Stack-based Buffer Overflow

An unauthenticated stack-based buffer overflow in the Boa web server embedded in Netcore NR256CN firmware through 1.5.140116 lets remote attackers crash the router's main Boa process - and potentially execute code - by sending an HTTP Basic-auth username longer than 63 bytes to any password-protected /router/*.cgi route. The defect lives in the pre-authentication user_ok() handler, where Basic-auth usernames are copied with unbounded strcpy() into a fixed 64-byte stack buffer, so exploitation requires no credentials and no user interaction; the practical risk is governed almost entirely by exposure, since the attacker must be able to reach the device's HTTP management interface (far more dangerous when it faces the WAN, far less so when confined to the LAN). Per available data there is no confirmed active exploitation in CISA KEV and no public exploit code identified at time of analysis, but the zero-prerequisite access path and the network-facing attack vector make this a high-priority issue for any NR256CN with an internet-reachable admin UI.

Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office for Mac/LTSC for Mac editions, allowing an unauthenticated attacker to execute arbitrary code by convincing a victim to open a specially crafted document (UI:R). The stack-based buffer overflow (CWE-121) requires no privileges or non-default configuration (PR:N, AC:L), making it a high-priority target for social-engineering campaigns, though no public exploit code has been identified at time of analysis. Patch available per vendor advisory from the Microsoft Security Response Center.

Stack-based buffer overflow in Microsoft Word permits remote code execution in affected Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC 2021/2024 (including Mac editions) when a victim opens a maliciously crafted document. The vulnerability is unauthenticated from the attacker's perspective but requires user interaction (UI:R), so delivery typically depends on phishing or social engineering, and no public exploit identified at time of analysis or CISA KEV confirmation is available in the provided data. Patch available per vendor advisory via Microsoft's MSRC update guide.

Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac when a user opens or previews a specially crafted document. The flaw is a stack-based buffer overflow (CWE-121) rated 8.8, reachable by unauthenticated remote attackers with PR:N but requiring user interaction with UI:R; successful exploitation yields code execution with the victim user’s privileges. A vendor patch is available, and no public exploit has been identified at time of analysis.

A stack-based buffer overflow in HPE NonStop XABroker can corrupt memory and terminate the broker process, handing an attacker who already holds a valid low-privilege account on the NonStop host a local denial-of-service primitive against a core system service. Exploitation is constrained: the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R) confirms the attack is local, requires an authenticated low-privilege account, and needs a separate user action to deliver or process the crafted input, with our independent assessment narrowing the impact to availability only (S:U/C:N/I:N/A:H) rather than the confidentiality and integrity loss implied by the vendor-published score. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so this rates as a moderate, availability-focused issue that matters most in environments where untrusted or semi-trusted users already have NonStop logon rights.

A stack-based buffer overflow in HPE NonStop ODBC/MX Server (CWE-121) allows a local attacker with valid low-privileged credentials and user interaction to corrupt memory, potentially causing an application crash and denial of service. The assessed CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) indicates local access, authentication, and user interaction are required, and the impact is confined to service disruption rather than confirmed code execution. No public exploit code or active exploitation has been identified at time of analysis.

HPE NonStop ODBC/MX Services contains a stack-based buffer overflow (CWE-121) that allows a locally authenticated attacker with low privileges to crash the application via crafted input, provided a user action is performed. The vulnerability is not remotely exploitable and requires user interaction; no public exploit was identified at time of analysis. Per independent assessment, the impact is limited to availability (application crash), with no confirmed confidentiality or integrity impact.

Stack buffer overflow in the HPE NonStop SQL/MX Executor allows an authenticated remote user to trigger memory corruption, yielding partial information disclosure and a high-availability impact in the form of a process crash. The flaw is reachable over the network with low attack complexity and no user interaction, but requires valid credentials with at least low-level privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, base 7.6), meaning an attacker must already be able to submit SQL to the Executor. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; the exposure is further limited because HPE NonStop is a specialized fault-tolerant platform rather than a commodity database, so this is a moderate-priority issue rather than an urgent one.

Stack-based buffer overflow in HPE NonStop TELSERV versions T9553L01^BAJ and earlier allows remote, unauthenticated attackers to corrupt memory and crash the service, causing a denial of service. The flaw is network-reachable with low complexity and requires no authentication or user interaction per the CVSS vector (PR:N/UI:N), so any party able to open a TELSERV session can attempt the overflow. No public exploit identified at time of analysis, and the impact is limited to availability - no code execution or data disclosure is described.

Stack-based memory corruption in the HPE NonStop SNMP Trap Multiplexer (T1041L01^BAA and earlier) lets remote, unauthenticated attackers crash the trap-handling service, producing a denial-of-service condition on the SNMP trap collection path. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms network reachability with no authentication, privileges, or user interaction required, but limits impact strictly to availability - there is no assessed loss of confidentiality or integrity, so code execution or data disclosure is not established by the available evidence. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore a remotely triggerable service crash on a specialized, typically network-segmented platform.

Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based buffer overflow (CWE-121) in the httpd process that serves the J-Web management interface, reachable by an unauthenticated network attacker who can reach the J-Web HTTP(S) listener. The vendor-assigned CVSS 4.0 score is 9.3 (and our independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. 9.8), reflecting full confidentiality, integrity and availability impact with no authentication or user interaction required; attack complexity is low in the base vector, though the real-world exploitable population is constrained by two configuration prerequisites. Successful exploitation is contingent on J-Web being enabled and a J-Web virtual-domain being configured - a non-default state - so devices with J-Web disabled or no virtual-domain configured are not affected. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.

Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid EVPN route advertisements sent by an established BGP/EVPN peer for a configured EVPN-VPWS service, while the identical input causes only an rpd crash (denial of service) on Junos OS Evolved. The underlying defect is a stack-based buffer overflow (CWE-121) in a daemon that runs with root privileges on FreeBSD-based Junos OS, so a successful overflow yields full device compromise, and Juniper has published patched builds under advisory JSA112187. The vendor's CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, but real exposure is gated by the requirement that the attacker already hold a configured BGP/EVPN adjacency to the target device; no public exploit code has been identified at time of analysis and there is no KEV confirmation of active exploitation.

