Memory Corruption

Out-of-bounds write in MediaTek's GeniZone Trusted Execution Environment (TEE) component enables local privilege escalation across 14 distinct MediaTek chipsets. An attacker who has already achieved System-level privilege on an affected Android device can exploit a missing bounds check to write outside intended memory boundaries within the secure enclave, gaining confidentiality and integrity access beyond what System privilege normally permits. No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability; however, the pre-existing System privilege prerequisite substantially narrows the realistic attack surface.

Out-of-bounds write in MediaTek's GenieZone hypervisor component enables local privilege escalation beyond System-level access on a wide range of MediaTek mobile chipsets. Exploitation is constrained to attackers who have already obtained System privileges, making this a secondary step in a multi-stage attack chain rather than an initial foothold technique. No public exploit code exists and EPSS of 0.13% (3rd percentile) confirms negligible real-world exploitation activity; no CISA KEV listing at time of analysis.

Heap buffer overflow in MediaTek's Audio Hardware Abstraction Layer (HAL) across six chipset families enables local denial of service on affected mobile and automotive platforms. A local user-level process can trigger an out-of-bounds write in the Audio HAL, crashing the audio subsystem with no user interaction required. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with SSVC's 'none' exploitation status and the strictly local, availability-only impact profile.

Out-of-bounds write in the MediaTek display driver allows a local attacker who has already obtained System-level privilege to further escalate privileges on affected Android devices. The vulnerability stems from a missing bounds check (CWE-787) in display subsystem code across at least ten MediaTek chipsets, including MT8910, MT8188, MT8799, and MT6991 among others. No public exploit or active exploitation (CISA KEV) is identified at time of analysis; EPSS score of 0.14% (4th percentile) and SSVC exploitation rating of 'none' both confirm this remains an undemonstrated threat as of the August 2026 advisory.

Local denial of service in MediaTek's ccci (Cross Core Communication Interface) kernel driver affects MT6986, MT6988, and MT6813 chipsets through a missing bounds check that enables an out-of-bounds memory access. A local user-privileged attacker - such as a malicious Android application - can crash the kernel, causing device unavailability without requiring user interaction. No public exploit code exists and EPSS probability is 0.16% (6th percentile); SSVC exploitation status is confirmed 'none,' aligning all risk signals toward low immediate threat.

Local privilege escalation in MediaTek's display subsystem affects 17 chipset variants used in Android devices, allowing an attacker who has already obtained System-level privilege to exploit a missing bounds check (CWE-787) and write out of bounds in display memory, achieving high confidentiality and integrity impact. The CVSS vector (PR:H/AV:L) confirms this is not an initial-access vector - it is a post-compromise escalation step requiring pre-existing System privilege. No public exploit has been identified, EPSS stands at 0.14% (4th percentile), and the vulnerability is not listed in CISA KEV, consistent with SSVC's exploitation status of 'none.'

Local privilege escalation in the MediaTek display driver allows an attacker who already holds System-level privileges to further escalate via a use-after-free memory corruption condition, potentially achieving kernel-level access. Seventeen MediaTek SoC models used across Android devices are affected, disclosed in MediaTek's August 2026 security bulletin with Patch ID ALPS11019722. No public exploit code exists and EPSS at 0.14% (4th percentile) confirms negligible current exploitation probability; this vulnerability is not in the CISA KEV catalog.

Out-of-bounds write in MediaTek's Trusted Firmware-A (TFA) component allows a local attacker already holding System-level privilege to crash the device, causing a denial of service. Affected hardware includes MediaTek Dimensity and Helio chipsets MT6986D, MT6986, and MT6982VB. No public exploit code has been identified and CISA KEV does not list this vulnerability, consistent with its low EPSS score of 0.14% and SSVC exploitation status of none.

Out-of-bounds write in the MediaTek Download Agent (DA) firmware component across eight chipset families allows an attacker with physical device access to trigger a local denial of service by sending a crafted payload while the device is in DA mode. Affected chipsets span mobile SoCs (MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) and modem/automotive chipsets (MT2735, MT2737), broadening the potential device footprint across Android smartphones and connected vehicle platforms. No public exploit code exists, EPSS sits at the 6th percentile (0.16%), SSVC confirms no known exploitation, and the physical access prerequisite fundamentally constrains real-world risk.

Local privilege escalation in MediaTek's apusys AI Processing Unit subsystem on MT8196 and MT8366 chipsets allows an attacker already holding System-level privileges to further escalate by exploiting a confused deputy flaw - likely realized through an out-of-bounds write (CWE-787) - achieving high confidentiality and integrity impact on the vulnerable system. Disclosed by MediaTek in their August 2026 Product Security Bulletin, a vendor patch is available under Patch ID AUTO00833804. No public exploit has been identified at time of analysis, and an EPSS of 0.14% at the 4th percentile reflects negligible probability of widespread exploitation.

