Stack-based Buffer Overflow

Stack-based buffer overflow in TP-Link TL-MR100 V3.20 allows an adjacent unauthenticated attacker to corrupt the httpd process stack by sending a crafted encrypted payload to the /cgi/login endpoint before any authentication occurs. The flaw resides in the http_gdpr_decrypt function, which performs insufficient bounds checking on incoming data, enabling overwrite of saved control-flow data and potential arbitrary code execution in the context of the httpd process. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in MongoDB BI Connector ODBC Driver allows an authenticated user who can influence the numeric argument of a SQL LIMIT clause to crash the hosting application process or corrupt adjacent stack memory. The vulnerability is gated by a non-default driver configuration: the prefetch feature must be explicitly enabled, narrowing real-world exposure to that subset of deployments. No public exploit code has been identified and the issue is absent from CISA's Known Exploited Vulnerabilities catalog; however, where conditions are met, availability impact is rated High by the reporter.

Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.

Stack-based buffer overflow vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch web management interface allow a remote authenticated attacker to crash the CGI process and disrupt web-based device administration. Three separate POST parameter handlers in /cgi-bin/dispatcher.cgi - processing usrPass, enbPass, usrName, and usrPass - copy user-supplied input into fixed-size stack buffers without bounds validation, triggering CWE-121 conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; impact is confined to denial of service against the web management plane.

Stack-based buffer overflow and null pointer dereference vulnerabilities in the PLANET GS-4210-16P2S managed PoE switch firmware (all versions before 3.441b260626) allow a remote authenticated attacker to crash the CGI-based web management service by submitting crafted POST requests to RADIUS server configuration handlers. The `web_radiusSrv*_post` handler family in `/cgi-bin/dispatcher.cgi` copies user-controlled parameters into fixed-size stack buffers without bounds checking and dereferences `radName`/`radIp` pointers without confirming their presence. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis; a vendor-released firmware patch is available.

Stack-based buffer overflows in PLANET GS-4210-16P2S managed switch firmware before 3.441b260626 allow a remote administrator to crash the web management interface by sending crafted HTTP POST requests to /cgi-bin/dispatcher.cgi. More than 30 named CGI handler functions - spanning VLAN, SNMP v3, ACL, AAA, DHCP, STP, PoE, and cable diagnostics subsystems - copy attacker-supplied POST parameters into fixed-size stack buffers without length validation. The confirmed impact is denial of service of the web management service; the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, though a vendor patch is available.

Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated attacker to crash VPN processing via specially crafted network traffic, causing a denial-of-service condition on affected Firebox appliances. Any Firebox with IPsec VPN exposed to untrusted networks is at risk across an unspecified range of Fireware OS versions. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with network-accessible, zero-authentication exploitation reflects meaningful operational urgency for perimeter security devices.

Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprecated Mobile Security feature, where a stack-based buffer overflow lets an unauthenticated remote attacker run arbitrary code on the appliance. The CVSS 4.0 base score is 9.3 (critical) with a network, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, but as a perimeter firewall RCE the impact is severe for any deployment still running Mobile Security.

Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-based buffer overflow lets a remote, unauthenticated attacker run arbitrary code by sending specially crafted network traffic. Because iked terminates VPN negotiations at the network edge, any Firebox appliance exposing IKE/IPsec is reachable pre-authentication. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth RCE profile on a perimeter security device makes this a top-priority patch.

Stack-based buffer overflow in the Bendix EC80ESP brake ECU family enables adjacent-network attackers to crash the ECU or achieve remote code execution and arbitrary CAN bus traffic injection via a crafted payload. All known variants across both EC80ESP and EC80ESP+ product lines are affected, including J1708, 6S/6M, PLC, 2nd CAN, integrated TPMS, CAN Gateway, and 4S/4M configurations deployed on commercial vehicles. Successful exploitation could disable safety-critical functions including ABS, steering assist, speedometer, and automatic gear shifting. No public exploit has been identified at time of analysis; the flaw was disclosed by CISA ICS-CERT.