Juniper Junos OS and Junos OS Evolved rpd contain a stack-based buffer overflow that an unauthenticated adjacent LDP peer can trigger with a malformed LDP Label Mapping message, causing an rpd crash or potentially arbitrary code execution. Exploitation requires LDP/MPLS to be configured and the attacker to have an LDP adjacency, so exposure is limited to MPLS-enabled routers rather than arbitrary internet-facing systems. Vendor patches are available; no public exploit code has been identified at time of analysis.

A stack-based buffer overflow in the authd authentication daemon of Juniper Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service when both SNMP and AAA are enabled. Exploitation requires valid SNMP read credentials (low-privileged, authenticated) and the specific SNMP+AAA configuration, but no user interaction, making it a credible high-priority risk for devices with exposed SNMP management. Vendor patches are available; no public exploit was identified at time of analysis.

Stack-based buffer overflow in the srxpfe packet-forwarding daemon of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series lets a Layer-2-adjacent attacker execute arbitrary code as root by injecting crafted high-availability fabric traffic. This is a genuinely serious but access-constrained vulnerability: exploitation requires the SRX to be operating in a high-availability chassis cluster, and the attacker must already sit on the same Layer-2 segment as the HA fabric link - the flaw is not reachable over routed networks and does not affect standalone or non-clustered deployments. No authentication or user interaction is required once fabric adjacency is achieved (PR:N/UI:N per the assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector and the vendor CVSS 4.0 score of 8.7), and no public exploit code has been identified at time of analysis; the vendor reports a patch is available via advisory JSA112186.

Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routing protocol daemon (rpd) processes crafted BMP route monitoring messages from a configured external BGP neighbor. Exploitation requires the target device to have an established external BGP (eBGP) session with the attacker-controlled peer and BMP route monitoring enabled; routers without BMP configured or without eBGP peers are not exposed. No public exploit code or active exploitation has been identified at time of analysis.

A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, remote attacker execute code as root or crash the device by sending a crafted packet through a configured GRE tunnel. The only meaningful precondition is that a GRE tunnel must be configured and the malformed packet must arrive on that tunnel interface, so SRX deployments without GRE are not exposed; where GRE is enabled the attack is network-reachable, requires no credentials and no user interaction, and the independent assessment rates the resulting impact as high across confidentiality, integrity and availability. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but vendor patches are available and the configuration-dependent exposure makes rapid triage of GRE-enabled SRX fleets worthwhile.

Stack-based buffer overflow in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potentially execute commands with root privileges via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. Exploitation requires that BMP be explicitly enabled (not default) and that the attacker have an established BGP session, meaning a configured neighbor or compromised peer. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited; patched releases are available from Juniper.

Unauthenticated remote code execution as root affects Juniper Junos OS on MX Series routers that are configured for IKE/IPsec with certificate-based authentication, due to a stack-based buffer overflow in the key management daemon (kmd). An attacker with network access to the IKE service can send specially crafted IKE certificate-based packets to trigger the overflow and execute arbitrary code with root privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the vendor has released patches and the vulnerability carries a critical severity rating (CVSS 9.3 from Juniper, 9.8 assessed).

Denial of service in Juniper Networks Junos OS and Junos OS Evolved rpd allows an attacker with access to a configured BGP peering session to crash the routing protocol daemon by sending a crafted BGP route attribute that is processed while a BGP RIB streaming telemetry subscription is active. Affected are Junos OS and Junos OS Evolved versions 22.1R1 and later (22.1R1-EVO for Evolved); earlier releases are not vulnerable. Exploitation is conditional on both the BGP peer relationship and a non-default telemetry subscription, making this a conditional availability risk rather than a top-tier emergency; no public exploit identified at time of analysis, and vendor patches are available.

Stack-based buffer overflow in Juniper Networks Junos OS and Junos OS Evolved BGP flowspec handling allows a configured BGP flowspec peer to compromise the routing engine or cause a routing-daemon denial of service when BGP update-threading is enabled. The vendor CVSS 4.0 score is 9.3, and the independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a genuinely high-priority issue whose exploitability is more constrained than the critical score alone suggests: the attacker must already be a configured flowspec BGP neighbor, and update-threading must be enabled, so devices without those conditions are not exposed. Vendor patches are available in fixed builds such as Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.4R2-S5, 25.4R1-S3, and 26.2R1-S2 (with corresponding Junos OS Evolved -EVO releases); no public exploit code has been identified at time of analysis.

Remote code execution with root privileges or denial of service in Juniper Networks Junos OS on SRX Series devices is possible through a stack-based buffer overflow in the iked IKE key-management daemon. An authenticated remote-access VPN client on an SRX running affected Junos OS releases can exploit the remote-access VPN authentication and JIMS identity-publishing path; deployments not using remote-access VPN or JIMS identity publishing are not exposed. No public exploit code has been identified at time of analysis, but a vendor patch is available and the vendor CVSS score is 8.7 with high confidentiality, integrity, and availability impact.

Adjacent, unauthenticated code execution as root affects Juniper Junos OS and Junos OS Evolved devices that support Secure-ZTP when their phone-home daemon (phcd) processes a crafted DHCP SZTP bootstrap message. The flaw is a stack-based buffer overflow (CWE-121) that can be triggered by a network-adjacent attacker (CVSS 4.0 AV:A/AC:L/PR:N/UI:N, vendor score 8.7 High); no credentials or user interaction are required, but the target must be a Secure-ZTP-capable platform actively in the DHCP SZTP bootstrap/provisioning state and the attacker must be on the same Layer-2/logical segment. Vendor patches are available; no public exploit code or KEV-listed active exploitation was identified in the provided data.

