degrades the target system without impacting confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis.

Heap buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local low-privileged attacker to crash the system, resulting in a denial of service. The flaw is rooted in improper bounds checking during heap memory operations (CWE-787). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available via IBM advisory node/7283858.

Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.

Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; the overall risk is low given the local, user-interaction-dependent attack path.

Stack buffer overflow and off-by-one NUL-write vulnerabilities in the Sierra Wireless HL7800 cellular modem driver within Zephyr RTOS (versions 2.4.0 through 4.4.1) allow an attacker controlling a rogue LTE base station or a compromised modem baseband to crash or potentially execute arbitrary code in kernel context. Roughly twenty AT response handlers incorrectly size the destination argument to net_buf_linearize(), placing the null terminator one byte past a 128-byte stack buffer; the +KCELLMEAS handler is the most critical, passing the raw wire length as the destination size and enabling a full, attacker-content-driven stack overflow that runs in the driver's RX kernel thread. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.

JIT miscompilation in Firefox's SpiderMonkey JavaScript engine exposes sensitive memory to remote attackers via crafted web content. The CWE-843 (type confusion) root cause means the JIT compiler generates native code that accesses a JavaScript value as the wrong type, resulting in a high-confidentiality information disclosure. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing has been identified at time of analysis.

Race condition and use-after-free memory corruption in Mozilla Firefox's Graphics component allows remote unauthenticated attackers to achieve limited confidentiality and integrity impact when a user visits a malicious web page. Affected across the standard release channel and all ESR branches, the vulnerability is fixed in Firefox 154, ESR 115.39, ESR 140.14, and ESR 153.1 per Mozilla's official advisories. No public exploit code has been identified and CISA has not listed this in KEV; the SSVC framework rates exploitation status as none and marks it not automatable.

Unexpected process termination in Apple iOS/iPadOS and macOS Tahoe can be triggered remotely by luring a user to visit maliciously crafted web content, exploiting a use-after-free flaw in the web content rendering engine. The vulnerability affects iOS and iPadOS versions prior to 26.6.1 and macOS Tahoe prior to 26.6.2, with impact limited to availability - crashing the affected browser or WebKit-based process - and no confirmed confidentiality or integrity loss. No public exploit code or CISA KEV listing is identified at time of analysis, though the low-complexity, network-accessible attack surface warrants prompt patching given the broad Apple device install base.

Use-after-free memory corruption in Apple's WebKit web rendering engine crashes the browser process when handling maliciously crafted web content on iOS, iPadOS, and macOS Tahoe. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms network-reachable exploitation limited to availability impact - a process crash - with no confidentiality or integrity compromise. Apple has released fixes across both the legacy iOS 18.x branch and the current iOS 26.x line, indicating broad exposure across the installed base. No active exploitation or public proof-of-concept has been identified at time of analysis.

Out-of-bounds stack read and write in the WNC-M14A2A LTE-M modem driver (wncm14a2a.c) within Zephyr RTOS versions 1.13.0 through below 4.4.2 allows a rogue cellular base station or RF attacker to crash the modem RX thread and leak adjacent stack memory without any application interaction. The defect fires automatically on receipt of an unsolicited %NOTIFYEV: event whose payload exceeds 39 bytes and lacks a quote character within the linearized region, causing scanning loop indices to walk past the fixed 40-byte stack buffer. While the write primitive is weakly controlled — limiting demonstrated impact to denial of service and stack disclosure — the CVE is tagged RCE by reporters, though the description explicitly states memory-safe code execution has not been demonstrated. No public exploit or CISA KEV listing exists at time of analysis.

Use-after-free in HarmonyOS 6.1.0's time and time zone module allows a local low-privileged attacker to crash the affected component, degrading availability. Exploitation is local and requires existing user-level access, limiting the realistic attacker pool to on-device processes or malicious apps. No public exploit code or active exploitation has been identified at time of analysis.

Memory corruption and denial of service in Zephyr RTOS's second-generation delayable work queue (kernel/work.c) arise because the documented safe-cancellation APIs-k_work_cancel_delayable_sync() and k_work_flush_delayable()-fail to block until an in-flight timeout handler completes before returning, allowing callers to free a k_work_delayable object that work_timeout() subsequently dereferences. The race exists exclusively in SMP builds; work_timeout() performs a use-after-free read of the freed object's flags and, if the memory slot has been reused so the bail check passes, a use-after-free write to wp->flags and a submit against a stale dw->queue pointer. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; exploitation is probabilistic and gated on kernel-mode code execution with influence over subsystem work-item teardown timing.

