Memory Corruption

Local privilege escalation in the Windows Perception Simulation Service allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). The flaw is not remotely reachable: the attacker must first establish a foothold on the machine and be able to interact with the service so that the vulnerable memory is freed and then reused under attacker control. Exploitation reliability depends on winning the memory-reclamation race, and the Perception Simulation Service (a Windows Holographic / mixed-reality component) must be present and active in the target configuration for the vulnerable code path to be exercised. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H2, and Windows Server 2019, and a vendor fix is available; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis.

Local privilege escalation in Microsoft Windows Installer (msiexec) allows a low-privileged attacker who already holds an interactive session on a Windows host to elevate to higher integrity, including SYSTEM, by triggering a use-after-free memory corruption in the installer service. Successful exploitation requires winning a race/timing window (AC:H) rather than a simple reliable trigger, and no user interaction is needed from a victim; the CVSS 3.1 vector resolves to AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H for a base score of 7.0. At the time of analysis there is no public proof-of-concept and no confirmation of active exploitation (CISA KEV), so this is assessed as a genuine but moderate-priority privilege-escalation issue that matters most on multi-user, RDP-accessible, or shared-workstation deployments where untrusted users already have local logon rights.

Local privilege escalation in the Windows Update Delivery Optimization service allows an authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free (CWE-416) in the Delivery Optimization service (DoSvc), which is enabled by default on supported Windows client and server editions. Rated CVSS 7.0 (High) with High confidentiality, integrity and availability impact, exploitation requires prior local access (AV:L/PR:L) and no victim interaction (UI:N), but depends on winning a race/timing condition (AC:H), making reliable escalation non-trivial. No public exploit identified at time of analysis, and Microsoft has released vendor patches for all affected Windows versions.

Local privilege escalation in Microsoft Windows through the Software Protection Platform (SPP) service allows an authenticated attacker holding a low-privileged local account to trigger a use-after-free condition and ultimately execute code with elevated (SYSTEM) privileges. Exploitation is local-only and gated by a high-complexity precondition (a timing/allocation window that must be won), so this is a moderate-priority elevation-of-privilege issue rather than a remote emergency; no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV). Default installations of the affected Windows client and server builds carry the SPP service, so no unusual feature enablement is required, but the attacker must already have local code execution or a valid low-privileged account on the host.

Local privilege escalation in the Windows Broadcast DVR User Service - the component implementing GameDVR/game capture and broadcast functionality - lets an attacker who already holds a low-privilege, authenticated foothold on the host trigger a use-after-free (CWE-416) in the service and gain code execution at a higher privilege level. The flaw is rated 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: it requires local authenticated access (PR:L) and the successful winning of a high-complexity timing race (AC:H) to take control of the freed object, with no user interaction and no remote or unauthenticated path. This is therefore a moderate-priority, post-compromise escalation most relevant to shared or multi-user Windows hosts; no public exploit code has been identified at time of analysis, and neither CISA KEV status nor an EPSS score was supplied in the source data.

Use-after-free in Windows Message Queuing (MSMQ) allows unauthenticated remote attackers to execute arbitrary code on systems where the optional MSMQ feature is installed and its listener is network-reachable, typically on TCP port 1801. Exploitation requires winning a memory race due to the high attack complexity (CVSS AC:H), and the feature is not enabled by default, which significantly limits real-world exposure; no public exploit identified at time of analysis.

Remote code execution in Microsoft Remote Desktop Client can be triggered when a victim connects to a malicious or compromised RDP server, exploiting a use-after-free (CWE-416) condition during processing of server responses. The vulnerability requires user interaction (UI:R) - the victim must initiate the RDP connection, for example via a malicious .rdp file or social engineering - but no authentication to the victim's system is needed (PR:N), and it is remotely exploitable with low complexity (AV:N/AC:L). CVSS 3.1 score is 8.8, reflecting high confidentiality, integrity, and availability impact; no public exploit has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.

Memory corruption in the Microsoft Windows PDF rendering component allows an unauthenticated remote attacker to execute arbitrary code on unpatched Windows 10, Windows 11, and Windows Server systems by supplying a crafted PDF document, resulting in total loss of confidentiality, integrity, and availability (CVSS 8.1, CWE-787). Exploitation is not confirmed as active: the CISA SSVC assessment records exploitation as 'none' and no public exploit has been identified, while the high attack complexity (AC:H) and SSVC Automatable=no reflect the heap-layout manipulation normally required to turn the out-of-bounds write into reliable code execution. Vendor patches are available, so the residual risk is concentrated in systems that have not yet applied the current cumulative updates - the assessed vector (PR:N/UI:N) implies a parsing path that may not require an explicit user action, but that precondition should be verified with Microsoft before treating the issue as fully drive-by.

Local privilege escalation in the Microsoft Windows Search Component lets an authenticated, low-privileged attacker on a Windows host trigger a use-after-free (CWE-416) and gain elevated privileges, potentially SYSTEM, with high impact to confidentiality, integrity, and availability. Exploitation requires local access and a valid low-privilege account (CVSS PR:L/AV:L) and no user interaction; it cannot be triggered remotely and is therefore a post-compromise escalation step, especially risky on shared, multi-user, RDP, or terminal-server hosts. No public exploit was identified at time of analysis, and this is assessed as a credible but not emergency-tier patch priority.

Local privilege escalation in Windows Autopilot (a component of Windows 11 24H2, 25H2, and 26H2) allows an attacker who already holds low-privileged local access to trigger a use-after-free and gain SYSTEM-level privileges. Exploitation requires an existing authenticated local foothold (PR:L, AV:L) and is complicated by a race-condition-style high attack complexity (AC:H), so it is not remotely or anonymously reachable and is not reliably triggered on demand. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not automatable), and vendors have released patches fixing the flaw in build 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), and 10.0.26300.9711 (26H2).