Stack-based buffer overflow in Juniper Networks Junos OS jdhcpd lets an unauthenticated adjacent attacker crash the DHCP client process with a crafted DHCP response, causing denial of service for DHCP, relay, and zero-touch-provisioning services on devices configured as DHCP clients. Exploitation requires L2 adjacency to the victim and no authentication or user interaction; devices not operating as DHCP clients are not exposed, and service recovers once malicious traffic stops. Vendor patches are available per Juniper advisory JSA112188, and no public exploit code has been identified at time of analysis.

Stack-based buffer overflow in the cfmd process of Juniper Junos OS and Junos OS Evolved on MX Series and PTX Series platforms enables unauthenticated adjacent-network attackers to execute arbitrary code as root or cause denial of service when enhanced CFM mode and a configured down-MEP are present. The CVSS 8.7 score reflects high confidentiality, integrity, and availability impact, but real-world exposure is constrained by the non-default CFM/802.1ag configuration and the need for Layer 2 adjacency; no public exploit identified at time of analysis.

A stack-based buffer overflow in Juniper's jdhcpd process lets an adjacent, unauthenticated attacker crash or potentially achieve root-level code execution on Junos OS and Junos OS Evolved devices that are configured to use the DHCPv4 local-client feature. Exploitation requires the device to act as a DHCPv4 client and an attacker to sit on the same Layer 2 segment able to deliver a malformed DHCPv4 server response (for example via a rogue or spoofed DHCP server); there is no public exploit identified at time of analysis, but a vendor patch is available. Because jdhcpd runs with root privileges, a successful overflow could yield high confidentiality, integrity and availability impact, making this a mid-to-high priority issue for exposed deployments rather than a universal emergency.

A stack-based buffer overflow in the l2cpd (Layer 2 Control Protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker who is Layer 2 adjacent - on the same broadcast domain or directly cabled to the target interface - crash Layer 2 control-plane processing by sending crafted LLDP packets to an interface with LLDP enabled. The primary outcome is denial of service: repeated triggering can destabilize LLDP and other Layer 2 control protocols on the device, though the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, ~6.5) rates this as availability-only impact with no confidentiality or integrity loss. Exploitation is gated by two prerequisites - the attacker must already have local Layer 2 presence and the targeted interface must explicitly have LLDP configured - so remote Internet-based attacks are not possible; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and vendor patches are available.

Adjacent unauthenticated attackers can trigger a stack-based buffer overflow in the l2cpd process on Juniper Junos OS and Junos OS Evolved by sending crafted LLDP traffic to an interface configured with Unified Access Policy, potentially causing a denial of service or root-level code execution. Exploitation requires Layer-2 adjacency and the non-default UAP configuration, so this is a high-priority networking vulnerability rather than a universal emergency. No public exploit identified at time of analysis, and a vendor patch is available.

Stack-based buffer overflow in the authd process of Juniper Networks Junos OS allows an attacker who can influence a configured RADIUS server to crash the device or execute arbitrary code with root privileges. This unauthenticated, adjacent-network attack (CVSS 8.7) is limited to devices that have RADIUS authentication enabled and where the attacker either controls the RADIUS server or can inject or modify RADIUS responses on the adjacent network. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed (not in CISA KEV).

Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.

A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.

A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.

A stack-based buffer overflow in the kernel of Juniper Networks Junos OS Evolved can be triggered by a crafted TCP packet when key-chain authentication is configured for BGP or LDP sessions, leading to a kernel panic and denial of service. This remotely exploitable, unauthenticated vulnerability requires network reachability to BGP (TCP/179) or LDP (TCP/646) and the operator-side configuration of key-chain authentication for those protocols. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is limited to denial of service with no confidentiality or integrity impact, and it is not a code-execution threat.

Remote, unauthenticated code execution is possible in the HPE NonStop SNMP Trap Multiplexer, which processes inbound SNMP trap messages on the HPE NonStop platform. An attacker who can reach the trap-receiving interface can deliver a crafted trap that overflows a stack buffer (CWE-121); our independent assessment rates the full impact as high for confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas the vendor-published 7.5 vector reflects only an availability impact (C:N/I:N/A:H) - a conflict that must be reconciled with HPE before prioritization. Exploitation requires network reachability to the trap listener and no credentials, privileges, or user interaction (PR:N/UI:N); no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV. Exposure is confined to the specialized population running HPE NonStop with this multiplexer deployed - typically banking, telecom and transaction-processing environments - which limits the scale but not the severity of a successful attack.

Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a crafted primary zone file to perform out-of-bounds stack writes, including overwriting a callback function pointer that is invoked immediately after parsing, which can lead to arbitrary code execution. The vulnerable path requires direct ingestion of a specially formatted zone file; NSD-generated zone files, including those for secondary zones received by transfer, are not formatted in the triggering way and will not exploit the flaw. No public exploit code or confirmed active exploitation is identified in the available intelligence, and the assessed vector requires low privileges (PR:L) through local or zone-supply access rather than ordinary remote DNS queries.

Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-controlled data, which can corrupt control flow in the name server process and lead to code execution or a crash. The trigger is a HIP resource record whose RDATA is filled to (or near) its size limit and which also carries a second dname RDATA field, the HIP Rendezvous server; the bug lives in zone-file parsing, so it is not reachable through ordinary DNS query traffic, and zones NSD writes out itself - including secondary zones learned via zone transfer - are not formatted in the vulnerable way. Exploitation therefore requires the attacker to control zone-file content fed directly to NSD, for example through an operator-controlled provisioning or automation pipeline; no public exploit code was identified at time of analysis, and the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, score 8.7) overstates practical remote risk relative to the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). Authentication is required per the supplied vectors (PR:L), which corresponds in practice to a low-privileged position able to supply zone-file content to the daemon.

A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supply a crafted zone file to corrupt memory and potentially achieve arbitrary code execution. The flaw is triggered when the RDATA is filled to the wire-format limit and an ECH parameter overflows the stack, after which the base64 decoder can write attacker-controlled data of unlimited size. Exploitation requires that the crafted zone file be fed directly to NSD; zone files written by NSD itself (e.g., secondary zones) are not affected. The attacker must control or inject into the zone-provisioning path, such as a multi-tenant zone-submission pipeline, and authentication requirements are low-privileged per the CVSS vector (PR:L). No public exploit or in-the-wild exploitation has been identified at time of analysis.

Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data split into chunks of three characters or fewer, causing the token length calculation to yield zero bytes and letting an attacker overwrite up to 64K of stack memory with attacker-controlled data, with likely code-execution impact. Our independent assessment rates this CVSS 3.1 AV:L/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact, reflecting that the attacker must control zone-file content fed directly to NSD (PR:L, i.e., write/submit access to the zone input path) - it is not reachable through normal DNS queries and does not affect zone files NSD generates itself, such as zones for which the instance is secondary. The vendor rates it CVSS 4.0 8.7 (High) with AV:N/PR:L; patch availability is not confirmed in the provided data, and no public exploit code or CISA KEV activity was identified at time of analysis.

Privilege elevation in Microsoft SQL Server lets an attacker who already holds high-privilege credentials on the instance trigger a stack-based buffer overflow over a network connection and break out of their authorization boundary. Exploitation is constrained: the CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C) and the vendor description both indicate an authorized, highly privileged principal is required, and the AC:H rating means the overflow depends on specific server state, data, or timing rather than trivial input, so it is not reliably repeatable on a first attempt. All affected GDR and CU builds are pre-patch, Microsoft has published a fix via the MSRC update guide, and no public exploit or confirmed active exploitation was identified at time of analysis, so risk is real but conditional rather than a drop-everything emergency.

Remote code execution in Microsoft SQL Server 2022 and 2025 arises from a stack-based buffer overflow (CWE-121) that is triggered when a client connects to an attacker-controlled SQL Server endpoint and the malicious response overflows a fixed-size stack buffer. The vulnerability is unauthenticated from the attacker's side (PR:N) but requires victim-side interaction (UI:R) and high attack complexity (AC:H), so it is a moderate-priority issue rather than a mass-exploitation emergency; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation. Affected builds are SQL Server 2022 GDR below 16.0.1210.3 and CU27 below 16.0.4305.5, plus SQL Server 2025 GDR below 17.0.1145.4 and CU9 below 17.0.5015.4, with vendor-released patches available from Microsoft.

Arbitrary code execution in Adobe Substance 3D Sampler 6.0.3 and earlier is possible because a stack-based buffer overflow (CWE-121) is triggered when the application parses a specially crafted file, with any code executed inheriting the privileges of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) shows no privileges are required, but the attack is not network-reachable: the attacker must first deliver the malicious file and rely on the victim opening it in the application. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuinely moderate-risk desktop issue rather than a top-priority emergency, though the high confidentiality, integrity, and availability impact on the user's session justifies prompt patching.

Opening an attacker-supplied crafted file in Adobe Dimension 4.1.8 or earlier can trigger a stack-based buffer overflow that allows arbitrary code execution in the context of the victim's user account. Scoring 7.8 under CVSS 3.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is delivered purely through social engineering - a target must open a malicious file - and requires no network reachability, credentials, or elevated privileges, though any resulting code runs only at the victim's privilege level with no scope change. No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a credible but moderate-priority patching item rather than an emergency.

Arbitrary code execution in Adobe Substance 3D Stager (versions 3.1.8 and earlier) is possible when a victim opens a maliciously crafted file, which overflows a stack buffer during parsing and lets the malformed input corrupt memory in the context of the current user. The attack cannot be triggered remotely or without the target's cooperation - it is a local vector (AV:L) that requires user interaction (UI:R), so delivery depends on social engineering that convinces the victim to open the file - and code executes with the privileges of that user only (S:U), meaning a non-administrative victim limits the blast radius to that account. Adobe's PSIRT assigned a 7.8 base score (CWE-121), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).

Opening a crafted file in Adobe Substance 3D Stager 3.1.8 or earlier can trigger a stack-based buffer overflow that leads to arbitrary code execution in the context of the current user. The attack is local in nature (AV:L) and requires the victim to open an attacker-supplied file (UI:R), while requiring no privileges on the target (PR:N), so practical exploitation depends on socially engineering a user into opening a malicious asset rather than on any remotely reachable network service. There is no public exploit identified at time of analysis and nothing in the supplied intelligence indicates confirmed active exploitation, so this is a genuine but not emergency-priority issue at a CVSS 3.1 base score of 7.8, with impact bounded by the privileges of the user who opens the file.

Stack-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code in the context of the user who opens or previews a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, corresponding Mac editions, and Office Online Server; exploitation requires user interaction (UI:R), and no public exploit was identified at time of analysis. Vendor patches are available, with fixed builds such as 16.0.17932.21056 for Office LTSC 2024.

Stack-based buffer overflow in the Excel document parser allows a remote, unauthenticated attacker to execute code in the context of the current user when a victim opens a maliciously crafted spreadsheet. Exploitation requires user interaction (UI:R) - the file must be opened - and the attacker gains no elevated privileges, with code running locally rather than as SYSTEM or root, though impact to confidentiality, integrity and availability is rated high for that user context. The flaw affects Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021/2024, and a vendor patch is available; no public exploit code was identified at time of analysis and exploitation has not been confirmed as active (no CISA KEV listing), so risk is driven by the large Office install base and the ease of delivering a file by email or web rather than by observed attacks.

Stack-based buffer overflow in Microsoft Excel enables remote code execution against affected builds when a victim opens an attacker-crafted spreadsheet; the memory-corruption flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or prior access are needed, but successful exploitation hinges entirely on the target user opening the malicious document. Exposure spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, Office LTSC 2021/2024 and Office 365 for Mac, and Office Online Server running builds below the fixed versions enumerated in ENISA EUVD-2026-99809. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a vendor fix through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97750), which keeps this a high-priority but manageable patch-now item rather than an emergency.