Out-of-bounds write in Zephyr RTOS's LoRaWAN Fragmented Data Block Transport service corrupts the Semtech/LoRaMAC-node decoder's internal MatrixM2B recovery-matrix state when a DATA_FRAGMENT command carries frag_index_n = 0, underflowing the 1-indexed counter arithmetic to array index -1. Impact is constrained to denial of an active FUOTA (Firmware Update Over The Air) session and decoder state corruption - not code execution - despite 'RCE' appearing in the intelligence metadata tags, which directly contradicts the CVE description. No public exploit has been identified and this vulnerability is not listed in CISA KEV.

Out-of-bounds write in IBM i 7.3 through 7.6 enables a local, low-privileged attacker to execute arbitrary code or trigger a denial of service via improper bounds checking. The vulnerability is classified under CWE-787 and carries tags for RCE, memory corruption, and buffer overflow, indicating a classic memory safety failure in a privileged operating environment. No public exploit or CISA KEV listing has been identified at time of analysis, and IBM has released a patch.

Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker exploiting an out-of-bounds write (CWE-787) in a network-facing component, resulting in limited availability and integrity impact. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) characterizes this as network-exploitable without credentials but requiring high attack complexity, substantially constraining real-world exploitability. No public exploit code has been identified at time of analysis, and IBM has released a patch addressed through its support advisory portal.

Sensitive information disclosure in IBM i versions 7.3 through 7.6 allows a remote authenticated attacker to read heap memory contents by triggering a heap buffer overflow in a vulnerable network-accessible component. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the attack is network-delivered with low-privilege authentication and yields limited but real confidentiality exposure with no integrity or availability impact. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch via PTF advisory and affected customers should apply it as a medium-priority remediation.

Stack-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privileged network access to crash the system, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network reachability at low complexity, but impact is limited strictly to availability - no confidentiality or integrity consequences are indicated. IBM has released a patch; no public exploit or active exploitation has been identified at time of analysis.

Buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to obtain sensitive information from the system. The vulnerability (CWE-787, out-of-bounds write) exposes memory contents under network-accessible conditions, with IBM confirming a patch is available. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, and EPSS data was not provided.

Wireshark 4.6.0 through 4.6.7 on Windows crashes when parsing malformed Ixia IxVeriWave capture files or Vector Informatik BLF files, resulting in denial of service via an out-of-bounds write (CWE-787). The vulnerability requires a user to open a crafted file, making it a user-assisted local attack. No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary code execution at SYSTEM or root privilege levels when clients connect to an attacker-controlled rogue gateway or are subjected to a man-in-the-middle attack. The vulnerability resides in the client-side VPN agent's processing of gateway-supplied data, where a crafted response can corrupt memory and hijack execution. No public exploit has been identified at time of analysis, and CISA has not confirmed active exploitation, but full confidentiality, integrity, and availability compromise is possible on any affected endpoint that connects through a manipulated gateway.

IBM Security Verify Access and IBM Verify Identity Access - across both traditional software and container deployments - expose a Use After Free (CWE-416) memory corruption flaw in the Reverse Proxy component that authenticated network attackers can trigger under certain non-default configurations to cause a denial of service. The vulnerability carries a low CVSS base score of 3.1, reflecting high attack complexity and impact limited strictly to availability, with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds write in the Base64 decoder of Amazon's aws-sdk-cpp (all versions before 1.11.862) exposes applications to heap memory corruption or crash when processing attacker-supplied Base64-encoded content. Remote authenticated attackers can trigger the defect by submitting crafted input to any application built on this SDK that routes user-controlled data through the affected decoder path. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, though the CWE-787 heap write class carries inherent tail risk beyond the denial-of-service primary impact.

Use-After-Free vulnerabilities in the GNU linker (ld) component of binutils crash the linker process when processing crafted object or archive files during LTO-enabled linking on Red Hat Enterprise Linux systems. The flaws exist at three distinct dereference points in add_archive_element() in ld/ldmain.c, where plugin_maybe_claim() frees the BFD object but the caller retains dangling pointers that are subsequently accessed. The attack surface is confined to build-time environments, with the primary realistic threat being a supply chain attack introducing a malicious object file into CI/CD pipelines or developer build systems; no public exploit code or active exploitation has been confirmed at time of analysis.

Out-of-bounds write in Zephyr RTOS's llext subsystem allows a local attacker with low privileges to corrupt supervisor-context memory by loading a crafted relocatable ELF extension on Xtensa targets. The vulnerability in llext_link_plt() (subsys/llext/llext_link.c) occurs before any extension code executes - at link time - meaning sandbox protections are bypassed entirely. Exploitation complexity is high (CVSS AC:H) due to constraints on the write value, no public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to deployments using llext on Xtensa architecture.

