Memory Corruption

A use-after-free issue was addressed with improved memory management. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The issue was addressed with improved memory handling. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

An out-of-bounds write issue was addressed with improved input validation. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

/etc/timezone can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.

/etc/avahi/services/z9.service can be Arbitrarily Written.19.5; BLU-IC4: through 1.19.5. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.

Use-after-free memory corruption in X.Org X server's Xkb extension allows local authenticated attackers to achieve high confidentiality impact, low integrity impact, and high availability impact (CVSS 7.3) through improper resource cleanup during client disconnection. The vulnerability affects Red Hat Enterprise Linux distributions with multiple security advisories released (RHSA-2025:19432 through RHSA-2025:22055). EPSS data not provided, but the local attack vector (AV:L) and low complexity (AC:L) indicate exploitation requires authenticated local access. No CISA KEV listing or public POC identified at time of analysis.

Use-after-free in X.Org X server and Xwayland during Present extension notification processing allows local authenticated users to achieve arbitrary code execution or denial of service. The flaw affects core display server components across multiple Linux distributions, with Red Hat confirming patches through 15 security advisories (RHSA-2025:19432 through RHSA-2025:22055). CVSS 7.3 reflects high integrity and availability impact with low confidentiality impact. No active exploitation confirmed (not in CISA KEV). EPSS data not provided, but the local attack vector and authentication requirement reduce remote exploitation risk despite the severity of potential impact.

Parsing a maliciously crafted CO design file in Ashlar-Vellum Cobalt 12.2.1204.97 (the version identified in the CPE data) can trigger a use-after-free that allows arbitrary code execution in the context of the user running the application. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) shows the flaw is reachable without authentication (PR:N) but is not remotely reachable as a service: it is a local-vector issue that requires mandatory user interaction, meaning the victim must open the file or visit a page that serves it, and any code runs at the privileges of the current, normally non-elevated user (no scope change). Reported through Trend Micro's Zero Day Initiative as ZDI-CAN-26631 / ZDI-25-956, the issue has no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.21% (11th percentile), consistent with a targeted, file-delivery-dependent client-side bug rather than a mass-exploited one.

Denial of service in ISC Kea's kea-dhcp4 DHCPv4 server (versions 3.0.1 and 3.1.1 through 3.1.2) lets a remote, unauthenticated attacker crash the daemon by sending DHCPv4 messages containing certain crafted option content, taking the DHCP service down for the whole subnet. The flaw is conditional: it is reachable only when the operator has set ddns-qualifying-suffix to a non-empty value while leaving hostname-char-set at its default ('[^A-Za-z0-9.-]') and hostname-char-replacement empty; DDNS updates themselves do not need to be enabled for the crash to occur. Exploitation results in availability loss only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); there is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.42% (34th percentile).

Out-of-bounds write in the XML parsing component of GCC Productions' Fade In 4.2.0 lets an attacker corrupt memory on a target system when a victim opens a specially crafted .fadein project file. Because the flaw is triggered by parsing malformed XML content, successful exploitation depends entirely on user interaction - the victim must be persuaded to open an attacker-supplied file - and code execution is confined to the privileges of the user running Fade In (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High). Publicly available exploit code exists per the Talos vulnerability report TALOS-2025-2250, but EPSS is low at 0.34% (25th percentile) and there is no evidence of confirmed active exploitation (CISA KEV), so this is a legitimate memory-corruption bug that is a lower operational priority than its High score suggests.

A use-after-free in the XML parsing component of GCC Productions' Fade In 4.2.0 lets an attacker corrupt heap memory by getting a victim to open a specially crafted .xml file, with the assessed impact being high confidentiality, integrity, and availability loss in the context of that user. The flaw is a local, user-interaction-dependent (AV:L/UI:R, PR:N) client-side issue rather than a remotely reachable server bug, and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is low at 0.34% (25th percentile), reflecting the situational, file-delivery nature of the attack; this is a genuine but narrow client-side risk, not a mass-exploitation threat.

Use-after-free vulnerability in Mozilla Firefox 142 and 143 enables compromised renderer processes to trigger memory corruption in the GPU or browser process via malicious WebGPU IPC calls, potentially achieving sandbox escape. Affecting Firefox versions 142.0 through 144.0.1, this CWE-416 flaw carries CVSS 9.8 despite low real-world exploitation probability (EPSS 0.06%, 18th percentile). No public exploit identified at time of analysis. Patched in Firefox 144.0.2 released January 2025.

IBM Db2 High Performance Unload (HPU) versions 5.1 through 6.5.0.0 IF1 contain an out-of-bounds write (CWE-787) that an authenticated user can trigger with crafted input, causing the utility to crash and resulting in a denial-of-service condition. The vulnerability requires valid credentials (PR:L) and is network-reachable (AV:N) with low complexity (AC:L) and no user interaction, but the assessed impact is limited to availability (A:H) with no confirmed confidentiality or integrity impact and no evidence of code execution. EPSS is low at 0.31% (21st percentile), and no public exploit code or active exploitation (CISA KEV) has been identified.

