Memory Corruption

Local privilege escalation and potential code execution in NVIDIA GPU Display Driver for Windows and Linux arise from a use-after-free (CWE-416) reachable by a low-privileged local user who can issue a crafted sequence of driver commands. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity, and availability impact as high, with the greatest risk in shared or virtualized GPU deployments where guest-driver or virtual GPU manager isolation may be broken. No public exploit code or confirmed active exploitation is identified in the available data, and EPSS is not provided; exploitation requires local access and construction of the specific command sequence.

Local privilege escalation in NVIDIA Display Driver for Windows and Linux allows an unprivileged local attacker to trigger a use-after-free condition by issuing a crafted sequence of driver commands, potentially achieving code execution, privilege escalation, denial of service, or information disclosure. The vulnerability affects systems with GeForce, RTX/Quadro/NVS, or Tesla GPUs running vulnerable driver versions. No public exploit identified at time of analysis.

Local privilege escalation and memory corruption in NVIDIA GPU Display Driver on Windows and Linux, affecting GeForce, RTX/Quadro/NVS, and Tesla lines. An unprivileged local user can trigger a use-after-free (CWE-416) by issuing a specific sequence of driver commands, leading to potential code execution, privilege escalation, denial of service, or information disclosure. Requires local access and low privileges (AV:L/PR:L) with no user interaction (UI:N); no public exploit identified at time of analysis. Risk is highest in multi-user or shared-GPU environments such as VDI, terminal servers, and cloud/virtualized GPU hosts.

Local privilege escalation in the NVIDIA GPU Display Driver for Linux allows an authenticated, unprivileged user to trigger a use-after-free condition by issuing a specific sequence of driver commands, potentially leading to code execution, privilege escalation, denial of service, and information disclosure. The vulnerability affects GeForce, RTX/Quadro/NVS, and Tesla GPU drivers, including guest-VM vGPU deployments, and requires local access with low privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Use-after-free in the NVIDIA GPU Display Driver for Linux allows a local, unprivileged user to corrupt driver memory by racing or abusing object lifetime handling, with a successful exploit potentially yielding code execution in kernel context, privilege escalation to root, denial of service, information disclosure, and data tampering. The flaw scores 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is confined to local attackers who already hold an account on the GPU host, with no network vector and no user interaction required. This is a genuine but not emergency-grade issue: no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so realistic exposure is concentrated on shared or multi-tenant GPU systems - VDI desktops, cloud GPU instances, and HPC nodes - where untrusted users share a single driver instance.

Type confusion in the kernel-mode component of the NVIDIA GPU Display Driver for Windows allows a local attacker who already holds low-privileged code execution to corrupt kernel memory and potentially escalate to SYSTEM, crash the machine (BSOD/DoS), disclose kernel memory, or tamper with data. The issue is rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must be local and authenticated with low privileges and no user interaction is required, and it affects the GeForce, RTX/Quadro/NVS and Tesla Windows driver branches. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is an access-gated local privilege-escalation risk rather than a remotely reachable mass-exploitation threat.

Local privilege escalation in NVIDIA Display Driver on Windows allows an authenticated low-privileged user to trigger a use-after-free in the kernel-mode driver, potentially enabling code execution with SYSTEM privileges, denial of service, information disclosure, or data tampering. The vulnerability requires local access and high attack complexity (AC:H) due to race conditions or kernel-pool reclamation, making reliable exploitation non-trivial, and it is not known to be actively exploited. The highest risk is in shared multi-user, VDI, or cloud-GPU environments where crossing a trust boundary from low-privileged user to kernel is significant.

Local code execution and denial of service on Windows systems with affected NVIDIA GPU Display Drivers stem from an integer overflow in the display driver's DIAG escape handler that results in an out-of-bounds write (CWE-787). An unprivileged local user (CVSS PR:L) can trigger the flaw via a device I/O call to the handler; no user interaction is required, and exploitation is confined to the local machine, meaning an attacker must already have a foothold. No public exploit identified at time of analysis (and no CISA KEV entry), but the shared-system impact-multi-user workstations, VDI, and cloud GPU instances-raises the risk profile.

An out-of-bounds write in NVIDIA NVAPI for Windows allows a locally authenticated attacker holding standard user privileges to corrupt memory by invoking NVAPI entry points, potentially leading to code execution, elevation of privileges, information disclosure, denial of service, or data tampering. The flaw affects hosts running the NVIDIA GPU driver package on Windows - including GeForce, RTX/Quadro/NVS, and Tesla driver-equipped systems - with a CVSS 3.1 base score of 7.8 (HIGH) under vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, but the local-only, low-privilege prerequisite makes shared and multi-tenant GPU/VDI hosts the most exposed environment.

Type confusion in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows a local low-privileged user (CVSS vector AV:L/AC:L/PR:L/UI:N) who can reach the driver's device-node/ioctl interface to trigger memory corruption with high impact across confidentiality, integrity, and availability, potentially yielding code execution in kernel context, privilege escalation to root, denial of service, information disclosure, and data tampering. The CVSS 3.1 base score of 7.8 reflects a local attack vector paired with uniformly high impacts rather than any remote reachability, and despite the 'RCE' tag in the source metadata the vulnerability is not remotely exploitable. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and no EPSS or CISA KEV signal was provided.

A type-confusion flaw in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux lets a local, low-privileged user who can open the driver's device nodes and issue ioctls trigger memory corruption by winning a handle-recycle race, yielding kernel-level code execution, privilege escalation, denial of service, information disclosure and data tampering. Affected platforms are the Linux driver branches covering GeForce, RTX/Quadro/NVS, Tesla/data-center GPUs and the vGPU guest driver and Virtual GPU Manager (CVSS 3.1 base 7.8; our independent assessment rates it AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. 7.0, because the race window makes exploitation timing-sensitive rather than deterministic). This is a local privilege-escalation-class issue with no remote vector: no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though it is most consequential on multi-user, VDI and cloud/virtualized GPU hosts where untrusted tenants share a single driver instance.

Local privilege escalation in NVIDIA GPU Display Driver for Linux allows an unprivileged local user to trigger an out-of-bounds write in kernel memory via a crafted ioctl call with an unvalidated buffer size, enabling code execution, privilege escalation, information disclosure, and denial of service. The flaw affects GeForce, RTX/Quadro/NVS, and Tesla drivers, as well as Guest Driver and Virtual GPU Manager components, with highest risk in multi-tenant GPU environments such as VDI and cloud/HPC deployments. No public exploit identified at time of analysis; CVSS 3.1 score is 7.8 (local, low privileges, no user interaction).

