Memory Corruption

Type confusion in the V8 JavaScript engine of Google Chrome before 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Signals conflict and must be weighed carefully: the numeric severity is high, yet Google's own Chromium security severity for this issue is 'Low' and CISA's SSVC assessment records no exploitation and a non-automatable attack path, with no public exploit identified at time of analysis. A vendor-released patch exists in Chrome 155.0.8059.39, so fully updated installations are not exposed.

Type confusion in V8, Chrome's default JavaScript and WebAssembly engine, enables a remote attacker to run arbitrary code inside the browser's renderer sandbox in Google Chrome releases below 155.0.8059.39. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms the attack is network-reachable and requires no authentication, though it does require the victim to open attacker-controlled web content, so a phishing, malvertising, or watering-hole lure is a prerequisite. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, so real-world priority currently sits below what the 8.8 base score alone implies; note that code execution is confined to the renderer sandbox, meaning full host compromise would require chaining a separate sandbox-escape flaw. Google has shipped a vendor patch.

An out-of-bounds write in the Media component of Google Chrome before 155.0.8059.39 lets a remote attacker corrupt memory and potentially achieve arbitrary code execution outside the browser sandbox when a victim opens an attacker-crafted HTML page containing malicious media content. The attack is fully remote and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is gated by user interaction (UI:R) - the victim must visit the malicious or compromised page - and the 'outside the sandbox' outcome implies defeating Chrome's process sandbox, which is materially harder in practice than the 9.6 base score suggests. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build.

Use-after-free in Chrome's font handling on Windows allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page; the flaw affects Google Chrome versions prior to 155.0.8059.39. Exploitation requires user interaction (UI:R) - the victim must load attacker-controlled content - and there are no authentication prerequisites (PR:N), but the resulting code execution is confined to the Chrome sandbox, so host-level compromise would require a second, independent sandbox-escape bug. Consistent with the medium severity rating assigned by the Chromium team, CISA's SSVC assessment records no known exploitation and no automatable exploitation path, and no public exploit code has been identified at time of analysis.

A use-after-free memory-safety flaw in Google Chrome's Media component lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a user loads a crafted HTML page containing malicious media content. All Chrome builds prior to 155.0.8059.39 are affected, and exploitation requires the victim to visit or load the attacker-controlled page (UI:R), which is the main practical barrier; no credentials or special privileges are needed. There is no public exploit identified at time of analysis and the CISA SSVC assessment records no exploitation, but the vendor has shipped a fix in 155.0.8059.39, and the EPSS-style risk picture is dominated by Chrome's ubiquity and the high CVSS base score (8.8) rather than by observed attacks.

Use-after-free in Google Chrome's garbage-collection code before 155.0.8059.39 allows an unauthenticated remote attacker to corrupt memory and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (PR:N, UI:R) and the code execution stays contained in the browser sandbox, so OS-level compromise would require chaining a separate sandbox-escape flaw; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', which tempers the high 8.8 CVSS base score. Vendor-released patch: 155.0.8059.39, distributed through Chrome's stable channel.

Use-after-free in the Streaming component of Google Chrome prior to 155.0.8059.39 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim is socially engineered into loading a crafted HTML page, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:R. Google rates the issue Medium severity (Chromium) while the CVSS base score is 8.8, reflecting high confidentiality, integrity, and availability impact on the renderer process rather than the host. There is no CISA KEV listing and no public exploit identified at time of analysis, and the SSVC assessment records exploitation as none; the primary containment is Chrome's process sandbox, so full host compromise would require chaining a separate sandbox-escape flaw.

Use-after-free in Google Chrome allows unauthenticated remote attackers to execute arbitrary code within the renderer sandbox by convincing a victim to load a crafted HTML page, affecting all versions prior to 155.0.8059.39. The attack requires user interaction (UI:R) but no authentication or special configuration, and while code execution is confined to the sandbox, the CVSS 3.1 score is 8.8. No public exploit or active exploitation has been identified, and a vendor patch is available.

Use-after-free in Google Chrome's Track component before 155.0.8059.39 allows an unauthenticated remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The CVSS 3.1 base score is 8.8 (High) with UI:R, meaning exploitation requires user interaction but no authentication; successful code execution remains confined to Chrome's renderer sandbox and would require a separate sandbox-escape bug to affect the host OS. No public exploit identified at time of analysis, and SSVC records Exploitation: none; CISA KEV does not list this CVE.

Use-after-free in Google Chrome's built-in PDF handling (fixed in 155.0.8059.39) lets remote, unauthenticated attackers execute arbitrary code inside the Chrome renderer sandbox when a victim opens a crafted PDF file - exploitation is not automatic and depends entirely on the user interaction of opening the document (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Because the code execution is confined to the sandboxed renderer, turning this into full host compromise would require chaining a separate sandbox-escape bug; the advisory rates it Chromium severity High. At the time of analysis there is no public exploit identified and CISA SSVC records exploitation as none, though the vulnerability is fully described and a vendor patch plus the underlying Chromium issue tracker entry are publicly referenced. Google Chrome versions before 155.0.8059.39 are affected on all platforms tracked under cpe:2.3:a:google:chrome.

Google Chrome builds prior to 155.0.8059.39 contain a use-after-free in PDF handling that allows a remote, unauthenticated attacker to execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page that embeds a malicious PDF. Exploitation requires the user to open attacker-controlled web content processed by Chrome's built-in PDF (PDFium) viewer - a mandatory interaction step (CVSS UI:R) with no zero-click vector, and any code execution is confined to the sandboxed renderer unless chained with a separate sandbox escape. There is no public exploit identified at time of analysis, SSVC records no observed exploitation and rates the issue not automatable, but technical impact is rated total given high confidentiality, integrity, and availability impact; a vendor patch exists in 155.0.8059.39.

Use-after-free in Google Chrome's V8 JavaScript engine (all releases prior to 155.0.8059.39) lets unauthenticated remote attackers execute arbitrary code inside the renderer sandbox when a victim navigates to an attacker-controlled page containing crafted HTML/JavaScript. The bug carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Chromium's own 'High' severity rating, and because the V8 engine is enabled by default in every standard installation, no special configuration or privileges are needed on the target side. Impact is bounded, however: per the vendor description code execution is confined to the sandbox, so a standalone exploit does not by itself compromise the host and a separate sandbox-escape would be required, and no public exploit identified at time of analysis (SSVC Exploitation: none, Automatable: no) - a genuine priority-worthy issue whose urgency is tempered by the required user interaction, sandbox confinement, and absence of observed exploitation.