Uninitialized pointer access in the NVIDIA Virtual GPU Manager lets a malicious guest VM running on a vGPU-enabled hypervisor host corrupt host-side memory, potentially achieving code execution in the hypervisor context, denial of service, privilege escalation, information disclosure, or data tampering. Per the CVSS vector (AV:L/PR:L/UI:N), exploitation requires an attacker to already control a guest with a vGPU assigned and to hold low privileges inside that guest; no network reachability or host-side user interaction is needed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.18% (7th percentile), so this is a moderate, non-urgent priority concentrated in multi-tenant GPU-virtualized deployments.

Remote denial-of-service in libsoup affects GNOME and WebKit-based applications that rely on the library for HTTP/2 client communication. A race in the asynchronous message-queue handling lets a queue item be freed twice when network operations are aborted at precise timing, producing a use-after-free that crashes the consuming application. Red Hat reported the issue and has shipped errata fixes; there is no public exploit identified at time of analysis and the flaw is confined to availability impact (no code execution or data exposure indicated).

Denial of service in MongoDB Server (7.0 before 7.0.25, 8.0 before 8.0.15, and 8.2.0) lets an authenticated user who holds DDL privileges crash the mongod process by issuing a schema-changing command concurrently with an active query workload. The underlying defect is a use-after-free that surfaces as a buffer over-read (CWE-416) and the trigger is a non-deterministic race, so the assessed vector is AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - medium severity, availability-only impact, with no confidentiality or integrity effect. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.27% (18th percentile).

An attacker-supplied PNG image can drive an out-of-bounds heap write in libwebsockets' UPNG decoder when a crafted oversized width value overflows the arithmetic used to size a heap allocation. Only deployments compiled with the non-default LWS_WITH_UPNG flag that also exercise the library's HTML display stack are exposed, and exploitation additionally requires a user to visit an attacker-controlled page serving the malicious PNG, so the realistically reachable population is small. Impact is limited to a crash or denial of service (availability only, no confidentiality or integrity loss); no public exploit code has been identified at time of analysis and EPSS is low at 0.39% (31st percentile).

Use-after-free in the WebSocket server handshake handling of libwebsockets (warmcat) can cause a denial of service when an application embedding the library provides a callback for the LWS_CALLBACK_HTTP_CONFIRM_UPGRADE event. Exploitation requires a specific, non-default configuration where that callback is registered; the attack is network-reachable and unauthenticated but has high attack complexity due to a timing-sensitive condition (AT:P). The impact is limited to availability (no confidentiality or integrity loss), EPSS is low (0.40%, 33rd percentile), and no public exploit or active exploitation has been identified; an upstream fix commit is available.

Denial of service in Envoy Proxy's Lua HTTP filter occurs when a response-phase Lua script rewrites a response body to exceed the configured per_connection_buffer_limit_bytes (default 1MB), forcing a local reply that overrides original response headers and leaves dangling references, resulting in a use-after-free crash. Only deployments that use a Lua HTTP filter to rewrite response bodies are affected; stock Envoy configurations without such a filter are not vulnerable. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.42% (34th percentile).

Double free memory management vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows local apps to trigger unexpected system termination through memory corruption. Affecting iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, macOS Ventura 13.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. No public exploit code or active exploitation confirmed; EPSS score of 0.01% indicates minimal real-world exploitation probability despite moderate CVSS rating.

Network-reachable requests sent to a BIG-IP virtual server that has an Advanced Firewall Manager (AFM) denial-of-service protection profile bound to it can terminate the Traffic Management Microkernel (TMM) process, taking the data plane offline until TMM restarts or a high-availability peer takes over. Exposure is limited to systems where an AFM DoS protection profile is actually configured on a virtual server - a non-default state - and F5 did not evaluate releases past End of Technical Support. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS is low at roughly 0.37% (29th percentile), consistent with the configuration prerequisite. The assessed impact is availability-only (VC:N/VI:N/VA:H) with no confirmed confidentiality or integrity effect.

Denial of service in F5 BIG-IP's Traffic Management Microkernel (TMM) lets a remote, unauthenticated attacker crash the traffic-processing core by sending undisclosed crafted TCP/UDP traffic, but only on systems where the database variable tm.tcpudptxchecksum has been set to the non-default value 'Software-only'; default configurations are not affected. The root cause is a memory-corruption class defect (CWE-787, out-of-bounds write) in TMM's software checksum handling, rated 8.2 under the vendor's CVSS 4.0 vector, while independent assessment with CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) places it lower because the non-default checksum setting is a hard prerequisite (captured as AT:P in the 4.0 vector). EPSS is low (0.35%, 26th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV. Because TMM is shared across virtually every BIG-IP module, an affected appliance loses its data-plane forwarding capability each time TMM terminates.