Local privilege escalation in the NVIDIA GPU Display Driver for Linux allows an authenticated unprivileged user to trigger a use-after-free in the kernel mode layer, potentially achieving code execution, denial of service, privilege escalation, information disclosure, and data tampering. The flaw is reachable only by a locally authenticated low-privileged account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) that can issue ioctls to the GPU kernel-mode device interface; there is no remote attack path and no user interaction is required once a foothold exists. The 'Guest Driver' classification makes the issue most consequential in virtualized/vGPU and multi-tenant datacenter environments, where a low-privileged guest can reach the shared GPU driver. No public exploit identified at time of analysis, and the vendor advisory is the authoritative source for fixed driver versions.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows an unprivileged local user to corrupt kernel memory, which can lead to code execution in the kernel, privilege escalation, denial of service, information disclosure, or data tampering. Systems running GeForce, RTX/Quadro/NVS, or Tesla driver packages on either operating system are affected; per the CVSS vector (AV:L, PR:L, UI:N) the flaw is reachable only by a user who already has local code execution on the host, making it a local privilege-escalation primitive rather than a remote entry point. No public exploit has been identified at time of analysis.

Use-after-free in the NVIDIA GPU Display Driver kernel mode layer (Windows and Linux) lets a local user who already holds low-privileged code execution on the host trigger a memory-corruption condition inside the kernel driver, with the potential for code execution, privilege escalation, information disclosure, data tampering, and denial of service. Affected platforms span consumer and professional GPU lines (GeForce, RTX/Quadro/NVS, Tesla) as well as the vGPU components, where a malicious or compromised guest can exercise the vulnerable path through the Guest Driver and Virtual GPU Manager. The attack is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, score 7.8), requires no user interaction and no non-default configuration beyond having the driver installed, and there is no public exploit identified at time of analysis - no KEV entry and no proof-of-concept code is referenced in the available data.

A locally-triggered out-of-bounds write in the NVIDIA GPU Display Driver kernel-mode layer lets an attacker who already holds low-level privileges on a Windows or Linux host corrupt kernel memory, with the potential for code execution in kernel context, escalation of privileges, denial of service, information disclosure and data tampering. The affected driver ships by default across the GeForce, RTX/Quadro/NVS, Tesla and Virtual GPU Manager product lines, so any host with a current NVIDIA driver installed is in scope, but exploitation is not remote: an attacker must first obtain code execution on the target (an authenticated local user, a compromised low-privileged process, or sandboxed code with driver access) and then develop a reliable kernel corruption exploit. CVE-2026-47548 carries a vendor/NVD CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, High); no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows a local, low-privileged authenticated user to corrupt kernel memory, with the potential to escalate privileges to kernel-level code execution, crash the system (denial of service), disclose information, or tamper with data. The flaw rates CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires pre-existing code execution as a standard user on a host with the driver loaded, but no user interaction and no non-default configuration; the vulnerable kernel-mode layer ships and loads by default once the driver is installed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but the affected GeForce, RTX/Quadro/NVS, and Tesla product families are extremely widely deployed, making this a genuine high-priority patch-management item rather than an emergency.

Local attackers with low privileges can exploit an uninitialized pointer access flaw (CWE-824) in the firmware of NVIDIA Display Driver for Windows and Linux to achieve code execution, denial of service, privilege escalation, information disclosure, or data tampering. The vulnerability requires local access (AV:L) and authenticated low-privilege credentials (PR:L); no public exploit identified at time of analysis. Affected products include GeForce, RTX/Quadro/NVS, and Tesla product lines, including vGPU Manager deployments.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux lets a local attacker who already holds low-privilege code execution corrupt kernel memory, with potential outcomes of privilege escalation, arbitrary code execution, denial of service, information disclosure and data tampering (CWE-787, CVSS 7.8). The assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H shows low attack complexity and no user interaction, but the attack is strictly local: an attacker must first have a foothold on the host, or on a guest in a vGPU configuration, which confines it to privilege-escalation and sandbox-escape scenarios rather than remote mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis (no public exploit identified at time of analysis), so this is a genuine local privilege-escalation priority despite the absence of exploitation signals, and it warrants prompt patching on endpoint, workstation, and multi-tenant virtual-desktop estates.

A use-after-free (CWE-416) in the NVIDIA GPU Display Driver for Windows and Linux lets a local unprivileged user free and then re-reference a driver-managed memory object, potentially yielding code execution in kernel context, privilege escalation, data tampering, denial of service, and information disclosure. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects GeForce, RTX/Quadro/NVS, and Tesla product lines; the 'Guest Driver' tag indicates the vulnerable path may also be reachable from inside a virtualized guest, making guest-to-host or guest-context escalation a relevant scenario. Exploitation requires that the attacker already hold a local foothold with normal user privileges on a host with the affected driver installed and the GPU device interface exposed - there is no remote/network vector - and at time of analysis no public exploit code and no confirmed active exploitation have been identified, so this is a priority local privilege-escalation issue rather than an imminent, opportunistically exploited threat.

Local privilege escalation in the NVIDIA GPU Display Driver kernel-mode layer allows a user with standard privileges to trigger an out-of-bounds write in kernel memory, potentially achieving kernel-level code execution, denial of service, information disclosure and data tampering. The affected driver branches span NVIDIA GeForce, RTX/Quadro/NVS and Tesla families on both Windows and Linux, and the 'Guest Driver' tag indicates virtualized/vGPU and guest-VM driver deployments are also in scope, which matters for GPU-accelerated VDI and datacenter estates. Exploitation is constrained to the host: the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), so an attacker must already have a foothold and the ability to run code as a low-privileged local user; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Local privilege escalation in the NVIDIA GPU Display Driver for Windows allows a low-privileged local user - or a sandboxed process or guest with access to the driver interface - to trigger a use-after-free in the kernel-mode layer, potentially achieving kernel code execution, privilege escalation, denial of service, information disclosure, or data tampering. The assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) means the attacker must already have code running on a host with an affected NVIDIA driver installed, but needs no user interaction and faces low complexity once local access exists; per the affected CPEs, the GeForce, RTX/Quadro/NVS, and Tesla branches are in scope, and the associated Guest Driver and Virtual GPU Manager tags mean a virtual-GPU guest may also be able to reach the kernel layer. No public exploit code or confirmed active exploitation was identified at the time of analysis, and hosts without an NVIDIA GPU/driver installed are unaffected.

Local code execution, privilege escalation, denial of service, information disclosure, and data tampering are possible on Linux systems running vulnerable NVIDIA GPU Display Drivers (GeForce, RTX/Quadro/NVS, and Tesla branches) because of a type-confusion flaw (CWE-843) in the outdated embedded cryptographic library used by the NGX updater. The assessed profile is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8): an attacker who already holds a low-privileged local account can reach the vulnerable updater code path, with no user interaction required and low complexity, but the flaw is not remotely reachable, so shared and multi-user hosts (VDI, HPC/Tesla compute clusters, and workstations with untrusted local users) are the realistic risk surface. No public exploit code has been identified at time of analysis, and the exact affected and fixed driver versions must be confirmed from NVIDIA's advisory.