Secure boot heap buffer overflow in MediaTek chipsets MT2737, MT6880, MT6890, and MT6990 enables local privilege escalation by an attacker with physical device access. The vulnerability exists at the pre-OS firmware layer, where a write beyond allocated heap boundaries can corrupt boot verification logic and permit execution of unsigned or attacker-controlled code. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, and the EPSS score of 0.16% (6th percentile) is consistent with the hard physical access prerequisite sharply limiting opportunistic exploitation.

Out-of-bounds write in the MediaTek HEVC video decoder enables further privilege escalation on devices running MT6761, MT8766, and MT8768 chipsets. The flaw, rooted in an integer overflow during HEVC bitstream processing, can be triggered without user interaction but only by an actor who already holds System-level privilege on the device. No public exploit code has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with SSVC's 'Exploitation: none' assessment - though SSVC rates Technical Impact as total, reflecting the severity of what a successful second-stage exploit could achieve.

Cross-buffer memory aliasing in msgpack-ruby prior to 1.8.2 allows same-process code to read or corrupt data belonging to a separate MessagePack::Buffer instance via a use-after-free in the rmem slab allocator. MessagePack::Buffer#clear returns a 4 KiB rmem page to the shared pool but leaves rmem_last, rmem_end, and rmem_owner pointing into the freed page; a subsequent write on the cleared buffer and a concurrent second Buffer allocation can claim the same physical page, creating a memory alias that exposes the second buffer's serialized bytes. A PoC is included in the vendor advisory (GHSA-4mrv-5p47-p938); no public exploit identified at time of analysis beyond that PoC, and the CVE is not in CISA KEV.

Use-after-free in Chrome's DataTransfer component on Windows exposes process memory to local attackers who can deliver a crafted HTML page to a victim. The flaw affects all Chrome versions on Windows prior to 151.0.7922.72 and results in high-confidence confidentiality loss with no integrity or availability impact. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with CISA SSVC classifying exploitation as 'none' and technical impact as 'partial' - making this a low operational priority despite the High confidentiality CVSS sub-score.

Sandbox escape in Google Chrome's ANGLE graphics layer on Android enables an attacker who has already compromised the renderer process to break out of the Chrome sandbox via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. This is a second-stage exploit primitive requiring a prior renderer compromise; no public exploit code exists and SSVC reports exploitation as none, keeping real-world risk moderate despite the scope-change nature of the flaw.

Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.

Use-after-free in the GPU process on macOS enables sandbox escape in Google Chrome versions prior to 151.0.7922.72, but only when an attacker has already achieved renderer process compromise. This is a second-stage exploit primitive - it extends an existing renderer compromise across the sandbox boundary into the GPU process, potentially allowing arbitrary code execution outside Chrome's sandbox on macOS. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; however, sandbox escapes are a critical capability for attackers chaining browser exploit kits.

Use-after-free in the Bluetooth component of Google Chrome on Android prior to 151.0.7922.72 enables a sandbox escape for remote attackers who have already achieved renderer process compromise. Exploitation requires delivering a crafted HTML page to a victim user and successfully triggering a memory corruption condition in the Bluetooth subsystem, allowing code execution outside the renderer sandbox. No public exploit code has been identified at time of analysis, and EPSS at 0.21% (11th percentile) indicates low observed exploitation probability; no CISA KEV listing is present.

Buffer overrun in the Apache Traffic Server multiplexer plugin's chunk-decode logic allows network-adjacent attackers who can influence upstream origin responses to cause denial of service across versions 8.0.0 through 10.1.3. The flaw is classified as CWE-787 (Out-of-bounds Write) and is constrained to availability impact only - no code execution or data exposure is indicated. No public exploit or CISA KEV listing has been identified, and the CVSS 3.7 Low score reflects meaningful real-world limitations, primarily the high attack complexity imposed by the upstream-input dependency.

Use-after-free in the sqlite3 Ruby gem (published as both sqlite3-ruby and sqlite3) versions 2.1.0 through 2.9.4 lets an aggregate function be invoked through a still-open prepared statement after its Database object has been explicitly closed, producing an invalid memory read and a segmentation fault that crashes the Ruby process. Exploitation requires an in-process API-misuse pattern in the host application itself - local, high-complexity, low-privileged per the assessed CVSS:3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) - with no remote or network vector and no attacker-supplied input. No public exploit identified at time of analysis (EPSS 0.11%, CISA SSVC exploitation: none, Automatable: no); the maintainers classify it as Low severity, describing a reliably reproducible crash after garbage collection rather than a proven denial-of-service or code-execution primitive.

A use-after-free vulnerability in the sqlite3-ruby gem allows an attacker to crash the Ruby process by defining a custom SQLite function with the same name but a different number of arguments or text encoding, leading to an invalid memory read and segmentation fault. The issue affects versions prior to 2.9.5 and was assessed as low severity by the maintainers due to the specific code pattern required for exploitation.

Memory corruption in Xen allows guest VMs with Populated on Demand (PoD) enabled to cause denial of service by attempting to reclaim non-guest memory pages, corrupting hypervisor memory management state. No public exploit identified and SSVC indicates no current exploitation, but the flaw is automatable with partial technical impact.