Use-after-free in the Media component of Google Chrome prior to 155.0.8059.39 lets a remote attacker execute arbitrary code within the browser's renderer sandbox by luring a victim to open a crafted HTML page. The flaw carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or prior privileges are required, but successful exploitation depends on the user actively navigating to attacker-controlled content. There is no public exploit identified at time of analysis - CISA's SSVC assessment lists exploitation as 'none' - and code execution is contained within the renderer sandbox, so a separate sandbox-escape would be needed to reach the host OS; the vendor has released a patched build.

Type confusion in the V8 JavaScript engine of Google Chrome prior to 155.0.8059.39 lets a remote, unauthenticated attacker execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page; the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so the sole prerequisite is that the victim renders attacker-controlled content in an unpatched desktop build. No public exploit code or active exploitation was identified at time of analysis, and CISA KEV does not list this CVE. The vendor-released patch is Chrome 155.0.8059.39, and installations already updated past that version are not affected. Because the impact is scoped to the sandbox (S:U) per the description, full host compromise would require chaining a separate sandbox-escape vulnerability.

Google Chrome versions prior to 155.0.8059.39 contain a use-after-free in the WebRTC component that a remote, unauthenticated attacker can trigger by convincing a victim to visit a crafted HTML page, resulting in arbitrary code execution within the renderer sandbox (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not automatable and requires user interaction, and the resulting code execution is confined to Chrome's renderer sandbox per the vendor description, so full host compromise would additionally require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no known exploitation; Chrome's built-in auto-update is the primary exposure-reduction control, as patched versions 155.0.8059.39 and later are not vulnerable.

Arbitrary code execution inside the renderer sandbox is achievable in Google Chrome builds prior to 155.0.8059.39, where a use-after-free in the browser's Media component can be triggered when a victim loads a crafted HTML page. Scoring 8.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the bug requires no authentication but does require the user to visit attacker-controlled content, and because the resulting code execution is confined to the renderer sandbox, full host compromise would require chaining a separate sandbox-escape flaw. A vendor patch is available in the Chrome Stable channel update, and no public exploit has been identified at time of analysis - this is a high-priority patching item rather than an emergency.

Use-after-free in Google Chrome's Media component allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim into loading a crafted HTML page in any Chrome build prior to 155.0.8059.39. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), consistent with Google's own 'High' Chromium security severity, and requires no authentication or privileges on the victim host beyond the user visiting the malicious content (UI:R). Exploitation is confirmed to be constrained by user interaction and by the renderer sandbox - CISA SSVC scores it Exploitation: none, Automatable: no, Technical Impact: total - and there is no public exploit identified at time of analysis, though a vendor-released patch is available.

Use-after-free in Google Chrome's parser allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page, affecting all Chrome versions prior to 155.0.8059.39. Exploitation requires user interaction (the victim must visit or open the malicious page), and the resulting code execution is contained by Chrome's renderer sandbox, so full host compromise would require chaining with a separate sandbox-escape vulnerability. A vendor patch is available in 155.0.8059.39, and no public exploit identified at time of analysis, with CISA's SSVC assessment recording exploitation as none.

Remote code execution inside the renderer sandbox is possible in Google Chrome builds prior to 155.0.8059.39, where a use-after-free in the Media component can be triggered by a crafted HTML page. Exploitation requires the victim to load attacker-controlled web content (UI:R) but no authentication or special privileges (PR:N), so default desktop installs are affected; resulting code execution is contained within the renderer sandbox rather than the host operating system. At time of analysis there is no public exploit identified at time of analysis per available intelligence (SSVC exploitation: none, automatable: no), and a vendor patch is available from Google. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Chromium security severity High, this is a genuine high-priority patching item, though the signals are mixed on urgency.

A use-after-free in Chrome's Metrics component (CWE-416) lets an attacker who has already compromised a sandboxed renderer process execute arbitrary code outside the sandbox - a sandbox-escape primitive rather than an initial-access bug. Only users running Chrome versions below 155.0.8059.39 are affected; the flaw is unauthenticated from the network perspective (PR:N) but requires the victim to load attacker-controlled crafted HTML (UI:R) and carries High attack complexity (AC:H) because the attacker must win a use-after-free race and defeat sandbox mitigations. Google has released a fix in Chrome 155.0.8059.39, no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none, and the overall posture is patch-promptly-but-not-emergency rather than urgent.

Use-after-free in Google Chrome's Select component before version 155.0.8059.39 allows unauthenticated remote attackers to execute arbitrary code inside the browser's renderer sandbox, but only after socially engineering a victim into opening a crafted HTML page (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R). The impact is confined to the sandbox, so compromise of the host operating system would require chaining a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google - the reporting party - has released a fixed build.

Remote code execution inside the Chrome renderer sandbox is possible on Chrome builds prior to 155.0.8059.39, where a use-after-free in the WebRTC component can be triggered by a crafted HTML page. The flaw is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and assigned Chromium severity High; no authentication or prior privileges are required, but the victim must open or be redirected to the attacker's page (UI:R). Impact is confined to the renderer sandbox - reaching the host OS would require chaining a separate sandbox-escape vulnerability - and no public exploit was identified at time of analysis; the primary exposure window is the short period before Chrome's auto-update moves users to the fixed build.

Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome builds prior to 155.0.8059.39, where a use-after-free defect in the HTML handling path can be triggered by a crafted HTML page. Any user running an unpatched desktop Chrome who loads attacker-controlled web content (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) can be targeted; no credentials or elevated privileges are required, but mandatory user interaction (UI:R) and the renderer sandbox confinement limit the direct blast radius, since escaping the sandbox to the host OS would require a separate, distinct vulnerability not covered by this CVE. Google has shipped a vendor patch (155.0.8059.39) and the issue was reported through the Chrome vulnerability program with a Chromium severity rating of High; no public exploit code and no confirmed active exploitation have been identified, and the affected-code flaw is consistent across the CPE wildcard for google:chrome.

Use-after-free in Google Chrome's Web Audio implementation affects versions prior to 155.0.8059.39, where a remote attacker can achieve arbitrary code execution inside the browser's renderer sandbox by getting a victim to open a crafted HTML page that exercises the Web Audio API. The flaw carries an assessed CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or non-default configuration is required, but the attack does depend on user interaction (loading the page) and the resulting code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. Chromium rates the issue High severity, the vendor has published a fix in 155.0.8059.39, and no public exploit code has been identified at time of analysis; there is no CISA KEV confirmation of active exploitation.