Local privilege escalation in the NVIDIA GPU Display Driver for Linux allows an authenticated, low-privileged user to drive an out-of-bounds write in the driver's kernel-mode layer by supplying mismatched memory buffers during event buffer setup, with a successful exploit potentially leading to kernel code execution, denial of service, privilege escalation, information disclosure, and data tampering (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected code is the Linux kernel-mode component shipped with GeForce, RTX/Quadro/NVS and Tesla driver packages, and the same path can be reached by untrusted code inside a guest VM using the NVIDIA vGPU guest driver on a host running the Virtual GPU Manager. No public exploit code was identified and there is no confirmed active exploitation (CISA KEV) at time of analysis; the bug is local-only, requiring the attacker to already run code with at least low privileges on the host or in a guest, and it is not remotely reachable.

Local privilege escalation in the NVIDIA GPU Display Driver kernel-mode layer lets an attacker who already holds low-privileged code execution on a Windows or Linux host - including code running inside a vGPU guest VM - drive the driver into an error path that mishandles reference counts, producing a use-after-free. The corrupted object is kernel memory, so successful exploitation can yield code execution, escalation of privileges, denial of service, information disclosure, and data tampering (CVSS 7.8, AV:L/AC:L/PR:L/UI:N); it is not remotely reachable and requires a vulnerable driver version to be installed. The GeForce, RTX/Quadro/NVS, and Tesla driver families are in scope, and no public exploit code has been identified at the time of analysis.

An out-of-bounds write in the Pgpool-II connection pooling and load-balancing middleware allows an authenticated remote attacker to trigger abnormal termination of the Pgpool-II process, denying service to PostgreSQL clients routed through it. Exploitation requires valid credentials accepted by the Pgpool-II frontend (PR:L) and network reachability to its listening port; no user interaction or high privileges are needed, and the assessed impact is availability only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, vendor-scored 7.1 under CVSS 4.0). Affected releases are Pgpool-II 3.5.x through 4.2.x, 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7 and 4.7.0-4.7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a genuine but bounded-severity availability issue rather than an active exploitation campaign.

An out-of-bounds write (CWE-787) in Pgpool-II, the PostgreSQL connection pooler, allows an authenticated attacker who already holds valid low-privileged credentials to cause abnormal termination of the Pgpool-II process or, depending on memory layout and build hardening, to achieve arbitrary code execution. Affected branches span 3.5.x through 4.2.x as well as 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7 and 4.7.0-4.7.2; exploitation is remote (AV:N), low complexity and requires no user interaction, but the PR:L authentication prerequisite makes this a post-authentication flaw rather than an unauthenticated internet-facing one. The vendor score is 8.7 (CVSS 4.0) and the independent assessment maps it to 8.8 (CVSS 3.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis and there is no CISA KEV listing confirming active exploitation.

Out-of-bounds write in PCRE2, the regular-expression library embedded in PHP, nginx, Apache httpd, Git and numerous language runtimes, allows memory corruption when a consuming application compiles an attacker-controlled pattern through the JIT compilation API in the manner described by the vendor advisory. Only releases before 10.49 are affected, and exploitation is gated on two conditions holding at once: the application must accept untrusted, user-supplied regexes and must route them through PCRE2's JIT path, so default library presence alone does not imply exploitability. The assessed vector is network-reachable with high attack complexity and no privileges required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, base 7.6); no public exploit code and no CISA KEV entry were identified at time of analysis. A vendor patch is available per the advisory, so upgrading to a fixed release remediates.

Unauthenticated remote code execution in Pexip Infinity Conferencing Nodes (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) allows an attacker who can reach the node over the network to run arbitrary code as an unprivileged service account by sending crafted input that triggers an out-of-bounds write. Affected builds are all versions before 38.2 as well as 39.0, 39.1 and 40.0; a fixed 38.2 release and corresponding maintenance releases are referenced in Pexip's security bulletins. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), but exploitation requires no authentication, no user interaction and no special conditions, and the resulting code execution is unprivileged - full host takeover would require chaining a separate local privilege-escalation bug such as sibling CVE-2026-103106.

Improper input validation in Pexip Infinity's media implementation allows an unauthenticated remote party to send a crafted media stream that causes memory corruption or a controlled software abort on the conferencing node, resulting in denial of service. Affected releases are Infinity before 38.2 and the 39.0, 39.1, and 40.0 branches; because the published vector is network-reachable with no privileges (PR:N) and no user interaction (UI:N), any host able to route media to an exposed node can attempt exploitation, though CISA's SSVC assessment rates the issue as not automatable, indicating a hand-crafted rather than commodity attack. The confirmed outcome is a controlled abort (availability impact), with memory corruption explicitly a stated potential rather than demonstrated, and the published 9.4 score is moderated in independent assessment (C:N/I:L/A:H) since confidentiality impact is not established; there is no public exploit identified at time of analysis and EPSS is low at 0.24% (14th percentile).

Memory corruption in U-Boot's DHCPv6 netboot path allows an attacker on the same local network to crash or corrupt the bootloader by sending crafted DHCPv6 ADVERTISE or REPLY packets with oversized DUID (SERVERID/CLIENTID) option lengths. All U-Boot builds prior to 2026.10-rc5 that perform DHCPv6-based network boot are affected; the assessed impact is availability-focused (CVSS:3.1 AV:A/AC:L/PR:N/UI:N/C:N/I:L/A:H), with confidentiality unaffected and integrity impact limited. Exploitation requires adjacency to the booting device and only works during the brief netboot window, so devices that boot from local storage are not exposed; no public exploit and no confirmed active exploitation were identified at time of analysis.

A use-after-free in U-Boot's lwIP-based wget HTTP client lets an attacker who controls (or MITMs) the server a device downloads from crash the bootloader during a netboot/provisioning fetch, interrupting boot. The bug sits in the httpc_recv_cb() receive callback: when HTTP data storage fails, it frees the connection's protocol control block but returns ERR_BUF instead of ERR_ABRT, so the TCP input path continues on released memory. All U-Boot versions before 2026.10-rc5 are affected; the CVSS 4.0 vector scores 8.8 (AV:N/AC:L/PR:N/UI:N, VA:H, VI:L) and our independent CVSS 3.1 assessment rates it 7.5 as an availability-dominant issue - no public exploit identified at time of analysis, and impact is limited to a bootloader crash rather than code execution or data exposure.