Remote code execution in Microsoft Excel can be triggered by a stack-based buffer overflow when a victim opens a specially crafted workbook, allowing arbitrary code in the context of the opening user. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac variants, and Office Online Server; the attack is network-deliverable (AV:N) and requires no authentication (PR:N) but depends on user interaction (UI:R) to open the file. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Remote code execution in Microsoft Outlook results from a stack-based buffer overflow triggered when a victim opens or previews a maliciously crafted email/message. The flaw affects Microsoft Office LTSC 2021 before 16.0.14334.20974, Microsoft Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise, with CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and no privileges required. This is a high-priority issue, though not the absolute top tier of urgency, because user interaction is required; no public exploit identified at time of analysis, and vendor patches are available.

Stack-based buffer overflow in Microsoft Office Word enables a local, authenticated user to elevate privileges to the level of the affected process, resulting in high confidentiality, integrity, and availability impact on the host (CVSS 3.1 base 7.8 HIGH). Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and Office LTSC/365 for Mac. A vendor patch is available; no public exploit code or confirmed active exploitation has been identified at time of analysis.

Denial of service in Windows Host Guardian Service (HGS) affects servers where the optional HGS role is installed and its network endpoint is reachable. An unauthenticated, remote attacker can trigger a stack-based buffer overflow (CWE-121) to crash or disrupt HGS, impacting attestation and key-protection services for guarded hosts; the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis, and the narrow HGS deployment footprint makes this a bounded, medium-priority patch rather than an emergency.

Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) allows a low-privileged SharePoint user to run arbitrary code on the server over the network. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), the attacker must already hold valid credentials for a SharePoint account - the vulnerable code path is not reachable by unauthenticated users - but no victim interaction is required, and the impact on confidentiality, integrity, and availability is total. The status of this vulnerability at the time of analysis is that no public exploit code has been identified; it is not listed in CISA KEV, so confirmed in-the-wild exploitation has not been established, though the low attack complexity and the common exposure of internet-facing SharePoint portals with broadly provisioned accounts make it a high-priority patch target.

Remote code execution affects Microsoft Outlook through a stack-based buffer overflow (CWE-121) that a remote attacker can trigger by delivering attacker-controlled content to the victim's Outlook client, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicating an unauthenticated, no-interaction attack and a maximum impact rating of 9.8 (C:H/I:H/A:H). Impact is total: successful exploitation corrupts stack memory in the Outlook process and can yield code execution in the context of the logged-on user, including full read/write access to mail data and the ability to pivot on the endpoint. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation as "none" while rating the attack Automatable (yes) and Technical Impact as total, meaning scalable exploitation is technically feasible once exploit code is developed; patched builds are listed by the vendor for the Windows LTSC lines while several Mac and subscription builds are still tied to pending publication.

Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.

A stack-based buffer overflow in the Microsoft Graphics Component, reachable through Microsoft Office for Android, lets an authenticated attacker who can place a crafted document or graphics object in front of a victim gain code execution in the context of the mobile app, with high impact to confidentiality, integrity, and availability. Only builds from 16.0.1 up to but not including 16.0.20430.20000 are affected, and exploitation requires user interaction - the victim must open or render the malicious file - which materially narrows the practical attack surface despite the 8.0 CVSS score. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; the vendor has published an update-guide entry, so affected organizations should treat this as a credible mid-to-high priority patching item rather than a top-tier emergency.

Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.

Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.

Stack-based buffer overflow in Microsoft GDI+ enables remote code execution in the security context of the current user when a crafted image or document is opened or rendered by the victim. The flaw is remotely deliverable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation hinges on mandatory user interaction - CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and no public exploit code has been identified at time of analysis, so there is no confirmed actively exploited (CISA KEV) activity. Because GDI+ is a built-in Windows component, the affected surface spans a very broad estate - Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - making this a high-priority patching item on patch-Tuesday cadence rather than an emergency response, with vendor patches already available. CISA SSVC nonetheless rates the technical impact as "total," reflecting the potential for full confidentiality, integrity and availability compromise on an unpatched host.

Denial of service in the Windows Graphics Device Interface (GDI) subsystem allows unauthenticated, remote attackers to trigger a stack-based buffer overflow (CWE-121) and crash affected components, requiring no user interaction. The flaw (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affects all supported Windows client and server editions, including Server Core installations, but impact is confined to availability - there is no confidentiality or integrity loss, code execution, or privilege escalation described. CISA's SSVC assessment records exploitation as "none" and notes the flaw is automatable; no public exploit code was identified at time of analysis, and a vendor patch is available per the Microsoft advisory.

Local privilege escalation in the Windows Universal Disk Format (UDFS) kernel driver allows an already-authenticated, low-privileged user to corrupt kernel memory and gain SYSTEM-level code execution by causing the driver to parse attacker-controlled UDF-formatted data, typically through mounting or accessing a crafted UDF volume such as a malicious ISO or disk image. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with total technical impact across confidentiality, integrity and availability, but it is strictly local - there is no network attack path and no victim user interaction is required beyond the attacker's own action. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best characterized as a post-compromise local-to-SYSTEM escalation primitive rather than an initial-access vector; a vendor patch is available.

A stack-based buffer overflow (CWE-121) in the Windows Installer component (msiexec/MSI package processing) allows an authenticated local attacker holding a low-privileged session to elevate to higher privileges, including SYSTEM, with high confidentiality, integrity, and availability impact (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable in the default configuration of all supported Windows client and server editions, but exploitation requires an existing local foothold and no victim interaction, so it is best characterized as a privilege-escalation link in a broader intrusion chain rather than an initial-access vector. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as total. A vendor patch is available per Microsoft's MSRC update guide.

A stack-based buffer overflow in the Windows Installer (msiexec) component allows an authenticated attacker holding a low-privileged local account to elevate privileges to SYSTEM on affected Windows hosts. The flaw is local-only (AV:L) and requires no victim interaction, but carries High attack complexity (AC:H), meaning a race condition or a specific system state must be won before the overflow can be reliably triggered, which limits practical exploitability to shared and multi-user systems such as RDS/terminal servers rather than typical single-user endpoints. No public exploit code has been identified at time of analysis and no active exploitation is confirmed (CISA SSVC exploitation: none); the high EPSS-style urgency signals are absent, and Microsoft has released a vendor patch, making this a genuine but moderate-priority issue that should be handled through normal patch cycles.