Denial-of-service via out-of-bounds write in Apple CoreAudio when processing malicious audio streams. Affected iOS, iPadOS, macOS, tvOS, watchOS, and visionOS versions are vulnerable. No known active exploitation or public exploit code exists at time of analysis, and EPSS probability is low (0.17%).

An out-of-bounds write vulnerability in Apple iOS 26.6 and earlier allows a malicious app to cause unexpected system termination (kernel panic). No public exploit or active exploitation has been reported; patch available from Apple.

Denial-of-service via type confusion in Apple ImageIO affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Processing a maliciously crafted image can crash an application, with no code execution. No active exploitation or public exploit is known; EPSS 0.17% indicates low likelihood of widespread attacks.

We are tasked with synthesizing data from multiple intelligence sources about CVE-2026-64754 into a comprehensive analysis, returning a JSON object with specific fields. All fields must be plain text strings (paragraphs). We must use all provided data and cross-reference to add value. The output must be grounded in the input data, not invented. Let's extract and analyze the provided data: - CVE ID: CVE-2026-64754 - Description: "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service." - CVSS Score: 5.5, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CWE: CWE-787 (Out-of-bounds Write) - EPSS: 0.16% (percentile 5%) — low exploitation probability. - Patch: Available from vendor (Yes). The fix is listed in the versions above. - Reported by: apple - CPE: apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, apple:watchos — all with *:*:*:*:*:*:*. Specific version ranges given by EUVD: macOS 0 <15.7.8, macOS 0 <14.8.8, iOS and iPadOS 0 <26.6, macOS 0 <26.6, watchOS 0 <26.6, tvOS 0 <26.6, visionOS 0 <26.6. Note the macOS versions include Sequoia 15.7.8 fix, Sonoma 14.8.8, Tahoe 26.6. "macOS 0 <26.6" likely means macOS Tahoe (version 26.x). So affected products: all Apple operating systems before these fixed versions. - Tags: Apple, Buffer Overflow, Ios And Ipados, Tvos, Visionos, Watchos, Memory Corruption. Also "Memory Corruption" tag is relevant. - References: All are Apple support pages: 128066, 128067, 128068, 128069, 128070, 128071, 128072. Also ENISA EUVD ID: EUVD-2026-49465, with link to NVD. Now, we need to produce each field as a paragraph. 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT

Out-of-bounds read in Apple macOS allows a local app to access sensitive user data. The vulnerability (CWE-787) has been patched in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. Exploitation requires user interaction (opening a malicious app or file), and no public exploits are known to be in the wild.

Unexpected Safari crash via use-after-free when processing maliciously crafted web content affects Safari 26.6 and earlier on all Apple platforms. This denial-of-service condition requires user interaction to open a malicious webpage; no public exploit identified and EPSS probability is low (0.14%).

Denial of service in Apple operating systems via out-of-bounds write allows a local app to cause unexpected system termination. Affected versions include iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to 26.6. No active exploitation has been reported, EPSS risk is low at 0.16%, and no public exploit code identified at time of analysis.

Denial of service in SQLite 3.41 due to a use-after-free in the JSON extraction function. A local unauthenticated attacker can trigger a crash by supplying a malicious JSON input, causing the host application to terminate. No active exploitation has been confirmed in the wild, but public exploit proof-of-concept may exist.

A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.

Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.

Use-after-free in NLnet Labs Unbound 1.15.0 through 1.25.1 crashes the DNS daemon via a dangling pointer to a freed TLS server name string in the DNS-over-TLS forwarding path. A remote attacker with knowledge of the target resolver's configuration can trigger the crash by sustaining query pressure against the configured DoT zone while inducing a transient upstream connection failure, causing denial of service. No public exploit code exists and this vulnerability has not been confirmed as actively exploited, but the network-accessible attack surface (PR:N) makes it relevant to operators running internet-facing recursive resolvers with DoT forwarding.

Heap use-after-free in the SyncTeX parser shipped with TeX Live and embedded by GNOME Evince allows crash or potential arbitrary code execution when a user opens a malformed .synctex or .synctex.gz file. The flaw stems from a NULL parent pointer condition in _synctex_post_process_ref() that bypasses node detachment, causing recursive freeing of live tree nodes and leaving dangling pointers later accessed during document parsing. Exploitation requires local file access and active user interaction (UI:A per CVSS 4.0), no public exploit has been confirmed, but a detailed researcher blog post by the discoverer (Fatih Çelik) is publicly available and the RCE tag suggests demonstrated impact potential.

Out-of-bounds memory corruption in kronosnet's packet reassembly engine (versions ≤ 1.34) enables a remote, unauthenticated network attacker to crash the kronosnet process or cause heap corruption by transmitting malformed fragmented packets carrying invalid sequence numbers. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10, and Red Hat OpenShift Container Platform 4, making this relevant to HA clustering infrastructure that depends on kronosnet for inter-node communication via Corosync or Pacemaker. No public exploit code and no active exploitation have been identified at time of analysis, though the network-accessible, no-privilege-required attack path elevates operational risk for clustered environments despite the AC:H complexity rating.