Memory corruption in U-Boot's IP fragment reassembly code (net/net.c) allows remote, unauthenticated attackers on the boot network to crash the bootloader and corrupt adjacent memory while a device is performing a netboot. Only builds compiled with CONFIG_IP_DEFRAG are affected - an opt-in, frequently disabled compile option - so deployments without it are not vulnerable, and exploitation requires delivering a crafted IP fragment with a non-zero offset and the More-Fragments flag onto the boot path during the narrow netboot window. The CVSS 4.0 base score is 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H), an availability-dominant flaw with only limited integrity impact and no confidentiality loss, and no public exploit has been identified at time of analysis (no CISA KEV listing).

Arbitrary code execution inside the renderer sandbox can be achieved by a remote attacker who lures a Google Chrome user, on any build prior to 154.0.8037.92, into loading a crafted HTML page that triggers a type confusion in the V8 JavaScript engine. No authentication or special privileges are required, but the victim must actively render attacker-controlled HTML/JavaScript (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), so exploitation is dependent on user interaction. Per the CISA SSVC evaluation exploitation is currently none and no public exploit code has been identified at time of analysis; the risk is driven instead by Chrome's enormous install base, the total technical impact rating, and the fact that any resulting code execution stays confined to the renderer sandbox - full host compromise would require chaining a separate sandbox-escape vulnerability. Google classifies the issue as High severity and a vendor patch is available.

Sandbox escape via a use-after-free in Google Chrome's PictureInPicture component affects all versions prior to 154.0.8037.92 and can lead to arbitrary code execution outside the browser sandbox, but only as a second-stage primitive: the attacker must already have compromised Chrome's sandboxed renderer process and must convince a victim to render a crafted HTML page. Scored CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), the High AC:H value reflects that precondition, so this is realistically usable only as one link in an exploit chain rather than a standalone remote compromise. CISA's SSVC assessment records no exploitation activity and no public exploit code has been identified at time of analysis; the Chromium severity is High and a vendor patch is available.

An out-of-bounds write in the GPU process of Google Chrome prior to 154.0.8037.92 allows an attacker to break out of the browser sandbox and potentially execute arbitrary code at the browser's privilege level via a crafted HTML page. The attack is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed exploitation conditions indicate the attacker must have already compromised Chrome's renderer process, and the victim must load attacker-controlled content, making this a sandbox-escape link in a multi-stage exploit chain rather than a directly reachable remote bug. Only Chrome builds below 154.0.8037.92 are affected, and effective exploitation requires overcoming non-trivial memory-corruption and chaining conditions (AC:H); no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Google has released a vendor patch in Chrome 154.0.8037.92.

Use-after-free in Chrome's Views UI framework allows a remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code outside the browser sandbox on any Chrome desktop build prior to 154.0.8037.92. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) confirms remote, unauthenticated attack with no special privileges, but also confirms that user interaction - social engineering to get the victim to load the page - is mandatory, which is the main limiting factor; the scope change (S:C) reflects that impact is not confined to the renderer. No public exploit was identified at the time of analysis and CISA's SSVC assessment rates exploitation as 'none' and not automatable, but a vendor patch is available from Google and the technical impact is total, making prompt updating the priority.

Use-after-free in Google Chrome's FullScreen implementation prior to 154.0.8037.92 allows a remote, unauthenticated attacker to execute arbitrary code outside the browser's renderer sandbox by enticing a victim to load a crafted HTML page. The vulnerability carries a CVSS 3.1 base score of 9.6 with scope change (S:C) and High confidentiality, integrity, and availability impact, reflecting that successful exploitation escapes the sandbox rather than being confined to a compromised renderer. No public exploit code and no confirmed active exploitation have been identified at time of analysis (SSVC Exploitation: none), and the attack is not automatable for mass exploitation because it requires the victim to visit attacker-controlled content (UI:R); Google has released a vendor patch in Chrome 154.0.8037.92.

Type confusion in V8, Chrome's JavaScript engine, allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation requires user interaction (CVSS PR:N/UI:R) - the target must navigate to attacker-controlled or compromised content - and no public exploit code has been identified at time of analysis, with CISA's SSVC assessment recording Exploitation = none. Because V8 is the always-on JavaScript engine, any HTML/JS-rendering context is a viable trigger with no special configuration needed, but the resulting code execution is confined to the renderer sandbox (S:U), so full host compromise requires chaining a separate sandbox-escape vulnerability.

Remote code execution outside the browser sandbox is possible in Google Chrome builds prior to 154.0.8037.92 through a use-after-free in the Passwords component, which a remote attacker can trigger by convincing a victim to open a crafted HTML page. Because the CVSS vector is PR:N/UI:R, no authentication or special configuration is required, but the victim must actively navigate to the attacker's content and a successful chain must also defeat the sandbox, leaving full compromise achievable but non-trivial. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, while Google has released a vendor patch in Chrome 154.0.8037.92; the scope-change (S:C) rating reflects that a working exploit would escape the renderer boundary rather than remain confined to a single security context.

A use-after-free in Chrome's Views UI framework allows an unauthenticated remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code outside the browser sandbox in Google Chrome desktop builds prior to 154.0.8037.92. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), no credentials or special browser configuration are required - default installations are affected - but exploitation depends on user interaction with attacker-controlled content and on overcoming the difficulty of turning a use-after-free into a reliable sandbox escape, so a working exploit is not trivial. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; a vendor patch (154.0.8037.92) is available, which makes rapid update the decisive control.

Type confusion in the V8 JavaScript engine in Google Chrome prior to 154.0.8037.92 lets remote attackers execute arbitrary code inside the renderer sandbox by luring a victim into opening a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction - the victim must render the attacker's page - and because V8 runs JavaScript on essentially every page, default desktop configurations are exposed. Impact is scored 8.8 High (C:H/I:H/A:H) with the important caveat that code execution is confined to the sandbox, so full host compromise requires chaining a separate sandbox-escape bug; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available as Chrome 154.0.8037.92.

Type confusion in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the V8 sandbox when a victim loads a crafted HTML page in any Chrome build prior to 154.0.8037.92. Exploitation requires user interaction (the victim must browse to the malicious or compromised page) but no authentication or special configuration, since default JavaScript execution is sufficient; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Google has released a vendor patch in 154.0.8037.92, and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) has been identified. Because the flaw is contained by the V8 sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability.

Remote code execution outside the browser sandbox can potentially be achieved by an unauthenticated attacker in Google Chrome versions prior to 154.0.8037.92 by exploiting a use-after-free in the Bluetooth subsystem. The victim must navigate to a crafted HTML page that exercises the Web Bluetooth code path (UI:R), and successful exploitation can lead to arbitrary code execution with a scope change (S:C), meaning a sandbox escape. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in Chrome 154.0.8037.92.

