Memory Corruption

Use-after-free in Meta's proxygen C++ networking library (versions v2026.04.06.00 up to but not including v2026.09.28.00) lets unauthenticated remote clients trigger memory corruption during the teardown of a QUIC WebTransport session, reachable through QuicWtSession::closeSession on deployments that actually serve WebTransport. Per the vector (PR:N) no credentials are needed, but the independent assessment rates the attack complexity as high because exploitation depends on winning the destruction/reference-release sequencing inside the session-close path; practical impact is most likely a denial-of-service crash of the affected service, with partial confidentiality, integrity, and availability effects possible. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and EPSS is correspondingly low at 0.14% (3rd percentile), with CISA SSVC recording Exploitation: none and Technical Impact: partial.

An insufficient buffer-size validation defect in Zephyr RTOS's ADI MAX32 ADC driver (drivers/adc/adc_max32.c) allows a local, low-privileged user-mode thread to write up to twice the length of its supplied buffer into kernel memory, producing attacker-controlled out-of-bounds writes at an attacker-chosen offset. Exploitation requires a build compiled with CONFIG_USERSPACE running on ADI MAX32 hardware where the calling thread has already been granted access to a MAX32 ADC device object; on such a build the attacker fully controls channels, buffer, buffer_size and options->extra_samplings, and the resulting corruption of adjacent memory, kernel data or thread stacks is a plausible local privilege-escalation and denial-of-service primitive (CVSS 7.8, AV:L/PR:L). The flaw is not remotely exploitable, and builds without CONFIG_USERSPACE are reduced to a caller-side robustness defect since the application supplies its own buffer; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).

An out-of-bounds kernel-mode write in Zephyr RTOS's NXP MCUX LPADC driver (drivers/adc/adc_mcux_lpadc.c) lets an unprivileged user-mode thread corrupt memory outside its own partition, providing a genuine local privilege-escalation and denial-of-service primitive rather than an inflated high-severity score. The bug affects builds compiled with CONFIG_USERSPACE that use the MCUX LPADC driver in interrupt-driven mode (or DMA-driven mode on releases carrying the DMA path), where adc_read()/adc_read_async() are system calls: a thread already granted access to the LPADC device object controls channels, buffer, buffer_size and options->extra_samplings, and can demand up to channels × 65536 samples into a tiny buffer, causing the driver's ISR or DMA callback to walk past the buffer while running in kernel mode where the MPU does not confine it. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the CVSS vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact from an authenticated local attacker, and upstream fixes are available.

Kernel memory corruption in Zephyr RTOS arises from the RTIO userspace syscall verifier z_vrfy_rtio_sqe_copy_in_get_handles(), which validates the RTIO object handle and the incoming sqes array but never checks that the caller-supplied handle out-parameter is writable before executing *handle = sqe in supervisor mode. Any user-mode thread that has been granted a struct rtio kernel object - the normal situation for applications using sensor_read_async_mempool() or the async ADC helpers, which call rtio_sqe_copy_in_get_handles() internally - can supply an arbitrary destination address and thereby obtain a write-what-where primitive that stores a pointer to attacker-controlled ring data at any kernel location, corrupting function pointers, thread structures or memory-domain partition tables and breaking the CONFIG_USERSPACE isolation boundary. The issue is local-only and build-gated (CVSS 7.8, AV:L/PR:L, CWE-787), requires both CONFIG_USERSPACE and CONFIG_RTIO, and no public exploit code has been identified at time of analysis, although an upstream vendor fix and GitHub security advisory are available.

Memory corruption in Wind River VxWorks 7 occurs when a task passes crafted arguments to a specific system call, causing an out-of-bounds write inside the RTOS memory-management subsystem and giving the caller full confidentiality, integrity, and availability impact on the running instance (CVSS 3.1 7.8 HIGH). The flaw is local in nature - per the vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the attacker must already execute code on the device as at least a low-privileged task, so only VxWorks 7 deployments that run untrusted or lower-trust code are realistically exposed; locked-down devices that execute only vendor-signed firmware are not remotely reachable through this bug. All VxWorks 7 builds prior to version 26.09 are affected, and there is no public exploit code or CISA KEV entry identified at time of analysis.

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code execution when a victim opens a maliciously crafted file, scoring CVSS 8.8 (AV:N/AC:L/PR:N/UI:R, CWE-787). Apple fixed the flaw in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and states it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records an exploitation value of 'none' with the attack assessed as non-automatable.

Use-after-free in Meta's experimental moxygen Media-over-QUIC (MoQ) library (MoQSession::dataStreamReadLoop) lets a remote, unauthenticated peer corrupt memory and crash an endpoint that accepts MoQ sessions over proxygen's WebTransport API. The flaw is triggered when a data stream names an unknown/unresolved track alias and carries the FIN flag in the same write, so the stream read handle is invalidated by the FIN before the read loop finishes using it; affected builds are those from b24f8e65cb83ebe5f3880cc4e3a4c8f64e1882f9 up to (excluding) the fix commit 004123dd24c30dad6b649163575145f240dabc94. Exploitation requires only that the target runs a vulnerable commit and exposes an accepting MoQ endpoint; there is no public exploit identified at time of analysis (EPSS 0.14%, third percentile; CISA SSVC exploitation:none), and the vendor fix is available as upstream commit 004123dd24c30dad6b649163575145f240dabc94.

Type confusion in XS::Parse::Infix versions 0.40 through 0.49 - the Perl XS module distributed as part of XS-Parse-Keyword - lets an attacker who can influence a list handed to a list-associative infix operator (for example the zip operator from Syntax::Operator::Zip) make the interpreter dereference an address of the attacker's choosing. Supplying a bare number where an array reference is expected reliably segfaults the process (denial of service), while a crafted string carrying 0x0b at byte 12 slips past the faulty reference guard and is treated as an AV head, so bytes 16-23 are used as AvARRAY and its entries are pushed onto the Perl stack as live SVs, yielding a limited out-of-bounds read / information-disclosure primitive. Publicly available exploit code exists (a minimal zip-based proof-of-concept is described by the reporter), but there is no confirmed active exploitation (no CISA KEV listing) and EPSS is low at 0.18% (7th percentile); this is a library flaw with no standalone attack surface, so real-world risk depends entirely on whether a consuming application passes untrusted, attacker-influenced data into such an operator.