Remote code execution confined to Chrome's renderer sandbox is possible in Google Chrome prior to 155.0.8059.39, where a use-after-free in the browser's Bindings layer can be triggered when a victim opens a crafted HTML page. The attack is unauthenticated (PR:N) but depends on user interaction (UI:R), and because the assessed scope is unchanged (S:U), code execution is contained inside the renderer sandbox - reaching the host would require a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Chrome's automatic update mechanism narrows the realistic exposure window, making this a high-priority patch item rather than an emergency.

Out-of-sandbox code execution is achievable in Google Chrome desktop builds prior to 155.0.8059.39 by exploiting a use-after-free in the browser-process TabStrip component, reached when a victim is socially engineered into opening an attacker-crafted HTML page. The flaw carries a 9.6 CVSS (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the corrupted component sits outside the renderer sandbox, so a successful exploit escapes Chrome's primary containment boundary; however, it is not a zero-click bug and no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with Automatable 'no'. A vendor-released patch (155.0.8059.39) is available, making this a high-priority but currently non-weaponized patch-now item rather than an active incident.

Remote code execution outside the browser sandbox in Google Chrome prior to 155.0.8059.39 allows a remote attacker to execute arbitrary code on a victim's system via a crafted HTML page. The flaw is a use-after-free in the browser's Core component, and exploitation requires the victim to open attacker-controlled web content (UI:R) while no authentication or special privileges are needed (PR:N); the CVSS score is 9.6 with scope change (S:C) reflecting sandbox escape. Despite the high impact, there are no exploitation signals: no public exploit identified at time of analysis and the SSVC assessment lists exploitation as none, though the total technical impact and wide deployment make timely patching a priority.

Use-after-free in Google Chrome's Storage component (all versions prior to 155.0.8059.39) allows a remote attacker to execute arbitrary code outside the sandbox, but only after the attacker has already compromised the renderer process - typically by chaining a separate renderer bug - and only when a victim loads a crafted HTML page (CVSS 8.3, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Because a prior renderer compromise, user interaction, and non-trivial heap grooming are all required, this is a second-stage sandbox-escape primitive rather than standalone initial access. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none, and Google has shipped a vendor patch in Chrome 155.0.8059.39.

Use-after-free in Google Chrome's parser allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to visit a crafted HTML page. All Chrome builds prior to 155.0.8059.39 are affected, and exploitation requires user interaction (UI:R) but no authentication (PR:N). The flaw carries a High Chromium severity rating (CVSS 8.8) and no public exploit has been identified at time of analysis; however, standalone impact is constrained because the description specifies code execution 'inside the sandbox,' meaning a second vulnerability would be needed to escape to the host.

A use-after-free in the Chrome Tabs component of Google Chrome on macOS allows a remote attacker to potentially execute arbitrary code outside the sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.39. Exploitation is unauthenticated (CVSS PR:N) but requires user interaction (UI:R) - the victim must navigate to or open attacker-controlled web content, with no zero-click vector indicated, and reliable code execution additionally depends on successful heap grooming of the freed object. The issue is assessed as a genuine high-priority problem rather than a high-CVSS-but-low-real-risk case (CVSS 9.6, scope-changed), and no public exploit was identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39.

Use-after-free in Chrome's Tint shader compiler lets a remote attacker achieve code execution outside the browser sandbox when a victim opens a crafted HTML page - the page drives Chrome's WebGPU pipeline so that Tint compiles a malicious WGSL shader that triggers the memory-safety flaw. The flaw affects Google Chrome builds prior to 155.0.8059.39 and is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), with the scope-change sub-score reflecting that successful exploitation escapes the renderer sandbox and yields host-level impact; no authentication is needed, but the attacker must convince the user to visit the page (UI:R). No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is currently a high-priority patch-now issue rather than an actively exploited one; a vendor patch is available in the 155.0.8059.39 stable release.

Use-after-free in the ANGLE graphics layer of Google Chrome allows a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page; the vulnerable code path is present in Chrome builds prior to 155.0.8059.39. Exploitation is not automatic - the attacker must lure the user into rendering the malicious page (UI:R), but no credentials are required and the assessed CVSS:3.1 vector scores 9.6 with a scope change (S:C) because successful exploitation escapes Chrome's primary containment boundary rather than staying inside the renderer sandbox. Only publicly available exploit code would normally elevate this beyond an urgent patch-now item: at the time of analysis there is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit identified, while a vendor patch is available. Note that the description scopes the flaw to Chrome on Android, whereas the only vendor reference is the Desktop stable-channel release notes - the affected platform should be verified against the vendor advisory before relying on a platform-specific assumption.

Type confusion in ANGLE, Chrome's OpenGL ES abstraction layer, lets a remote attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox in Google Chrome versions prior to 155.0.8059.39. The victim must load attacker-controlled graphics content (crafted HTML invoking WebGL/ANGLE paths), so user interaction is required, and the bug cannot be triggered by merely visiting a page without a separate renderer exploit first - it is a second-stage sandbox-escape primitive in a multi-bug chain rather than an initial-access vector. No public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, but technical impact as total, consistent with the CVSS scope change (S:C), high confidentiality and integrity impact, and the High Chromium security severity rating.

Use-after-free in Google Chrome's Track component (versions prior to 155.0.8059.39) allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is network-reachable, low-complexity, and requires no authentication, with mandatory user interaction - the victim must navigate to or be redirected to attacker-controlled content - as the only gating prerequisite. Google rates the issue Critical and shipped a fix in the 155.0.8059.39 stable-channel release; no public exploit code has been identified at time of analysis, and the escape from the browser sandbox would require a separate, independent vulnerability.

Memory corruption in Google Chrome's Navigation component - a use-after-free (CWE-416) - allows a remote attacker to execute arbitrary code outside the browser sandbox on any Chrome installation prior to 155.0.8059.39 by getting a user to load a crafted HTML page. The flaw is rated Critical by Chromium with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): no authentication is required and delivery is network-based, but exploitation still depends on the victim rendering attacker-controlled content, and the scope change (S:C) reflects that successful exploitation escapes the renderer sandbox to affect the host system. No public exploit has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and this is a genuine high-priority issue rather than an inflated high-CVSS score.

Use-after-free in the browser-process component of Google Chrome before 155.0.8059.39 lets a remote attacker execute arbitrary code outside the sandbox when a victim opens a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires the user to navigate to attacker-controlled content (UI:R); the scope change and high confidentiality, integrity, and availability ratings reflect that a successful page load escapes the renderer sandbox to reach host-level code execution, which pushes the base score to 9.6 and earns a Chromium security severity of Critical. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so the practical near-term risk comes from the low complexity of the trigger (phishing, malvertising, or a compromised site) rather than from observed attacks. Vendor-released patch: Chrome 155.0.8059.39.