Out-of-bounds write in davenardella snap7 up to version 1.4.3 allows network-authenticated attackers to corrupt memory by supplying a crafted PDULength value during S7 protocol negotiation. The vulnerable function TSnap7Peer::NegotiatePDULength in src/core/s7_peer.cpp fails to enforce bounds on the PDULength argument, enabling writes beyond the allocated buffer boundary. A public proof-of-concept exploit is available on GitHub (issue #17), and the CVSS 4.0 E:P modifier confirms this - elevating practical risk above the medium base score, particularly in OT/ICS deployments where snap7 is commonly used to interface with Siemens S7 PLCs.

Out-of-bounds write in Bouncy Castle BC-LTS bcprov-lts8on affects ARM deployments running versions 2.73.0 through 2.73.12.0, with high confidentiality impact if successfully exploited. The flaw resides in ARM-specific native C implementations of SHA3 and SHAKE algorithms and is only triggered when an application accepts memoable SHA3/SHAKE cryptographic states from potentially untrusted external sources. No public exploit code exists and no active exploitation has been confirmed at time of analysis; the CVSS 4.0 score of 1.7 reflects the very narrow exploitation conditions required to reach this code path.

YAML::Syck before version 1.47 crashes the Perl interpreter when parsing a YAML document that redefines an anchor name, due to a use-after-free and double-free in the bundled libsyck C library. Any caller invoking Load() or LoadFile() on attacker-controlled YAML - a common pattern in Perl web frameworks and data-pipeline tooling - is exposed to a denial-of-service condition that aborts the interpreter process. No public exploit beyond the CPANSec-confirmed 7-byte trigger document exists and no CISA KEV listing is present, but the trivially short trigger makes reliable reproduction straightforward.

Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local attacker with high OS-level privileges to execute arbitrary code in System Management Mode (SMM) - a CPU execution context operating below the operating system and hypervisor with access to all system memory. Successful exploitation allows persistent firmware-level implants that survive OS reinstallation and defeat Secure Boot and standard endpoint detection tools. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, SMM code execution represents one of the highest-impact firmware attack primitives available to an advanced threat actor.

Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local privileged attacker to corrupt power management settings within System Management Mode, a CPU execution context operating below the OS kernel at Ring -2. Successful exploitation could allow persistent firmware-level tampering that survives OS reinstalls and reboots. No public exploit has been identified at time of analysis, and exploitation requires pre-existing high OS-level privileges, substantially limiting real-world risk to post-compromise scenarios.

Use-after-free in ESET's Linux security product kernel components enables a local high-privileged attacker to trigger a kernel panic, causing a complete system crash and denial of service. Both ESET Endpoint Antivirus for Linux and ESET Server Security for Linux are affected across unspecified versions, per ESET's own customer advisory. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, server-deployed AV with kernel-level hooks makes the DoS impact operationally significant in production environments.

Heap overflow in Absolute Security Secure Access client certificate parsing causes a local denial of service. Versions prior to 14.55 are affected. An attacker who already holds local administrator privileges on a managed endpoint can trigger the overflow to crash the Secure Access client, effectively disabling it on that machine. No public exploit code has been identified, and this vulnerability is not listed in the CISA KEV catalog.

Use-after-free in ImageMagick's FreeType integration path allows remote denial of service against image processing pipelines using vulnerable 6.x or 7.x releases. When FreeType initialization fails during an image processing operation, the affected code path neglects to exit cleanly and continues referencing already-freed memory, causing process corruption or crash. No public exploit identified at time of analysis; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects meaningful preconditions required to trigger the failure path.

Denial of service in BusyBox 1.38.0 arises from a use-after-free in the awk_sub() routine of the AWK applet (editors/awk.c), allowing an attacker who can supply a crafted AWK script to crash the busybox awk process. The flaw is a memory-corruption bug (CWE-416) with availability-only impact and no confidentiality or integrity consequences. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and its EPSS score is low (0.14%, 4th percentile).

Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclose sensitive server-side information. The CVSS vector (AV:N/PR:L/C:H) confirms that any authorized database user - regardless of their data access permissions - can potentially trigger the flaw remotely with no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality impact and low access complexity make patching a meaningful priority for organizations running SQL Server 2025.

Use-after-free in the Windows Virtual Filtering Platform (VFP) enables authenticated network attackers to crash affected Windows endpoints and servers, resulting in a denial-of-service condition. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases through 2025, making patch prioritization important despite the medium CVSS score. No public exploit code or active exploitation has been identified at time of analysis, and SSVC classifies this as not automatable with partial technical impact.

Privilege escalation via physical attack in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects all major Windows 10, Windows 11, and Windows Server releases through 2025. The use-after-free memory corruption flaw (CWE-416) in the kernel-mode driver allows an attacker with physical access to the device to escalate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability compromise. No public exploit code has been identified and CISA has not listed this in KEV, but the SSVC assessment notes total technical impact - the physical access requirement is the primary limiting factor, not the vulnerability's severity once that barrier is cleared.