An out-of-bounds write in the L2TP control-channel parsing routine (tunnel_set_params in tunnel.c) of D-Link DIR-895L firmware A1_102b07 lets a remote attacker corrupt memory by sending a crafted L2TP control message containing a malformed Host Name AVP. The vendor's CVSS 4.0 score of 8.6 reflects a network-reachable, low-complexity attack requiring low privileges (PR:L), and VulDB has published a public proof-of-concept write-up, so publicly available exploit code exists. Note that the vendor vector's subsequent-system (SC/SI/SA:H) clause appears inflated - the flaw is an in-process memory corruption on a single consumer router - and the DIR-895L is a discontinued model, so no vendor patch has been identified.

Decompiling a maliciously crafted binary with Ghidra through 12.1.4 can drive a stack-based out-of-bounds write inside the decompiler's leftshift128 routine, letting the sample corrupt process memory and potentially achieve code execution in the analyst's Ghidra session. The flaw is triggered when a specific instruction sequence lowers to p-code containing a negative shift amount that reaches the RuleDivOpt/RuleDivTermAdd divisor-optimization path; no privileges are required (PR:N in both the reported CVSS 4.0 vector and the independent CVSS 3.1 assessment), but exploitation is gated on the victim loading and decompiling the attacker-supplied file (UI:P/UI:R), making this a targeted threat against reverse engineers rather than a remote one. At the time of analysis, no public exploit code has been identified for this issue and there is no confirmed active exploitation (CISA KEV status is not present).

A use-after-free race condition in QEMU's 9pfs (virtfs) passthrough subsystem allows a malicious guest user to escape the shared directory boundary and read or write arbitrary files on the host, potentially achieving code execution as the QEMU process user (VM escape). Only hosts that have enabled 9pfs/virtfs host-directory sharing are exposed, since this is not a default configuration; the attacker must be a local guest user able to issue 9p protocol requests and must win a race between QEMU's main thread and a 9pfs worker thread with concurrent Tlcreate and Twalk requests. No public exploit code or active exploitation telemetry was identified at time of analysis, but the flaw is rated high severity (CVSS 8.8, scope-changed, C:H/I:H/A:H) and affects QEMU packages shipped in Red Hat Enterprise Linux 6 through 10, Red Hat OpenShift Container Platform 4, and related Red Hat products.

A use-after-free in the Linux kernel's btrfs RAID stripe-tree insertion path can free an in-flight transaction handle and transaction twice, corrupting kernel memory on systems that enable the opt-in raid-stripe-tree feature (added in Linux 6.7). Only local users who can write to such a filesystem, and only when a memory allocation fails (-ENOMEM) at exactly the btrfs_insert_one_raid_extent() failure site during ordered-extent finishing, can trigger it; the independent assessment scores this AV:L/AC:H/PR:L with no confidentiality impact but high availability impact (C:N/I:L/A:H), noting it is a high-CVSS-but-low-real-risk kernel issue that is not attacker-input-controlled. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); vendor-released patches exist in the affected branches.

Type confusion in the AWS pgcollection PostgreSQL extension (versions 2.0.0 through 2.1.1) lets an authenticated remote database user execute arbitrary code as the postgres operating system user by submitting crafted SQL that triggers mismatched type metadata during collection value retrieval and array conversion. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H), reflecting a network-reachable, low-complexity attack that requires only a valid low-privileged database role but yields full confidentiality, integrity and availability impact. AWS has released pgcollection 2.1.2 as the fix; no public exploit code has been identified at time of analysis, and exploitation is constrained to databases where the non-default extension is actually installed and where an attacker can execute the affected SQL functions.

Heap out-of-bounds write in the MongoDB C Driver (libmongoc) allows an unauthenticated attacker who controls DNS resolution and the responses of hosts in a client's connection string to corrupt memory and crash the application. Exploitation requires a privileged network position (MITM or rogue server) and results in denial of service, not code execution or data disclosure. Patched versions 1.30.12 and 2.5.5 are available; no public exploit code or active exploitation has been identified at time of analysis.

Privilege-gated out-of-bounds write in Altera Trusted Firmware (the SoCFPGA port of ARM Trusted Firmware-A) through socfpga_v2.14.0 allows an attacker who already holds high privileges in the normal world to corrupt memory in the secure firmware, degrading the integrity and availability of the trusted execution environment and extending the scope of compromise beyond the attacker's original context. The root cause is an improperly configured or implemented memory protection (CWE-787) that is reachable only from a local, already-privileged position on Altera/Intel SoC FPGA Hard Processor System platforms, so it is not remotely reachable and does not affect general-purpose systems; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).

An out-of-bounds write in GIMP's GIMPressionist plug-in allows an attacker to corrupt memory by convincing a user to load a malicious preset file, potentially leading to a crash or arbitrary code execution. The flaw is an unauthenticated local attack (CVSS PR:N) that requires user interaction (UI:R) to open a crafted preset file, and it affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 plus likely upstream GIMP versions. No public exploit has been identified at time of analysis, and the overall risk is assessed as genuine but not urgent due to the requirement for user interaction with a crafted file.

Out-of-bounds write in the rp-l2tp component of D-Link DIR-825 firmware 3.00b32 allows a remote, unauthenticated attacker to corrupt memory by sending a crafted L2TP Host-Name AVP, with the CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity, and availability impact. The flaw resides in tunnel_set_params() in tunnel.c, where the peer_hostname argument is copied without adequate bounds validation, so an oversized or malformed value overwrites adjacent memory; because the vulnerable code sits in the L2TP tunnel setup path, an attacker only needs network reachability to the router's L2TP service and no credentials or user interaction. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the severity and low attack complexity make the exposure significant for any deployment that leaves L2TP enabled on a WAN-facing interface.

Type confusion in the Perl DBI module's fetchrow_hashref implementation allows an application that assigns a non-string scalar (integer/IV or float/NV) to the FetchHashKeyName attribute and then calls fetchrow_hashref to trigger an out-of-bounds memory read, typically crashing the Perl process (denial of service) and, in principle, exposing adjacent heap memory in error output. Affected are DBI releases before 1.654 on any platform where the module is installed; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates this unauthenticated and remotely triggerable, though independent assessment raises attack complexity to AC:H because exploitation requires the hosting application to propagate attacker-controlled data into a statement-handle attribute that is normally set by the application itself. No public exploit code has been identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.21% (10th percentile), reflecting the narrow precondition of application-specific attribute misuse.