An out-of-bounds write (CWE-787) in Adobe FrameMaker allows an attacker to corrupt memory and potentially execute arbitrary code with the privileges of the user who opens a maliciously crafted document. Affected builds are FrameMaker 2026 at or below 18.0.0.206 and FrameMaker 2022 at or below 17.0.9.866. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) confirms there is no network or unauthenticated trigger: exploitation depends on social engineering a victim into opening a booby-trapped file, and any code that runs is confined to the current user's rights with no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a credible but not emergency-tier patching priority.

Local privilege escalation in the Windows Security App allows an authenticated attacker with existing local access to elevate privileges to SYSTEM or administrative level via a use-after-free (CWE-416) memory corruption condition. Exploitation is rated CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring a local foothold and successful heap grooming or timing manipulation; no public exploit code has been identified at time of analysis, and Microsoft has released a patch (see advisory).

Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker with low-level privileges to gain elevated privileges on affected Windows systems. The use-after-free flaw requires winning a memory-timing race condition (high attack complexity, CVSS 7.0), making reliable exploitation difficult. No public exploit code or active exploitation has been identified at time of analysis.

Use-after-free in the Windows Search component of Microsoft Windows allows unauthenticated remote attackers to elevate privileges, per a CVSS 3.1 score of 9.8. No public exploit code has been identified at time of analysis. However, the description's framing as privilege elevation-which typically requires a local foothold-conflicts with the network-unauthenticated vector; confirm exact preconditions via the MSRC advisory.

Remote code execution in Windows Schannel can be triggered by unauthenticated attackers who can reach a TLS/SSL service that relies on Schannel-such as RDP with TLS, IIS HTTPS, LDAPS, or EAP/TLS endpoints-by sending crafted handshake data that causes an out-of-bounds write (CWE-787). The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact, meaning no authentication or user interaction is required, but successful exploitation is constrained by high attack complexity and dependence on specific memory state, likely requiring heap grooming or repeated attempts. No public exploit identified at time of analysis, and no CISA KEV active exploitation is indicated in the provided data.

Arbitrary code execution in Adobe FrameMaker is possible when a user opens a maliciously crafted file, due to a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires user interaction (UI:R) and is local (AV:L), meaning an attacker must deliver the file to the victim, who then opens it; no authentication is needed (PR:N). While no public exploit code has been identified, the issue is rated CVSS 7.8 and is considered a genuine but not emergency-grade priority; Adobe has published a security bulletin (APSB26-172) with remediation guidance.

Out-of-bounds write in Adobe FrameMaker allows arbitrary code execution in the context of the current user when a victim opens an attacker-crafted document. Rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787), the flaw is reached locally and requires user interaction, so exploitation depends on social engineering to deliver a malicious file that the target then opens; no authentication is required of the attacker and no non-default configuration is implicated, meaning any installation that opens the file is affected. Impact is bounded by the privileges of the user running FrameMaker (S:U), and there is no public exploit code or confirmed active exploitation identified at time of analysis.

An out-of-bounds write (CWE-787) in Adobe FrameMaker allows arbitrary code execution in the context of the current user when a victim opens a crafted FrameMaker document. Exploitation is file-based and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 7.8 HIGH): the attacker must socially engineer the target into opening malicious content, and the resulting code runs with only that user's privileges rather than gaining system-level control. No confirmed active exploitation or publicly available exploit code was identified at time of analysis, but the full confidentiality, integrity, and availability impact makes prompt patching important for engineering and technical-publishing environments that routinely exchange FrameMaker files.

Remote code execution in Remote Desktop Client can be triggered when a user connects to an attacker-controlled or compromised RDP server, due to a use-after-free in the client. The attacker does not need credentials (PR:N), but the victim must initiate the outbound RDP session (UI:R), so environments that restrict outbound RDP to trusted hosts are less exposed; successful exploitation runs code in the context of the connecting user. No public exploit identified at time of analysis; this is a serious client-side vulnerability but not an emergency because the attacker cannot reach the client unsolicited.

Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker to gain elevated privileges by exploiting a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires local access (PR:L) and high attack complexity (AC:H), but successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 7.0). No public exploit code or active exploitation has been identified at time of analysis.

Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an authenticated low-privileged attacker to execute code at a higher integrity level on affected Windows 10 and Windows 11 systems. The flaw is a use-after-free (CWE-416) in a default Game DVR/broadcast component; exploitation requires existing local access (AV:L/PR:L) and success is limited by high attack complexity (AC:H) due to a specific memory-reuse or race condition. No user interaction is needed (UI:N), there is no network attack vector, and no public exploit identified at time of analysis (no KEV or POC data was provided).

Type confusion (CWE-843) in Microsoft .NET and Visual Studio allows an unauthenticated remote attacker to elevate privileges when a victim opens, loads, or builds attacker-supplied content in developer tooling, rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not zero-click: an attacker must socially engineer a developer into processing a malicious file, project, or package so the type-confusion code path is reached, and the practical limiting factor remains that user-interaction requirement. No CISA KEV entry, no public exploit code, and no EPSS data were provided at time of analysis, so this is a credible high-priority issue but with important caveats.

Local privilege escalation in the Windows VHD miniport driver allows an authenticated attacker with low privileges to execute arbitrary code in kernel mode, resulting in full system compromise. This use-after-free (CWE-416) vulnerability requires the attacker to already possess low-privileged local access and the ability to interact with the virtual disk subsystem. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and EPSS data is not available; the CVSS score is 7.8.

Local privilege escalation in the Windows StateRepository API allows an attacker who already has code execution as a low-privileged, authenticated user to trigger a type-confusion condition and gain higher-integrity code execution on the same machine. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw is not reachable remotely and requires no user interaction, but it cannot serve as an initial-access vector - it is a post-compromise escalation primitive that assumes a local foothold and valid credentials. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); combined with the local-only attack path, this is a credible but not emergency-tier internet-facing threat.