A stack-based buffer overflow (CWE-121) in the Windows Client-Side Caching (CSC) service - the component that implements Offline Files caching of network shares - allows an authenticated, low-privileged local attacker to corrupt stack memory inside a service that normally runs with SYSTEM privileges, resulting in full local privilege escalation (CVSS 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). The attack requires a pre-existing local foothold (a standard user account or low-privileged code execution) plus the ability to reach and interact with the CSC service; there is no remote vector and no user interaction needed once local access exists. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, so this is a genuine but second-tier priority for patching cadence. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025.

Stack-based buffer overflow in Microsoft Windows Error Reporting (WER) allows a remote, unauthenticated attacker to execute code in the context of the affected component, though exploitation requires the victim to open or trigger processing of attacker-supplied content, as reflected by the CVSS UI:R metric. The exposure is unusually broad: Windows 10 and Windows 11 up to 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 at the pre-patch build numbers catalogued by ENISA EUVD, are all listed as affected. CISA's SSVC assessment rates exploitation as none and automatable as no, no public exploit code has been identified at time of analysis, and Microsoft has released vendor patches that fully address the issue on updated builds.

Remote unauthenticated code execution in Microsoft Exchange Server is possible via a stack-based buffer overflow in affected builds of Exchange Server Subscription Edition RTM, Exchange Server 2019 CU14/CU15, and Exchange Server 2016 CU23, rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers with network reachability to an unpatched Exchange deployment need no credentials and no user interaction, and the assessed impact is total (confidentiality, integrity, and availability all rated High). The high attack complexity component indicates that reliable exploitation depends on conditions outside the attacker's direct control, such as defeating stack protections or reaching a specific vulnerable code path, and CISA SSVC records Exploitation: none and Automatable: no; no public exploit identified at time of analysis, and Microsoft has released fixed builds.

Local privilege escalation in the Microsoft PostScript Printer Driver allows a low-privileged user on an affected Windows host to gain elevated code execution by having attacker-controlled PostScript/print-driver data processed on the machine, with the root cause classified as a CWE-121 stack-based buffer overflow and a CVSS base score of 7.8. The vector (AV:L/AC:L/PR:N/UI:R) shows no privileges are required prior to exploitation (PR:N) but local presence is mandatory and the victim must be induced to trigger processing of the malicious data (UI:R); CISA's SSVC assessment records Exploitation=none and Automatable=no, and no public exploit code has been identified at time of analysis. This is a credible but context-dependent post-compromise escalation step rather than a mass-exploitation emergency, and a vendor patch is available.

Stack-based buffer overflow in Windows DHCP Server allows an authenticated attacker with low-level network privileges to run arbitrary code on unpatched Windows Server and Windows 10 systems where the DHCP Server service is present. The flaw is network-reachable, low-complexity, and needs no user interaction, but PR:L means the attacker must already have an authenticated foothold; CISA SSVC rates exploitation as none and not automatable, and no public exploit code is identified at time of analysis. Vendor patches are available, making this a serious flaw to prioritize on exposed DHCP servers rather than an immediate emergency.

Local privilege escalation in Microsoft Sysinternals allows an authenticated low-privileged attacker to elevate privileges by exploiting a stack-based buffer overflow, requiring user interaction. The vulnerability has a CVSS 3.1 base score of 7.3 (High). No public exploit code or active exploitation has been identified at time of analysis.

Local privilege escalation in Microsoft's Windows Storage component allows an authenticated attacker who already holds low-level privileges on the host to trigger a stack-based buffer overflow and gain elevated (likely SYSTEM-level) code execution. The vulnerability is not remotely reachable and requires no user interaction, but the high attack complexity (AC:H) means exploitation likely depends on winning a race or achieving a precise memory state, so it is harder to weaponize than the 7.0 base score suggests. No public exploit code has been identified and it is not listed in CISA KEV; this is an escalation-from-foothold primitive rather than an initial-access vector, making it a moderate-priority local privilege escalation for patching rather than a top-tier emergency.

Denial of service against the QAPI service in Commvault Cloud can be triggered by an authenticated low-privilege user who sends a crafted request that overflows a stack buffer on CommServe, Web Server, Command Center, or Index Server. Per the vendor's advisory, exploitation is limited to service availability - there is no data disclosure, data tampering, or code execution impact (CVSS:4.0 vector VC:N/VI:N/VA:H, score 7.1), and the independent CVSS:3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees that only availability is affected. Valid credentials are mandatory and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority availability issue rather than an emergency, but Commvault has directed customers to a resolved maintenance release.

Stack-based buffer overflow in NVIDIA DALI lets a locally authenticated, low-privileged user who can get a crafted input file processed through a DALI pipeline corrupt memory and potentially achieve code execution, information disclosure, data tampering, or denial of service. Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3 High), exploitation is not remotely reachable: it requires an existing local foothold with at least low privileges plus some form of user interaction, which in practice means a victim or automated process must load attacker-controlled data. There is no public exploit identified at time of analysis and the flaw has not been added to CISA KEV; the practical risk concentrates on multi-tenant or pipeline-automation GPU hosts where untrusted files are routinely fed into DALI. Exact affected versions are unconfirmed because the CPE is a wildcard, so defenders must verify their deployed DALI build against the NVIDIA advisory.

Stack-based buffer overflow in the TRENDnet TEW-432BRP (firmware 3.10B20) web management interface lets an attacker with a valid low-privilege session crash or execute code on the device by sending an overlong 'Name' parameter to the /goform/formTcpipSetup handler. Publicly available exploit code exists, so risk is elevated wherever the router's management interface is reachable from an untrusted network or is protected only by default or weak credentials; impact is negligible where management access is confined to a trusted LAN. The device reached end-of-life in 2011 and the vendor has confirmed it has no way to test or patch the issue, meaning no vendor fix will be issued and replacement is the only complete remediation. This is not confirmed as actively exploited (CISA KEV), but the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact when the authentication prerequisite is met.