Heap out-of-bounds write in QuickJS's bytecode deserializer (JS_ReadFunctionTag) lets a crafted serialized blob corrupt heap memory, giving an attacker the potential for arbitrary code execution in the context of the host process. The flaw is only reachable when the embedding application calls JS_ReadObject with the JS_READ_OBJ_BYTECODE flag on attacker-controlled input - not the default pattern of executing JavaScript source - so exposure is confined to plugin, cache, or IPC loaders that treat serialized bytecode as untrusted data; where that path is exposed, the flaw is remotely triggerable by an unauthenticated attacker (CVSS vector PR:N) with a single malformed blob and no user interaction. Public exploit code has not been identified at time of analysis (EPSS 0.17%, 5th percentile), and while the vendor score is 9.8 with AC:L, an independent assessment rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because exploitation depends on a non-default deserialization path in the hosting application.

Memory corruption in Espruino 2v29 (commit bffc6d0) allows local attackers to trigger a one-byte out-of-bounds write by supplying crafted JavaScript with an overlong token, corrupting the adjacent tokenValue pointer and causing application crashes or denial of service. The flaw only manifests in RELEASE/NO_ASSERT firmware builds; debug builds with assertions enabled catch the overlong token before the write. No public exploit code has been identified at time of analysis, and the assessed CVSS 3.1 vector rates this as AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (score 7.7).

Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow corrupt heap memory, crash the application, or potentially hijack control flow for code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a vendor fix (advisory node 7288830). The vendor-published vector claims unauthenticated network exploitation at 9.8, but our assessment scores the issue AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: the practical attack is high-complexity, requires an authenticated position to supply the malicious input, and the specific trigger surface is unconfirmed, so real-world severity is materially lower than the published base score suggests.

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity declarations allows unauthenticated local attackers to crash or potentially execute code in applications that use the library. Tracked as CVE-2026-96889 and reported by Red Hat, the flaw affects librsvg as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10. Exploitation requires user interaction (UI:R) because a victim must open, preview, or thumbnail a malicious SVG; the CVSS 3.1 score is 7.8. No public exploit code was identified at time of analysis, and independent assessment indicates that arbitrary code execution is unproven-only denial of service or crash is reliably reachable.

A heap buffer overflow in BusyBox's romfs filesystem image parsing path can be triggered when the utility processes an attacker-crafted romfs image whose volume ID metadata is read with an unbounded strlen, producing an out-of-bounds heap write (CWE-787) rated CVSS 3.1 base 7.3. Because the attack vector is local (AV:L), the malicious image must be delivered to the target system - for example via removable media, a downloaded archive, a firmware/container image, or a package - and some process or user must then parse or mount it (UI:R); it is not remotely triggerable over a network. Under the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) no privileges are required, and successful corruption could yield code execution in the context of the parsing process with high impact to confidentiality, integrity, and availability; no public exploit or POC was identified in the supplied intelligence and there is no confirmed active exploitation.

A use-after-free in Foxit PDF Editor and Foxit PDF Reader can be triggered by opening a crafted PDF whose image objects carry malformed optional-content (OCG) attributes, which the program processes while rendering the page image and which causes it to dereference an already-freed internal data structure. The reliably reproducible outcome described by the vendor is an application crash (denial of service); because the defect is a memory-corruption class (CWE-416), code execution in the context of the user may be possible but would require additional heap grooming that is not demonstrated in the available data. Exploitation requires local delivery of the malicious file and a victim to open it (AV:L, UI:R), while no authentication or privileges are needed on the attacker side (PR:N); the vendor-rated CVSS 3.1 base score is 7.8 (High). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.

Foxit PDF Editor and Reader can crash due to a use-after-free (CWE-416) when a user opens a specially crafted PDF that includes JavaScript triggered by page-visibility events. The reentrant execution leads the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash. Exploitation requires user interaction (the victim must open the malicious file) and JavaScript must be enabled, but no public exploit code or active exploitation has been identified at time of analysis; the independent assessment confirms only availability impact (crash), not code execution or data compromise.

Specially crafted PDFs can trigger a use-after-free in Foxit PDF Reader and Editor when JavaScript is enabled, leading to memory corruption and potential code execution in the user's context. The attack requires local access and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and depends on JavaScript execution being enabled; no public exploit identified at time of analysis.

Use-after-free in Foxit PDF Editor and Foxit PDF Reader is triggered when a victim opens a specially crafted PDF: embedded JavaScript rewrites annotation rich-text attributes with malformed font data, and a freed object is then dereferenced during automatic annotation appearance reconstruction, crashing the application at minimum and, per the vendor-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), potentially permitting code execution in the user's context. Exploitation is strictly client-side and requires the user to open the malicious file (UI:R) with PDF scripting active; no privileges are required (PR:N), and there is no network-remote trigger. The provided intelligence includes no CISA KEV listing and no public exploit code, so the status is no public exploit identified at time of analysis; the description demonstrates only a crash, while full code execution is asserted by the vendor CVSS rating but not evidenced in the available technical detail.

An out-of-bounds write (CWE-787) in the PDF rendering engine of Foxit PDF Editor and Foxit PDF Reader can be triggered when a victim opens a specially crafted PDF containing malformed color space data, causing the application to crash and potentially allowing remote code execution in the context of the logged-in user. The flaw is rated CVSS 3.1 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: exploitation is unauthenticated per the vector but strictly local in attack path and requires user interaction, meaning the attacker must deliver the file and convince the target to open it on an affected default installation. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; the confirmed outcome is a crash, with code execution described by the vendor as potential rather than demonstrated, and EPSS data was not provided with this record.

Use-after-free in Foxit PDF Editor and Foxit PDF Reader (CWE-416) lets a specially crafted PDF trigger memory corruption while the application processes JavaScript array objects, potentially crashing the viewer or achieving arbitrary code execution in the context of the logged-on user. Exploitation is client-side only: the attacker must lure a victim into opening a malicious PDF with JavaScript execution enabled in the product (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8), and there is no privilege prerequisite or network-service exposure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; turning the use-after-free into reliable code execution additionally depends on attacker-controlled heap state, which is the principal limiting factor beyond the mandatory user interaction.

Opening a malicious PDF in Foxit PDF Editor or Foxit PDF Reader can corrupt memory and terminate the application: the document forces a page-structure change while the file is being rendered, so the page-tree logic accesses a page object that has already been released (CWE-416, use-after-free). Rated CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw requires no authentication on the victim's side but does require the user to open the crafted file, making social engineering the sole delivery gate. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Memory corruption in Foxit PDF Editor and Reader arises from a heap-based out-of-bounds write (CWE-787) that occurs when the application renders a Circle annotation with a malformed 'Cloudy' appearance stream inside a crafted PDF. The flaw stems from insufficient validation of the annotation's appearance geometry during rendering, requiring the victim to open a malicious file (UI:R) with no privileges needed (PR:N). CVSS is 7.8, but no public exploit code has been identified at time of analysis, and the need for user interaction plus a deliberately malformed annotation structure limits practical, widespread exploitation.