Remote code execution outside the browser sandbox is possible in Google Chrome builds prior to 155.0.8059.39 through a use-after-free flaw in the built-in Chromecast (Cast) component: an attacker who gets a victim to render a crafted HTML page can corrupt freed memory and run arbitrary code with the browser's privileges (CVSS 9.6, Chromium severity Critical). The sole hard prerequisite is user interaction - no credentials or elevated privileges are required per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) - and because Cast ships with standard desktop Chrome rather than as an optional extension, the exposed population is essentially every unpatched Chrome installation. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.

Unauthenticated attackers with adjacent-network access can crash the TDP daemon on TP-Link Tapo C500 v2.0 cameras by sending a single crafted UDP datagram, causing a denial-of-service condition. The flaw is an out-of-bounds function-pointer dispatch (CWE-823) that triggers an invalid indirect call, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) plus our independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirm only availability is impacted-no data disclosure or code execution. No public exploit code or active exploitation is identified in the provided data, but the vendor has released a patch; the attack requires Layer-2 adjacency and no authentication, session, or pairing.

A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an attacker within Bluetooth radio range execute arbitrary code on unpatched Android devices, with no user interaction and no additional execution privileges required. The flaw is rated CVSS 9.8 under the vendor's AV:N vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); our independent assessment re-scores it AV:A because exploitation realistically requires the device's Bluetooth to be enabled and the attacker to be within radio range to deliver crafted CCC/GATT traffic, while agreeing that no authentication or victim action limits the attack. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and a fix is published in the Android/Pixel security bulletin dated 2026-10-01.

Heap corruption and process termination in SixLabors ImageSharp 3.0.0 through 4.1.0 can be triggered by decoding a crafted tiled TIFF that uses CCITT fax compression (T4, T6, or Modified Huffman) with a TileWidth smaller than ImageWidth. Because DestinationBuffer is sized by TileWidth while TiffDecompressorsFactory.Create instantiates the fax decompressor with the full frame width, attacker-controlled scanlines overflow the tile buffer, producing out-of-bounds writes and CWE-787 heap corruption. The flaw is remotely reachable, requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), and is scored availability-only. No public exploit code has been identified at time of analysis, and the issue is fixed in version 4.1.1.

Heap buffer overflow in SixLabors ImageSharp (all versions from 3.0.0 up to but excluding 4.1.1) is triggered when the library decodes a strip-organized TIFF file that uses CCITT Group 3 (T4) or Modified Huffman compression: attacker-controlled run lengths are written into the strip buffer before the current row width is validated, corrupting heap memory and terminating the host process. Exploitation is remote and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), but the realistic outcome is denial of service - a crash - rather than data disclosure or modification, and no public exploit code was identified at time of analysis. The issue is fixed in ImageSharp 4.1.1 via the vendor advisory GHSA-jj3q-cwqj-842r and pull request #3176.

Out-of-bounds heap writes in the ImageSharp TIFF CCITT Group 4 (T6) fax encoder, affecting versions 2.1.0 through 4.1.1, allow attacker-supplied image data to corrupt memory and terminate the process. The encoder allocates only Width × rowsPerStrip bytes for a strip while T6BitCompressor.CompressStrip can emit encoded row data plus two 12-bit end-of-facsimile-block codes beyond that capacity, and TiffCcittCompressor.WriteCode performs the writes without bounds checks; a decode-and-re-encode flow that inherits TiffCompression.CcittGroup4Fax and one-bit bilevel metadata from the input reaches this path, giving unauthenticated remote attackers a denial-of-service primitive (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H). Impact is confined to availability - no confidentiality or integrity effect - and there is no public exploit code identified at time of analysis and no CISA KEV listing; the issue is fixed in version 4.1.2.

Denial of service in SixLabors ImageSharp (2.0.0 up to but not including 4.1.2) lets a remote, unauthenticated attacker terminate an image-processing process by supplying a crafted 32-bit floating-point TIFF. The attack only succeeds when the consuming application decodes that TIFF into an Image<HalfVector4> and then applies the global HistogramEqualization processor, at which point a non-finite or out-of-range BT.709 luminance value is consumed as an unchecked histogram offset in GrayscaleLevelsRowOperation.Invoke, producing an out-of-bounds access (CWE-787) and process termination. Impact is availability-only (CVSS 7.5, C:N/I:N/A:H); Adaptive Histogram Equalization and AutoLevel are explicitly unaffected, and no public exploit code or CISA KEV listing was identified at time of analysis.

Memory corruption in SixLabors ImageSharp 4.0.0 through 4.1.1 allows an unauthenticated remote attacker to crash or destabilize a host process by supplying an image whose embedded ICC profile declares more than four LUT16 input/output channels, causing out-of-bounds writes past a four-float internal buffer. The flaw is only reachable when an application has explicitly set DecoderOptions.ColorProfileHandling to Convert, since the default Preserve mode does not run ICC conversion; the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only impact rather than data disclosure or modification. No public exploit code was identified at time of analysis, and the issue is fixed in version 4.1.2.

TIFF encoding in SixLabors ImageSharp 2.0.0 through 4.1.1 can write past the end of an undersized compressed-data buffer when CCITT Group 3 fax compression is used on narrow 1-bit images, corrupting process memory and typically terminating the process. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) only when the host application either explicitly selects TiffCompression.CcittGroup3Fax during encoding or inherits that compression setting from attacker-supplied TIFF metadata in a decode-and-re-encode flow; the impact is limited to availability (denial of service), with no confidentiality or integrity loss assessed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 4.1.2.

Out-of-bounds kernel memory writes in the WibuKey driver for Windows below version 6.72 allow an authenticated, locally logged-on low-privileged user who can send input to the driver (for example via a device IOCTL) to crash the affected system and, under unfavorable kernel heap layouts, modify adjacent kernel memory. Because the flaw requires local access and authentication and depends on uncontrolled kernel memory layout, reliability is limited primarily to denial of service, with adjacent-memory modification explicitly conditional rather than a guaranteed outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is local-only with no network vector.