Type confusion in the V8 JavaScript engine allows remote code execution inside the Chrome renderer sandbox on any unpatched build prior to 154.0.8037.92. Because the flaw is triggered by a crafted HTML page, the attacker needs only to convince a victim to visit it - no credentials or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8, Chromium severity High) - and exploitation works against default configurations with JavaScript enabled. Successful exploitation yields arbitrary code execution confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape bug; exploitability is high but not trivially mass-exploitable. No public exploit was identified at time of analysis, and our assessment rates this as a genuinely high-priority browser vulnerability rather than an inflated-CVSS artifact. Vendor-released patch: 154.0.8037.92.

An out-of-bounds heap write in Eclipse ThreadX LevelX's NAND flash-translation-layer metadata parser can give a local attacker control-flow hijack when the device mounts a crafted NAND flash image through lx_nand_flash_open(), overwriting a driver function pointer with an attacker-chosen 8-byte value; two accompanying out-of-bounds reads were also demonstrated. The bug (CWE-787) is rated 8.6 under CVSS 4.0 and independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication or user interaction is needed but the attacker must first supply or tamper with the flash image (removable or attached NAND media, modified firmware or OTA image, or supply-chain/provisioning substitution). No public exploit code was identified at time of analysis, though the issue was reproduced verbatim under ASan at HEAD 9f1cfdc; devices that only mount internally trusted flash images are not realistically reachable, while those accepting field-swappable or externally sourced NAND are directly exposed, with the worst impact on bare-metal or non-memory-protected targets where the hijacked pointer yields code execution.

Heap out-of-bounds write in the mDNS responder of Eclipse ThreadX NetX Duo allows an unauthenticated attacker on the same local network segment to corrupt packet memory by sending two ordinary mDNS PTR records in response to a _http._tcp service query. The flaw arises from a string-table bucket collision: owner names of 12-15 characters round to the same slot size, causing the responder to reuse a shorter stored entry and write 1-3 bytes past the transmit packet's data end. With the mDNS addon active and adjacency to the target, the realistic impact is denial of service through corrupted neighboring packets or pool free lists, though code execution is not demonstrated; no public exploit code or active exploitation has been identified at time of analysis.

An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACKET control block structures via a maliciously crafted masked WebSocket frame, potentially leading to code execution or denial of service. The vulnerability, tracked as CVE-2026-102761 with a CVSS 4.0 score of 9.3, affects all versions of NetX Duo per the CPE. No public exploit code has been identified at time of analysis, and no KEV status is reported.

Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device, because each outbound TLS record is zeroed after the TCP layer has already taken ownership of - and may have freed and recycled - the underlying packet chain. The defect is a CWE-416 use-after-free write with a length underflow on reused packets, reachable from the network without authentication (CVSSv3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, with the published CVSS 4.0 score of 8.3 reflecting the availability impact). It is not present in default builds: exploitation requires the non-default NX_SECURE_KEY_CLEAR compile-time option plus packet-pool free/reuse timing an attacker cannot deterministically force, so practical risk is lower than the headline score; no public exploit identified at time of analysis and no confirmed active exploitation.

A type-confusion memory-safety flaw in libsoup's WebSocket handling can crash or corrupt the heap of applications that process incoming Pong frames. When a Pong frame arrives, SoupWebsocketConnection emits its ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes object, so any application that connects a ::pong handler written to the documented GBytes API will misinterpret the payload and may suffer heap corruption or a crash. This is not exploitable against default libsoup usage: the target must both act as a WebSocket peer and explicitly register a ::pong handler, and the attacker must control or compromise the WebSocket endpoint (or otherwise inject a crafted Pong frame) into that connection. The recorded CVSS 3.1 base score is 8.6, but the independent assessment rates it AC:H with C:L/I:L/A:H because exploitation is gated on that non-default handler registration; unauthenticated remote attackers (PR:N, UI:N) can reach the code path, however no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited.

Heap-based buffer overflow in CTranslate2 before 4.8.1 allows an attacker to cause a crash or potentially achieve arbitrary code execution by supplying a malicious binary model file (.bin) that is loaded by the victim. The flaw is in the binary model loader, which fails to validate the payload length against the allocated buffer size (CWE-787). Exploitation requires the victim to actively load an untrusted model, making it a local, user-interaction-dependent issue rather than a remotely reachable network threat. No public exploit has been identified at time of analysis. The CVSS score is 8.5.

Out-of-bounds memory access in OpenSSL during an in-progress TLS/DTLS handshake can crash or destabilize servers that call SSL_set_SSL_CTX() mid-handshake, producing a denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). The issue affects OpenSSL 4.0.0 through 4.0.2, 3.6.0 through 3.6.4, 3.5.0 through 3.5.8, and 3.4.0 through 3.4.7, and is fixed in 4.0.3, 3.6.5, 3.5.9, and 3.4.8 respectively. Exploitation is unauthenticated and requires only network reach to a server that swaps SSL_CTX objects inside the SNI (servername) callback for virtual hosting or multi-certificate selection; no public exploit identified at time of analysis, and this is a conditional availability issue rather than a critical priority.

Use-after-free in OpenSSL 4.0.0 through 4.0.2's X.509 extension cache allows unauthenticated remote attackers to crash multithreaded services that parse or validate attacker-influenced certificates, producing denial of service. Exploitation is not a deterministic single-shot input: it requires winning a timing-sensitive thread race while the same certificate object's extension cache is accessed concurrently, so single-threaded or non-shared certificate handling is unaffected. NVD lists the issue at CVSS 7.5, while our assessment applies AC:H and confirms availability-only impact (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit code or KEV-listed active exploitation was identified at time of analysis.

Memory corruption in Mozilla Firefox ESR's Graphics: Canvas2D component allows remote attackers to execute code within the browser content process when a victim is induced to load attacker-controlled web content; the root cause is a use-after-free (CWE-416) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability loss inside the exploited process. Affected builds are ESR 115.x before 115.42, ESR 140.x before 140.17, and ESR 153.x before 153.4, with vendor fixes released in Firefox ESR 115.42, 140.17, and 153.4. Exploitation requires victim interaction (loading a malicious or compromised page) and is unauthenticated over the network (PR:N); no public exploit code was identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with 'no' automatable applicability and total technical impact.

Use-after-free in Mozilla Firefox's DOM UI Events and Focus Handling code allows a remote, unauthenticated attacker to corrupt the browser's heap and potentially achieve code execution in the content process when a victim loads attacker-controlled web content. The flaw affects Firefox builds before 157 and Firefox ESR before 153.4, where it has been fixed; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction (opening the page) being the primary precondition, and CISA's SSVC assessment does not consider it automatable. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so despite the high base score this reads as a medium-priority memory-corruption flaw in an ubiquitous browser rather than an emergency, actively exploited issue.