Use-after-free in Foxit PDF Editor and Foxit PDF Reader enables a crafted PDF containing embedded JavaScript to reference form fields after they have been released, causing memory corruption that crashes the application and, given the high confidentiality, integrity, and availability impact in the CVSS vector, could potentially lead to code execution. Exploitation requires the victim to open the malicious file (UI:R) on a local system (AV:L) and does not require authentication (PR:N); environments that disable PDF JavaScript execution are not affected by this specific trigger. No public exploit code or confirmed active exploitation is identified at time of analysis.

Heap-based out-of-bounds memory write in Foxit PDF Editor and Foxit PDF Reader's PRC 3D-content parser (CVSS 7.8) lets an attacker corrupt process memory by getting a user to open a crafted PDF that embeds a PRC model with malformed vertex indices in a triangular fan texture mesh. The attack is not network-triggerable on its own (AV:L) and requires the victim to open the file (UI:R), with no authentication needed (PR:N); successful exploitation yields memory corruption, a likely application crash, and potential code execution in the context of the Foxit process (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the risk is concentrated in email, web-download, and file-share delivery of weaponizable PDFs to engineering/3D-CAD workflows that exercise Foxit's PRC rendering path.

Heap-based out-of-bounds write in Foxit PDF Editor and Foxit PDF Reader occurs when the products decode JPEG2000 image data inside a PDF and fail to sufficiently validate the embedded image metadata, allowing the malformed metadata to drive writes past the end of an allocated heap buffer. An attacker can deliver the trigger inside an ordinary-looking PDF; because the CVSS vector is AV:L with UI:R and PR:N, the flaw is not remotely exploitable without interaction - the victim must open or render the crafted file, and exploitation then runs in that user's context with high confidentiality, integrity and availability impact (CVSS 7.8). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and this is a client-side file-parsing bug rather than a wormable or pre-auth network service issue.

Use-after-free in the annotation-handling code of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF containing embedded JavaScript to trigger reentrant deletion of an annotation object, causing the freed memory to be dereferenced afterwards - crashing the application and, given the CVSS vector's high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), creating memory-corruption conditions that could potentially be steered toward code execution. The attack is client-side and file-based: per the vector (AV:L/AC:L/PR:N/UI:R) no authentication or privileges are required, but the attacker cannot reach the application remotely and the victim must open the malicious document, with JavaScript execution permitted in the reader for the vulnerable code path to be reached. There is no public exploit code identified at time of analysis and no confirmation of active exploitation; no EPSS score was provided with the source data.

Out-of-bounds write in the U3D/GIF texture decoding path of Foxit PDF Editor and Foxit PDF Reader allows a crafted PDF to corrupt process memory and potentially achieve remote code execution when the victim opens the file. Exploitation requires user interaction (the document must be opened and the malicious 3D model or GIF texture must actually be rendered) and is delivered through the local file/processing path (AV:L), while no application-level authentication is required (PR:N). No confirmed active exploitation and no public exploit code were identified at time of analysis; Foxit directs users to its security bulletins page for version guidance.

Opening a specially crafted PDF with malformed form fields in Foxit PDF Editor or Foxit PDF Reader can trigger a use-after-free (CWE-416) that crashes the application and corrupts memory. The flaw is reachable only through the local, user-interaction vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H per independent assessment), meaning an attacker must first socially engineer a victim into opening a malicious document - there is no remote or unauthenticated network trigger, and no public exploit code was identified at time of analysis. The confirmed outcome is an application crash; reliable code execution from the use-after-free is not demonstrated in the available data, so the practical impact should be treated as availability loss with potential secondary confidentiality/integrity effects rather than a proven full remote code execution chain.

Use-after-free in Google Chrome desktop versions prior to the September 2026 stable channel update allows remote attackers to cause information disclosure and memory corruption when a victim loads attacker-controlled web content. Exploitation requires user interaction (UI:R) and a high-complexity timing or heap-state precondition (AC:H), but no authentication (PR:N); the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, yielding a base score of 8.3. A vendor patch is available in the September 2026 stable channel update, and no public exploit code or active exploitation has been identified in the provided intelligence.

Use-after-free memory corruption in Google Chrome desktop (Stable channel below 154.0.8037.57) allows remote attackers to corrupt browser memory and reach code-execution-class impact when a victim browses an attacker-controlled page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) and carries high attack complexity (AC:H) because reliable reuse of the freed object depends on heap grooming or an allocation/timing race; the S:C scope change with C:H/I:H/A:H indicates the compromise can extend beyond the browser's original security context toward a sandbox escape. CVSS 3.1 base score is 8.3 (HIGH); no public exploit code was identified at time of analysis, and a vendor fix is available as Chrome 154.0.8037.57.

Type confusion (CWE-843) in Google Chrome before 154.0.8037.57 lets remote attackers corrupt memory and potentially disclose information or execute code inside the renderer by having a victim load attacker-controlled web content. The bug is unauthenticated and network-delivered (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8 High), but requires the user to visit or render a malicious page, and the assessed scope is unchanged (S:U), so renderer-scoped compromise would need a separate sandbox escape to reach full system impact; no public exploit identified at time of analysis, and no CISA KEV entry is associated with this CVE. Chrome ships on an aggressive release cadence, so the fix is already available in the stable channel and risk is concentrated in unpatched or auto-update-disabled fleets.

Google Chrome desktop stable-channel builds are affected by CVE-2026-95333, a flaw whose description, CVSS vector, and CWE classification were all absent from the available intelligence, leaving only a vendor patch flag and a single Chrome Releases stable-channel advisory reference as substantive signals. Because no exploitation, authentication, or impact data is present, the effect on confidentiality, integrity, or availability cannot be characterized from this input, and no public exploit code was identified at time of analysis. The most notable finding is an internal metadata conflict: the record is attributed to vendor:ubuntu while the sole reference is Google's Chrome desktop advisory, so the actually affected package (Google Chrome versus Ubuntu's Chromium/Chrome packaging) should be confirmed directly against the linked Chrome Releases post before remediation is scoped.