Memory corruption - specifically a use-after-free (CWE-416) - in Qualcomm Snapdragon components lets a locally-positioned attacker holding low privileges corrupt memory while the platform processes service requests, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: the attacker must already have a foothold on the device, such as a malicious or compromised application capable of reaching the affected Qualcomm service interface, and no user interaction is needed once that foothold exists. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, and because the available data does not name the specific service, chipset model, or configuration, the precise triggering interface should be verified against the Qualcomm October 2026 security bulletin.

Memory corruption in Qualcomm Snapdragon system service routines allows a locally installed, low-privileged application to trigger a use-after-free by supplying a malformed input buffer, potentially achieving code execution at the privilege level of the affected service and thereby compromising confidentiality, integrity, and availability. The flaw is scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is access-gated: the attacker must already be executing code on the device with low privileges and must be able to reach and invoke the vulnerable routine - there is no remote or network vector, and no user interaction is required once that code runs. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliable exploitation would generally require heap grooming of the target service, and actual exposure depends on the specific Snapdragon chipset and firmware build listed in Qualcomm's October 2026 security bulletin.

Memory corruption via a use-after-free in the FastRPC implementation on Qualcomm Snapdragon platforms allows a local attacker with low-privilege code execution to escalate privileges and compromise confidentiality, integrity, and availability of the affected device. Triggering the bug requires a pre-existing foothold - code able to open the FastRPC driver interface and drive DSP invocations - plus concurrent asynchronous threads that race shared performance counter data, so successful exploitation depends on winning a timing window rather than a deterministic primitive. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; because the vector is local-only (AV:L) with no network reachability, this is a genuine but not emergency-grade priority.

Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Use-after-free memory corruption affecting Qualcomm Snapdragon platforms lets a local, low-privileged attacker (PR:L, AV:L, UI:N) trigger concurrent operations on shared memory page lists that are not properly synchronized, potentially reusing freed memory and gaining high impact to confidentiality, integrity, and availability. Because the root cause is a race condition (CWE-416), exploitation is timing-dependent and may require repeated attempts; the attacker must already have code running on the device, so there is no remote or network attack path. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor advisory is the October 2026 Qualcomm security bulletin. Note that the independent assessment rates this as AC:H (high attack complexity; score 7.0) rather than the submitted CVSS 7.8 with AC:L, reflecting the difficulty of reliably winning the race.

An out-of-bounds write in Oracle VM VirtualBox before 7.2.8 lets a user with a foothold inside a guest VM corrupt memory in the host-side hypervisor process through the emulated PCNet (Am79C970A) network adapter. The flaw sits in pcnetReceiveNoSync in DevPCNet.cpp, and because the write crosses the guest-to-host boundary it can lead to host memory corruption and potential code execution in the VirtualBox process, though integrity and availability impacts are the primary outcomes. Exposure is materially narrower than the vendor-supplied 9.1 network-vector score implies: the vulnerable code path is only reachable when the VM is explicitly configured with the legacy PCNet NIC rather than VirtualBox's modern Intel PRO/1000 or virtio-net defaults, and the attacker must already have local user-level access in the guest. No public exploit has been identified at time of analysis, SSVC records exploitation as none, and there is no CISA KEV listing.

Unauthorized code execution during the boot process is possible on AMD Zynq UltraScale+ MPSoC, Zynq UltraScale+ RFSoC, and Kria SOM devices when an attacker with physical or local USB access can drive oversized Device Firmware Upgrade (DFU) download requests while the device is held in USB boot mode. The flaw is an out-of-bounds write (CWE-787) in the USB boot-mode DFU path: missing boundary validation allows the download to overflow the DDR receive buffer and corrupt adjacent First Stage Boot Loader (FSBL) memory before the FSBL hands off to later boot stages. AMD rates this 7.5 (CVSS 4.0 AV:L/AC:L/AT:P/PR:N/UI:N with High confidentiality, integrity, and availability impact to the device); no public exploit code and no confirmed active exploitation were identified at time of analysis, and practical exposure is limited to devices whose boot configuration actually permits USB boot rather than QSPI/eMMC/SD.

Local privilege escalation in Google Android 14 through 17 (including 16-qpr2) arises from type-confusion memory corruption in multiple platform locations, letting a process that already has a low-privilege foothold on the device gain high-privilege code execution with confidentiality, integrity, and availability impact. Based on the CVSS vector (AV:L/AC:L/PR:L/UI:N), exploitation requires the attacker to already run code locally in a low-privileged context - a malicious or compromised app in its sandbox - and needs no user interaction and no special configuration; the flaw is reachable in default builds of the affected versions. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the issue as not automatable, and a vendor-released fix is available through the October 2026 Android Security Bulletin (patch level 2026-10-01), so this is a genuine but not emergency-grade priority - the key limiting factor is the need for an existing on-device foothold rather than remote reachability.

Local privilege escalation in Android's Bluetooth stack lets an app running with ordinary privileges corrupt control flow in the privileged Bluetooth process and inherit its elevated rights. The root cause is an uninitialized-pointer dereference (CWE-824) in handle_le_monitor_device_event of msft.cc, the Microsoft HCI vendor-extension handler, affecting Android 16, Android 16-qpr2 and Android 17 per EUVD. This is a second-stage escalation rather than a remote entry point: the attacker must already have local code execution and be able to reach the Bluetooth LE monitoring path (CVSS AV:L, PR:L, UI:N), and no public exploit code has been identified at time of analysis; Google addresses the issue in its October 2026 Android Security Bulletin.

An out-of-bounds write in Android's wpa_supplicant Robust AV / SCS action-frame handler (wpas_handle_robust_av_scs_recv_action in robust_av.c) can be turned into remote code execution on Android 14 through 17 (including 16-qpr2) devices that receive a crafted SCS action frame. Exploitation is sharply constrained: per the CVSS vector PR:H, the attacker must already hold System-level execution privileges on the target before the malformed frame is processed, and the independently assessed vector (AV:A) places the attacker in Wi-Fi/adjacent range rather than on arbitrary internet-routable paths. User interaction is not required (UI:N), and no public exploit code or CISA KEV entry has been identified at time of analysis; combined with the vendor score of 7.2 and the adjacent-vector reassessment, this rates as a moderate, not emergency, priority.

Out-of-bounds kernel memory writes in the NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) of Zephyr RTOS let a local user-mode thread that has already been granted the ADC device object corrupt memory beyond an undersized buffer it supplies to the adc_read()/adc_read_async() syscalls. Exploitation of the privilege boundary requires a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC with the GAU ADC devicetree node enabled; the attack vector is localized (CVSS 3.1 8.4, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) and the caller must already hold a device-object grant, but the scope change (S:C) and high integrity/availability impact reflect a genuine userspace-to-kernel privilege escalation path capable of kernel memory corruption or a crash. No public exploit code and no confirmed active exploitation were identified at time of analysis; builds without CONFIG_USERSPACE or on SoCs other than RW61x with the GAU ADC node enabled are not exposed to the privilege boundary and only suffer a silent overflow when the application itself passes an undersized buffer.