Type confusion in the Windows Composite Image File System (CimFS) kernel driver enables local, low-privileged authenticated users to disclose protected memory contents on widely-deployed Windows 10, Windows 11, and Windows Server platforms. The flaw (CWE-843) causes the driver to access a kernel resource via an incompatible type, resulting in unintended memory reads with high confidentiality impact. No public exploit or active exploitation has been confirmed - SSVC lists exploitation as 'none,' EPSS stands at 0.29% (21st percentile), and the vulnerability is absent from the CISA KEV catalog - placing real-world risk in the lower-medium tier despite the C:H CVSS sub-score.

Privilege escalation via use-after-free in the Windows USB Print Driver affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, requiring physical access to exploit. An attacker with hands-on access to a target machine can trigger a memory corruption condition through the USB print subsystem to achieve full local privilege escalation - High confidentiality, integrity, and availability impact per CVSS. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Use-after-free memory corruption in gawk's do_getline_redir() routine within io.c allows a local attacker to crash the gawk process, causing a denial of service. All gawk versions 5.4.0 and below are affected, as confirmed by CERT-PL and an upstream patch commit. No active exploitation has been identified (not in CISA KEV), and the impact is confined to availability - no confidentiality or integrity effects have been demonstrated.

Out-of-bounds stack write in Zephyr's nRF70 Wi-Fi driver exposes embedded systems to memory corruption when the nRF70 co-processor returns a power-save event with more than eight TWT flow entries. The vulnerable function `nrf_wifi_event_proc_get_power_save_info()` blindly copies co-processor-supplied TWT entries into a fixed 8-element stack array without validating `num_twt_flows` against `WIFI_MAX_TWT_FLOWS`, enabling heap/stack corruption of approximately 40 bytes per excess entry. No public exploit code exists and the flaw is not listed in CISA KEV, but the adjacent-network attack vector and the indirect over-the-air influence path via a rogue AP manipulating TWT sessions make this a meaningful risk in Wi-Fi 6 (802.11ax) deployment environments running Zephyr with `CONFIG_NRF70_STA_MODE`.

Use-after-free and double-free in Zephyr RTOS's experimental USB host stack (CONFIG_USB_HOST_STACK, introduced in v4.4.0) allows an attacker with physical USB access to crash the target device or corrupt live kernel slab objects by bouncing a USB device connection to trigger a second removal event after the slab has already been freed. The flaw exists because usbh_device_disconnect() frees the root usb_device slab object without clearing the cached ctx->root pointer, and UHC controller drivers (uhc_max3421e, uhc_mcux_common) emit UHC_EVT_DEV_REMOVED directly from hardware line-state with no debounce or re-entry guard. No public exploit identified at time of analysis, and no CISA KEV listing; the physical-access prerequisite substantially constrains the realistic attacker population.

Out-of-bounds write in Zephyr RTOS's Bluetooth BAP Broadcast Assistant (subsys/bluetooth/audio/bap_broadcast_assistant.c v4.4.0 and earlier) allows a BLE-adjacent attacker operating one or more malicious Scan Delegator peripherals to corrupt the target device's memory or cause a denial of service. The root cause is a file-static 512-byte att_buf (net_buf_simple) shared across all connection instances: when the Broadcast Assistant holds two or more concurrent BLE connections, concurrent GATT notification callbacks interleave writes into this buffer without tailroom checks, enabling writes past the BSS boundary into adjacent memory. No public exploit has been identified and exploitation requires high attack complexity, but the memory corruption primitive is serious for embedded/IoT targets where crash recovery may be unavailable.

Use-after-free in ImageMagick before 7.1.2-26 exposes servers that process untrusted images to denial of service and potential code execution via a dangling pointer in the FormatMagickCaption method when memory allocation fails. The CVSS 4.0 vector scores this at 6.3, reflecting high attack complexity (AC:H) and specific prerequisite conditions (AT:P), though intelligence tags flag RCE - a claim the vendor CVSS impact metrics do not fully corroborate, as only low availability impact is scored. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Use-after-free in ImageMagick's PDB decoder (all versions before 7.1.2-15) allows remote attackers supplying crafted Palm Database image files to crash the application or write a single null byte to freed heap memory. The flaw manifests specifically when memory allocation fails during PDB decoding, leaving a stale pointer that is subsequently dereferenced rather than nulled or re-validated. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects constrained exploitation conditions (AC:H, AT:P) and impact limited strictly to availability.

Stack buffer overflow in Vim's SAL sound-folding spell engine prior to version 9.2.0725 crashes the editor by writing a null byte one position past the end of a MAXWLEN-element stack buffer in spell_soundfold_sal(). Exploitation requires a user to open Vim with a SAL-based spell file active under a non-multibyte 8-bit encoding and trigger sound-based spell suggestions on a boundary-length word, corrupting the eval_soundfold() stack frame. No public exploit has been identified at time of analysis, and the impact is limited to availability (editor crash) with no confidentiality or integrity consequences.