Use-after-free memory corruption in Google Chrome before 154.0.8037.57 allows a remote, unauthenticated attacker to potentially escape the browser's renderer sandbox by persuading a victim to visit attacker-controlled web content. Exploitation requires mandatory user interaction (UI:R) and a high-complexity precondition such as precise heap grooming or a timing race (AC:H), and no public exploit has been identified at time of analysis. Google has issued a vendor-released patch in version 154.0.8037.57 that removes the vulnerable code path.

No technical details are available for CVE-2026-95338: the description field is empty and no CVSS score, CVSS vector, CWE classification, CPE string, or affected package name was supplied alongside the record. The only identifying signal is that the issue was reported under the vendor:ubuntu source, indicating it is tracked as a vulnerability in a package distributed through Ubuntu's repositories and handled via the Ubuntu Security Notice process. Risk cannot be meaningfully assessed from the available data, and there is no public exploit identified at time of analysis; exploitation prerequisites, impact, and affected versions must be obtained from the Ubuntu Security Notice for this CVE before any triage decision is made.

Use-after-free memory corruption in Google Chrome's desktop stable channel lets remote, unauthenticated attackers achieve high-integrity/high-availability impact against a victim who simply renders attacker-controlled web content - the attacker must first convince the user to visit a malicious or compromised page (or load a malicious ad/iframe), which is why the assessed vector carries UI:R despite PR:N. Per our independent assessment, a practical exploit must win a heap-grooming race to reclaim the freed object and, because of the scope change (S:C), chain a further sandbox escape to fully realize the 9.6 severity, so exploitation is possible but not trivial. A vendor fix is available in the referenced Chrome stable channel update, and no public exploit code has been identified at time of analysis; the specific vulnerable component and exact fixed build are not disclosed in the available data.

Use-after-free in Google Chrome before 154.0.8037.57 can be triggered when a victim visits attacker-controlled web content, potentially allowing a remote unauthenticated attacker to corrupt memory and escape the renderer sandbox to execute code or disclose information. The vendor-assigned CVSS 3.1 score is 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting mandatory user interaction and high attack complexity. Vendor-released patch: 154.0.8037.57; no public exploit was identified at time of analysis.

Use-after-free memory corruption in Google Chrome builds prior to 154.0.8037.57 allows a remote, unauthenticated attacker to corrupt memory and potentially execute code within the browser renderer by persuading a victim to load attacker-controlled web content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Exploitation requires the victim to open a malicious page or attacker-embedded content in a trusted site, and because the assessed scope is unchanged (S:U) the impact is initially confined to the renderer sandbox, so full host takeover would require a separate sandbox escape; Google has shipped a fixed build that is distributed through Chrome auto-update, shrinking the exposure window on kept-current fleets.

Memory corruption via use-after-free in Google Chrome allows remote code execution or sensitive data disclosure in the renderer when a victim loads attacker-controlled web content in any version earlier than 154.0.8037.57. The flaw is network-reachable, low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High), but it does require the user to open a malicious page, ad or iframe, and because the scope is Unchanged the immediate impact stays inside the sandboxed renderer, so full host compromise realistically needs a second, chained sandbox-escape bug. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); a vendor patch is available in Chrome 154.0.8037.57.

Google Chrome on the desktop stable channel carries a vendor-patched security defect tracked as CVE-2026-95347, disclosed through Google's Chrome Releases stable-channel update in September 2026. The actual impact is currently undetermined: no description, CVSS score or vector, CWE classification, or affected version range has been published, so the vulnerability class, whether attackers must be authenticated, and whether user interaction (such as visiting a crafted page) is required cannot be confirmed from available data. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS probability or SSVC decision data exists to refine the risk; this should be treated as a patch-priority item pending the details in the vendor advisory.

Type confusion in Google Chrome's renderer allows remote attackers to corrupt memory and potentially achieve code execution inside the browser by convincing a victim to open a crafted web page; the attack is network-delivered, requires no authentication (PR:N), and has low complexity, with the only meaningful barrier being that the user must interact with attacker-controlled content (UI:R). A vendor patch is available per the September 2026 stable-channel update, and no public exploit code or confirmed active exploitation was identified at time of analysis, so the high priority here is driven mainly by Chrome's ubiquity rather than observed attacks. Because the CVSS scope is unchanged (S:U), full-system compromise as scored would likely require chaining this bug with a separate sandbox-escape vulnerability, while on its own the flaw is expected to yield renderer-level memory corruption, information disclosure, and potential arbitrary code within the sandboxed process.

Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 allows remote attackers to achieve high-integrity and high-confidentiality impact against a victim who loads attacker-controlled web content and performs some interaction with it, but exploitation is not trivially repeatable: with AC:H it depends on winning a race or reliably grooming heap layout rather than a single deterministic trigger. The flaw is reachable without authentication (PR:N) and the vector's scope change (S:C) indicates the assessed impact crosses a component boundary, yet no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this should be treated as a high-priority patching item rather than a confirmed in-the-wild threat. A vendor patch is available.

Use-after-free memory corruption in Google Chrome builds earlier than 154.0.8037.57 allows a remote, unauthenticated attacker to corrupt memory in the browser by having a victim load attacker-controlled web content, yielding code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, CWE-416). Exploitation is network-reachable with low complexity and requires no credentials, but is gated on user interaction (UI:R) - the victim must visit a malicious page or view attacker-controlled content such as a malicious ad or iframe. Because scope is unchanged (S:U), the primitive is contained within the renderer process, so full host compromise realistically requires chaining an additional sandbox-escape vulnerability; a fixed build is already available and there is no public exploit identified at time of analysis (no CISA KEV listing, no confirmed in-the-wild activity reported in the supplied intelligence).

Use-after-free memory corruption in Google Chrome allows remote attackers to corrupt memory and potentially execute code beyond the browser's normal security boundaries when a victim loads attacker-controlled web content. The flaw carries a CVSS 9.6 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, meaning no authentication is required, the attack is network-delivered, and the scope change plus full confidentiality, integrity, and availability impact indicate a flaw that can affect resources beyond the vulnerable component - consistent with a renderer sandbox escape. Exploitation requires the victim to visit a malicious page or render a malicious embedded resource such as an ad or iframe; at time of analysis there is no public exploit identified, but the vendor has released a patched stable-channel build and defenders should treat untrusted browsing on unpatched Chrome as high risk.