Out-of-bounds write in MediaTek's 'vdec' hardware video-decoder path allows remote escalation of privilege on a broad set of affected MediaTek SoCs - including MT6768, MT6833, MT8186, MT8195 and MT6877 - when a victim opens or plays attacker-controlled media that reaches the vulnerable decode routine. Exploitation requires no additional execution privileges or authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but does require user interaction, since the crafted stream must actually be rendered by the decoder; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the risk is best characterised as a credible, above-average-priority mobile vulnerability rather than an emergency. MediaTek has assigned patch ID ALPS11383899 (issue MSV-9614) and published guidance in its October 2026 product security bulletin.

Local privilege escalation in the MediaTek APU (AI Processing Unit) driver allows an attacker with existing code execution on affected devices to trigger a use-after-free, achieving full compromise of confidentiality, integrity, and availability (CVSS 8.4). The flaw affects MediaTek chipsets MT8781, MT6993, MT6899, MT8668, MT8910, and MT8793, and requires no additional privileges or user interaction once local access is obtained. No public exploit code or active exploitation is confirmed at time of analysis.

An out-of-bounds write in MediaTek modem (baseband) firmware allows an attacker operating a rogue base station to escalate privileges on a wide range of MediaTek chipsets (e.g., MT6853, MT6980, MT6991, MT8798, MT6895) once the victim's device connects to that base station; no authentication is required, but exploitation is high-complexity and requires user interaction per the assessed vector. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is bounded by the need for RF proximity to a malicious base station rather than being a mass-exploitable remote flaw.

Local privilege escalation in MediaTek NeuroPilot on affected chipsets (MT8781, MT8189, MT6993, MT8793, MT8910, MT8668, MT8188, MT6881, MT8875) allows an attacker with local code execution to trigger an out-of-bounds write in the APU/AI driver, potentially gaining high-integrity code execution with no user interaction, though no additional privileges are needed once that local app context exists. Vendor patch ALPS11249062 is available; no public exploit identified at time of analysis. It is a high-priority patch target for affected MediaTek-based devices but is not remotely reachable, limiting its scope to privilege escalation rather than initial compromise.

Local privilege escalation in MediaTek's NeuroPilot component allows an attacker with an existing foothold on a device to corrupt memory and elevate privileges via an out-of-bounds write caused by a missing bounds check (CWE-787), rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected platforms are devices built on MediaTek chipsets MT8668, MT8875, MT8781, MT8910, MT6881, MT8188, MT8189 and MT6993 that ship an unpatched NeuroPilot build. The flaw is not remotely reachable and requires local code execution (typically a running or installed Android app with no special privileges); no user interaction or elevated permissions are needed once that foothold exists, and no public exploit code was identified at time of analysis.

Memory corruption in the MediaTek cellular modem baseband (an out-of-bounds write from a missing bounds check) allows an attacker who operates a rogue base station within radio range to escalate privileges on the target device without authentication and without any user interaction. Exploitation is not reachable over the internet: the CVSS vector AV:A/AC:H/PR:N/UI:N with C:H/I:H/A:H reflects that the attacker must be in adjacent radio proximity and must successfully induce the victim's UE to attach to the malicious base station, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a conditionally gated baseband flaw rather than a mass-exploitation emergency. No public exploit code has been identified at time of analysis; MediaTek has released a fix under Patch ID MOLY01778988 (Issue ID MSV-8897) in its October 2026 product security bulletin.

An out-of-bounds write in MediaTek modem firmware (CWE-787) allows a nearby attacker operating a rogue base station to escalate privileges on affected devices once the user equipment attaches to the attacker-controlled cell. The flaw has a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects dozens of MediaTek chipsets, including MT6833, MT6877, MT6983, MT6985, and MT6989, when they run unpatched modem firmware. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, and MediaTek has published a fix under Patch ID MOLY01778993 in its October 2026 product security bulletin.

Use-after-free in Google Chrome's MediaStream component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page, affecting all Chrome builds prior to 154.0.8037.97 on the stable channel. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) but depends on user interaction: the target must load a malicious page that exercises the WebRTC/MediaStream path, and the resulting code execution is confined to the sandboxed renderer (S:U), so host-level compromise would require a separate sandbox-escape bug. At time of analysis there is no public exploit identified and no evidence of active exploitation (SSVC Exploitation: none, EPSS 0.21% / 11th percentile), while a vendor patch exists at Chrome 154.0.8037.97, making this a serious-but-not-emergency patching priority.

Use-after-free in SVG rendering in Google Chrome versions prior to 154.0.8037.97 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by convincing a victim to load a crafted HTML page. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting unauthenticated remote reach with high confidentiality, integrity and availability impact, but it does require user interaction - the victim must navigate to or render attacker-controlled content, and no non-default configuration is needed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the practical severity is further bounded by the fact that code execution stays within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape bug. Vendor-released patch: Chrome 154.0.8037.97.

A use-after-free flaw in Chrome's Contextual Tasks component on Windows lets an attacker who has already compromised the renderer process break out of the browser sandbox and execute arbitrary code with the browser's privileges, triggered when the victim loads a crafted HTML page. Only Chrome builds on Windows prior to 154.0.8037.97 are affected, and exploitation is not an initial-access path: it requires a pre-existing renderer compromise plus user interaction, which is why the CVSS 3.1 base score of 8.3 reflects high attack complexity (AC:H). No public exploit code has been identified and EPSS is low at 0.21% (11th percentile), with CISA SSVC rating exploitation as 'none' and automatable as 'no'; Google has shipped a vendor patch in version 154.0.8037.97, and Chrome's default auto-update resolves the exposure.

Type confusion in the V8 JavaScript engine of Google Chrome allows remote code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page, affecting all versions prior to 154.0.8037.97 (Chromium severity: High, CVSS 3.1 base 8.8). Exploitation is unauthenticated but requires user interaction (UI:R) - the victim must navigate to or render attacker-controlled HTML/JavaScript - and code execution is confined to the sandbox with scope Unchanged, so escaping to the host OS would require a separate sandbox-escape flaw and site isolation further limits cross-origin reach. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available.