Use-after-free in the JavaScript JIT compiler of Mozilla Firefox (versions before 157) and Firefox ESR (before 153.4) allows remote attackers to corrupt memory and potentially execute code within the browser process when a victim loads attacker-controlled JavaScript from a malicious or compromised page. Exploitation requires user interaction (the victim must navigate to the crafted content), and while CVSS 8.8 indicates high confidentiality, integrity, and availability impact, no public exploit code or active exploitation in the wild has been identified at the time of analysis. The flaw is fixed in Firefox 157 and Firefox ESR 153.4.

A use-after-free in Mozilla Firefox's Widget:Gtk component enables a sandbox escape: an unauthenticated remote attacker who persuades a user to load attacker-controlled web content can corrupt freed heap memory in the GTK widget rendering path and cross the browser's security boundary (CVSS 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), turning a rendering bug into code-execution-class impact outside the sandbox. GTK-based (Linux/Unix) Firefox builds are the primary target surface, and the flaw affects Firefox releases prior to 157 as well as the ESR branches prior to 153.4 and 140.17, where Mozilla has shipped the fix. No public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automation rated 'no', although the assessed technical impact is total if the bug is successfully triggered; the principal hurdles are the required user interaction and the difficulty of reliably grooming a UAF into a working sandbox escape.

Use-after-free in Mozilla Firefox's CSS Parsing and Computation component allows a remote attacker to corrupt browser memory and potentially achieve code execution in the content process by getting a victim to render attacker-controlled web content. The flaw affects Firefox before 157 and Firefox ESR before 153.4 (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416), and although no authentication or non-default configuration is required, exploitation is not zero-click - the target must actually load the malicious page, win the use-after-free race, and defeat browser memory hardening. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score or KEV listing was provided, so this sits in the high-CVSS but moderate-real-world-priority band rather than an emergency-patch category.

Sandbox escape in Mozilla Firefox stems from a use-after-free in the DOM: Core & HTML component, allowing attacker-controlled web content to corrupt memory and break out of the browser's content-process sandbox. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17; the flaw carries a CVSS 9.6 rating (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the scope change (S:C) reflects escape from the renderer sandbox into the wider browser/OS context with high confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and this CVE is not in CISA KEV; however, exploitation only requires a victim to load attacker-controlled content (UI:R) and needs no authentication or non-default configuration, so browser auto-update to a fixed build fully removes exposure.

Use-after-free in Mozilla Firefox's Preferences: Backend component before version 157 enables a sandbox escape, allowing attacker-controlled web content to break out of the browser's renderer sandbox and gain code execution with browser privileges; exploitation requires the victim to load attacker-controlled content (UI:R) with no authentication or special privileges (PR:N), and default configurations are affected. Mozilla addressed this in Firefox 157 via the mfsa2026-97 advisory, and while the CVSS 9.6/S:C scoring reflects a genuinely high-severity memory-corruption issue, no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Sandbox escape in Mozilla Firefox allows remote attackers to break out of the content sandbox by exploiting a use-after-free in the browser's Disability Access (accessibility) APIs. Affected are Firefox versions before 157 and Firefox ESR versions before 153.4; the attack is network-delivered and requires no authentication, but is not zero-click - the victim must open attacker-controlled web content that exercises the accessibility APIs and win the use-after-free race (CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Mozilla has fixed the flaw in Firefox 157 and Firefox ESR 153.4, and no public exploit has been identified at time of analysis; the score reflects the high confidentiality, integrity, and availability impact combined with scope change once the sandbox boundary is crossed, while the UI:R component keeps it from being self-propagating.

Use-after-free in Mozilla Firefox's Graphics: WebRender compositor lets remote, unauthenticated attackers corrupt memory and escalate privileges inside the browser when a victim loads attacker-controlled web content - no authentication is required (PR:N), but the attack is not server-side passive and depends on the target visiting or interacting with a malicious or compromised page (UI:R). The flaw rates CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was fixed in Firefox 157 and in Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but not urgent priority. Modern Firefox content-process sandboxing further limits post-corruption impact unless the attacker chains a separate sandbox escape, and WebRender is enabled by default, so no unusual configuration is needed to reach the vulnerable path.

Use-after-free in Mozilla Firefox's WebAssembly engine (JavaScript/SpiderMonkey component) allows an unauthenticated remote attacker to corrupt browser memory and potentially achieve code execution against users running Firefox versions prior to 157. Exploitation requires the victim to open attacker-controlled web content that exercises a crafted WebAssembly module (UI:R), and while no public exploit code has been identified at time of analysis and the issue is not on CISA KEV, the CVSS 3.1 base score of 8.8 with C:H/I:H/A:H reflects a full high-impact memory-corruption outcome typical of an RCE-class heap use-after-free. Users on Firefox 157 or later are not affected.

JIT miscompilation in Firefox's WebAssembly engine allows crafted WebAssembly delivered through attacker-controlled web content to corrupt in-process memory via a type confusion (CWE-843), producing high confidentiality impact and limited integrity impact but no availability impact. The flaw is remotely reachable at low complexity and unauthenticated (AV:N/AC:L/PR:N) but is gated by user interaction (UI:R) - the victim must load a malicious page that exercises the vulnerable JIT path - and by the content-process sandbox, so on its own it yields in-process memory disclosure rather than host compromise, which would require chaining a separate sandbox-escape bug. Mozilla has fixed it in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17; EPSS is only 0.16% (4th percentile) and no public exploit or CISA KEV entry was identified at time of analysis.

Use-after-free in the DOM: Core & HTML engine of Mozilla Firefox allows memory corruption that can be driven by attacker-controlled web content, potentially yielding code execution or memory disclosure inside the browser's content process. Affected are Firefox releases before 157 and the ESR branches before 153.4, 140.17, and 115.42; exploitation only requires that the victim load a malicious or compromised page (UI:R) with no authentication and no non-default settings, since the DOM Core/HTML code path is always active. Mozilla has published fixed versions and no public exploit was identified at time of analysis, and the achievable impact is bounded by Firefox's content-process sandbox unless chained with a separate escape.

Use-after-free in Mozilla Firefox's XSLT engine lets a remote, unauthenticated attacker corrupt memory by getting a victim to render attacker-controlled content that performs an XSL transformation, with the assessed CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflecting high confidentiality, integrity, and availability impact. The flaw affects Firefox builds before 157 and ESR builds before 153.4, 140.17, and 115.42, and is remediated in those releases. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); the main practical barrier is the mandatory user interaction, since the victim must visit or render the malicious content for the XSLT path to execute.