Use-after-free memory corruption in Google Chrome desktop builds earlier than 154.0.8037.57 (CWE-416) allows remote attackers to corrupt memory and potentially achieve code execution inside the renderer process when a victim opens a malicious or compromised web page. The flaw is remotely reachable with low attack complexity and no privileges required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but it hinges on user interaction and, because scope is unchanged, exploitation is contained to the sandboxed renderer; full host compromise realistically requires chaining a separate sandbox-escape bug. There is no confirmed active exploitation and no public exploit identified at time of analysis, so the elevated priority is driven by Chrome's ubiquity and the reliability of memory-safety bugs in this class rather than by observed attacks; vendor patches are already available.

Type confusion in Google Chrome builds prior to 154.0.8037.57 lets a remote attacker who convinces a victim to load attacker-controlled web content corrupt memory inside the renderer and potentially achieve code execution in that process. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-843), meaning no authentication or privileges are required but exploitation is not zero-click: the victim must render a malicious page, and because scope is unchanged the initial compromise is confined to the renderer sandbox unless chained with a separate sandbox escape. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); a vendor-released patch is available in Chrome 154.0.8037.57.

Use-after-free in Google Chrome builds prior to 154.0.8037.57 allows remote, unauthenticated attackers to corrupt memory when a victim loads attacker-controlled web content, with potential for information disclosure and code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates low-complexity, network-reachable exploitation that is gated only by user interaction, and because scope is unchanged (S:U) any initial code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor patch in Chrome 154.0.8037.57 is available.

Use-after-free in Google Chrome affects desktop installations older than the 154.0.8037.57 stable channel release (September 2026), allowing an attacker who can get a victim to interact with crafted content to corrupt browser memory and potentially achieve code execution, data theft, or an information leak. The flaw is unauthenticated (PR:N) with low attack complexity but requires user interaction (UI:R), and the CVSS 3.1 vector scores it 7.8 with high confidentiality, integrity, and availability impact; note that the vector is AV:L, so the trigger is reached locally rather than as a pure remote drive-by. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though CWE-416 use-after-free flaws in browsers are historically attractive targets; a vendor fix is available in Chrome 154.0.8037.57.

CVE-2026-95277 is currently an effectively empty record: no description, CVSS score, CVSS vector, CWE mapping, affected product, version range, or CPE data has been published, and the only intelligence signal is attribution to the Ubuntu vendor reporting channel. Because the vulnerability class, attack vector, authentication requirements, and impacted component are all unknown, risk cannot be meaningfully assessed from the available data and no exploit status can be confirmed - there is no public exploit identified at time of analysis, and the entry is not listed as confirmed actively exploited (CISA KEV). Organizations should treat this identifier as a placeholder to be re-triaged once Ubuntu publishes a corresponding security notice (USN) or the upstream CVE record is populated.

The affected product and the nature of the security impact for CVE-2026-95325 cannot be established from the intelligence available at time of analysis. The only signal present is that the entry was reported by the vendor source 'ubuntu', with no description, CVSS score or vector, CWE mapping, CPE identifiers, references, EPSS score, or KEV status supplied; the independent assessment accordingly classifies this as a data-void entry with no analyzable signals. No public exploit identified at time of analysis, and there is no basis to characterize the attack vector, authentication requirements, or affected versions.

Unspecified security defects in Google Chrome desktop builds are addressed by a September 2026 stable-channel update, meaning only users running outdated installations remain exposed. The exact vulnerability class, attack vector, and privilege requirements are not disclosed in the available data, so the primary applicability condition is simply that the victim runs an unpatched Chrome desktop build and loads attacker-influenced web content, which implies user interaction (browsing) as a limiting factor. There is no CVSS score or vector, no CWE mapping, no EPSS probability, no CISA KEV listing, and no public exploit code identified at time of analysis, so no quantitative severity or exploitation-probability framework can be applied to this record.

An out-of-bounds memory write in Google Chrome allows an unauthenticated, remote attacker to corrupt memory and potentially execute arbitrary code or crash the browser when a victim opens a crafted web page, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6, scope-changed). The flaw is classified as CWE-787 (out-of-bounds write) and is addressed by the vendor's stable channel update for desktop, with the fix credits originating from the Ubuntu vendor reporting channel, meaning downstream Chromium packages are also in scope. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS data provided; however, because browser memory-corruption bugs of this class are historically attractive to exploit developers, this remains a high-priority patching item despite the absence of exploitation telemetry.

Out-of-bounds write (CWE-787) in Google Chrome permits a remote, unauthenticated attacker to corrupt memory in the browser when a victim opens or is redirected to attacker-controlled web content (UI:R), with high confidentiality and integrity impact and a scope change (S:C) that the independent assessment reads as the corruption crossing the renderer sandbox boundary. Exploitation is not turnkey: the high attack complexity (AC:H) reflects a precondition the attacker must satisfy - typically heap grooming, a race, or a specific object/memory state - before the write is reachable, which constrains reliability and mass exploitation. No public exploit identified at time of analysis, and the fixed build 154.0.8037.57 is already shipping, so exposure is limited to un-updated Chrome clients, making this a genuine high-priority browser issue rather than a top-tier emergency.

Ubuntu Linux is the only product attributable to CVE-2026-95319, and the sole intelligence signal available is a vendor:ubuntu report with no accompanying advisory text, version range, or affected component. No description, CVSS score, CVSS vector, CWE classification, CPE string, EPSS score, KEV status, or reference link was supplied, so the vulnerability class, attack vector, privilege requirements, and impact cannot be characterized. No public exploit code has been identified at time of analysis, but this reflects absent data rather than a confirmed absence of exploitation, and the entry must be treated as unassessable until the upstream NVD or Ubuntu security advisory is retrieved.

A use-after-free in Google Chrome desktop can be triggered when a victim renders attacker-controlled web content, allowing memory corruption that may lead to code execution or disclosure of sensitive in-process data. Affected are Chrome desktop builds on Windows, macOS, and Linux prior to the September 2026 stable channel update; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) requires no authentication or privileges but does require the victim to open or load a malicious or compromised page, and the S:C metric indicates the attack can affect a component beyond the one that is corrupted. Vendor-released patch available; no public exploit identified at time of analysis, and the reporting originator is Ubuntu.

Out-of-bounds memory write in Google Chrome (desktop builds) lets remote, unauthenticated attackers corrupt browser memory when a victim loads attacker-controlled web content. The vendor CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U with C:H/I:H/A:H (base 8.8), so the only prerequisite is that a user navigates to or renders a malicious page, and because the vector is scope-unchanged the memory corruption is expected to remain within the renderer/browser process rather than granting an inherent sandbox escape. The underlying flaw is an out-of-bounds write (CWE-787) in Chrome builds predating the vendor's September 2026 stable channel fix; patched builds are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Risk cannot be meaningfully assessed for CVE-2026-95299 because the vulnerability record contains no description, no CVSS score or vector, no CWE mapping, and no CPE/product identifiers; the only attributable data point is that the issue was reported by the vendor Ubuntu. Consequently the affected component, the attack surface, and any prerequisite conditions remain unknown, and no public exploit has been identified at time of analysis. Analysts should treat this identifier as unresolved rather than low-risk: an empty record frequently reflects a placeholder or embargoed entry that is populated later, so the absence of detail is not evidence of low severity.

Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 lets an attacker who convinces a user to open or interact with crafted content trigger the reclamation and subsequent dereference of a freed object, yielding high confidentiality, integrity, and availability impact within the affected process (CVSS 3.1 base 7.8). The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates no authentication is required but that user interaction is mandatory and that the scored attack path is local rather than a pure remote drive-by; if the underlying bug proves remotely web-reachable, real-world exposure would be higher than the AV:L score implies. Vendor-released patched builds exist (154.0.8037.57 and later, stable-channel desktop update tracked as EUVD-2026-89226), and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 allows a remote, unauthenticated attacker to trigger heap memory corruption in the browser by convincing a victim to load attacker-controlled web content - a single page navigation is sufficient (UI:R, PR:N, AV:N). The flaw is rated CVSS 9.6 with a scope change (S:C), indicating the corruption can affect resources beyond the initially vulnerable component; no authentication, prior privileges, or non-default configuration is required, though exploitation hinges entirely on user interaction with a malicious or compromised page. Google has already shipped a fixed build (154.0.8037.57) on the stable channel, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine high-priority patch-and-update item rather than an emergency zero-day response.

Type confusion in Google Chrome's core rendering code allows remote attackers to corrupt memory and execute arbitrary code inside the browser renderer, affecting Chrome builds prior to 154.0.8037.57 on all platforms. Exploitation requires the victim to load attacker-controlled web content (a malicious or compromised page), matching the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H profile - no credentials are needed, and default configurations are exposed because the flaw sits in normal rendering rather than an optional feature. At the time of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; the impact is contained to the sandboxed renderer (S:U), so full host compromise would require a separate sandbox escape not described in this record, but the integrity and confidentiality impact within the renderer is high and the issue is rated 8.8.

Out-of-bounds memory write in Google Chrome allows remote attackers to corrupt memory in a victim's browser by having them load attacker-controlled web content, rated CVSS 3.1 base 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). No authentication or non-default configuration is required, but exploitation depends on user interaction (the victim must visit or load the malicious page) and on running an unpatched build predating the September 2026 stable-channel fix; exact affected versions are not confirmed in the available data. The scope-change component suggests impact extending beyond the initially affected component - the classic profile of a renderer-process compromise crossing Chrome's process boundary - and while a vendor patch is available, no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.

Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffer overflow (out-of-bounds write) in an FTM component lets an attacker with valid low-privilege credentials submit crafted input and gain code execution in the containerized transaction platform. The vendor rates this 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment concurs on high confidentiality and integrity impact while treating the scope change as unproven (S:U). Exploitation requires authentication (PR:L) and is not considered reliably repeatable on the first attempt (AC:H), and no public exploit identified at time of analysis. A vendor patch is available per IBM advisory node/7288641, so organizations running FTM on OpenShift should treat this as a priority patch action for their FTM estate.

Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated quantity value to a vulnerable feature, causing an out-of-bounds write (CWE-787) that can lead to arbitrary code execution. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis; a vendor patch is available via IBM support node 7288641.

An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates the MQTT broker that a device connects to corrupt heap/stack memory and potentially achieve full code execution on that device. Only devices built with lwIP's optional MQTT client compiled in are exposed, and because MQTT connections are client-initiated the device is not directly reachable inbound: the attacker must operate a malicious broker, compromise the legitimate broker, or hold a man-in-the-middle position on the client-to-broker path (feasible where TLS is absent or certificate validation is disabled). No authentication or user interaction is required once that broker-side position is achieved, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N) presents this as trivially exploitable, whereas the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the significant broker-control/MITM prerequisite.

Out-of-bounds write in Adobe Substance3D Modeler allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local attack (CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) requires user interaction and is not known to be actively exploited; no public exploit code has been identified at time of analysis. The flaw affects the application's file parsing logic and could lead to full compromise of confidentiality, integrity, and availability for the current user.

An out-of-bounds write in Adobe Substance3D Modeler lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted file in the application. The flaw is triggered during parsing of a malicious asset, so exploitation is local and requires user interaction: there is no network-reachable or drive-by path, and no public exploit code has been identified at time of analysis. With a CVSS base of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and no CISA KEV listing, this is a genuine but lower-priority-than-the-headline-number memory-corruption bug whose real-world impact is bounded by the privileges of the user who opens the file.

Opening a maliciously crafted 3D model or project asset in Adobe Substance 3D Modeler can trigger an out-of-bounds write during file parsing, allowing an attacker to corrupt memory and execute arbitrary code under the privileges of the user running the application. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no privileges are required (PR:N), but exploitation is gated by mandatory user interaction - the victim must open the hostile file - and the impact is confined to the current user's session rather than escalating to SYSTEM or root. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, so risk is limited to environments where users routinely open untrusted 3D asset files; Adobe has published vendor guidance in advisory APSB26-155.

Out-of-bounds write (CWE-787) in Adobe Bridge allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Adobe rates the flaw 7.8 (HIGH) under CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - a local, client-side vector that requires user interaction rather than any network-facing or service exposure, with PR:N simply meaning no application authentication is needed while social engineering remains a prerequisite. No public exploit code or confirmed active exploitation was identified from the available intelligence at time of analysis, and the affected version range is unspecified in the source data, so any deployed Adobe Bridge build should be assumed potentially vulnerable until the vendor advisory is reconciled against the installed release.

Out-of-bounds write in Adobe Bridge can be triggered when a user opens or previews a maliciously crafted file, allowing memory corruption that may lead to arbitrary code execution in the context of the current user. Only systems with Bridge installed where users routinely open untrusted asset files are exposed; the vector is local (AV:L) with mandatory user interaction (UI:R), so there is no unattended or remotely reachable attack path and no privilege escalation beyond the logged-in user (S:U). Adobe self-reported the flaw in advisory APSB26-148 and rates it CVSS 3.1 7.8 HIGH; no public exploit code was identified at time of analysis and there is no KEV status confirming active exploitation.

Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).

Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.

Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.