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse: arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user * Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.

Use-after-free (CWE-416) in OpenSSH's ssh client component affects all releases before version 10.5, triggered when a specific pair of remote-forwarding operations occur concurrently, causing access to freed realloc'd memory. A malicious or compromised SSH server could exploit this race condition against a connecting client to achieve partial information disclosure or limited memory corruption. No public exploit has been identified and CISA SSVC rates exploitation as none with partial technical impact, consistent with the moderate CVSS score of 4.8.

Remote code execution in Microsoft Edge (Chromium-based) below version 151.0.4129.78 stems from a type confusion flaw (CWE-843) in the browser engine, exploitable over the network when a user visits or interacts with attacker-controlled content. The vendor has confirmed patch availability and the flaw is tagged as causing memory corruption, which aligns with the typical consequence of type confusion in browser engines. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the unauthenticated network vector with low attack complexity warrants prioritized patching in enterprise environments.

Use-after-free in MongoDB Server's geospatial validation subsystem allows an authenticated user with write privileges to crash the database server through concurrent operations against a collection using a specific validator type. Affected branches are MongoDB 7.0 (prior to 7.0.40), 8.0 (prior to 8.0.29), and 8.3.x (prior to 8.3.8), per EUVD advisory EUVD-2026-56913. No public exploit code exists and SSVC assessment indicates no current exploitation activity; patched releases are available from MongoDB.

Use-After-Free in the AMD Ryzen Master Utility Driver exposes kernel memory to a locally authenticated, high-privileged attacker, with the primary confirmed impact being system availability loss. The vulnerability (CWE-416) resides within the driver component bundled with both the Ryzen Master application and its Monitoring SDK, affecting all versions prior to the patched releases. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 5.6 reflects the restricted local, high-privilege attack surface despite the kernel-level nature of the flaw.

Privilege escalation via use-after-free in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, requiring physical device access to exploit. An attacker with physical proximity can trigger kernel memory corruption under high-complexity conditions to gain full control of the affected system, achieving complete confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and CISA SSVC confirms exploitation status as none.

Out-of-bounds write (CWE-787) in Intel Slim Bootloader firmware enables a denial of service condition on the local system. Exploitation requires a privileged local account and the presence of specific attack preconditions (AT:P per CVSS 4.0), and impact is confined to low availability on the vulnerable system with no confidentiality or integrity consequences. Intel disclosed this issue through advisory INTEL-SA-01475 with a CVSS 4.0 base score of 1.8; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.

Use-after-free in the kernel-mode (Ring 0) driver component of Intel PROSet/Wireless WiFi Software for Windows enables a local denial-of-service condition by crashing the affected system. The flaw resides in the most privileged execution ring on x86/x64, meaning a successful trigger causes a kernel panic (BSOD) with no containment boundary below the OS. No active exploitation has been confirmed by CISA KEV, no public exploit code has been identified at time of analysis, and the combination of local-only access with high attack complexity substantially constrains real-world risk.

Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows (Ring 2: Device Drivers) enables a denial-of-service condition exploitable from adjacent network position without authentication. The memory corruption flaw in the Windows WiFi driver stack can be triggered with passive user interaction, causing high availability impact to the vulnerable system and a residual low availability impact to subsequently connected systems. No public exploit code has been identified at time of analysis, and Intel has published advisory INTEL-SA-01422 addressing this issue.

Use-after-free in Vim's JSON channel parsing (versions 9.2.0511 through 9.2.0843) causes the socketserver process to crash when processing malformed JSON messages that straddle read-buffer boundaries. The stale pointer p in json_decode_item() is invalidated when channel_fill() frees the underlying buffer mid-parse; the error-reporting code then reads freed memory, producing a crash with no code-execution or data-exfiltration potential. No active exploitation is confirmed and no public exploit code has been identified; vendor-released patch v9.2.0844 resolves the flaw.

Heap out-of-bounds write in Tesseract OCR engine prior to 5.5.3 is triggered by a crafted LSTM .traineddata model file that causes a signed integer multiplication overflow in Convolve::DeSerialize, undersizing the forward-pass output buffer while write operations use the original unwrapped element count. Any application or user that loads an attacker-controlled model file is exposed to memory corruption that can lead to arbitrary code execution or process crash in the context of the OCR engine. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and a vendor-confirmed fix is available in Tesseract 5.5.3.

Out-of-bounds heap write in Zephyr RTOS's USB device-next CDC NCM class handler allows any physical USB host to corrupt the device's shared network buffer pool by issuing standard GET_NTB_PARAMETERS or GET_NTB_INPUT_SIZE control requests with a wLength field smaller than the response structure size. The overflow is bounded at up to 27 bytes and writes only fixed device constants, making its primary impact denial of service of the USB stack rather than arbitrary code execution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, exploitation requires only physical USB access to a device built with the opt-in device_next stack and CDC NCM class.