Use-after-free memory corruption in Windows Hyper-V allows an authenticated low-privileged attacker who already has code execution inside a guest VM to trigger memory corruption in the hypervisor and, per the assessed scope change, likely cross the guest-to-host boundary with high confidentiality, integrity, and availability impact. The CVSS:3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, so the flaw is local, low-complexity, requires low privileges, needs no user interaction, and has Changed scope; it is not a remote unauthenticated network-reachable bug. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV active-exploitation entry was provided.

Privilege escalation in the Windows Win32k kernel subsystem lets an authenticated local attacker who already holds a low-privileged foothold (CVSS PR:L, AV:L) corrupt kernel memory via a use-after-free (CWE-416) and elevate to SYSTEM-level code execution with high confidentiality, integrity, and availability impact. Because the vulnerability depends on a timing-sensitive race or a specific memory-reclamation state, the attack complexity is rated high (AC:H) and success is non-deterministic, confining this to post-compromise escalation rather than initial access; no user interaction is required (UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS base score of 7.0 reflects the local-only vector tempered by the unreliable race condition.

Remote code execution in Windows RPC Runtime (CVSS 8.8) arises from a type confusion flaw (CWE-843) that an unauthenticated attacker can trigger over the network, though exploitation requires user interaction-such as connecting to an attacker-controlled RPC endpoint or processing a malicious server response. No public exploit code has been identified at time of analysis, but the high impact and unauthenticated nature make this a high-priority issue for patching.

Local privilege escalation in Microsoft Windows Media Foundation (CVSS 3.1 7.8, High) lets an attacker who already holds low-privileged authenticated code execution on a Windows host corrupt memory via a use-after-free and elevate to a higher-integrity context. The flaw requires no user interaction (UI:N) and has low attack complexity (AC:L), but it is strictly local - there is no network vector and scope remains unchanged, so a pre-existing foothold is a hard prerequisite. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); risk is therefore primarily relevant to post-compromise escalation and defense-evasion chains rather than initial access.

Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) lets a low-privileged, already-authenticated user on the same machine trigger a use-after-free condition and obtain higher-integrity code execution, with full confidentiality, integrity, and availability impact scored at CVSS 7.0. Microsoft's authoritative fix information is published through the MSRC Security Update Guide entry for CVE-2026-102197; exploitation is not remotely reachable and is complicated by the high attack complexity of the underlying race/timing-dependent heap condition, and no public exploit code has been identified at time of analysis. This is a legitimately serious local elevation-of-privilege flaw but not an emergency.

Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to elevate privileges by exploiting a use-after-free condition. The service is a default component on Windows client installations, and exploitation requires no user interaction, making it a reliable post-compromise escalation vector for low-privileged users. No public exploit code or active exploitation has been identified at time of analysis, but the issue is considered credible and actionable for multi-user systems.

Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds low-privileged, authenticated local access to a Windows client host corrupt memory via a use-after-free (CWE-416) and potentially gain full system-level read, write, and execute control. The vulnerability is rated CVSS 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable, requires no user interaction, but is gated by high attack complexity - exploitation likely depends on winning a race condition or precise heap grooming, so success is probabilistic rather than guaranteed. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the EPSS-style risk signal is not provided, and Microsoft's MSRC update guide is the authoritative source for the fix.

No public exploit identified at time of analysis for a local privilege-escalation use-after-free (CWE-416) in the Windows Graphics Kernel that allows an authenticated attacker with low privileges to elevate to higher privileges, potentially achieving SYSTEM-level code execution. The vulnerability requires local access and high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), as the exploit likely depends on winning a race condition or reliable kernel-heap grooming. No active exploitation is confirmed, and no patch version is specified; apply Microsoft's update when available and monitor the advisory.

Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker to elevate privileges on the host by triggering a use-after-free. The flaw affects Windows systems where the service is present, requires local access and high attack complexity, and no public exploit code has been identified at time of analysis. Successful exploitation could result in full compromise of confidentiality, integrity, and availability of the affected system.

Remote code execution in Microsoft QUIC (MsQuic) is possible for unauthenticated network attackers via a use-after-free (CWE-416), with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The independent assessment adjusts the attack complexity to High (AC:H), since exploitation requires a reachable QUIC/UDP endpoint running a service built on the MsQuic stack, such as an HTTP/3 listener on UDP 443 or an SMB-over-QUIC file server. No public exploit code has been identified at time of analysis, and weaponization demands precise heap manipulation to turn the memory corruption into code execution.

Remote code execution in the Remote Desktop Gateway Service (Windows Server) via a use-after-free memory corruption flaw (CWE-416) allows an unauthenticated network attacker to execute code with high impact. Although the assessed vector (AV:N/AC:H/PR:N/UI:N) requires no authentication or user interaction, the high attack complexity means exploitation depends on winning a memory-reuse race, making success probabilistic. No public exploit code or confirmed active exploitation has been identified at time of analysis, and organizations that restrict RD Gateway exposure behind VPN/MFA or do not deploy the role are materially less exposed.

Remote code execution in Microsoft Excel allows an unauthorized attacker to execute arbitrary code when a victim opens a crafted spreadsheet, per the vendor advisory for CVE-2026-100212. The issue is a use-after-free (CWE-416) reachable over the network with no privileges required (AV:N/PR:N), but exploitation is gated by user interaction (UI:R) and runs in the security context of the user who opens the file (S:U). No public exploit identified at time of analysis, and the independent assessment rates it a credible prioritization candidate but not an emergency.

Code execution in Microsoft Excel can be triggered when a victim opens or previews an attacker-crafted workbook, exploiting a use-after-free (CWE-416) in file parsing. The flaw is remotely reachable with low complexity and no privileges per CVSS (PR:N), but requires user interaction (UI:R), so exploitation depends on file delivery and social engineering rather than self-propagation. No public exploit was identified at time of analysis and no CISA KEV confirmation was provided; the risk is high-priority but not an automatic emergency given the user-interaction requirement.