Memory corruption in F5 BIG-IP SSL Orchestrator (CWE-787 out-of-bounds write) lets unauthenticated remote attackers crash a virtual server when SSL Orchestrator is configured as an explicit forward proxy with the proxy connect feature enabled, producing a high availability impact with no confidentiality or integrity loss. The prerequisites are explicit and non-default - devices without SSL Orchestrator, running it in transparent or inbound mode, or with proxy connect disabled are not affected - and F5 notes that End-of-Technical-Support versions were not evaluated. Risk signals are low: EPSS is 0.35% (26th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, though the vendor's description of 'undisclosed traffic' triggering the corruption leaves the exact trigger uncharacterized.

Use-after-free memory corruption in Adobe Animate 23.0.13, 24.0.10 and earlier allows arbitrary code execution in the context of the current user when a victim opens a maliciously crafted Animate file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) confirms exploitation is local and requires user interaction, delivering code execution only at the victim's privilege level rather than system-wide. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.25% (15th percentile), pointing to opportunistic rather than mass-exploitation risk.

Use-after-free memory corruption in Adobe Substance 3D Stager 3.1.4 and earlier allows an attacker to execute arbitrary code in the context of the current user when a victim opens a maliciously crafted file in the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a client-side, local attack: despite PR:N, the Local vector and required user interaction mean the attacker cannot reach this remotely or autonomously and must socially engineer the victim into opening the file. Exploitation stays within the privileges of the current user with no privilege escalation or scope change, and no public exploit code has been identified at time of analysis (EPSS 0.22%, percentile 11%, indicating low predicted exploitation activity); it is not confirmed actively exploited (CISA KEV).

Arbitrary code execution in Adobe Dimension 4.1.4 and earlier is possible through a use-after-free (CWE-416) triggered when a victim opens a crafted malicious file. The attack is local and requires user interaction, and code runs with the current user's privileges; per the CVSS vector, no privileges are required (PR:N), though social engineering is necessary. EPSS is low at 0.23% (13th percentile) and no public exploit has been identified at time of analysis, making targeted exploitation more likely than opportunistic mass exploitation.

Out-of-bounds write in Adobe Illustrator 29.7, 28.7.9 and earlier allows an attacker to execute arbitrary code in the context of the current user by convincing the victim to open a maliciously crafted file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) confirms this is a local, user-interaction-dependent file-parsing attack rather than a remotely triggerable one: no privileges are required (PR:N), but the victim must open the file (UI:R), and code execution is bounded by the privileges of the account running Illustrator (S:U). No public exploit code has been identified at time of analysis, and the EPSS score is low at 0.21% (11th percentile), so this is a legitimate but moderate-priority vulnerability rather than an urgent emergency; the primary limiting factor is the social-engineering dependency on getting the target to open an attacker-supplied document.

Out-of-bounds write in Adobe Illustrator (29.7, 28.7.9, and earlier) allows arbitrary code execution in the context of the current user when the victim opens a maliciously crafted file. The vector is strictly local and file-based - there is no remote or unauthenticated network path, so an attacker depends entirely on social engineering to get a crafted document opened (CVSS 3.1: AV:L/PR:N/UI:R/S:U, 7.8). No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and EPSS rates exploitation likelihood low at 0.21% (11th percentile), making this a moderate-priority patch-and-remediate item rather than an emergency.

Arbitrary code execution in Adobe FrameMaker (2020.9, 2022.7 and earlier) is possible when a victim opens a maliciously crafted document, because a use-after-free condition in the application's file processing leads to memory corruption. The attack is local and client-side: no privileges are required per the CVSS vector (PR:N), but exploitation is contingent on mandatory user interaction (UI:R), and any code that executes runs only at the current user's privilege level. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS score is low (0.22%, 11th percentile), so this is a serious client-side memory-corruption risk that is not an urgent mass-exploitation priority. Vendor-released patched builds are available through Adobe's security advisory APSB25-101.

Opening a specially crafted file in Adobe Substance 3D Viewer version 0.25.2 and earlier can trigger an out-of-bounds write (CWE-787) that leads to arbitrary code execution with the privileges of the current user. The flaw is exploitable only through user interaction - a victim must open the malicious file - reflecting a local attack vector (AV:L, UI:R) with no network service exposed, and code execution is confined to the victim's own account rather than SYSTEM or root. No public exploit code has been identified at time of analysis and the issue is not in CISA's KEV catalog; EPSS is very low at 0.19% (8th percentile), so this is a real but not emergency-grade risk that should be handled through routine patching.

Opening a malicious 3D asset file in Adobe Substance 3D Viewer 0.25.2 and earlier can trigger an out-of-bounds write that crashes the application, producing a local denial-of-service. The attacker must convince a victim to open a crafted file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5), so there is no remote or unauthenticated network path and no impact to confidentiality or integrity - only availability. Risk is currently low: EPSS is 0.16% (4th percentile), no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, though the underlying memory-corruption class means a crash-only impact cannot be assumed permanent across future product versions.