Use-after-free in Mozilla Firefox's Graphics: Canvas2D rendering component allows a remote, unauthenticated attacker to corrupt browser memory and potentially achieve arbitrary code execution when a victim loads crafted web content in an unpatched build. Exploitation hinges on user interaction - the victim must open a malicious or compromised page that exercises the Canvas2D path - and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects high confidentiality, integrity, and availability impact confined to the browser process by the renderer sandbox. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), making this a serious client-side bug rather than an emergency; vendor-released fixes are Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42.

Memory corruption in Mozilla Firefox's JavaScript and WebAssembly engine (CWE-824, access of uninitialized pointer) allows a crafted or compromised web page to trigger an invalid-pointer dereference in the browser's content process, potentially resulting in information disclosure or code execution within that process. Exploitation requires the victim to navigate to attacker-controlled content in a pre-patch build - Firefox before 157, Firefox ESR before 153.4, or Firefox ESR before 140.17 - and is unauthenticated per the assessed CVSS vector (AV:N/PR:N), although the vendor's 9.8 score assumes no user interaction while our independent assessment requires UI:R, so the effective risk should be reconciled before treating this as an emergency. No public exploit code has been identified at time of analysis (no KEV listing, no POC) and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity.

Use-after-free memory corruption in Mozilla Firefox's Graphics component can be exploited by a remote, unauthenticated attacker to escape the browser's content sandbox and run code at the privilege of the parent/broker process, provided the victim renders attacker-controlled content. The only prerequisite is user interaction - visiting or rendering a crafted page in any unpatched build (Firefox before 157, ESR before 153.4, ESR 140.17, ESR 115.42) - since graphics rendering is enabled by default and no credentials are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6). No public exploit code or in-the-wild exploitation has been identified at time of analysis, and the independent assessment notes that reliable heap grooming of the use-after-free is non-trivial, making this a high-priority RCE-class flaw rather than a demonstrated weaponized one.

Memory corruption in Mozilla Firefox's DOM: Core & HTML component allows unauthenticated remote attackers to trigger a use-after-free when a victim loads attacker-controlled web content, potentially leading to arbitrary code execution, information disclosure, or crashes. Affected versions include Firefox before 157 and Firefox ESR before 153.4, 140.17, and 115.42; the flaw is patched in those fixed releases. Exploitation requires user interaction in default browsing and must contend with Firefox sandboxing and heap-hardening mitigations; no public exploit identified at time of analysis (no CISA KEV confirmation).

A use-after-free in Firefox's Layout: Text and Fonts component lets remote attackers corrupt memory by enticing a victim to open crafted web content, potentially leading to code execution within the browser's content process. Unauthenticated network attackers can trigger it with low complexity, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) confirms a successful attack requires user interaction and no privilege is needed beforehand. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; there is no CISA KEV entry and no public exploit identified at time of analysis, though the memory-corruption class makes weaponization plausible.

A use-after-free flaw in Firefox's DOM Core & HTML component (CWE-416) can corrupt browser memory when a victim loads attacker-controlled web content, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All supported release channels are affected below the fixed builds - Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 - and the flaw is exploitable by unauthenticated remote attackers only if the user actively visits or is induced to load a malicious page (UI:R), with no server-side exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis; impact ranges from information disclosure and memory corruption to a potentially exploitable crash or code execution, though reliable exploitation requires winning the heap reallocation race and defeating browser sandbox mitigations, placing it in the normal severity band for this bug class rather than an emergency.

A use-after-free in Mozilla Firefox's XSLT (XML stylesheet transformation) engine can be triggered when a victim loads attacker-controlled content that exercises stylesheet processing, allowing memory corruption that jeopardizes confidentiality, integrity, and availability of the browser session. The flaw affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires no privileges (PR:N) but does require user interaction (UI:R) - the target must open a malicious page or XML document, with no zero-click or server-side path indicated by the available data. Mozilla has released fixed versions across all supported release and ESR channels; no public exploit code was identified at time of analysis.

Use-after-free in Mozilla Firefox's DOM Core & HTML engine allows attacker-controlled web content to corrupt memory and escape the browser's content sandbox, potentially yielding code execution at higher privilege on the host. Affected are Firefox builds prior to 157 and ESR branches prior to 153.4, 140.17, and 115.42; the flaw is rated CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), so no authentication or non-default configuration is required, but a victim must load or render a malicious page (UI:R). No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited, though the scope-changed rating reflects that a successful trigger crosses a security boundary rather than merely crashing a content process.

Use-after-free in the Graphics: Canvas2D component of Mozilla Firefox allows remote, unauthenticated attackers to corrupt browser memory when a victim renders attacker-controlled web content - a malicious page, ad, or iframe provides the required user interaction (UI:R). Successful exploitation can expose or modify memory (high C/I/A impact per the 8.8 CVSS), causing crashes and potentially arbitrary code execution inside the content/renderer process, although turning the primitive into reliable code execution also requires defeating Firefox's site isolation, sandbox, and ASLR hardening, which keeps practical difficulty above the raw score. Only unpatched builds are affected; Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42 carry the fix, and no public exploit code or active exploitation was identified at the time of analysis.

A use-after-free in Mozilla Firefox's WebAssembly component allows remote attackers to potentially execute arbitrary code by enticing a victim to visit a malicious web page. The vulnerability affects Firefox versions before 157, Firefox ESR before 153.4, and Firefox ESR before 140.17; no authentication or non-default configuration is required, but exploitation requires user interaction (UI:R). No public exploit code or active exploitation has been identified at time of analysis, and browser process sandboxing limits the impact.

Use-after-free in Mozilla Firefox's DOM: Core & HTML implementation lets remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim loads attacker-controlled web content in an unpatched build. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is network-reachable and low-complexity and requires no authentication, but does depend on user interaction - the victim must open a malicious or compromised page. Every supported channel is affected prior to the fixed releases (Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42); there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though successful heap grooming of the freed DOM object can escalate beyond a crash within the constraints of Firefox's sandbox and mitigations.

Use-after-free in Mozilla Firefox's IndexedDB storage implementation allows a remote, unauthenticated attacker to execute arbitrary code with the victim's privileges by convincing them to load attacker-controlled web content that exercises the IndexedDB API. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact, with the only meaningful barrier being the required user interaction - no authentication or non-default configuration is needed. Mozilla fixed the flaw in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; no public exploit code or confirmed active exploitation was identified at time of analysis, but given Firefox's enormous install base and the browser-context code execution primitive, this warrants priority patching rather than emergency escalation.