Use-after-free memory corruption in Microsoft Office Excel allows remote, unauthenticated attackers to execute arbitrary code in the context of the user who opens a crafted spreadsheet (CVSS 3.1 base 8.8, High; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is client-side and hinges on user interaction: the victim must open or preview an attacker-supplied Excel document, so delivery depends on a social-engineering lure (email attachment, hosted file, or file-share link) and resulting code runs only at the privilege level of the opening user. No public exploit code and no confirmed active exploitation (CISA KEV) were identified in the available intelligence at time of analysis, and Protected View plus Mark-of-the-Web handling of files from untrusted sources materially constrains realistic exploitation.

Unauthenticated remote code execution in Windows Message Queuing (MSMQ) Queue Manager affects systems where the optional MSMQ feature is installed and reachable. The use-after-free (CWE-416) in the Queue Manager allows an attacker to execute arbitrary code over the network without authentication, but the attack surface is significantly limited because MSMQ is not enabled by default and must be exposed on TCP port 1801 (or related ports). No public exploit code has been identified at time of analysis.

Local privilege escalation in the Windows Update Service on Microsoft Windows allows an authenticated attacker with low privileges to gain full control of a host by exploiting a use-after-free memory corruption flaw. The vulnerability requires high attack complexity to win a race condition, and no public exploit code has been identified at time of analysis. The CVSS 3.1 base score is 7.0 (HIGH), with full impact to confidentiality, integrity, and availability upon successful exploitation.

An out-of-bounds write in Commvault's CvFWD network-communication daemon allows a low-privilege authenticated attacker who can reach the service over the network to crash it, producing a denial of service against the affected Commvault component. The flaw is availability-only (CVSS 4.0 7.1, VA:H with VC:N/VI:N) and offers no path to data disclosure or code execution; it affects Commvault Cloud deployments, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale, until the resolved maintenance release is applied. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Use-after-free in FreeRDP's smartcard redirection allows a malicious RDP server to corrupt memory on a connecting client, potentially leading to crashes or code execution. Affected versions are 3.0.0-beta1 through 3.31.x; exploitation requires the victim to connect to an attacker-controlled server with the smartcard channel active, and no public exploit identified at time of analysis.

An uncontrolled out-of-bounds write in NVIDIA DALI (the Data Loading Library used for GPU-accelerated data preprocessing) allows a locally positioned attacker who already holds low-level privileges to corrupt process memory when a DALI pipeline loads or decodes attacker-influenced input such as a crafted image, media file, or dataset record. A successful exploit can produce denial of service, information disclosure, and data tampering, consistent with the vendor rating of 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), which requires local access, low privileges, and user interaction (a victim or process must ingest the malicious data). There is no CISA KEV listing and no public exploit identified at time of analysis, so practical risk is concentrated in multi-tenant training clusters, pipelines consuming externally sourced datasets, and services that accept user-submitted media for GPU preprocessing rather than in default in-house-only deployments.

A use-after-free in Mozilla Firefox's Networking component can be escalated into a sandbox escape, meaning a malicious page can corrupt freed memory and break out of the browser's content-process sandbox to reach higher-privileged code. Affected are Firefox builds prior to 158 and Firefox ESR builds prior to 153.5; no authentication is required, but exploitation depends on the victim navigating to attacker-controlled web content (UI:R), consistent with the assessed CVSS:3.1 vector of 9.6 and the SSVC 'not automatable' rating. Vendor-released patches exist in Firefox 158 and Firefox ESR 153.5; at time of analysis there is no public exploit identified, no CISA KEV listing, and no confirmed in-the-wild activity.

Sandbox escape and site-isolation bypass in Mozilla Firefox allow unauthenticated remote attackers to break the browser's security boundary by triggering a use-after-free in the Networking component. Affected are Firefox versions before 158 and Firefox ESR before 153.5; exploitation requires the victim to load attacker-controlled web content, meaning no autonomous trigger exists. No public exploit identified at time of analysis, though the 9.6 CVSS score and total technical impact warrant urgent patching.

A type-confusion miscompilation in Mozilla Firefox's JavaScript JIT engine (CWE-843) lets remote attackers corrupt memory and potentially read or modify data inside the browser process when a user loads attacker-controlled JavaScript. Exploitation is unauthenticated over the network (PR:N) but requires user interaction (UI:R) - the victim must visit or render hostile content with JavaScript enabled on an unpatched build. The issue is fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; no public exploit code or confirmed active exploitation has been identified, and the EPSS score is low at 0.16% (5th percentile), making this a serious but not emergency-tier browser flaw.

Denial of service is possible in libwebsockets because the LEJP JSON parser's pre-patch bounds checks in lib/misc/lejp.c permit a one-past-the-end write into the fixed-size ctx->i[] and ctx->st[] arrays when deeply nested JSON is parsed. The flaw is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but the affected target is the main-branch commit 106d542c rather than a confirmed released version, and exploitability depends entirely on whether the host application routes attacker-controlled JSON into lejp_parse(); impact is limited to availability (a crash), with no code execution or data disclosure indicated. EPSS is 0.29% (20th percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis, although upstream fixes exist in commits 736a4a2 and c404a20.

An out-of-bounds write in the language-processing functionality of Progress MarkLogic Server lets an authenticated remote user with only low-level privileges crash or destabilize the server and, more narrowly, modify limited data. Only MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms availability is the dominant impact while confidentiality is untouched and integrity impact is limited. The mandatory pre-existing authenticated session is the primary limiting factor, so the realistic threat is an insider or an attacker who already holds valid credentials, and no public exploit code and no confirmed active exploitation were identified at time of analysis.

Memory corruption through a use-after-free (CWE-416) in the JavaScript engine integration of Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 can lead to controlled process failure, server instability, or corrupted memory state. Exploitation is not anonymous: the assessed vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) requires a high-privileged account that can already execute server-side JavaScript, and the high attack complexity indicates the defect depends on specific timing or state conditions that are not reliably achievable on demand - so realistic abuse is confined to trusted, insider, or post-compromise contexts. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixed versions 12.1.0 (12.x track) and 11.3.7 (11.x track).