Arbitrary code execution in Adobe Substance 3D Viewer 0.25.2 and earlier can occur when a victim opens a maliciously crafted file, caused by an out-of-bounds write (CWE-787) that corrupts memory in the context of the current user. With CVSS 3.1 score 7.8 and vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the flaw is local and unauthenticated but requires user interaction, making social engineering the key exploitation prerequisite. No public exploit identified at time of analysis, and EPSS is 0.19% (8th percentile), which supports a moderate real-world priority rather than an emergency.

Local code execution in Microsoft Office (including 365 Apps Enterprise, Office 2016/2019, and Office LTSC 2021 across Windows, macOS, and Android) is possible when a victim opens a maliciously crafted document that triggers a use-after-free condition. An unauthorized attacker who convinces a user to open the file can execute arbitrary code in the context of the current user, with no public exploit identified at time of analysis. CVSS is 7.8 reflecting local attack vector with required user interaction but full confidentiality, integrity, and availability impact.

Local code execution in Microsoft Office (including Microsoft 365 Apps Enterprise, Office 2016/2019, and Office LTSC 2021 across Windows x86/x64, macOS, and Android) arises from a use-after-free memory corruption (CWE-416) that an attacker can trigger by convincing a user to open a crafted document. Exploitation runs in the context of the current user with high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Arbitrary code execution within the AMI Aptio V BIOS can be triggered by a local attacker with low-level privileges and a specific attack prerequisite, potentially compromising firmware integrity and availability. The vulnerability requires local access (PR:L), a specific attack requirement (AT:P), and passive user interaction (UI:P), but no public exploit code has been identified and EPSS is very low (0.16%, 5th percentile), so opportunistic mass exploitation is impractical. Apply the firmware update provided by your OEM per AMI advisory AMI-SA-2025008.

Out-of-bounds write in AMI Aptio V BIOS allows local low-privilege authenticated attackers to corrupt memory, leading to data loss and system unavailability. The vulnerability is rated medium (CVSS 4.0: 5.9) and has a very low EPSS score (0.05%), indicating minimal immediate exploitation risk, with a vendor advisory already released.

Local authenticated

Crafted CIP payloads can cause a denial-of-service condition in the 1715 EtherNet/IP Adapter, resulting in loss of CIP communication that requires a manual restart to recover. The vulnerability is an out-of-bounds write (CWE-787) allowing remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) to disrupt availability; no special configuration is needed beyond network reachability to the device. No public exploit or active exploitation has been identified, and EPSS is low at 0.32%. The vendor CVSS 4.0 score is 7.7, but practical risk is bounded by the need for network access to the OT device.

Use-after-free memory corruption in Mozilla Thunderbird 143+ and Firefox allows remote code execution via malicious web extensions exploiting the native messaging API on Windows. CVSS 9.8 (critical) with network-based attack vector requiring no user interaction or authentication. Patched in Firefox 144 and Thunderbird 144. No public exploit identified at time of analysis, but CVSS metrics indicate high exploitability (AV:N/AC:L/PR:N/UI:N) with complete impact to confidentiality, integrity, and availability.

Out-of-bounds memory corruption in Mozilla Firefox and Thunderbird allows unauthenticated remote attackers to achieve code execution via malicious WebGL texture operations. A compromised web content process can exploit manipulated WebGL textures to trigger out-of-bounds reads and writes in privileged browser processes, potentially leading to full system compromise. Affects Firefox <144, Firefox ESR <115.29 and <140.4, and Thunderbird <144 and <140.4. Vendor-released patches available across all affected product lines. CVSS 9.8 reflects network-accessible, no-authentication-required attack with high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the specific Bugzilla reference (1989127) indicates detailed technical analysis exists.

Remote code execution in Mozilla Firefox (all versions prior to 144, ESR prior to 140.4) and Thunderbird (all versions prior to 144, ESR prior to 140.4) allows unauthenticated remote attackers to execute arbitrary code, disclose sensitive information, or cause denial of service through a use-after-free vulnerability in MediaTrackGraphImpl::GetInstance(). With a critical CVSS score of 9.8 and no authentication required, this memory corruption flaw represents a severe security risk. No public exploit identified at time of analysis, though EPSS data not available to assess exploitation probability.

Local privilege escalation in the MediaTek GNSS driver on Android 14.0 and 15.0 allows an attacker who already holds System privilege to trigger an out-of-bounds write through an incorrect bounds check, resulting in full compromise of confidentiality, integrity, and availability on affected devices. The attack is local only (AV:L), requires high privileges (assessed PR:H, specifically Android System), and needs no user interaction (UI:N); our assessment and the vendor description both indicate this is a post-compromise escalation step rather than an independent entry point. No public exploit has been identified at time of analysis, and EPSS is 0.09% (0th percentile); the MediaTek October 2025 bulletin provides patch ID ALPS09920033 for this issue (MSV-3797).