A stack-based buffer overflow in the web service upload-handling code of Siemens APOGEE and TALON building-automation controllers allows an unauthenticated remote attacker to crash the device, producing a denial-of-service condition. Affected platforms include APOGEE PXC Compact and PXC Modular (BACnet all versions before V3.5.7, P2 Ethernet all versions before V2.8.21), TALON TC Compact and TC Modular (BACnet all versions before V3.5.7), and the APOGEE MBC/MEC (PPC) variants in BACnet and P2 Ethernet builds, which are listed as affected in all versions. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but exploitation is trivial from a network standpoint - the CVSS vector confirms PR:N/UI:N with low attack complexity - so any controller whose HTTP upload interface is reachable is at risk. Siemens rates this CVSS 4.0 8.7; our independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Denial of service in the embedded web service of Siemens APOGEE MBC/MEC (PPC), APOGEE PXC Compact/Modular, and TALON TC building-automation controllers, caused by improper validation of multipart input that can crash the service via a stack buffer overflow (CWE-121). An unauthenticated remote attacker with network reachability to the controller's HTTP interface (CVSS PR:N/UI:N) can send a crafted multipart request and take the web service down; the assessed impact is availability-only (C:N/I:N/A:H), with no confidentiality or integrity loss demonstrated. Exploitation is bounded by exposure: these are OT field panels normally expected on segmented building networks, and no public exploit code has been identified at time of analysis - this is a credible OT risk for internet- or IT-reachable controllers, not a confirmed widespread-exploitation emergency. All-version APOGEE MBC/MEC (PPC) models carry the highest residual risk because no fixed version is listed for them, whereas APOGEE PXC Compact/Modular (BACnet) and TALON TC are fixed at V3.5.7 and the P2 Ethernet PXC Compacts at V2.8.21.

Unauthenticated remote attackers can cause a denial of service on Siemens APOGEE MBC/MEC, PXC, and TALON building automation controllers by sending a crafted input that triggers a stack-based buffer overflow (CWE-121) in the device's FTP service. The flaw affects all versions of the MBC and MEC PPC families and PXC/TALON TC models below BACnet V3.5.7 or P2 Ethernet V2.8.21. No public exploit code or confirmed active exploitation has been identified, and the impact is limited to availability (no confidentiality or integrity impact); real-world risk hinges on whether the FTP service is enabled and reachable from an attacker's position on the OT network.

Stack-based buffer overflow in the Wavlink WL-WN530BE1-A router (firmware build 251117) allows remote compromise of the device through its web management interface. An unauthenticated attacker who can reach the device's HTTP server can send a crafted request to /cgi-bin/ExportAllSettings.cgi with an oversized attacker-controlled HTTP_COOKIE / X-Cmd value, overwriting stack memory and potentially achieving code execution with full confidentiality, integrity, and availability impact. The issue is rated 9.3 under CVSS 4.0 and maps to an authoritative assessed CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; publicly available exploit code exists (no CISA KEV listing at time of analysis), and EPSS-style probability data was not provided, so risk is driven primarily by the unauthenticated, trivially reachable attack surface of the exposed CGI endpoint.

Authenticated remote code execution in IBM Planning Analytics 2.0 and 2.1 stems from a stack-based buffer overflow (CWE-121) that allows a remote attacker holding valid low-privilege credentials to corrupt stack memory and execute arbitrary code. IBM assigns a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), and the independent assessment raises the availability impact to High, indicating a successful exploit may also crash or destabilize the affected service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor patches are available via IBM support node 7291604.

Memory corruption in IBM Power Systems host firmware FW1060.00 through FW1060.81 lets an attacker who already holds authenticated, high-privileged service-level access to the Flexible Service Processor (FSP) write crafted configuration data that corrupts the host firmware boot stack during system IPL, with the compromise then propagating to the hypervisor loaded by that firmware and to the managed system. Because the flaw is reachable only from the local FSP interface (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) and only fires on a (re)boot cycle rather than at runtime, the practical attack path is an insider or compromised FSP service account on the management plane rather than a remote network attacker, and no public exploit identified at time of analysis and no CISA KEV listing is associated with this CVE. Full confidentiality, integrity, and availability impact is scored against the managed system, with a scope change reflecting that the corruption begins in host firmware but affects the separately-managed hypervisor.

Local code execution in IBM Power Systems firmware (FW1060.00 through FW1060.81) lets an attacker who already holds authenticated service-level access to the Flexible Service Processor (FSP) send a crafted service processor mailbox message that overflows host firmware runtime attribute storage, compromising the managed system's memory and hardware interfaces. The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (base 8.2) is internally consistent with that description: the flaw is local, requires high-privilege service-plane credentials, needs no user interaction, and its scope change reflects a jump across the trust boundary from the service processor into the host firmware runtime with high confidentiality, integrity and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; IBM published the vendor advisory at https://www.ibm.com/support/pages/node/7290126.

Arbitrary code execution on the host system is possible in IBM Power Systems firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81, due to a stack-based buffer overflow (CWE-121) in the host firmware boot process image validation path. An attacker with high-privileged service access to the service processor (PR:H, AV:L) can supply a maliciously crafted code update image to execute arbitrary code on the host system, resulting in full confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.2, High). No public exploit has been identified at time of analysis, and exploitation requires local/service-level access and high privileges, substantially limiting real-world risk.

Arbitrary code execution in the host firmware runtime of IBM Power Systems is possible via the service processor mailbox interface, affecting firmware levels FW1060.00 through FW1060.81. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can send a crafted mailbox message that overflows host firmware runtime attribute storage (CWE-121), gaining full access to the managed system's memory and hardware interfaces. This is a high-severity local/management-plane issue (CVSS 8.2) requiring high privileges; no public exploit has been identified at time of analysis, and while it is not a mass-exploitation priority, isolation of the FSP network and limiting service accounts are recommended.