Memory exhaustion in Juniper Networks Junos OS and Junos OS Evolved snmpd allows an authenticated network attacker to crash SNMP monitoring by sending specific valid SNMPv3 queries that trigger an out-of-bounds write and progressive memory leak. The snmpd process will exhaust available memory over time, crash, and restart, rendering SNMP-based network monitoring unavailable for the duration of each crash cycle. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, the CVSS 4.0 supplemental metric AU:Y indicates the attack is automatable.

Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes the process when handling crafted network requests, taking down all web-management-dependent services including J-Web, remote-access VPN, and firewall authentication until automatic process recovery. Exploitation is gated on a specific non-default configuration - remote-access VPN with pre-logon compliance check enabled - limiting the exposed population to SRX deployments that actively use this feature. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the official CVSS 5.3 score reflects the limited, reversible availability-only impact.

Heap buffer overflow in Vinchin Backup & Recovery through version 9.0.0.86562 allows unauthenticated remote attackers to crash the agentlink_server process or corrupt heap memory without any prior access or user interaction. The agentlink_server service accepts a TCP packet body_len field without bounds validation, passing the attacker-controlled value directly to recv() and enabling heap writes of up to approximately 4 GiB beyond the allocated buffer. This vulnerability is not listed in CISA KEV and no public exploit code is confirmed at time of analysis, though the heap overflow magnitude raises concern for potential code execution beyond simple denial-of-service.

Type confusion (CWE-843) in Samsung's open-source Escargot JavaScript engine enables pointer manipulation, leading to high-impact availability disruption and limited integrity compromise when processing malicious JavaScript. All Escargot versions prior to commit 779f6bedf58f334dec64b0a51ebb724b4708b84a are affected, with particular relevance to Samsung embedded and smart appliance ecosystems where this engine is deployed. No public exploit has been identified at time of analysis, and an upstream fix is available via GitHub PR #1580, though a formally versioned release has not been independently confirmed.

Memory corruption in Qualcomm Snapdragon firmware triggers an out-of-bounds write (CWE-787) when prepared commands are updated using invalid port indices supplied from user space that exceed supported read client limits. The vulnerability spans an exceptionally broad portfolio of Snapdragon chipsets covering mobile, automotive, XR/AR, and connectivity platforms. No public exploit has been identified at time of analysis, and CISA SSVC assessment rates exploitation as none and the flaw as non-automatable, though the changed scope (S:C) in the CVSS vector indicates impact can propagate beyond the directly vulnerable firmware component.

Memory corruption in Qualcomm Snapdragon silicon allows a local low-privileged attacker to trigger an out-of-bounds write (CWE-787) by submitting input with a buffer plane count or batch size exceeding the maximum allowed value. The scope change in the CVSS vector (S:C) indicates the corruption can escape the vulnerable component's security boundary, yielding partial confidentiality, integrity, and availability impact on an adjacent system component. No public exploit or active exploitation has been identified at time of analysis; SSVC confirms no known exploitation and non-automatable attack conditions.

Out-of-bounds write in Qualcomm Snapdragon's flash command handler allows a local low-privileged attacker to corrupt memory by exploiting a race condition between userspace LED count modifications and kernel-side flash command processing. The CVSS scope change (S:C) indicates the corruption can reach components beyond the immediately vulnerable driver - raising the potential for privilege escalation on affected Snapdragon-based devices. No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds write in Qualcomm Snapdragon's JPEG command parser exposes local low-privilege users to memory corruption via crafted JPEG input. Validation checks within the parser fail to account for extra buffer writes, overwriting adjacent memory and enabling a scope change beyond the vulnerable component's boundary - consistent with Snapdragon's isolated subsystem architecture (DSP, camera ISP). Qualcomm disclosed this in its July 2026 Security Bulletin; no public exploit identified at time of analysis.

Local privilege escalation and memory corruption in Qualcomm Snapdragon chipset drivers allows a malicious application to trigger a use-after-free by issuing multiple IOCTL calls that reference the same buffer file descriptor. The flaw affects a broad range of Snapdragon mobile, compute, connectivity (FastConnect/WCN/WCD/WSA) and XR platforms, and successful exploitation can corrupt kernel memory to gain high impact on confidentiality, integrity and availability. There is no public exploit identified at time of analysis, EPSS risk is very low (0.09%), and CISA SSVC rates exploitation as none.

Use-after-free memory corruption in Qualcomm Snapdragon platform driver code allows a local low-privileged process to trigger access of already-freed memory by issuing multiple IOCTL calls that reference the same buffer file descriptor. A successful attacker gains full compromise of confidentiality, integrity, and availability on the affected device, which in practice can mean kernel-level code execution or privilege escalation from an unprivileged app. There is no public exploit identified at time of analysis, EPSS is negligible (0.09%, 1st percentile), and CISA SSVC records no known exploitation.