An out-of-bounds write in MediaTek's imgsensor kernel driver (MediaTek patch ALPS10089545, issue MSV-4279) lets a local attacker who already holds System privilege on a MediaTek-based device corrupt kernel memory and escalate to full kernel/root-level control. The affected platforms are MediaTek-based Android 13, 14, 15 and 16 builds plus MediaTek IoT Yocto 25.0; no user interaction is required once the prerequisite System access is held. No public exploit code has been identified at time of analysis and the EPSS score is negligible (0.09%), so this is a chained-exploit or already-privileged-attacker scenario rather than a remotely reachable bug.

Local privilege escalation in the MediaTek wlan AP driver lets an attacker who already holds System privilege on an affected MediaTek-based device trigger an out-of-bounds write and escalate into the kernel. The root cause is an incorrect bounds check (CWE-787) in the Wi-Fi access-point driver code path shipped through the MediaTek Software Development Kit and integrated into OpenWrt 19.07.0 and 21.02.0 builds; no user interaction is required and the vector is strictly local. Our independent assessment places the prerequisite at PR:H (the attacker must already possess System privilege), which is stricter than the published vector's PR:L, and no public exploit code was identified at time of analysis, with EPSS at just 0.14% (3rd percentile) - so the practical exposure is post-compromise privilege chaining on devices running the vulnerable driver rather than opportunistic exploitation. MediaTek has published a fix under patch ID WCNCR00421149 in its October 2025 product security bulletin.

An out-of-bounds write in MediaTek's wlan AP driver (CVE-2025-20715, CWE-787) lets a local attacker who already holds System privilege escalate to kernel-level code execution, because the driver performs an incorrect bounds check when handling data. The affected surface spans MediaTek's software development kit and OpenWrt 19.07.0 and 21.02.0 platforms that embed the driver, and exploitation requires local access plus pre-existing high privileges per our assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with no user interaction. EPSS is only 0.14% (3rd percentile) and no public exploit code has been identified, so this is a conditional local privilege-boundary escape rather than an internet-facing emergency; a vendor patch (Patch ID WCNCR00421152, Issue MSV-3731) is referenced in MediaTek's October 2025 security bulletin.

An out-of-bounds write in the MediaTek WLAN access-point (AP) driver lets an unauthenticated attacker within wireless radio range corrupt memory and escalate privileges on affected access points. Exploitation requires the device to be running the vulnerable driver in AP mode - typically MediaTek SDK-based firmware or OpenWrt 19.07.0/21.02.0 images built for MediaTek Wi-Fi chipsets - and no user interaction or credentials are needed (PR:N/UI:N), though the attacker must be physically proximate (AV:A). The flaw has a public vendor fix (Patch ID WCNCR00422399, issue MSV-3748) and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, with EPSS sitting at a low 0.31% (22nd percentile), so risk is best characterized as technically serious but not yet broadly targeted.

Denial of service in libxslt via type confusion when processing EXSLT <func:result> elements during stylesheet compilation. Remote attackers can crash applications using the library by providing a crafted XSLT document, with high attack complexity and user interaction required.

A use-after-free vulnerability in the storage management module of Huawei HarmonyOS 5.0.1 and 5.1.0 allows a local attacker with low privileges to cause a denial of service by crashing the affected service. Exploitation requires local access and existing low-level privileges, and no user interaction is needed. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.10% (percentile 1%), indicating a moderate-severity, availability-only issue that does not rise to urgent-priority status.

Use-after-free memory corruption in Fuji Electric's Monitouch V-SFT engineering software (v6.2.7.0 and earlier) allows an attacker to trigger information disclosure, abnormal application termination (ABEND), or arbitrary code execution when a specially crafted V-SFT project/configuration file is opened in the affected application. The flaw lies in the VS6ComFile!load_link_inf routine reached during file parsing; the attack vector is local and requires the victim to open a malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, vendor score 8.4), so exploitation depends on social-engineering or supply-chain delivery of a crafted project file rather than a network-exposed trigger. EPSS is low at 0.17% (6th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.

Out-of-bounds write in Fuji Electric V-SFT 6.2.7.0 and earlier can let a crafted V-SFT project file cause information disclosure, abnormal termination (ABEND), or arbitrary code execution when a user opens it. The flaw is in the VS6ComFile!CItemDraw::is_motion_tween drawing-item parsing path; the assessed CVSS 3.1 vector is local with user interaction (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so exploitation depends on social engineering to deliver a malicious .V8/.V9 project file to a vulnerable engineering workstation rather than remote network access. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile), CISA KEV does not list this CVE, and the overall signals point to a moderate, non-urgent priority despite the 8.4 CVSS 4.0 score.

Opening a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT 6.2.7.0 and earlier can trigger an out-of-bounds write in the VS6ComFile!set_AnimationItem function, leading to information disclosure, abnormal termination, or arbitrary code execution. Exploitation requires the victim to actively open a malicious file (user interaction) and is limited to the security context of the user running the application; no public exploit code or active exploitation has been identified (EPSS 0.18%, not in CISA KEV). The independent assessment rates this as a genuine but not emergency-priority issue.