Use-after-free in GNOME Mutter's Wayland color-management (wp_image_description_v1) path allows a local, authenticated attacker who can run a malicious Wayland client to destroy the image-description resource while an asynchronous ICC file read is still in flight, after which the compositor writes into freed memory and frees a pointer derived from it - typically crashing the GNOME session and potentially enabling code execution inside the compositor process. The flaw is local-only and timing-dependent (it requires winning a race window), only applies to Wayland sessions where the color-management/ICC path is exposed (not X11-only sessions or builds without that code path), and no public exploit code or CISA KEV entry has been identified at time of analysis; in practice the more likely outcome is a session crash rather than reliable code execution. This is a credible local privilege/code-execution risk but not an urgent internet-facing emergency.

An out-of-bounds write in the native library libsamsungtts.so, part of the Samsung Text-to-Speech engine shipped on Samsung Android builds, allows code running locally on the device to corrupt memory and achieve arbitrary code execution in the TTS process context. The vulnerable component is reachable without special privileges or user interaction (CVSS 4.0 PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must already have a malicious or compromised app or local process able to invoke the TTS engine and supply crafted input; there is no remote/network exploitation path. Samsung addresses the flaw in the SMR Oct-2026 Release 1 maintenance update, and no public exploit code has been identified at time of analysis.

Local privilege escalation in Samsung's WSM service lets a malicious or compromised process already running on the device trigger a use-after-free and execute arbitrary code with system-level privileges. The flaw affects Samsung mobile firmware builds released before SMR Oct-2026 Release 1; remote network exploitation is not possible because the attacker must first have local code execution able to reach the WSM interface. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but the cross-boundary impact (scope change with high confidentiality, integrity and availability impact) makes prompt installation of the October 2026 security maintenance release the priority for any unpatched device.

Out-of-bounds write in Samsung's libsmkvextractor.so media-extraction library allows arbitrary code execution on Samsung mobile devices running firmware prior to SMR Oct-2026 Release 1. Exploitation requires local access - an attacker must already hold a foothold on the device or get a crafted MKV/Matroska media file into a local parsing path - yet the CVSS 4.0 vector requires no privileges and no user interaction (AV:L/PR:N/UI:N), and our independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) rates the impact as high integrity, low confidentiality, and low availability. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.

Out-of-bounds write in libnfs through 6.0.2 lets an attacker-controlled or man-in-the-middled NFS/RPC server corrupt memory in a client application linked against the library: the ZDR decoders libnfs_zdr_bytes(), libnfs_zdr_string() and libnfs_zdr_array() do not honour the caller-supplied maxsize, so a wire-declared length larger than the caller's preallocated buffer is accepted and copied past its end. The assessed CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, i.e. an unauthenticated remote server can trigger it but the victim must first connect to that server (UI:R), and impact is limited to integrity plus high availability loss rather than data disclosure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the flaw only affects callers that pass a non-zero, non-~0 maxsize with their own fixed-size storage, since zero/0xFFFFFFFF lengths remain intentionally unbounded.

Use-after-free in the Zephyr RTOS Bluetooth LE host lets an adjacent, unauthenticated peer with an established L2CAP connection-oriented channel (CoC) on a dynamic PSM (0x0080-0x00FF) leave a pending work item pointing into channel memory that the application has already been told it may free. The attacker only needs to send a data K-frame immediately followed by an L2CAP Disconnect Request; because the Bluetooth RX workqueue outranks the system workqueue under cooperative scheduling, the deferred rx_work item cannot run before teardown, so the stack's released() callback fires while the system workqueue still holds a reference, producing memory corruption, information disclosure, or a corrupted workqueue pending list. The vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N) reflects adjacent-only access, no privileges, and a scheduling race that must be won, and realistic exploitability is further reduced by the requirement that the application free or re-accept the channel in released(). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; an upstream fix commit is available.

An out-of-bounds write of up to 127 bytes in the Zephyr RTOS NXP MCUX TRNG entropy driver (drivers/entropy/entropy_mcux_trng.c) allows a locally-present attacker to corrupt memory immediately following a caller-supplied buffer on affected NXP i.MX RT5xx/RT6xx SoCs. Because entropy_get_entropy() is a syscall whose verifier (K_SYSCALL_MEMORY_WRITE) checks only the requested length, an unprivileged user-mode thread that has merely been granted the entropy device can supply a length such as 1 and an arbitrary destination, causing the kernel to write 128 bytes where 1 was proven to be owned; on these Cortex-M33 parts there is no MMU, so the overflow can land in adjacent kernel state. The same defect is reachable from kernel mode via getentropy() or sys_rand8_get()/sys_rand16_get() where those resolve to the hardware generator. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but exploitation is local, deterministic in offset, and low complexity, which the assessed vector captures as AV:L/AC:L/PR:L with changed scope and high integrity impact.

Local privilege escalation and sandbox escape in Zephyr RTOS affects builds with CONFIG_USERSPACE enabled that include a fuel-gauge driver: the syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() size kernel-side variable-length arrays directly from an unvalidated caller-supplied len, letting any user-mode thread displace the supervisor stack and, where the caller holds fuel-gauge object permissions, write len * sizeof(union fuel_gauge_prop_val) bytes of attacker-controlled data into privileged memory. The outcome is an out-of-bounds write executing in supervisor mode with attacker-chosen length and content, leading to kernel code execution or a device crash; with the default CONFIG_PRIVILEGED_STACK_SIZE of 1024 bytes, a len of roughly 170 is sufficient to overrun the privileged stack, and a hardware stack guard does not contain it because the copy begins below the guard and walks upward. CVSS 3.1 rates this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the vector requires the attacker to already hold a low-privilege foothold - here, the ability to execute a user-mode thread on the device - and no public exploit code has been identified at time of analysis.