Authenticated local access to the IBM Power Systems service processor enables writing crafted host firmware configuration data that crashes the boot stack during system initialization, potentially corrupting memory in firmware versions FW1060.00 through FW1060.81. This stack-based buffer overflow (CWE-121) has a CVSS 3.1 score of 7.3, with limited integrity impact and high availability impact. Exploitation requires service-level credentials (PR:L) and local access to the management plane (AV:L); no public exploit code or active exploitation is identified at time of analysis.

An authenticated remote stack-based buffer overflow in the Linksys E1700 router (firmware through 1.0.0.4.003) lets an attacker who can reach the device's HTTP management interface and hold a low-privilege session crash or potentially execute code on the device by sending an oversized vlan_set argument to the /goform/setVlan endpoint. Publicly available exploit code exists, including a GitHub proof-of-concept writeup, and the vendor was contacted early but did not respond, so no official fix is currently available. The vulnerability is rated CVSS 4.0 8.6 (independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires prior credentials or a hijacked authenticated session, and the management interface must be reachable from the attacker's position, giving this a targeted rather than mass-exploitation profile.

A stack-based buffer overflow in the Mac Filter configuration handler of Linksys E1700 firmware 1.0.0.4.003 allows an attacker who can reach the router's administrative web interface to send an overlong newap_text_%d value to /goform/ssid1MACFilter and corrupt the stack, resulting in a crash and potentially code execution with the privileges of the device's web server. Publicly available exploit code exists (a detailed PoC is published on GitHub), but there is no CISA KEV listing and active exploitation has not been confirmed, so this should be treated as a credible but not yet observed attack. The vendor was contacted early about the disclosure and did not respond, so no patched firmware has been confirmed; the provided CVSS 4.0 vector rates it 9.3 with PR:N, while our independent assessment maps the same flaw to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, because the /goform endpoint sits behind the admin UI and is normally reachable only after authenticating - resolving that pre-auth vs. post-auth question is the single biggest factor in real-world risk.

A stack-based buffer overflow (CWE-121) in the UNISOC modem OTA stack lets an attacker within radio range achieve remote code execution or crash the baseband by broadcasting a crafted SIB1 message whose scheduling information is not properly validated, which the modem parses automatically with no authentication or user interaction (PR:N/UI:N). The vendor assigned a CVSS 3.1 score of 9.8 with an AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector, but the exploitation path is adjacency-gated: the adversary must operate a rogue cellular base station (SDR plus a full baseband stack), out-compete legitimate cells so the victim device camps on the malicious cell during idle-mode (re)selection, and the target must run the affected UNISOC modem/OTA stack - making this a proximity-limited, targeted attack rather than an internet-scale one. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Stack-based buffer overflow in FalkorDB versions before 4.18.4 allows remote attackers who can issue Redis replication commands - for example against a network-reachable instance with no password configured - to crash the graph database and possibly achieve code execution by supplying a crafted RDB stream whose entity property count is unbounded. The decoder sizes two variable-length arrays on the thread stack from that attacker-controlled count and then fills them with attacker-supplied values, so a single malformed RDB payload overflows the stack (CWE-121). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released FalkorDB 4.18.4 moving large property sets to the heap; CVSS 4.0 rates this 9.2 with AV:N/AC:H/PR:N/UI:N, where the high attack complexity reflects the difficulty of converting the overflow into reliable arbitrary code execution rather than a denial of service.

Unauthenticated denial of service in the TP-Link Tapo C325WB v2 camera allows a crafted pair of RTSP-over-HTTP tunneling requests sent to the streaming service on TCP port 554 to corrupt memory (stack-based buffer overflow, CWE-121) and crash the streaming daemon, disrupting live video and related streaming functions until the daemon recovers or restarts. Only cameras with the optional Camera Account feature enabled are exposed, and the attacker must be positioned on the same adjacent network segment (Wi-Fi or LAN) as the camera, since the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no authentication or user interaction is required. Impact is availability-only and temporary, no public exploit identified at time of analysis, and a vendor patch is available per the TP-Link firmware release notes and advisory FAQ 5333.

Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is possible through a stack-based buffer overflow (CWE-121) in reachable product code, with the vendor CVSS vector indicating a network-accessible, unauthenticated trigger and no required user interaction (AV:N/PR:N/UI:N) and a maximum impact rating of 9.8. Our independent assessment scores the same impact but raises attack complexity to High (AC:H), reflecting that reliable code execution likely requires an attacker to defeat standard memory protections such as stack canaries, ASLR, and DEP, and CISA's SSVC framework rates the issue non-automatable with no observed exploitation; no public exploit identified at time of analysis, and EPSS is low at 0.37% (29th percentile). The practical picture is a high-severity, patch-priority issue rather than an emergency: the vulnerable code is assumed reachable in standard deployments since the advisory names no special prerequisite, but exposure is confined to environments running the three named 12.x releases and the vendor fix closes the window once applied.

Stack-based buffer overflow in Poppler's Decrypt::revision6Hash() allows a caller-supplied password longer than 127 bytes for an AESV3/R6 (AES-256 revision 6) encrypted PDF to overwrite the K1 and E stack buffers, crashing the process and corrupting nearby memory. Poppler 0.42.0 through 26.10.0 is affected across libpoppler, libpoppler-glib and the C++ API, and the flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:4.0 PR:N) but carries an explicit attack requirement - the attacker must control the password string passed to the decrypt routine - so realistic exposure is automated or server-side PDF pipelines that decrypt files with externally supplied passwords rather than interactive viewers where the user types the password. Impact is primarily availability (A:H) with a limited integrity effect (I:L); no public exploit identified at time of analysis, no CISA KEV confirmation of active exploitation, and an upstream fix is tracked via freedesktop GitLab merge request 2398 with a vendor advisory noted.

Stack-based buffer overflow in IBM DataPower Gateway firmware tracks 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows an authenticated attacker holding administrative-level privileges to execute arbitrary code on the gateway. Exploitation is network reachable but gated by high attack complexity (AC:H), meaning the attacker depends on conditions they cannot fully control, such as a specific memory layout or parsing state, so a single deterministic trigger is not guaranteed; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); IBM has released patched builds via its support advisory.