Out-of-bounds write in Fuji Electric's MONITOUCH V-SFT HMI configuration tool (v6.2.7.0 and earlier) allows an attacker who convinces a user to open a specially crafted V-SFT project file to corrupt memory and achieve information disclosure, abnormal termination (ABEND) of the application, or arbitrary code execution in the context of the victim user. Per the CVSS vector the flaw requires no authentication (PR:N) but is a local/client-side issue (AV:L) gated by user interaction (UI:A), so exploitation depends on social engineering rather than any network-reachable service. Exploitation status: no public exploit identified at time of analysis, and EPSS is very low at 0.18% (7th percentile), indicating limited expected opportunistic activity; the vendor-accepted CVSS 4.0 score is 8.4, and the independent assessment rates the same issue as CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Out-of-bounds write in Samsung Notes' SPI decoder affects versions prior to 4.4.30.63 and allows a local low-privileged attacker, typically a separate malicious or compromised app, to corrupt memory by supplying a crafted SPI-format file. The CVSS vector requires local access and low privileges (AV:L/PR:L) with no user interaction (UI:N), and impact is limited to integrity (I:H) with no confidentiality or availability effect. There is no KEV listing and no public exploit identified at time of analysis; EPSS is 0.12% (2nd percentile), making this a moderate, low-priority issue rather than an urgent one.

An out-of-bounds write in the JPEG header parser of libpadm.so on Samsung Android 13 devices allows a locally present attacker to corrupt memory by supplying a crafted JPEG image to the decoding path. Exploitation requires the attacker to already have code or an app running on the device with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), and no user interaction is needed, so the flaw is locally scoped rather than remotely reachable. Only builds at a security maintenance release before SMR Oct-2025 Release 1 are affected; there is no public exploit identified at time of analysis and the EPSS score is low (0.13%, 2nd percentile), so near-term exploitation risk is limited.

An out-of-bounds write in the libpadm.so library on Samsung Android 13.0 devices allows an attacker with local code execution to corrupt memory during JPEG pre-processing, which can lead to privilege escalation or code execution in the context of the affected process. The flaw is triggered only under a specific, vendor-unspecified condition when a crafted JPEG reaches a component backed by libpadm.so; the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms it requires local access with low privileges and no user interaction. There is no confirmed active exploitation and no public exploit identified at time of analysis, and the low EPSS score of 0.13% (2nd percentile) indicates opportunistic rather than widespread risk; Samsung addressed it in SMR Oct-2025 Release 1.

An out-of-bounds write in the JPEG decoding pre-processing routine inside Samsung's proprietary libpadm.so library allows a local attacker holding at least low privileges on an affected Samsung Android 13.0 device to corrupt memory outside the intended buffer, with high confidentiality, integrity, and availability impact if successfully exploited. Exploitation requires local execution - typically a malicious or compromised application that feeds a crafted JPEG into the vulnerable decoder - and no user interaction beyond delivering the image; there is no remote/network vector. At time of analysis there is no public exploit code identified and no confirmed active exploitation; EPSS is 0.13% (2nd percentile), reflecting the local-only attack surface, and the issue is fixed in the SMR Oct-2025 Release 1 security maintenance release.

An out-of-bounds write exists in the fingerprint trustlet shipped on Samsung Android 13 devices that have not yet applied SMR Oct-2025 Release 1 or later, allowing an attacker who already holds high privileges locally to corrupt memory outside the intended bounds. Exploitation requires a pre-existing privileged local foothold (CVSS AV:L/PR:H, UI:N) on an unpatched device and the ability to deliver crafted input through the trustlet's interface, so it is not reachable remotely, by an unprivileged app under default configuration, or without an existing compromise. There is no public exploit code identified at time of analysis and no confirmed active exploitation; EPSS is 0.12% (2nd percentile), and the vendor advisory is the primary source of affected-device detail.

Kernel-level memory corruption in the Linux kernel's rxrpc/RxGK subsystem allows an out-of-bounds access when the rxgk_yfs_decode_ticket() function parses an authentication response packet. The flaw stems from an unchecked unsigned subtraction ('ticket_len - 10 * 4') on attacker-influenced length data, which can underflow and drive an out-of-bounds write (CWE-787). It affects Linux 6.17 release-candidate kernels (rc1 through rc6); there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.13% (3rd percentile).

Memory corruption in Qualcomm firmware components (FastConnect 6700/6900/7800, QCC2072, Snapdragon 8cx/7c+ Gen 3 compute platforms, and WCD/WSA audio codecs) allows a local authenticated attacker to trigger an out-of-bounds write via crafted IOCTL remote procedure calls, potentially leading to code execution or privilege escalation. No public exploit code or active exploitation has been identified; EPSS is 0.09%, indicating low predicted exploit likelihood. The primary limiting factor is the need for local access with low privileges (PR:L) to invoke the vulnerable IOCTL interface.

Local privilege escalation in Qualcomm's DSP service buffer-allocation path affects numerous FastConnect, QMP1000, SM-series, and Snapdragon mobile/wearable platform firmware components. The flaw is a use-after-free (CWE-416) that allows an authenticated local attacker with low privileges-such as a malicious app or compromised unprivileged process able to reach the DSP IPC interface-to corrupt memory and potentially execute code in the DSP context, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is 0.09%, so priority is bounded by the local-only attack vector despite the 7.8 CVSS score.