Use-after-free in the FedCM (Federated Credential Management) component of Google Chrome can allow a remote attacker to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, with the only stated precondition being user interaction (CVSS UI:R); no authentication is required per the assessed vector (PR:N). The 9.6 score reflects a scope change (S:C) - successful exploitation escapes the renderer sandbox onto the underlying host - but signals diverge sharply: EPSS is only ~0.21% (11th percentile) and CISA's SSVC records Exploitation: none, so no public exploit has been identified at time of analysis. Google has released a fix in Chrome 154.0.8037.97, and Chromium rates the underlying issue High severity.

Out-of-bounds write in the WebGL implementation of Google Chrome prior to 154.0.8037.97 allows remote attackers to corrupt memory and potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction - the target must visit or be redirected to an attacker-controlled page that exercises the WebGL path (enabled by default) - but no authentication or prior privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6, Chromium security severity Critical). No public exploit code or confirmed active exploitation was identified at time of analysis; Google credits its own Chrome team for the report, and a vendor patch is available, so the primary risk window is unpatched Chrome installations that continue to browse untrusted content.

Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.

Out-of-bounds write in PeaZip's PEA archive extractor allows an attacker to execute arbitrary code with the privileges of the user who opens or extracts a crafted .pea file in PeaZip 11.2.0 and earlier, on Windows, Linux, macOS and BSD. The defect is in the first PCOMPRESS1 block: an attacker-controlled 32-bit compsize value is taken straight from the archive and used as both the blockread length and the copy-loop bound into fixed 1,114,112-byte global buffers, with no archive password, integrity tag or non-default configuration required. Exploitation is local and requires the victim to open or extract the archive (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H; CVSS 4.0 base 8.4), and no public exploit was identified at time of analysis, although the reporting researchers demonstrated code execution against the official Linux x86-64 and Windows x64 builds.

Out-of-bounds write in pgvector before 0.8.7 lets an authenticated database user corrupt memory while building or populating a vector index, which can escalate to arbitrary code execution on the PostgreSQL server host. Only users who can create/rebuild a vector index or insert rows into an indexed vector column can trigger it, and the trigger is supplying a vector whose dimensionality does not match the index definition, since affected versions perform no dimension validation. Patch status is a vendor-released fix (0.8.7) and no public exploit code was identified at time of analysis; SSVC scores exploitation as 'none' and automatable as 'no', and EPSS/KEV signals are absent, so this is a high-priority hardening item rather than an emergency - but SSVC rates technical impact as 'total', so multi-tenant databases where untrusted roles hold index or insert privileges are the realistic risk surface.

Concurrent Digest authentication requests against Apache HTTP Server before 2.4.69 can corrupt authentication state via a use-after-free in the mod_auth_digest module, yielding low integrity and availability impact with no confidentiality impact (per the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Unauthenticated remote clients can reach the flaw, but exploitation is gated by two non-default preconditions: AuthDigestNcCheck must be enabled or AuthDigestNonceLifetime set to 0, and the attacker must win a timing-dependent race by sending concurrent Digest requests - serial requests will not reliably trigger it. There is no public exploit identified at time of analysis, no EPSS score, no CISA KEV entry, and no vendor-supplied CVSS, so the sole source is the Apache advisory; the fix is version 2.4.69.

An out-of-bounds write in Apache HTTP Server 2.4.0 through 2.4.68 on Windows can corrupt memory when the server processes request paths containing MS-DOS 8.3 short filenames that expand to longer names, giving a remote attacker a route to service disruption (assessed availability impact High) with limited confidentiality and integrity impact. Exploitation is Windows-only and conditional: 8.3 short-name generation must be enabled on the underlying NTFS volume (the historical default unless NtfsDisable8dot3NameCreation has been set) and the crafted path must actually reach the expanding-path code path, which is reflected in the assessed vector's AC:H. Apache published no CVSS score, and the supplied intelligence contains no CISA KEV listing, no public exploit code, and no EPSS probability, so there is no public exploit identified at time of analysis.

Use-after-free in Apache HTTP Server's mod_http2 module (versions 2.4.0 through 2.4.68) allows unauthenticated remote attackers to corrupt memory and crash server worker processes by driving re-entrant access to a shared per-session buffer. The flaw only manifests when mod_http2 is loaded and HTTP/2 is actually enabled (h2 and/or h2c in the Protocols directive), and the trigger requires specific concurrent/streamed HTTP/2 request patterns, so the assessed vector is network-reachable but high complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) with impact limited to availability. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied.

An out-of-bounds write in Apache HTTP Server's mod_proxy_html output filter affects versions 2.4.0 through 2.4.68 and can be triggered by a crafted HTML response body that the server parses and rewrites while proxying upstream content. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates remote unauthenticated attackers can reach the flaw, but high attack complexity reflects a significant deployment prerequisite: mod_proxy_html must be explicitly loaded and actively rewriting proxied HTML, which is not a default configuration, and the attacker must be able to influence the upstream/backend response body being processed. The result is memory corruption with low confidentiality and integrity impact and a high availability impact, and no public exploit has been identified at the time of analysis; servers used solely as origin web servers, or proxies that do not enable mod_proxy_html, are not affected.

Denial of service in Apache HTTP Server 2.4.0 through 2.4.68 arises from a use-after-free in the mod_rewrite module that is reachable only when a RewriteRule or RewriteCond uses the lookahead variables %{LA-U:...} or %{LA-F:...}, which exercise an internal subrequest code path. An unauthenticated remote attacker who can reach a server configured that way can trigger the memory error and crash request-handling processes, degrading or halting service; the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is confined to availability and the high attack complexity combined with the non-default configuration prerequisite substantially limits real-world exploitability. No CVSS score or vector has been published by NVD or the vendor, there is no EPSS probability and no CISA KEV listing, and no public exploit code has been identified at time of analysis.

An out-of-bounds write in Apache HTTP Server's optional mod_charset_lite module (affecting versions 2.4.0 through 2.4.68) can corrupt process memory when character-set translation is configured, potentially crashing the server or enabling limited data disclosure or modification. Exposure is narrow: mod_charset_lite is not loaded in default installations and must be explicitly enabled and bound to a content path via directives such as CharsetSourceEnc, CharsetDefault, or an associated input/output filter, which is why the assessed vector rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Independent signals are otherwise sparse - no public exploit code, no CISA KEV listing, and no EPSS score were available - so no public exploit identified at time of analysis, and the practical severity hinges on whether the module is deployed.