A use-after-free in the Security Plugins component of RTI Connext Professional 7.6.0 through 7.7.0.0 lets an admitted, low-privilege participant in a DDS domain corrupt memory and manipulate files, producing high impact to confidentiality, integrity and availability. Exploitation is network-reachable but gated by two prerequisites: the deployment must have Security Plugins enabled (not just the base DDS libraries), and the attacker must already hold authenticated low-privilege access as an accepted DDS participant (CVSS 3.1 PR:L, CVSS 4.0 AT:P indicates an additional timing/precondition gate), so it is not exploitable against a default unauthenticated posture. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-supplied CVSS 4.0 base score is 7.7 (High).

Heap-based buffer overflow in libslirp's DHCPv6 and TFTP reply builders lets a malicious guest write attacker-controlled content and length past the end of the host-side reply buffer, causing host process crashes (denial of service) and potentially arbitrary code execution in the host. The flaw only manifests when the host interface is configured with a small, non-default MTU - the default MTU is explicitly unaffected - and requires the guest to reach libslirp's built-in DHCPv6 or TFTP service, which makes this a guest-to-host escape surface for QEMU user networking and slirp4netns rootless containers. Red Hat Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4 ship affected builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector is unauthenticated (PR:N) but high complexity (AC:H) because of the configuration prerequisite.

Heap use-after-free in the XS backend of Net::IDN::Punycode 2.301 through 2.589 allows an attacker-supplied punycode label that decodes to enough code points above U+FFFF to corrupt memory in the decoding Perl process, granting both read and write access to freed heap memory (CWE-416, CVSS 8.4). The defect was introduced by the 2.301 fix for CVE-2016-15059 and is confined to the XS implementation; deployments using the pure-Perl backend are not affected, and no public exploit code has been identified at time of analysis. Reachability depends on whether the consuming application feeds untrusted punycode into decode_punycode (for example IDN hostnames or internationalized email addresses), but the vulnerable call itself requires no authentication (CVSS PR:N).

A crafted graph query submitted to FalkorDB (Redis module) versions 4.20.1 through 4.20.4 drives an out-of-bounds read in the node_token_count/relation_token_count code path, crashing the module and the Redis process that hosts it - a purely availability-impacting denial of service with no data exposure or code execution. The flaw is network reachable and low complexity; per our independent assessment the practical authentication requirement depends on the deployment, since exploitation is effectively unauthenticated when Redis is exposed without requirepass or ACLs, but requires an attacker to already hold valid query privileges wherever Redis authentication or ACLs are enforced. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and impact is confined to service availability (base 7.5, NVD vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Envoy Proxy releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 can be crashed by a remote, unauthenticated attacker through its HTTP/3 datagram and Capsule Protocol handling (prerequisites: PR:N, no user interaction). When a request enters a stream-recreation path such as an internal redirect, the HttpDatagramHandler keeps a cached pointer to the original RequestDecoder; a subsequent HTTP/3 datagram invokes decodeData through that freed decoder, producing invalid virtual dispatch and process termination (CWE-416 use-after-free, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is gated on a non-default configuration - HTTP/3 (QUIC) downstream plus Capsule Protocol enabled, e.g. MASQUE connect-udp tunneling - combined with an internal-redirect route and precise frame sequencing; no public exploit code or CISA KEV entry was identified at time of analysis.

Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread that holds access to the Intel time-aware GPIO (TGPIO) device object to perform two uncontrolled 8-byte supervisor-mode writes to attacker-chosen kernel addresses via the tgpio_pin_read_ts_ec() syscall. The syscall's verification handler omitted the K_SYSCALL_MEMORY_WRITE() check that the sibling handlers in the same file already perform, converting a benign timestamp read-back into a write-what-where primitive that can corrupt kernel data structures, escalate the calling thread to supervisor privilege, or crash the system. Exposed builds are narrow: CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y must both be set, and because the affected source file failed to compile from v3.6.0 until after it was repaired past v4.4.0, the realistically exposed population is v3.5.0 builds plus downstream trees that locally patched that build breakage; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though it is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Use-after-free in Suricata before 8.0.7 can crash the HTTP/2 inspection engine when a transaction is inspected by rules that use http.response_header both with and without a transform. The flaw is remotely triggerable by HTTP/2 server responses traversing the sensor, requires no authentication per the CVSS vector, and the vendor has released 8.0.7 as the fix. No public exploit code or confirmed active exploitation was identified at time of analysis; the assessed impact is primarily denial of service and limited memory disclosure, not confirmed code execution, and exploitation depends on the specific dual-rule HTTP/2 configuration.

Suricata 8.x before 8.0.7 contains a type confusion vulnerability in the DoH2 (DNS over HTTPS version 2) parser that can result in an invalid free, leading to memory corruption. An unauthenticated remote attacker can trigger this by sending a crafted DoH2 request that performs an HTTP1-to-HTTP2 upgrade through a monitored network, potentially causing a crash or arbitrary code execution. The vulnerability is exploitable by default in 8.x sensors because the doh2 app-layer protocol is enabled out-of-the-box; no public exploit code has been identified at time of analysis, but the severity is high.

Local privilege escalation in Microsoft Edge (Chromium-based) versions below 153.0.4234.46 stems from a use-after-free (CWE-416) memory corruption flaw that an attacker with an existing low-privileged foothold on a Windows host can trigger to elevate privileges. Exploitation requires local access and low privileges (AV:L, PR:L, UI:N) and is constrained by high attack complexity (AC:H) because the bug is timing/race-dependent, so it is not reliably or automatically triggerable (SSVC Automatable=no); the changed-scope rating (S:C) reflects impact that can cross a security boundary such as the browser sandbox. No public exploit code has been identified and EPSS is low at 0.22% (13th percentile), with no evidence of active exploitation in CISA KEV or SSVC (Exploitation=none), making this a genuine but moderate-priority patching item rather than a remotely wormable emergency.

Heap-based out-of-bounds write in libheif prior to 1.23.2 lets an attacker who can supply an independently constructed tile image to the uncompressed-codec tiled encoding path corrupt memory past the heap output buffer. The flaw is only reachable when the library is built with WITH_UNCOMPRESSED_CODEC enabled and the host application uses the tiled writing API (heif_context_add_image_tile), which makes the encoder encode rather than decode attacker-influenced data; because that path is an encoder-side, build-optional feature requiring a specific application design, the vendor's AC:H rating is appropriate. CVSS is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) with high integrity and availability impact but no confidentiality impact, and no public exploit code or active exploitation has been identified at time of analysis; a vendor fix is available in 1.23.2.