Memory corruption in the firmware/driver stack of multiple Qualcomm components - FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, the WCD9378C/WCD9380/WCD9385 audio codecs, and WSA8840/WSA8845/WSA8845H smart-amp firmware - lets a locally executing, low-privilege application corrupt memory by invoking a vulnerable 'escape' call (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). Successful abuse yields high confidentiality, integrity, and availability impact, meaning the attacker can potentially read or modify protected data, crash the subsystem, or gain a more stable foothold on the device. There is no remote attack surface - the attacker must already have code running on the device, and exploitation is not confirmed in the wild: no public exploit code was identified at time of analysis (EPSS 0.09%, percentile 0%) and the CVE is not listed in CISA KEV.

Transient denial of service affects Qualcomm sound-platform firmware running on QCC5161, QCC7225, QCC7226, and QCC7228 Bluetooth audio chips as well as the S3, S3 Gen 2, S5, and S5 Gen 2 sound platforms, but only when the QHS (Qualcomm High Speed) feature is enabled and multiple Bluetooth audio profiles are concurrently active. The root cause is a use-after-free (CWE-416) that surfaces under this specific concurrent-profile timing condition, producing a self-recovering (transient) loss of availability with a minor integrity side effect and no confidentiality impact. Exploitation requires an established, paired-level connection to the device (PR:L) and the QHS/multi-profile configuration to be in use; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), with EPSS at 0.17% (5th percentile) indicating low predicted exploitation likelihood. Note that the supplied NVD vector (AV:N/AC:L, 7.1) is more permissive than our assessed vector (AV:A/AC:H, PR:L), which reflects that the flaw is an adjacent-range, race-dependent condition rather than a reliably network-triggerable low-complexity issue.

An out-of-bounds write in Qualcomm firmware/driver code that handles an IOCTL call for retrieving a memory mapping affects FastConnect 6900 and 7800 connectivity chips, QCC2072, SC8380XP, and the WCD9378C, WCD9380, WCD9385, WSA8840, WSA8845 and WSA8845H audio components, allowing a locally present attacker holding low privileges to corrupt memory and achieve full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, so it is realistically a privilege-escalation primitive that presupposes an existing foothold (for example a malicious or compromised app) rather than a remotely exploitable initial-access vector; no user interaction or non-default configuration is required. No public exploit code has been identified at time of analysis and exploitation activity is predicted to be very low (EPSS 0.09%, 0th percentile), with no CISA KEV listing.

Memory corruption in Qualcomm's IPQ and QCN networking firmware - spanning Immersive Home 214/216/316/318 platforms and the IPQ5010/IPQ5028, QCN60xx, QCN90xx chipset families - allows a local attacker who already holds low-privileged code execution to issue a crafted SCM (Secure Channel Manager) call and trigger an out-of-range pointer offset that corrupts memory across the secure-monitor boundary. Successful exploitation gives high confidentiality, integrity and availability impact with a scope change (S:C), reflecting that corruption crosses from the normal world into TrustZone-secured context. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is very low at 0.09% (0th percentile); the practical limiting factor is that the attacker must first obtain a local, low-privileged foothold (AV:L, PR:L) on an affected device.

Memory corruption in Qualcomm firmware - an out-of-bounds write (CWE-787) triggered when the reboot code path parses a malformed license file - can lead to code execution or denial of service in the affected subsystem. The flaw is local and privilege-dependent: per the CVSS vector (AV:L/PR:L/UI:N) the attacker must already hold a local foothold with low privileges on the device and must be able to place or influence the license file before a reboot, so it is not a remote or default-unauthenticated condition. No public exploit code has been identified at time of analysis (EPSS is 0.09%, percentile-based score negligible), and there is no confirmed active exploitation.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

In the Linux kernel, the following vulnerability has been resolved: blk-mq: use quiesced elevator switch when reinitializing queues The hctx's run_work may be racing with the elevator switch when. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

A memory corruption vulnerability exists in the Linux kernel's MSM display port driver that occurs when more than eight display bridges are connected, allowing local attackers with low privileges to corrupt kernel memory beyond a fixed-size array. The vulnerability affects Linux kernel versions up to 6.1-rc2 and requires local access to exploit, with no known active exploitation in the wild (not in KEV) and a very low EPSS score of 0.02% indicating minimal real-world exploitation likelihood.

A memory leak vulnerability exists in the Linux kernel's Rockchip clock driver (rockchip_clk_register_pll function) where allocated memory from kmemdup() is not freed when clk_register() fails, potentially causing denial of service through memory exhaustion. All versions of the Linux kernel with Rockchip clock support are affected. An attacker with local privileges can trigger repeated clock registration failures to exhaust system memory and crash the system, with an EPSS score of 0.01% indicating very low real-world exploitation probability despite the moderate CVSS score of 5.5.