Use-after-free in Zephyr RTOS kernel queue peek operations (z_impl_k_queue_peek_head and z_impl_k_queue_peek_tail in kernel/queue.c) allows a local low-privileged thread to obtain a dangling pointer to freed heap memory by winning a race against a concurrent k_queue_get call on a shared queue. Successful exploitation - requiring SMP or preemptive concurrency - can leak a stale heap pointer or crash the system when the returned dangling pointer is subsequently consumed as a live buffer in the net_buf, Bluetooth, USB, or networking subsystems. No public exploit exists and no active exploitation is confirmed; CVSS scores this at 3.6 (Low), accurately reflecting the narrow race window and local-only attack surface.

Heap out-of-bounds write in RadiAnt DICOM Viewer is triggered when processing JPEG-compressed pixel data embedded in a crafted DICOM file, potentially enabling arbitrary code execution on the victim's workstation. Reported to CISA ICS-CERT as a medical device advisory (ICSMA-26-218-01), the vulnerability requires no privileges and only passive user interaction - consistent with file-preview or file-open workflows common in clinical imaging environments. The provided CVSS 4.0 score of 5.3 rates impact as availability-only (VA:L), which conflicts materially with the described RCE potential; this discrepancy is significant and should be independently verified. No public exploit code or CISA KEV listing has been confirmed at time of analysis.

Use-after-free memory corruption in open62541's example client code allows a local low-privileged user to cause memory corruption with potential for denial of service or limited code execution. The vulnerability resides in the UA_Client_getRemoteDataTypes function within the examples/custom_datatype/client_types_custom.c file - notably example/sample code rather than the core library - at commit ca356b088ada7dee824d1b4acd07c1ff07ce242b. A publicly available proof-of-concept exploit exists, though the project closed the issue report citing improper disclosure channel, leaving no official patch or advisory. No confirmed active exploitation (CISA KEV absent), but the CVSS 4.0 E:P modifier reflects the published POC.

Use-after-free in Zephyr RTOS 4.4.0's Bluetooth ATT host layer (subsys/bluetooth/host/att.c) allows an adjacent unauthenticated peer to crash the Bluetooth host or potentially corrupt live memory by disconnecting while an ATT PDU is in-flight. The tx_meta_data_storage[] array retains a dangling att_chan pointer after L2CAP tears down and frees the channel slab slot, and the deferred att_tx_destroy_work_handler running on the system workqueue dereferences that freed pointer. No pairing or special privileges are required - a routine ATT connection is sufficient to reach the vulnerable code path. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Off-by-one memory corruption in popt's poptStuffArgs function allows a local low-privileged attacker to overwrite adjacent memory and potentially execute arbitrary code within any host application that unsafely processes the corrupted argument data. All supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4 ship the affected library. No public exploit code has been identified and no CISA KEV listing exists; exploitation requires high-complexity triggering conditions, making this a routine patch priority rather than an emergency response item.

Out-of-bounds write in the wifi subsystem of MediaTek MT6890, MT6990, and MT6988 chipsets enables a local denial of service, crashing the wifi component or device. Exploitation requires that the attacker has already obtained System-level privilege on the affected device - an extremely high bar that makes this a post-exploitation nuisance rather than an initial access vector. EPSS sits at 0.13% (3rd percentile), no public exploit code exists, and the vulnerability is not listed in the CISA KEV catalog, all consistent with the substantial privilege prerequisite.

Out-of-bounds write in the 'med' media processing component of specific MediaTek SoC chipsets (MT6890, MT6988, MT6990, MT2735, MT2737) enables a local attacker with standard user privileges to crash the device, causing a denial of service. The root cause is an incorrect bounds check (CWE-787) that allows a write past allocated buffer boundaries, corrupting memory. No public exploit is identified at time of analysis, and EPSS at 0.15% (4th percentile) combined with SSVC exploitation status of 'none' signals very low real-world exploitation probability.

Out-of-bounds write in MediaTek's HFRP component on the MT6993 chipset enables local privilege escalation beyond System-level access, confirmed via MediaTek's August 2026 security bulletin. The flaw stems from a missing bounds check (CWE-787), requiring an attacker who has already achieved System privilege to trigger further escalation - a post-compromise lateral movement primitive rather than an initial access vector. No public exploit code and no KEV listing have been identified; EPSS sits at the 3rd percentile, consistent with SSVC's 'exploitation: none' finding.