Out-of-bounds read and write in the CPC sketch deserialization path of Apache DataSketches C++ (datasketches-cpp) - specifically cpc_sketch::deserialize() called on a byte buffer or a stream - allows a crafted serialized sketch to corrupt heap memory: the decompressor reads past the end of the compressed data because the read position was only checked after decoding finished, and in the hybrid flavor it writes outside an internal heap buffer because decoded row indices were not validated, crashing the process with potential for further exploitation. All releases from 2.0.0-incubating before 5.3.0 are affected, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote, unauthenticated impact, but reachability is conditional: only applications that deserialize CPC sketches from untrusted sources are exposed, since the flaw lives in a C++ library whose attack surface depends on the embedding application. Exploitation signals are mixed and should be weighed carefully - EPSS is only 0.19% (8th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.

An out-of-bounds stack write in the MariaDB CONNECT storage engine's DOS table type lets an authenticated user crash the server and potentially achieve code execution by supplying a crafted column definition and value. The flaw is an incorrect boundary check in the CONNECT value conversion routine that permits a one-byte null write past a stack buffer at an attacker-controlled offset (CWE-787), and it affects MariaDB from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Exploitation requires the non-default CONNECT engine to be installed and enabled plus privileges to create CONNECT tables of table_type 'dos' with a crafted numeric definition such as double(255,30); the vendor rates it CVSS 8.5 while the independent assessment is slightly lower (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because authentication, a non-default engine, and high attack complexity are needed, and no public exploit code was identified at time of analysis.

Code execution inside the gVisor sentry process is achievable by a local attacker holding standard container privileges on any platform running a gVisor build prior to release 20260831.0, due to a use-after-free/double-free of the MemoryFile backing an in-sandbox overlay filesystem in the virtual filesystem (VFS) mount layer. The issue is local-only and requires authenticated in-sandbox access (CVSS 4.0 vector AV:L/PR:L), and the resulting code execution lands in the sentry, which remains confined by host-level Linux seccomp and namespace boundaries rather than directly in the host kernel, so a single exploitation does not automatically yield host-kernel compromise or cross-tenant escape. No public exploit code was identified at time of analysis, but the trigger path is documented in the upstream fix's regression tests.

Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread, in builds that enable both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT, to pass a user-writable kernel object - most practically a thread stack from k_thread_stack_alloc() or a granted static K_THREAD_STACK - to the device_deinit() syscall and achieve supervisor-mode code execution. The flaw is a type-confusion issue in z_vrfy_device_deinit(): validation with K_OBJ_ANY skips the object type comparison, so z_impl_device_deinit() treats attacker-written bytes as a struct device and follows attacker-controlled state and ops.deinit pointers. The upstream fix is available via commit 1036694889ab33996db41b4141ddf66aa786d267, no public exploit code was identified at time of analysis, and impact is gated by the required build configuration; v4.2.x and v4.3.x defaulted the vulnerable option to y, while v4.4.x is exposed only if explicitly enabled.

Type confusion in FalkorDB versions before 4.20.0 allows an authenticated client that can issue GRAPH.QUERY to crash the server and, depending on heap layout, potentially disclose or corrupt memory. The flaw lives in the _read_flags handler in src/commands/cmd_dispatcher.c, which accepts a --bolt argument from any client and blindly casts the following Redis string object to a bolt_client_t structure without verifying its origin, so result-set code later dereferences attacker-influenced pointers; the argument is parsed even when the Bolt endpoint is disabled, meaning default installations are exposed. Exploitation requires valid credentials with query-execution rights, and because of the high attack complexity (AC:H) a denial-of-service crash is the most reliable outcome, with memory disclosure or corruption being layout-dependent and not guaranteed; no public exploit code has been identified at time of analysis and the vendor has released a fixed version. This is assessed as a moderate-priority issue rather than an emergency.

Heap-based out-of-bounds write in FalkorDB's Bolt/WebSocket handling (all versions before 4.20.0) allows a remote unauthenticated attacker to crash the server and potentially corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The flaw spans ws_read_frame in src/bolt/ws.c and buffer_apply_mask in src/bolt/buffer.c, where the only length check is an ASSERT() that is compiled out of release builds, so the masked XOR operation runs past the end of the receive buffer. Impact is limited to deployments that explicitly enable the Bolt endpoint via BOLT_PORT, which is disabled by default; no public exploit code has been identified at time of analysis.

FalkorDB instances that explicitly enable the optional Bolt wire-protocol endpoint can be crashed, and possibly have arbitrary code executed, by an unauthenticated remote attacker who sends a single crafted Bolt RESET message with an attacker-chosen 16-bit chunk size. The vulnerability is a heap-based out-of-bounds write (CWE-787) in BoltReadHandler in src/bolt/bolt_api.c present before version 4.20.0; the size check is performed only with ASSERT(), which is compiled out of release builds, so production binaries provide no runtime guard. Exploitation requires the Bolt port (BOLT_PORT) to be enabled and network-reachable - it is disabled by default and is the decisive precondition that sharply limits the exposed population; with no CISA KEV entry and no public exploit code identified at time of analysis, reliable denial of service is the confirmed impact while remote code execution remains a theoretical possibility that has not been demonstrated.

Arbitrary code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) when an attacker who already holds administrative privileges on the appliance and can reach the local management interface supplies input that overflows a fixed-size stack buffer. The assessed CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with CWE-787 as the root cause, so the flaw is high-severity on impact but gated by a strong prerequisite: administrative control of the management plane rather than unauthenticated reach. Patch available per vendor advisory (IBM support page node/7291628); there is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC decision points record Exploitation: none, Automatable: no, Technical Impact: partial.

Memory corruption in MongoDB libmongocrypt lets an authenticated actor who can modify key vault documents - or a malicious or compromised MongoDB server - crash or corrupt the memory of any client application that has Client-Side Field Level Encryption (CSFLE) or Queryable Encryption enabled. The trigger is a crafted key document containing duplicate masterKey fields, which causes provider-specific KMS data to be mis-typed during key-document cleanup, producing invalid memory access and invalid frees (CWE-843 type confusion). Scored 8.7 under CVSS 4.0, while our own assessment is more conservative at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H, placing the confirmed impact at client-side crash and memory corruption rather than proven remote code execution; no public exploit code identified at time of analysis, and exploitation requires that encryption be in use plus key-vault write privileges (PR:L) or a hostile server.