HCL BigFix Quantum Risk Analyzer's binary executable lacks multiple industry-standard binary hardening protections, leaving it susceptible to a stack-based buffer overflow (CWE-121). The vulnerability requires local access with high privileges and high attack complexity, yielding a CVSS score of 3.9 (Low). No public exploit code has been identified at the time of analysis, and the combination of local-only access, elevated privilege requirements, and high exploitation complexity significantly constrains real-world risk despite the theoretical severity of a stack overflow primitive.

Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.

Stack-based buffer overflow in GNOME Dia diagram editor (0.98.0 and earlier) permits stack exhaustion and potential return-address corruption when a victim opens a crafted .dia XML file containing a Bus object with an attacker-controlled bus_handles value and then moves a handle in the diagram. The root cause - an unbounded g_alloca() call driven by an unvalidated file attribute - is also present in objects/Misc/tree.c via Tree objects, widening the attack surface. No public exploit or CISA KEV listing exists at time of analysis, but the GitLab issue provides sufficient technical detail for proof-of-concept development.

Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact.

Remote code execution within the Chrome sandbox is possible in Google Chrome prior to 152.0.7977.65 via a stack-based buffer overflow in the V8 JavaScript engine, triggered by a crafted HTML page visited by an unpatched user. The vulnerability requires no authentication or elevated privileges from the victim - only that they visit an attacker-controlled page - and achieves arbitrary code execution within Chrome's renderer sandbox. No public exploit has been identified at time of analysis, and EPSS at 0.39% (31st percentile) indicates low current exploitation probability despite the 8.8 CVSS score; notably, Google's own internal severity rating is Medium, reflecting the sandbox containment.

Stack-based buffer overflow in Adobe Substance 3D Sampler enables arbitrary code execution in the context of the logged-in user. Exploitation is triggered by opening a specially crafted file, making this a file-parsing attack delivered through phishing or malicious asset distribution targeting 3D artists and designers. No public exploit code or active exploitation has been identified at time of analysis, though full confidentiality, integrity, and availability impact makes this a meaningful risk for affected users.

Stack-based buffer overflow in SKYSEA Client View and SKYMEC IT Manager (SKY Co., Ltd.) enables an authenticated attacker to remotely execute arbitrary code on other Windows hosts running the same software via crafted UDP packets. The vulnerability functions as a lateral movement primitive: an attacker who has already obtained a login on one managed endpoint can exploit the product's UDP listener on any other reachable managed host, without requiring further interaction from the target. Reported by JPCERT/CC via JVN#JVN33423625, no public exploit or CISA KEV listing has been identified at the time of analysis.

Stack-based out-of-bounds write in OpenEXR's HTJ2K decode path allows remote attackers to crash applications that process crafted EXR image files. Affected are OpenEXR versions 3.4.0 through 3.4.13, where the vendored OpenJPH AVX2 decoder fails to reject JPEG 2000 SIZ marker geometries in which the first tile does not intersect the visible image, leading to invalid codeblock computation and a stack memory corruption that terminates the process. No public exploit identified at time of analysis; a vendor-released patch is available in version 3.4.14.

Stack-based buffer overflow in the SpaceDot AcubeSAT On-Board Computer (OBC) software allows remote unauthenticated attackers to crash the OBC by sending a crafted ECSS Telecommand (TC) message to the loadRawData function. The vulnerability, traced to commit eaf90ec, results in availability loss only - no confidentiality or integrity impact is indicated. No public exploit code or active exploitation has been confirmed; EPSS sits at 0.14% (4th percentile), consistent with the niche, mission-specific deployment footprint of this software.

Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.

Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. Publicly available exploit code exists and the flaw was reported by VulnCheck; CVSS 4.0 base is 9.3 (AV:N/AC:L/PR:N/UI:N), but no active exploitation (CISA KEV) is confirmed.

Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks.

Stack-based buffer overflow in UTT HiPER 1250GW firmware (≤ 3.2.7-210907-180535) exposes the device to remote code execution via a crafted HTTP request to the `/goform/aspRemoteApConfTempSend` endpoint. The unsafe `strcpy()` call processing the `Profile` parameter allows a low-privileged remote attacker to overwrite stack memory, with full confidentiality, integrity, and availability impact on both the device and downstream network systems per the CVSS 4.0 subsequent-system metrics. A public proof-of-concept is confirmed on GitHub; no public exploitation confirmed in CISA KEV at time of analysis.

Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET&section=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.

Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.

Stack-based buffer overflow in TP-Link TL-MR6400 v7 firmware update functionality enables an authenticated, adjacent-network attacker to achieve arbitrary code execution on the affected device. The flaw (CWE-121) arises from unsafe parsing of attacker-controlled metadata embedded in a firmware image, leading to memory corruption at the stack level. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is further constrained by requirements for high-privilege access (PR:H) and network adjacency (AV:A).

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 arises from a stack-based buffer overflow (CWE-121) that a remote attacker can trigger without authentication or user interaction, yielding total compromise of these Power-based enterprise Unix and virtualization-management systems. The CVSS 9.8 rating reflects a fully remote, low-complexity path to arbitrary code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low (0.61%, 47th percentile), indicating no observed widespread exploitation yet despite the critical severity.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.

Remote unauthenticated code execution is possible in swift-nio-ssh, Apple's Swift implementation of the SSH2 protocol built on SwiftNIO, where a single crafted SSH message triggers an out-of-bounds stack write of attacker-controlled length and content. Any server or client application built on swift-nio-ssh before 0.14.1 is affected, and an attacker can corrupt stack memory pre-authentication to potentially achieve arbitrary code execution. No public exploit identified at time of analysis, and despite the maximal 9.8 CVSS the EPSS probability is currently low (0.14%, 4th percentile).

Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege web management credentials to achieve arbitrary code execution on the device. The vulnerable function sub_44B50C, reachable via the CGI endpoint `/cgi-bin/mbox-config?method=SET&section=ptest_channel`, fails to bounds-check user-supplied input before copying it onto the stack. A public proof-of-concept exploit is available on GitHub (https://github.com/AdminSafe/CVE/issues/7), significantly lowering the barrier to exploitation; no CISA KEV listing has been identified at the time of analysis.

Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables remote attackers to crash or corrupt processes that use the library's DNS handling functions. The dnsname_to_labels() function in evdns.c mishandles the boundary check when writing DNS labels into a 64KB stack buffer - the terminating null byte is written one position past the allocated buffer to buf[buf_len] whenever a name-bearing record aligns precisely at the boundary. Any application embedding libevent's evdns module and querying an attacker-influenced DNS server is in scope; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitrary code by supplying an oversized SSID value to the device's CGI configuration endpoint. The vulnerable function sub_44B438, reachable via /cgi-bin/mbox-config?method=SET&section=ptest_ssid, performs no bounds checking on the ssid argument before copying it onto the stack. A public proof-of-concept exploit has been released on GitHub, and no vendor patch has been identified at time of analysis.

Stack-based buffer overflow in GIMP 3.2.2's TIF file parser enables remote attackers to execute arbitrary code in the context of the current user process. Exploitation requires the target to open a specially crafted TIF image file, making this a socially-engineered attack delivered via malicious webpage or email attachment. Reported by the Zero Day Initiative (ZDI-26-456/ZDI-CAN-29399), a fix commit has been pushed to the upstream GNOME GitLab repository, though no independently confirmed patched release version is available at time of analysis.