Local privilege escalation via memory corruption affects a broad range of Qualcomm Snapdragon chipsets, where a use-after-free condition in the device driver's input/output control (ioctl) path for mapping and unmapping persistent memory buffers can be triggered by an authenticated local application. Improper synchronization on these operations lets a low-privileged process corrupt kernel memory to gain full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.09%), consistent with CISA SSVC scoring exploitation as none.

Heap overflow in OP-TEE's ARM Crypto Extensions SHA-3 implementation corrupts TEE kernel memory across all platforms built with CFG_CRYPTO_WITH_CE82=y (ARMv8.2+ SHA3 extensions). The off-by-one error in the accelerated SHA-3 path overwrites memory beyond the hash state buffer, potentially corrupting all TEE kernel heap memory that follows. Affected versions span 3.21.0 through 4.11.0, and no public exploit has been identified at time of analysis, though the memory corruption primitive is significant in the context of a secure enclave.

Use-after-free in radare2's r_core_bin_load function (libr/core/cfile.c) affects all versions up to and including 6.1.6, allowing a local low-privileged user to trigger memory corruption resulting in a denial of service. A public proof-of-concept exists (GitHub issue #26049), confirmed by the CVSS 4.0 E:P exploitability modifier, though the vulnerability is not listed in CISA KEV and no confirmed widespread active exploitation is known. The CVSS 4.0 score of 4.8 (Medium) reflects the strictly local attack vector, limited availability impact, and absence of confidentiality or integrity compromise.

Use-after-free in radare2's regprofile handler crashes the application for local users on versions up to 6.1.6. The vulnerable function r_core_seek_arch_bits in libr/core/disasm.c mismanages memory during architecture bit-seeking operations, allowing a local attacker with standard user privileges to trigger application termination. No confidentiality or integrity impact is present; this is a denial-of-service class finding with a publicly available proof-of-concept and no confirmed active exploitation in the wild.

Spoofing in Microsoft Edge (Chromium-based) stems from a type-confusion memory-safety defect (CWE-843) that a remote, unauthenticated attacker can leverage over the network to misrepresent content or origin to the victim. Microsoft rates it CVSS 8.1 with a changed scope, driven largely by high integrity impact, though the CVSS vector's high attack complexity (AC:H) signals non-trivial exploitation. There is no public exploit identified at time of analysis (CVSS E:U), and it is not listed in CISA KEV; Microsoft has already shipped an official fix (RL:O).

Two off-by-one errors in FreeIPA's ipa-otpd daemon expose RHEL 6 through 10 deployments configured with an external OAuth2/OIDC Identity Provider to out-of-bounds memory access during the device authorization flow. An attacker who controls or can man-in-the-middle the configured IdP endpoint can serve an oversized authorization response, triggering CWE-787 writes or reads one byte past a fixed-size buffer boundary. The most probable outcome is denial of service of the ipa-otpd daemon; no public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog.

Use-after-free in OpenVPN's tls_wrap_reneg() function allows an authenticated remote client to crash the OpenVPN server by sending a crafted sequence of dynamic tls-crypt control-channel packets, resulting in denial of service for all connected VPN users. Affected versions prior to 2.7.5 and 2.6.21 are patched as of July 1, 2026. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the vulnerability was independently discovered by multiple research teams, elevating credibility of the finding.

Type confusion in API Platform Core's AbstractItemNormalizer allows authenticated API consumers to corrupt relational data by supplying IRIs pointing to resources of the wrong type during write operations (POST/PUT/PATCH). The root cause is that getResourceFromIri() omits the $operation context when calling IriConverter::getResourceFromIri(), silently bypassing the is_a type guard at IriConverter.php:86. All 4.1.x, 4.2.x, and 4.3.x releases prior to the patched versions are affected; no public exploit or CISA KEV listing has been identified at time of analysis.

Use-after-free in ImageMagick's 8BIM profile parser crashes the process when a specially crafted image is identified, affecting all releases prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch). The vulnerability is triggered by a specific format string embedded in the 8BIM metadata profile, causing memory corruption that results in a denial-of-service condition. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the intelligence feed.

### Summary A memory-safety vulnerability in Open Babel's PQS parser caused an uninitialized pointer dereference when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

### Summary A memory-safety vulnerability in Open Babel's MSI parser caused an uninitialized pointer dereference when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

### Summary A memory-safety vulnerability in Open Babel's GRO parser caused an uninitialized pointer dereference when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

Out-of-bounds write in the command interface of NVIDIA ConnectX SmartNICs and BlueField DPUs allows a local user holding virtual function (VF) access - typically a tenant inside a guest VM - to corrupt device memory via crafted input and potentially achieve arbitrary code execution on the network device itself. Because the CVSS scope is Changed (S:C), a successful exploit crosses the VF isolation boundary and threatens the host and other tenants, making this a serious multi-tenant/cloud isolation-breakout risk. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Heap memory disclosure in the Perl HTML::Gumbo module before 0.19 lets remote attackers leak bounded chunks of process heap by submitting HTML containing a <template> element. The XS binding's walk_tree function misclassifies the template node as a text node and runs strlen() past the intended buffer, serializing the over-read bytes into parse() output. No public exploit is identified at time of analysis, and EPSS is low (0.66%), but exploitation is automatable and the flaw is trivially triggerable against any service that parses untrusted HTML with the default settings.