Denial of service in IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 allows an attacker who already holds a valid low-privileged account to trigger improper memory allocation during key derivation, corrupting memory and rendering the gateway unavailable (CVSS 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Because the vector requires PR:L, the flaw is not exploitable pre-authentication, and its scope-changed rating reflects that the availability impact can extend past the initially compromised security boundary; there is no confidentiality or integrity impact. Patch available per vendor advisory and no public exploit identified at time of analysis, so risk is concentrated in unpatched appliances where an attacker can obtain even limited authenticated access.

Unauthenticated remote attackers can trigger a use-after-free in IBM DataPower Gateway, resulting in a denial of service and potential disclosure of sensitive information held in freed memory. The flaw affects the 10.5.0 branch (10.5.0.0 through 10.5.0.22), the 10.6.0 branch (10.6.0.0 through 10.6.0.10), the 10.6CD/10.6.1 branch (10.6.1 through 10.6.6), and the 11.0.0 branch (11.0.0.0 through 11.0.0.2); the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:H) rates it 9.1, but exploitation requires the gateway endpoint to be network-reachable and, as a memory-safety bug, reliable triggering typically depends on request sequencing and allocator/timing state. There is no public exploit identified at time of analysis, EPSS is low at 0.24% (14th percentile), and CISA's SSVC framework records exploitation as none and automatable as no - signals are therefore mixed between a high headline severity score and a low observed exploitation likelihood. A vendor patch is available per IBM's advisory.

A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrupt memory and potentially allow an attacker to fully compromise the affected appliance, as reflected in the assessed CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with the flaw reachable in the normal network-processing path since no authentication, user interaction, or special configuration is required. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the unauthenticated network attack surface and memory-corruption impact make this a genuine high-priority issue for exposed deployments; IBM has published a vendor fix via its support advisory.

Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance supplies crafted oversized input to a component that performs improper bounds checking, allowing an out-of-bounds write and, potentially, execution of arbitrary code in the appliance's process context. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; IBM has published a vendor fix, and no public exploit code was identified at time of analysis. Note that the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) characterizes this as remotely exploitable without privileges, which is inconsistent with the description's requirement for a local user and with the independent assessment of AV:L/AC:L/PR:L/UI:N - the local-access prerequisite is the practical limiter on real-world risk, while the impact if triggered remains full confidentiality, integrity, and availability loss.

Out-of-bounds write in IBM DataPower Gateway lets a remote, unauthenticated attacker corrupt memory and potentially execute arbitrary code on affected gateway builds (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2), as reflected in the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.1. The PR:N/UI:N components mean no credentials or user interaction are required, so any network-reachable instance on an affected build is exposed, though the AC:H rating indicates exploitation depends on satisfying a non-trivial condition - most likely a specific input state, parsing path, or memory layout - to escalate the write beyond a crash into reliable code execution. Vendor patch data indicates a fix is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis; the EPSS score was not provided in the underlying intelligence, so no probabilistic exploitation estimate can be quoted.

Unauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 - stemming from an out-of-bounds write (CWE-787) that corrupts memory and can be leveraged to run attacker-controlled code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the flaw is reachable over the network with no authentication and no user interaction, making any internet- or partner-facing DataPower instance running an unpatched build a high-priority target. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; patch available per vendor advisory (IBM support page node/7289775), with the specific fixed firmware builds published there.

IBM DataPower Gateway can be driven into a denial-of-service condition by a remote, unauthenticated attacker who supplies input that reaches a flawed sorting comparator, causing the comparator to violate strict-weak-ordering and triggering an out-of-bounds memory access (CWE-787) that can crash or destabilize the affected service. All builds in the 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 ranges are affected; the impact is confined to availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect and no privilege gain. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and IBM has published a fix via its support advisory, so this should be treated as a patching-priority availability risk rather than an emergency.

Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gateway and cause a denial of service. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, so any attacker who can reach a listening interface and deliver a crafted request to the vulnerable parsing path can trigger the fault. The assessed impact is availability-only (A:H, C:N/I:N) rated 8.2 High; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is governed mainly by network exposure of the gateway's listening interfaces. This is a genuine but tier-two priority issue rather than an emergency, with patches available from IBM.

A type confusion flaw (CWE-843) in IBM DataPower Gateway lets a remote, unauthenticated attacker crash a reachable gateway service, producing a denial-of-service condition. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a network-reachable, low-complexity, unauthenticated trigger with availability-only impact. IBM has published a vendor fix via its support advisory, and no public exploit code has been identified at time of analysis (no CISA KEV listing).

Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in disclosure of sensitive information and denial of service. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with a CVSS 3.1 base score of 8.6 driven by high availability impact alongside limited confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and IBM has made a fix available through its support advisory, so this is a credible operational priority rather than a confirmed emergency - exposure depends on whether the gateway's network listeners are reachable by the attacker.

Denial of service in IBM DataPower Gateway affects releases 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, where crafted network input reaching the vulnerable parsing path overflows a buffer and can crash the affected service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), exploitation requires no authentication and no user interaction, so any internet- or partner-facing listener that processes malformed input is exposed; impact is availability-only - a crash/restart condition rather than data exposure or code execution. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), so this is a genuine but bounded operational risk that depends primarily on whether affected listeners are reachable from untrusted networks.

An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows an unauthenticated remote attacker to corrupt gateway memory, most reliably causing a denial of service and potentially enabling partial confidentiality or integrity compromise. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), and the vector's PR:N/UI:N components confirm no credentials or user interaction are required to reach the vulnerable code - the practical limiting factor is whether the attacker's network can reach a DataPower service listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix via IBM Support (node/7289775).