Stack-based buffer overflow in GStreamer's OGG file parsing component allows remote attackers to execute arbitrary code in the context of the current process. Affected installations of GStreamer fail to validate the length of user-supplied data before copying it to a stack-based buffer during OGG container parsing, enabling full code execution (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, though it was discovered and disclosed by the Zero Day Initiative (ZDI-CAN-29584), which typically indicates a reliable, well-researched finding.

Wireshark's C12.22 protocol dissector crashes via a stack-based buffer overflow when processing malformed C12.22 packets, enabling unauthenticated remote denial of service against versions 4.4.0-4.4.18 and 4.6.0-4.6.7. An attacker who can inject crafted C12.22 traffic into a live capture session - or supply a malicious PCAP file - can crash the analyzer process, blinding the analyst to network activity. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in available intelligence.

Stack-based buffer overflow in TRENDnet TEW-755AP firmware (up to build 20260702) allows remote low-privileged attackers to corrupt stack memory via the cameo.wan.wan_pppoe_password_00 parameter in /cgi-bin/wan.cgi. A public proof-of-concept exploit script is confirmed on GitHub, materially lowering the bar for exploitation. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability on both the device and downstream network systems, though no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.

Stack-based buffer overflow in TRENDnet TEW-755AP firmware (versions up to 20260702) allows remote low-privileged attackers to corrupt the stack in the /sbin/mycli binary by supplying an oversized ssid argument to function FUN_401000, potentially enabling arbitrary code execution on the device. A public Python proof-of-concept (poc-mycli-overflow.py) is available on GitHub, materially elevating practical risk beyond the theoretical score. No vendor-released patch has been identified at time of analysis, leaving affected devices without an official remediation path.

Stack-based buffer overflow in TRENDnet TV-IP751WIC firmware 11.03.03 allows remote low-privileged attackers to achieve arbitrary code execution by sending a crafted value in the Currenttime parameter to the /cgi-bin/admin/set_time.cgi endpoint handled by the alphapd daemon. The CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability for both the compromised device and subsequent systems in its network segment. A public proof-of-concept exploit script is confirmed available on GitHub, though this vulnerability is not currently listed in the CISA KEV catalog.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows remote authenticated attackers to execute arbitrary code on affected systems. The flaw (CWE-121) is reachable over the network with low attack complexity and requires only low-privilege credentials, yielding complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.8 CVSS score and confirmed RCE potential make patching urgent for organizations running IBM POWER infrastructure.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run arbitrary code by triggering a stack-based buffer overflow, per the vendor-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N. IBM (the reporting party) has published a fix, and no public exploit identified at time of analysis. EPSS and KEV signals were not provided, so the 9.8 CVSS score is currently the strongest available severity indicator.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote authenticated attackers to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 score reflects low-complexity network exploitation requiring only low-privilege authentication (PR:L), making it accessible to any credentialed user on the system. No public exploit identified at time of analysis, but a vendor-released patch is available from IBM.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow (CWE-121) that a network attacker can trigger without authentication or user interaction. Because the flaw carries a CVSS 9.8 with an AV:N/AC:L/PR:N/UI:N vector, a successful attack yields full compromise of confidentiality, integrity, and availability on affected enterprise UNIX hosts and virtualization I/O servers. There is no public exploit identified at time of analysis, and IBM (the reporter) has released a fix.

Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service-level access holders to crash the firmware boot stack with possible memory corruption during system initialization, impacting integrity and availability of the managed Power system. Affected firmware spans three release trains: FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283238.

Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. No public exploit identified at time of analysis; IBM has released a fix and reported the issue itself.

Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP management network protocol. An attacker holding authenticated HMC administrator credentials and adjacent-network access to the management interface can trigger the overflow to execute arbitrary code on the Flexible Service Processor, achieving full out-of-band control over all managed hardware and hosted workloads. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the vendor has released a patch.

Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access to the Baseboard Management Controller (BMC), exploiting a stack-based buffer overflow (CWE-121) in the BMC-to-host communication interface. Affected firmware versions FW1120.00 and FW1110.00 through FW1110.30 are vulnerable; successful exploitation yields full control over the host system and all hosted logical partitions (LPARs), resulting in complete confidentiality, integrity, and availability compromise across all co-located workloads. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog; IBM has released a remediation patch via advisory at https://www.ibm.com/support/pages/node/7283220.

Stack-based buffer overflow in IBM Server Firmware's FSP firmware update process allows an authenticated administrator with adjacent network access to execute arbitrary code on the Flexible Service Processor, fully compromising the server management plane across confidentiality, integrity, and availability. Affected firmware spans four major release trains (FW950 through FW1120) deployed on IBM Power Systems servers. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, but the complete C:H/I:H/A:H impact profile makes patching a priority for any organization where FSP admin credentials or management network access could be shared or compromised.

Stack-based buffer overflow in IBM Power Firmware's host firmware configuration parser allows an attacker with service-level access to the BMC/FSP to supply specially crafted configuration data, triggering CWE-121 during the firmware boot stage and compromising the entire software stack loaded thereafter. Affected firmware spans multiple major release trains - FW1120, FW1110, FW1060, FW950, and OP940 - covering Power9 and Power HMC managed systems. No public exploit has been identified at the time of analysis, and a vendor patch is available from IBM.

Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.

Stack buffer overflow in FFmpeg's MPEG-PS muxer (libavformat/mpegenc.c) enables arbitrary code execution when processing crafted media input containing more streams than the muxer's fixed-size stack buffer can accommodate. Affected is all FFmpeg before commit 9d786e4; exploitation requires the victim to mux attacker-controlled input using the MPEG-PS output format, making this a file-processing attack rather than a remote network vulnerability. No public exploit code has been identified at time of analysis, but the patch commit and PR #24087 are publicly accessible, lowering the barrier for independent reproduction.

Stack-based buffer overflow in Wazuh's wazuh-authd enrollment daemon (versions 4.5.0 through 4.14.5 and 5.0.0-beta1) allows unauthenticated remote attackers to crash the service by sending a crafted nine-byte version string in the enrollment 'V:' field, triggering unsafe stack memory reads and a null byte write into adjacent stack frames. The vulnerable code path in compare_wazuh_versions() is reachable before authentication over TCP port 1515 when anonymous TLS enrollment is enabled, resulting in a denial of service against the agent enrollment service. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor-released patches are available in versions 4.14.6 and 5.0.0-beta2.

Stack buffer overflow in the FreeBSD iconv(3) ISO-2022 encoding modules allows a 4-byte out-of-bounds write when converting untrusted text to or from certain ISO-2022 variants. The affected code sizes an intermediate output buffer to MB_LEN_MAX (6 bytes), but some ISO-2022 variants emit up to 10 bytes per character, overflowing the stack. It affects FreeBSD 14.3, 14.4, 15.0, and 15.1 release branches before the fixed patch levels; there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%).

Stack-based buffer overflow in FreeBSD's libalias RTSP handler exposes NAT gateways to kernel-level or root-level remote code execution from hosts inside the NAT perimeter. The RTSP protocol rewriter copies rewritten packet data into a fixed-size stack buffer with no length validation, allowing a crafted RTSP stream to overflow that buffer. When NAT is implemented via ipfw(4), exploitation can yield kernel code execution; when using natd(8), the impact is RCE in a process typically running as root. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attackers corrupt memory by supplying oversized width/height values to the get_para_from_uri routine of the /cgi-bin/mbox-config endpoint. Because the flaw is reachable over the network with no authentication or user interaction (CVSS 4.0 base 10.0), a successful write can crash the device or achieve arbitrary code execution on the embedded firmware. It is not listed in CISA KEV and no productized exploit is confirmed, though a VulDB-referenced GitHub repository (1ChaoRen1/IOT_3) appears to document the finding.