Out-of-bounds write in the command interface of NVIDIA ConnectX network adapters and BlueField DPUs allows a local user holding an assigned virtual function (VF) to corrupt device memory via crafted input, potentially achieving arbitrary code execution on the device itself. Because the flaw sits at the firmware command interface reachable from a SR-IOV guest, a successful exploit crosses the guest/device trust boundary (CVSS scope-changed, base 9.0) and can compromise the host that owns the adapter. This is a vendor-reported issue with no public exploit identified at time of analysis and no CISA KEV listing.

Out-of-bounds write in MediaTek modem firmware allows a network-adjacent attacker controlling a rogue cellular base station to remotely crash affected User Equipment (UE), resulting in denial of service. Thirty-three distinct MediaTek chipsets - spanning flagship mobile SoCs (MT6991, MT6989, MT6985) to tablet and IoT chipsets (MT8795T, MT8893) - contain the vulnerable modem component identified under Patch IDs MOLY01267281 and MOLY01318201. No public exploit code has been identified at time of analysis, and the attack is non-trivial due to the requirement for attacker-controlled cellular infrastructure, but the sheer deployment scale of affected chipsets across Android devices makes the aggregate exposure significant.

Type confusion in the CSS processing engine of Google Chrome prior to 150.0.7871.47 enables remote attackers to read potentially sensitive data from renderer process memory by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no attacker privileges required, though a single user interaction - visiting the malicious page - is necessary. No public exploit code has been identified, CISA SSVC rates exploitation as none at time of analysis, and Chromium's own team classified severity as Low, suggesting limited practical memory disclosure value despite the NVD CVSS C:H rating.

Type confusion in Chrome's Bluetooth stack on Windows (versions prior to 150.0.7871.47) enables an adjacent-network attacker to exfiltrate sensitive data from Chrome process memory by presenting a malicious Bluetooth peripheral. The CVSS 6.5 score reflects high confidentiality impact but no integrity or availability exposure; notably, Chromium's internal security team rated this Low severity, suggesting the memory regions accessible are constrained. No public exploit code and no CISA KEV listing exist at time of analysis, and exploitation is physically bounded by Bluetooth range.

Use-after-free in Chrome's SSL handling on ChromeOS exposes process memory contents to remote attackers who can serve a crafted HTML page. Only ChromeOS builds of Chrome prior to 150.0.7871.47 are affected - this is not a cross-platform flaw. SSVC rates exploitation status as none and technical impact as partial, and Chromium's own severity classification is Low, making this a routine patch-cycle priority rather than an emergency response item despite the CVSS 6.5 score.

Use-after-free in Chrome's Chromecast component exposes process memory to attackers on the same local network segment via a malicious peripheral, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H), meaning successful exploitation leaks potentially sensitive data from the Chrome process heap. No public exploit or CISA KEV listing is identified at time of analysis, and Google has released a patch in the stable channel.

Use-after-free in Google Chrome's Bluetooth subsystem (all versions prior to 150.0.7871.47) enables an unauthenticated attacker within Bluetooth radio range to leak sensitive data from Chrome's process memory by operating a malicious Bluetooth peripheral. The CVSS vector (AV:A/PR:N/UI:N/C:H) confirms no attacker-side authentication is required and impact is confidentiality-only, with no integrity or availability loss. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV; the Chromium security team rated this Medium severity, consistent with the bounded adjacency-only attack vector.

Out-of-bounds read in Chrome's Layout engine prior to 150.0.7871.47 allows remote attackers to leak potentially sensitive data from the renderer process memory by serving a crafted HTML page. User interaction is required - the victim must visit the malicious page - limiting automated mass exploitation. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, placing real-world urgency below what the CVSS 6.5 score alone might suggest.

Use-after-free in Zephyr's asynchronous SNTP client (sntp_close_async, v4.2.0-v4.4.0) can be triggered remotely by any network peer or off-path attacker capable of dropping or delaying UDP NTP responses, exploiting a race between the system workqueue thread and the socket-service poll thread. The most probable outcome is a crash of the networking subsystem thread (denial of service); where the freed net_context pool slot is rapidly reallocated, memory corruption is possible. The vulnerability is on the normal SNTP timeout path, making it reliably and periodically triggerable when NET_CONFIG_SNTP_INIT_RESYNC is enabled. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Heap-use-after-free in openGauss 7.0.0-RC1 and RC2 allows a database user with SQL execution privileges to crash the backend process by crafting a to_timestamp() call with NLS parameters that triggers the seqscan+sort execution path. The nls_fmt_str pointer is stored in session context but allocated within SeqScan's expression memory context, which is freed upon scan completion; subsequent access by timestamp_out() via CheckNlsFormat() dereferences the dangling pointer. The practical impact is denial of service through backend process termination. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.