Remote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, because an out-of-bounds write in the RFC2047 encoded-word parser can corrupt memory and be leveraged to run arbitrary code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) indicates the flaw is network-reachable with low complexity, requires no credentials and no user interaction, and carries full confidentiality, integrity, and availability impact, though exploitation depends on a reachable service or flow that passes attacker-controlled data through MIME encoded-word decoding. According to available intelligence there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the primary source is IBM's advisory at https://www.ibm.com/support/pages/node/7289775.

Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or degrade an affected gateway by sending crafted input that the product fails to validate correctly, resulting in an out-of-bounds write in memory. All four supported release trains are affected: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms the attack is launched over the network with no authentication and no user interaction, and that the sole impact is availability - there is no confidentiality or integrity loss, so the risk is bounded to service outage on gateways whose vulnerable interface is reachable from untrusted networks. No public exploit code has been identified at time of analysis, no EPSS score was supplied, and CISA KEV does not list this CVE.

A heap buffer overflow in IBM DataPower Gateway (affected firmware levels 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows remote attackers to crash the service and cause a denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, privileges, or user interaction are required, so any reachable affected gateway is a candidate target. Impact is confined to availability - the vendor reports no confidentiality or integrity loss and no code execution. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); this is a genuine availability risk but not a top-tier emergency, with practical exposure limited by how broadly the gateway's data-plane and management interfaces are reachable.

Denial of service in IBM DataPower Gateway lets unauthenticated remote attackers send crafted network traffic that triggers an out-of-bounds write (CWE-787), degrading or halting the gateway's availability. The flaw affects version lines 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, scoring CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with availability-only impact. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but IBM has published a vendor fix, so internet-facing gateways should be treated as the highest-priority upgrade target.

Denial of service via out-of-bounds slice access in the Nickname profile of golang.org/x/text/secure/precis (all versions before 0.41.0), where transforming crafted input into a short destination buffer triggers a Go runtime panic. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5), but impact is confined to availability (C:N/I:N/A:H) because Go's memory-safe runtime converts the invalid slice access into a panic rather than exploitable memory corruption. Applications are only exposed if they actually invoke the precis Nickname profile on attacker-controlled strings such as usernames or nicknames; projects that merely depend on x/text without hitting that code path are unaffected. No public exploit identified at time of analysis, and vendor-released patch: golang.org/x/text 0.41.0.

Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running in ACI mode, and NX-OS-based software managed through Cisco UCS - carry a vendor CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated attacker with network reachability could potentially cause high confidentiality, integrity, and availability impact. The issues were discovered during a Cisco internal security review and are delivered as part of a bundled software hardening release rather than a single pinpointed defect, so the affected subsystem, protocol, or port is not enumerated in the available data. At time of analysis there is no public exploit identified, CISA SSVC records exploitation as 'none' with automatable 'no', and EPSS is low at 0.28% (19th percentile), indicating manual, targeted rather than scalable risk.

Heap memory corruption in llama.cpp's chat/tool parser lets unauthenticated remote attackers crash llama-server and potentially shape a controlled heap write primitive by sending a crafted POST /completion request containing a chat_parser that emits a tool-id token after a tool-close tag. Versions prior to build b11393 are affected; the trigger leaves the mapper's current_tool pointer dangling, producing a use-after-free and double-free in common_chat_peg_mapper::map. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 4.0 score of 9.2 reflects high confidentiality, integrity and availability impact, and the independent assessment confirms high severity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) - reliable denial of service is straightforward, while converting the bug into a controlled heap write requires heap grooming. A vendor patch exists as upstream PR/commit and as build b11393.

Out-of-bounds write in the TLS 1.3 client of Eclipse ThreadX NetX Duo 6.5.1.202602 allows a malicious or compromised server to corrupt memory in the session control block by sending an oversized handshake message before certificate authentication completes, potentially achieving code execution or causing denial of service. The flaw is client-side and unauthenticated from the network perspective, requiring the victim device to initiate a TLS 1.3 handshake to an attacker-controlled server; no valid server certificate is needed and certificate pinning does not prevent exploitation. No public exploit code was identified at time of analysis, but the CVSS 9.3 base score and the pre-authentication nature make this a high-priority memory-corruption issue for affected embedded deployments.

Unauthenticated attackers within radio-frequency (RF) proximity can crash the WIPS sensor service on affected Arista access points or potentially achieve remote code execution by sending a crafted frame. The vulnerability, an out-of-bounds write (CWE-787), affects APs with Wireless Intrusion Prevention System (WIPS) enabled and requires no wireless association, authentication, or user interaction. No public exploit has been identified at time of analysis; the CVSS 4.0 score is 8.7, and while not a mass-internet-exploitation emergency, it is an operational-priority issue for Arista wireless environments because successful exploitation disables WIPS monitoring and may allow code execution on the AP.

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript or EPS document, chaining memory corruption in document parsing with a runtime bypass of the -dSAFER sandbox. The flaw affects Ghostscript as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no privileges are required but a victim or automated pipeline must render the malicious file, with the malicious document first reaching the processing system. Publicly available exploit code exists, including a GitHub proof-of-concept, but the provided data does not confirm CISA KEV active exploitation, so -dSAFER should not be treated as a protective mitigation for affected versions.

Use-after-free in Google Chrome's CSS handling affects builds prior to 155.0.8059.39 and allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), yet Google assigned it Chromium severity Low because the resulting code execution is confined to the browser sandbox and requires user interaction - full host compromise would require chaining a separate sandbox-escape bug. No public exploit identified at time of analysis, and a vendor patch is available.

Code execution outside the Chrome sandbox is possible in Google Chrome desktop builds prior to 155.0.8059.39, where a use-after-free in the network component (CVE-2026-106234, CWE-416) can be triggered by a crafted Chrome extension that a remote, unauthenticated attacker convinces a victim to install. The UI:R prerequisite - social engineering the user into installing the extension - is the primary limiting factor, which is why the vendor assigned a Chromium security severity of Low even though the assessed CVSS is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and technical impact is rated total in the CISA SSVC framework; the high CVSS and the Low vendor severity are sharply conflicting signals. No public exploit identified at time of analysis (SSVC exploitation: none), and a vendor patch is available.