Stack-based buffer overflow in UTT HiPER 1250GW firmware (versions through 3.2.7-210907-180535) allows remote, low-privilege authenticated attackers to execute arbitrary code by submitting an oversized pvid argument to the /goform/aspApBasicConfigUrcp HTTP handler endpoint. The vulnerable strcpy() call performs no bounds checking, enabling stack memory corruption including return address overwrite. A public proof-of-concept exploit is available on GitHub, and the CVSS 4.0 subsequent-system impact metrics (SC:H/SI:H/SA:H) indicate a compromised gateway can affect the confidentiality, integrity, and availability of downstream networked systems.

Stack-based buffer overflow in UTT HiPER 1200GW firmware through version 2.5.3-170306 enables remote code execution via a crafted timestart parameter submitted to the /goform/formGroupConfig endpoint. The root cause is an unbounded strcpy() call (CWE-121) in the formGroupConfig handler that overwrites stack memory without validating input length. A public proof-of-concept exploit has been published to GitHub, and the CVSS 4.0 score of 8.6 with high impact across both the vulnerable device and subsequent network systems underscores the potential for network-wide compromise through this gateway appliance.

Remote stack-based buffer overflow in the embedded nginx binary (/usr/nginx/sbin/nginx) of the TRENDnet TEW-WLC100 wireless LAN controller, firmware 1v2.07b01, lets remote attackers overflow a fixed-size stack buffer in the HTTP Server-header handling routine FUN_0040da4c. Reported through VulDB with a public proof-of-concept exploit already available, the flaw carries a CVSS 4.0 base score of 9.3 and, per its vector, requires no authentication or user interaction. There is no public exploit identified as being used in active attacks - only a POC exists - but the combination of a network-reachable overflow and released exploit code makes this a high-priority patching candidate.

Stack-based buffer overflow in the DHCP blobmsg handler within /sbin/netifd on TRENDnet TEW-WLC100P firmware 12.07b01 allows unauthenticated adjacent-network attackers to execute arbitrary code with no user interaction required. A working proof-of-concept Python exploit script has been publicly released on GitHub, materially lowering the skill threshold for exploitation. No CISA KEV listing exists at time of analysis and no vendor patch has been identified, leaving affected devices exposed with only network-level compensating controls available.

Stack-based buffer overflow in Notepad++ before version 8.9.7 enables local code execution or process termination through the Run Dialog's variable expansion routine. The `expandNppEnvironmentStrs` function copies Notepad++ variable names from `$(...)` syntax into a fixed-size `wchar_t str[MAX_PATH]` stack buffer without bounding the loop index `m`, allowing any variable name of 260 or more wide characters to corrupt adjacent stack memory and trigger `__report_gsfailure` or, with precise crafting, execute arbitrary code. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack memory and achieve arbitrary code execution or denial of service by sending a single crafted UDP datagram containing more than 15 ACF-CAN messages. The root cause is an unbounded write index in the avtp_to_can() function, which increments unconditionally past the end of a fixed 15-slot stack array without comparing against the caller-supplied size. Exploitation requires no authentication because the ACF-CAN listener accepts packets from any sender matching a hardcoded stream identifier transmitted in plaintext; no public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.

Remote unauthenticated denial-of-service in INDI indiserver through 2.2.4.2 allows any attacker with TCP access to port 7624 to crash the daemon with a single malformed packet. The vulnerability stems from an unbounded sprintf() call writing XML error messages into a fixed 1024-byte stack buffer in MsgQueue.cpp - sending mismatched XML tags whose names exceed that boundary overflows the stack frame and terminates the process, immediately disconnecting all active astronomical instrument drivers and client sessions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack primitive is trivially constructible given the deterministic overflow path confirmed in the patch diff.

Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. Publicly available exploit code exists (disclosed via VulDB with a PoC report), but there is no public exploit identified as actively exploited in the wild, and no CISA KEV listing.