Remote unauthenticated heap use-after-free in iperf3 3.21 can let an attacker crash or potentially execute code on an exposed iperf3 server. The flaw occurs in server mode when the per-test watchdog frees an iperf_stream without joining the worker thread, and a blocked worker then dereferences the freed memory; exploitation requires winning a timing race (AT:P), so success is not guaranteed on a single attempt. No public exploit identified at time of analysis; the vendor fix is iperf3 3.22.

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - or make it call through a freed pointer - when the server's SSLContext.sni_callback reassigns a different SSLContext to SSLSocket.context and nothing else keeps the original callback-bearing context alive. Only this non-default coding pattern is exploitable (typically per-connection SSLContext creation or context replacement while connections are open), and triggering generally requires a second ClientHello on the connection - e.g. a TLS 1.3 HelloRetryRequest induced by offering a rejected key share - or a callback that raises after switching context; servers that wrap their listening socket with the SSLContext and pure TLS clients are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-reported CVSS 4.0 score of 9.2 conflicts with an independent CVSS 3.1 assessment of 6.9 (AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:H), which reflects the restrictive, non-default prerequisites rather than unqualified remote code execution.

Out-of-bounds write in the NVIDIA Virtual GPU Manager (vGPU plugin) lets an unprivileged user inside an assigned guest VM corrupt host-side memory by sending a specially crafted RPC call across the virtualization channel, resulting in privilege escalation, data tampering, and denial of service on the host. Rated CVSS 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), the bug is only reachable in vGPU/VDI/cloud-GPU deployments where the host runs the vGPU plugin and has at least one guest assigned; it is not a network-facing flaw and does not affect standard bare-metal Linux GPU driver installs, and no public exploit code has been identified at time of analysis. Real-world risk is therefore defined by the attack surface rather than by mass exploitability, since a successful attack requires an attacker to already hold an unprivileged local account inside a hosted guest VM.

An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with low privileges corrupt kernel memory, which the vendor rates as potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering (CVSS 3.1 base 7.8, HIGH). The attack is strictly local - vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - so it is not remotely exploitable and requires only an authenticated low-privileged context or a tenant/guest that can reach the host kernel module; the risk is highest in multi-tenant VDI and cloud-GPU deployments where local access is comparatively easy to obtain. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so there is no evidence of confirmed active exploitation.

An out-of-bounds write in the NVIDIA Virtual GPU Manager (vGPU plugin) for Linux allows a user who already holds a low-privileged account inside a guest VM to corrupt host-side memory by sending a crafted RPC message whose performance-state list size parameters are invalid, potentially yielding code execution, privilege escalation, data tampering, denial of service, or information disclosure across the virtualization boundary. The defect is locally triggered (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires no user interaction, but it is only reachable on hosts actually running the vGPU Manager for multi-tenant vGPU/VDI/cloud-GPU workloads - single-tenant systems without vGPU virtualization are not exposed through this guest-to-host path. No public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); exploitability is constrained by the need for prior guest authentication and the presence of the vGPU component, making this a contained but genuine virtualization-trust-boundary flaw rather than a broad remote threat.

An out-of-bounds write in NVIDIA vGPU Manager's GPU System Processor (GSP) plugin lets an authenticated user inside a guest VM hit host-side plugin code with a specially crafted RPC message, potentially yielding code execution, privilege escalation, data tampering, denial of service, or information disclosure in the virtualization host stack. The practical barrier is an existing foothold in an authorized vGPU guest rather than network reachability, and no public exploit code has been identified at time of analysis. Scoring 7.8 under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N, with high confidentiality, integrity, and availability impact) it represents a Moderate, locally-scoped risk that matters most in multi-tenant vGPU deployments where guest-to-host isolation is a core control.

An out-of-bounds write in the kernel-mode layer of the NVIDIA vGPU Virtual GPU Manager for Windows and Linux allows a local attacker holding low privileges to corrupt kernel memory and potentially achieve code execution, privilege escalation, denial of service, information disclosure, and data tampering (CVSS 3.1 base 7.8). The flaw is local-only (AV:L) and requires an existing low-privileged foothold (PR:L) with no user interaction (UI:N); there is no public exploit identified at time of analysis and the package is not listed in CISA KEV. Although the numeric score is High, practical risk is assessed as MODERATE because exploitation demands local code execution on a host that specifically runs the vGPU manager - a component found in vGPU/VDI and cloud-GPU deployments rather than ordinary consumer driver installs.

Local privilege escalation, code execution, denial of service, information disclosure, and data tampering are possible in NVIDIA GPU Display Driver for Linux due to a use-after-free in the open-source kernel module's event-delivery path. An authenticated local user with access to NVIDIA GPU device nodes can race asynchronous event delivery against file close (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), though the high attack complexity makes success non-deterministic and typically requires repeated attempts; no public exploit has been identified at time of analysis. Risk is concentrated on Linux hosts using the affected open-source kernel module, particularly multi-tenant vGPU, VDI, and cloud GPU deployments.

Out-of-bounds write in the NVIDIA GPU Display Driver for Windows kernel module can let a local, authenticated low-privileged user execute code, escalate privileges, cause denial of service, disclose information, or tamper with data on affected GeForce, RTX/Quadro/NVS, and Tesla systems. Exploitation requires local access to the GPU-equipped Windows host plus a low-privileged account able to reach the kernel module, and the high attack complexity means it is not reliably one-shot; multi-user, VDI, and cloud/virtual-GPU environments are the main risk. No public exploit identified at time of analysis, and CVSS is 7.0 with high confidentiality, integrity, and availability impact.

Local privilege escalation in NVIDIA GPU Display Driver for Windows and Linux can be achieved by an unprivileged local user through the open-source kernel module's DMA-BUF import path, where importing a read-only buffer from another device's DMA-BUF exporter improperly preserves memory access permissions. Successful exploitation can result in code execution, privilege escalation, denial of service, information disclosure, and data tampering, with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.

Local privilege escalation in the NVIDIA GPU Display Driver's open-source kernel module lets an unprivileged local user trigger a use-after-free in the Resource Server map cleanup path via a missing self-reference guard, yielding code execution, privilege escalation, denial of service, information disclosure and data tampering (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N, CWE-416). Affected are Windows and Linux hosts running the open-source kernel module variant of the driver, spanning GeForce, RTX/Quadro/NVS and Tesla product lines per the published CPEs; exploitation requires only a normal local account and no user interaction, but is strictly local with no network vector. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the practical risk is highest in shared or multi-tenant GPU environments (vGPU, VDI, cloud GPU) where gaining kernel-level control of the GPU driver crosses a meaningful tenant boundary.