A memory leak vulnerability exists in the Linux kernel's mxm-wmi (MXM WMI) platform driver where the ACPI buffer returned by wmi_evaluate_method() is not properly freed after invocation, leading to kernel memory exhaustion and potential denial of service. The vulnerability affects all versions of the Linux kernel with the mxm-wmi driver enabled, particularly systems with NVIDIA/AMD discrete GPU switching support. A local attacker with standard user privileges can repeatedly trigger the affected code path to exhaust kernel memory and crash the system, though the extremely low EPSS score (0.01th percentile) suggests exploitation is not actively observed in the wild.

This is a reference counting memory leak in the Linux kernel's radeon graphics driver, specifically in the radeon_atrm_get_bios() function where a PCI device pointer obtained via pci_get_class() is not properly released when loop conditions cause early exit. An authenticated local attacker with low privileges can trigger this vulnerability to cause a denial of service through kernel memory exhaustion, as unreleased PCI device objects accumulate in kernel memory. While no public exploit code exists (EPSS 0.01% indicates minimal real-world exploitation probability), the vulnerability affects all Linux kernel versions running the radeon driver and patches are available across multiple stable kernel series.

A memory leak vulnerability exists in the Linux kernel's AMD GPU (amdgpu) driver within the hpd_rx_irq_create_workqueue() function, where allocated memory for work queue structures fails to be properly freed if workqueue construction fails partway through initialization. This affects all Linux kernel versions with the vulnerable amdgpu driver code and requires local access with low privileges to trigger. An attacker can repeatedly trigger this condition to exhaust kernel memory and cause a denial of service, though the EPSS score of 0.01% indicates this is rarely exploited in practice. Patches are available from the Linux kernel stable branches.

A reference count leak exists in the Linux kernel's USB HID gadget driver (f_hid module) where the opts->refcnt is incremented but not properly decremented when report_desc allocation fails, leaving the options structure permanently locked and causing a denial of service condition. This affects all Linux kernel versions running the vulnerable USB gadget code path and requires local privilege to trigger. While the CVSS score is 5.5 (medium) and EPSS is extremely low at 0.01th percentile, patches are available from multiple stable kernel branches, indicating this is a real but low-priority issue with no known active exploitation.

A memory leak vulnerability exists in the Linux kernel's rtl8723bs WiFi driver initialization function rtw_init_cmd_priv(), where failure to allocate the response command buffer leaves the command buffer allocation unreleased. This affects all Linux kernel versions containing the vulnerable staging driver code and can be exploited by local attackers with low privileges to cause a denial of service through memory exhaustion. The vulnerability has a vendor-provided patch available across multiple stable kernel branches, and the EPSS score of 0.01% indicates minimal real-world exploitation probability despite the moderate CVSS 5.5 rating.

A memory leak vulnerability exists in the Linux kernel's ext4 fast commit (fc) implementation within the ext4_fc_record_regions() function. The vulnerability occurs when krealloc() fails and returns NULL, causing the function to improperly handle the state->fc_regions pointer, leaving allocated memory unreferenced and unable to be freed. This affects all Linux kernel versions with the vulnerable code path, allowing local attackers with unprivileged user access to exhaust kernel memory and trigger denial of service conditions. While the EPSS score of 0.01% indicates low real-world exploitation probability and no active exploitation is tracked in KEV data, the availability impact is high (CVSS score 5.5), and patches have been made available across multiple stable kernel branches.

In the Linux kernel, the following vulnerability has been resolved: dax: Fix dax_mapping_release() use after free A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields: kobject:...

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() The finalization of nilfs_segctor_thread() can race with nilfs_segctor_kill_thread() which terminates...

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Sync IRQ works before buffer destruction If something was written to the buffer just before destruction, it may be possible

In the Linux kernel, the following vulnerability has been resolved: clk: imx: scu: use _safe list iterator to avoid a use after free This loop is freeing "clk" so it needs to use list_for_each_entry_safe().

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Add histograms to hist_vars if they have referenced variables Hist triggers can have referenced variables without having direct variables fields.

In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing.

In the Linux kernel, the following vulnerability has been resolved: iavf: Fix use-after-free in free_netdev We do netif_napi_add() for all allocated q_vectors[], but potentially do netif_napi_del() for part of them, then kfree q_vectors and...

In the Linux kernel, the following vulnerability has been resolved: staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() The "exc->key_len" is a u16 that comes from the user.

In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915_requests may be trapped by userspace inside a sync_file or dmabuf (dma-resv) and held...

In the Linux kernel, the following vulnerability has been resolved: cpufreq: davinci: Fix clk use after free The remove function first frees the clks and only then calls cpufreq_unregister_driver().

In the Linux kernel, the following vulnerability has been resolved: vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg.

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write When the oob buffer length is not in multiple of words, the oob write function does out-of-bounds read on...

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free for cached IPU bio xfstest generic/019 reports a bug: kernel BUG at mm/filemap.c:1619!