Remote code execution in the Tenda W20E router firmware V16.01.0.6(2782) lets unauthenticated network attackers overflow a stack buffer and run arbitrary code on the device. The flaw is explicitly an incomplete fix for the earlier CVE-2025-44867 and CVE-2026-36819, meaning the same code path remains exploitable despite prior patch attempts. A public vulnerability-disclosure repository exists, but the issue is not in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no confirmed widespread exploitation yet.

Stack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution against the device by submitting an oversized PPPoE username to the WAN configuration endpoint. Low-privilege authenticated attackers with network access to the management interface can exploit the `pppUserName` parameter in `/goform/formWanTcpipSetup` to overwrite stack memory and gain arbitrary code execution on the device. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving the device with no available patch.

Stack-based buffer overflow in DefaultFuction's Customer-Relationship-Management-In-C-Project 2.0 exposes authenticated remote attackers to arbitrary code execution or application crash by supplying oversized input to the Customer Search Module's unsafe `gets()` call. A public proof-of-concept exploit is available on GitHub, and the project maintainer has acknowledged the issue is only 'being processed,' meaning no patch has been released. The vulnerability is not listed in CISA KEV, but the combination of network accessibility, low access complexity, and public exploit code makes it a credible risk in any environment running this software.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attackers to corrupt stack memory and potentially execute arbitrary code by sending a crafted value in the IPMacBindRule argument to the /goform/addIpMacBind endpoint. The vulnerable function ipMacBindListStore fails to validate input length before writing to a fixed-size stack buffer (CWE-121). Publicly available exploit code exists, raising active risk for any deployment where the web management interface is reachable and low-privilege credentials are obtainable.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attackers to execute arbitrary code by submitting a malformed qosIndex parameter to the /goform/delQos endpoint. The vulnerable formQOSRuleDel function fails to validate input length before writing to a fixed-size stack buffer in the QoS Rule Deletion component. A public proof-of-concept exploit is confirmed available on GitHub, significantly elevating real-world risk for any deployment with the management interface reachable by untrusted parties.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers to execute arbitrary code by supplying an oversized qosListConnecttedNum argument to the lstAdd function via the /goform/editQos endpoint. The vulnerability affects the QoS Edit component of this SOHO router and carries high impact across confidentiality, integrity, and availability - consistent with full device takeover. A publicly available proof-of-concept exploit exists on GitHub, meaningfully elevating operational urgency despite the absence of CISA KEV confirmation.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis.

Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows low-privileged remote attackers to corrupt stack memory by sending a crafted `staticRouteNet` argument to the `/goform/module` endpoint, potentially enabling arbitrary code execution on the device. All firmware versions up to and including build 20260625 are confirmed affected. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk; however, no CISA KEV listing has been identified, indicating active exploitation is not yet confirmed at scale.

Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows network-adjacent or remote authenticated attackers to corrupt stack memory by supplying an oversized value to the portMirrorMirroredPorts argument of the formSetPortMirror function at the /goform/module endpoint. All G0 firmware builds through 20260625 are confirmed affected per EUVD-2026-58575 and NVD CPE data. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation; no CISA KEV listing has been identified, so active widespread exploitation is not confirmed at time of analysis.

Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interface to remote code execution via a crafted guest WiFi configuration request. The vulnerable function `set_wl_guest_iplist` at the `/goform/WifiGuestSet` endpoint fails to validate the length of the `shareSpeed` argument before copying it onto a fixed-size stack buffer, enabling an attacker with low-privilege router access to overwrite the return address and seize control of the `httpd` process - which typically runs as root on embedded router firmware. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the barrier to exploitation; no CISA KEV listing is present, so confirmed active exploitation in the wild is not established at time of analysis.