Use-after-free in Mozilla Firefox's DOM: Core & HTML component (CWE-416) lets remote attackers achieve full confidentiality and integrity impact against unpatched Firefox builds when a victim simply loads attacker-controlled web content, matching the CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected are Firefox versions prior to 157, Firefox ESR prior to 153.4, and Firefox ESR prior to 140.17; exploitation needs no authentication or non-default configuration, and the mandatory browsing/user interaction is the primary limiting factor. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but Mozilla has shipped fixed builds, so prioritization should focus on unpatched endpoints in browser-exposed or high-value user populations.

Mozilla Firefox can be driven to escape its content sandbox through a use-after-free in the DOM Content Processes component, letting a remote, unauthenticated attacker who convinces a victim to load a crafted page (UI:R, PR:N) corrupt memory in the sandboxed content process and cross into the more privileged parent process - the pivot reflected in the CVSS 9.6 scope-change rating and the C:H/I:H/A:H metrics. The flaw affects Firefox before 157 and the ESR trains before 153.4, 140.17 and 115.42, and it is fixed in those exact builds. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis.

Use-after-free in Mozilla Firefox's JavaScript WebAssembly component lets remote attackers corrupt memory and potentially achieve code execution or disclose sensitive data when a user loads attacker-controlled web content containing a malicious WebAssembly payload. The flaw affects default Firefox configurations up to Firefox 157 and the ESR branches-Firefox ESR 153.4 and Firefox ESR 140.17 are the first fixed releases-and requires no authentication, only that the victim browse a crafted page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a genuine but not top-tier priority; exploitation is client-side and requires user interaction, and because scope is unchanged the initial impact is confined to the content process unless chained with a separate sandbox-escape bug.

Use-after-free in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to corrupt memory and potentially achieve code execution or read sensitive data when a victim loads attacker-controlled web content that exercises the WebGPU API; the flaw is fixed in Firefox 157. Exploitation is gated by user interaction (CVSS PR:N, UI:R) and by WebGPU being reachable in the victim's build, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The 8.8 CVSS score reflects high confidentiality and integrity impact within the affected browsing process, though the content-process sandbox typically limits standalone impact unless chained with a sandbox escape.

Mozilla Firefox builds prior to version 157, along with the ESR branches prior to 153.4, 140.17, and 115.42, contain a use-after-free in the Networking: Cache component that lets a remote attacker corrupt memory by persuading a victim to render attacker-controlled web content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) is the classic browser drive-by profile: no authentication is required, complexity is low, but exploitation depends on the user navigating to or loading a malicious page that reaches the specific cache code path, and the content-process sandbox limits how far a single use-after-free can be pushed toward full system compromise. The flaw is patched in Firefox 157 and Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no CISA KEV listing and no public exploit code were identified at time of analysis, so this is a patch-now, high-severity memory-safety bug rather than a confirmed actively exploited one.

Use-after-free in Mozilla Firefox's JavaScript WebAssembly engine enables remote code execution or memory corruption when a victim views a malicious webpage, requiring only that the user loads attacker-controlled content (UI:R) with no authentication (PR:N). The flaw affects all Firefox versions prior to 157 and Firefox ESR prior to 153.4, and is rated CVSS 8.8 due to high confidentiality, integrity, and availability impact; the content-process sandbox (S:U) limits impact to the browser process absent a separate escape. No public exploit identified at time of analysis, and no CISA KEV listing; Mozilla has released patches in Firefox 157 and Firefox ESR 153.4.

A use-after-free in Firefox's DOM Content Processes component lets unauthenticated remote attackers escape the content-process sandbox by getting a victim to render attacker-controlled web content, resulting in high confidentiality, integrity and availability impact across a changed security scope (CVSS 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). The mandatory user interaction (loading or rendering the malicious page) is the primary limiting factor, and no authentication or elevated privileges are required. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is fixed in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17 and Firefox ESR 115.42, so patched or auto-updated installations are unaffected.

A use-after-free in Mozilla Firefox's Graphics: WebGPU component (CWE-416) lets a remote attacker who gets a victim to render attacker-controlled web content corrupt memory and potentially achieve code execution in the browser's process, earning a High-severity CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All Firefox builds prior to 157 are affected, and Mozilla fixed the issue in Firefox 157 (advisory mfsa2026-97, Bugzilla 2059020). No public exploit code or confirmed active exploitation has been identified at time of analysis, and because the vector requires user interaction, mass automated exploitation is unlikely, though per-target heap grooming is needed for reliable execution.

Use-after-free (CWE-416) in Mozilla Firefox's Widget component allows remote attackers to potentially execute arbitrary code when a victim renders attacker-controlled web content in unpatched versions (before Firefox 157, Firefox ESR 153.4, ESR 140.17, or ESR 115.42). Successful exploitation requires reliable heap manipulation and depends on the user opening malicious content (UI:R), but can achieve high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.

Heap-based out-of-bounds write in the RPM Package Manager (rpm) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, allowing a local, unauthenticated attacker to corrupt memory by crafting an RPM package that is then parsed with rpm2cpio, rpm2archive, or rpm -qlvp. The flaw arises from an integer overflow in iterReadArchiveNext() when a symlink entry declares RPMTAG_LONGFILESIZES as 0xFFFFFFFFFFFFFFFF, shrinking the buffer allocation to one byte and enabling attacker-controlled data from the cpio filesize field to overwrite heap memory. Exploitation requires user interaction to inspect the malicious package and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 7.1.

Arbitrary code execution in Das U-Boot allows an unauthenticated attacker on the adjacent network segment to hijack the bootloader by replaying duplicated last-fragment IPv4 packets against stale IP reassembly state. Only builds compiled with the non-default CONFIG_IP_DEFRAG=y option and actively using U-Boot's network stack (for example TFTP or PXE netboot) are exposed, and the attacker must hit the narrow boot-time window while the bootloader is running, so the practical attack surface is narrower than the CVSS 9.0 base score implies. No public exploit code was identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; the vendor has released a fix in version 2026.07 (commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa).

Use-after-free in Meta's Proxygen HTTP library (v2024.10.28.00 through v2026.09.28.00) lets remote, unauthenticated attackers provoke the invocation of a freed read callback during WebTransport session teardown, because WebTransportImpl::terminateSessionStreams (named WebTransportImpl::destroy in releases before v2025.08.18.00) destroys streams without first unregistering their read callbacks. Only deployments that actually enable WebTransport over HTTP/3 are exposed, and the independent assessment rates this AV:N/AC:H/PR:N/UI:N with high availability impact and low confidentiality impact, since the attacker must open WebTransport streams and drive the session into the specific stream-close/teardown ordering. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.14%, 3rd percentile), so the practical risk is concentrated in services that both use Proxygen and enable WebTransport.