Stack-based buffer overflow in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01 allows a remotely authenticated attacker to overflow a fixed-size stack buffer in the `set_device_name` function by sending an excessively long `devName` value to the `/goform/SetOnlineDevName` endpoint of the httpd web management interface. Successful exploitation could yield arbitrary code execution on the device with the privileges of the httpd process. A public proof-of-concept exploit has been published on GitHub, elevating real-world risk despite the absence of a CISA KEV listing.

Stack buffer overflow in PostgreSQL's argument name matching logic allows a database object creator to crash backend processes and achieve low integrity impact by supplying a crafted OUT parameter count. Affected are all active major branches: versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. No public exploit or CISA KEV listing has been identified at time of analysis; however, the constrained-write nature of the overflow (limited to 0x0 and 0x1 bytes) caps realistic impact at availability loss rather than arbitrary code execution, making this a high-priority patch rather than an emergency incident response trigger.

Wireshark versions 4.6.0 through 4.6.7 contain a stack-based buffer overflow (CWE-121) in the Gammu DCT3 trace file parser that allows denial of service via application crash. Exploitation is constrained to local file-based attack scenarios requiring a user to open a specially crafted DCT3 trace file, with high attack complexity adding further real-world friction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a stack buffer (CWE-121), affecting Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on all listed platforms. Successful exploitation can crash the database engine or lead to code execution in the Db2 server process, yielding total loss of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as 'none'.

Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the context of the user who opens the dialog. The flaw is triggered when a DSN configuration containing an over-length file path is loaded into the setup dialog and a file or folder selection is initiated, due to an incorrect buffer capacity calculation in that handler. No public exploit exists and no CISA KEV listing is present; however, a confirmed vendor-released patch is available in v1.4.9, which clamps DSN path field sizes.

Remote code execution in IBM Informix Dynamic Server 14.10, 12.10.x, and 15.0 is possible through a stack-based buffer overflow (CWE-121) in the oninit daemon's sq_sgkprepare function, triggered when processing a SQL interface request containing an unchecked length field. An authenticated, network-adjacent attacker with low-privilege SQL credentials can exploit this to achieve full compromise of the database server, resulting in complete confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; IBM has released a patch via Security Advisory 7283143.

Stack-based buffer overflow in the WAD (Web Application Detection) daemon of Fortinet FortiOS 7.6.1-7.6.6, FortiProxy across multiple 7.x branches, and FortiPAM across numerous 1.x releases enables remote unauthenticated code execution in the daemon's context. Exploitation requires a non-default but operationally plausible configuration - explicit proxy with both Kerberos authentication and SOCKS enabled - and additionally demands the attacker defeat stack protection and ASLR. A proof-of-concept exploit is confirmed by the CVSS temporal metric (E:P) and an official fix is available (RL:O). Active exploitation has not been confirmed by CISA KEV at time of analysis.

Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.

Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.

Stack-based buffer overflow in Microsoft Office Excel enables local arbitrary code execution when a user opens a specially crafted file. The vulnerability (CWE-121) carries a CVSS 7.8 High score, with high confidentiality, integrity, and availability impact upon successful exploitation. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis.

Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a crafted file. The vulnerability (CWE-121) is triggered through user interaction with malicious content, requiring no privileges on the target system beyond access to run Excel. No public exploit code or CISA KEV listing is identified at time of analysis, though the high-impact CVSS 7.8 score reflects full compromise of confidentiality, integrity, and availability upon successful exploitation.

Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution on the victim's local machine when a specially crafted Excel file is opened. The vulnerability carries a CVSS base score of 7.8 with high confidentiality, integrity, and availability impact, affecting the victim's user-level security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, reducing immediacy compared to actively exploited file-format parsing flaws.

Stack-based buffer overflow in Microsoft Office enables local arbitrary code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation is local and requires user interaction - most likely triggered by opening a maliciously crafted Office file delivered via phishing or other social engineering. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the high-impact triad (C:H/I:H/A:H) and Microsoft Office's ubiquitous deployment footprint make this a notable patching priority.