Stack-based Buffer Overflow

Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.

Stack buffer overflow in FFmpeg's MPEG-PS muxer (libavformat/mpegenc.c) enables arbitrary code execution when processing crafted media input containing more streams than the muxer's fixed-size stack buffer can accommodate. Affected is all FFmpeg before commit 9d786e4; exploitation requires the victim to mux attacker-controlled input using the MPEG-PS output format, making this a file-processing attack rather than a remote network vulnerability. No public exploit code has been identified at time of analysis, but the patch commit and PR #24087 are publicly accessible, lowering the barrier for independent reproduction.

Stack-based buffer overflow in Wazuh's wazuh-authd enrollment daemon (versions 4.5.0 through 4.14.5 and 5.0.0-beta1) allows unauthenticated remote attackers to crash the service by sending a crafted nine-byte version string in the enrollment 'V:' field, triggering unsafe stack memory reads and a null byte write into adjacent stack frames. The vulnerable code path in compare_wazuh_versions() is reachable before authentication over TCP port 1515 when anonymous TLS enrollment is enabled, resulting in a denial of service against the agent enrollment service. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; vendor-released patches are available in versions 4.14.6 and 5.0.0-beta2.

Stack buffer overflow in the FreeBSD iconv(3) ISO-2022 encoding modules allows a 4-byte out-of-bounds write when converting untrusted text to or from certain ISO-2022 variants. The affected code sizes an intermediate output buffer to MB_LEN_MAX (6 bytes), but some ISO-2022 variants emit up to 10 bytes per character, overflowing the stack. It affects FreeBSD 14.3, 14.4, 15.0, and 15.1 release branches before the fixed patch levels; there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%).

Stack-based buffer overflow in FreeBSD's libalias RTSP handler exposes NAT gateways to kernel-level or root-level remote code execution from hosts inside the NAT perimeter. The RTSP protocol rewriter copies rewritten packet data into a fixed-size stack buffer with no length validation, allowing a crafted RTSP stream to overflow that buffer. When NAT is implemented via ipfw(4), exploitation can yield kernel code execution; when using natd(8), the impact is RCE in a process typically running as root. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attackers corrupt memory by supplying oversized width/height values to the get_para_from_uri routine of the /cgi-bin/mbox-config endpoint. Because the flaw is reachable over the network with no authentication or user interaction (CVSS 4.0 base 10.0), a successful write can crash the device or achieve arbitrary code execution on the embedded firmware. It is not listed in CISA KEV and no productized exploit is confirmed, though a VulDB-referenced GitHub repository (1ChaoRen1/IOT_3) appears to document the finding.

Stack-based buffer overflow in UTT HiPER 1250GW firmware (versions through 3.2.7-210907-180535) allows remote, low-privilege authenticated attackers to execute arbitrary code by submitting an oversized pvid argument to the /goform/aspApBasicConfigUrcp HTTP handler endpoint. The vulnerable strcpy() call performs no bounds checking, enabling stack memory corruption including return address overwrite. A public proof-of-concept exploit is available on GitHub, and the CVSS 4.0 subsequent-system impact metrics (SC:H/SI:H/SA:H) indicate a compromised gateway can affect the confidentiality, integrity, and availability of downstream networked systems.

Stack-based buffer overflow in UTT HiPER 1200GW firmware through version 2.5.3-170306 enables remote code execution via a crafted timestart parameter submitted to the /goform/formGroupConfig endpoint. The root cause is an unbounded strcpy() call (CWE-121) in the formGroupConfig handler that overwrites stack memory without validating input length. A public proof-of-concept exploit has been published to GitHub, and the CVSS 4.0 score of 8.6 with high impact across both the vulnerable device and subsequent network systems underscores the potential for network-wide compromise through this gateway appliance.

Remote stack-based buffer overflow in the embedded nginx binary (/usr/nginx/sbin/nginx) of the TRENDnet TEW-WLC100 wireless LAN controller, firmware 1v2.07b01, lets remote attackers overflow a fixed-size stack buffer in the HTTP Server-header handling routine FUN_0040da4c. Reported through VulDB with a public proof-of-concept exploit already available, the flaw carries a CVSS 4.0 base score of 9.3 and, per its vector, requires no authentication or user interaction. There is no public exploit identified as being used in active attacks - only a POC exists - but the combination of a network-reachable overflow and released exploit code makes this a high-priority patching candidate.

Stack-based buffer overflow in the DHCP blobmsg handler within /sbin/netifd on TRENDnet TEW-WLC100P firmware 12.07b01 allows unauthenticated adjacent-network attackers to execute arbitrary code with no user interaction required. A working proof-of-concept Python exploit script has been publicly released on GitHub, materially lowering the skill threshold for exploitation. No CISA KEV listing exists at time of analysis and no vendor patch has been identified, leaving affected devices exposed with only network-level compensating controls available.

Stack-based buffer overflow in Notepad++ before version 8.9.7 enables local code execution or process termination through the Run Dialog's variable expansion routine. The `expandNppEnvironmentStrs` function copies Notepad++ variable names from `$(...)` syntax into a fixed-size `wchar_t str[MAX_PATH]` stack buffer without bounding the loop index `m`, allowing any variable name of 260 or more wide characters to corrupt adjacent stack memory and trigger `__report_gsfailure` or, with precise crafting, execute arbitrary code. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Stack buffer overflow in COVESA Open1722 through version 0.9.2 enables unauthenticated remote attackers to corrupt stack memory and achieve arbitrary code execution or denial of service by sending a single crafted UDP datagram containing more than 15 ACF-CAN messages. The root cause is an unbounded write index in the avtp_to_can() function, which increments unconditionally past the end of a fixed 15-slot stack array without comparing against the caller-supplied size. Exploitation requires no authentication because the ACF-CAN listener accepts packets from any sender matching a hardcoded stream identifier transmitted in plaintext; no public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.

Remote unauthenticated denial-of-service in INDI indiserver through 2.2.4.2 allows any attacker with TCP access to port 7624 to crash the daemon with a single malformed packet. The vulnerability stems from an unbounded sprintf() call writing XML error messages into a fixed 1024-byte stack buffer in MsgQueue.cpp - sending mismatched XML tags whose names exceed that boundary overflows the stack frame and terminates the process, immediately disconnecting all active astronomical instrument drivers and client sessions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack primitive is trivially constructible given the deterministic overflow path confirmed in the patch diff.

Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. Publicly available exploit code exists (disclosed via VulDB with a PoC report), but there is no public exploit identified as actively exploited in the wild, and no CISA KEV listing.

Remote code execution in the Tenda W20E router firmware V16.01.0.6(2782) lets unauthenticated network attackers overflow a stack buffer and run arbitrary code on the device. The flaw is explicitly an incomplete fix for the earlier CVE-2025-44867 and CVE-2026-36819, meaning the same code path remains exploitable despite prior patch attempts. A public vulnerability-disclosure repository exists, but the issue is not in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no confirmed widespread exploitation yet.

Stack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution against the device by submitting an oversized PPPoE username to the WAN configuration endpoint. Low-privilege authenticated attackers with network access to the management interface can exploit the `pppUserName` parameter in `/goform/formWanTcpipSetup` to overwrite stack memory and gain arbitrary code execution on the device. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving the device with no available patch.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attackers to corrupt stack memory and potentially execute arbitrary code by sending a crafted value in the IPMacBindRule argument to the /goform/addIpMacBind endpoint. The vulnerable function ipMacBindListStore fails to validate input length before writing to a fixed-size stack buffer (CWE-121). Publicly available exploit code exists, raising active risk for any deployment where the web management interface is reachable and low-privilege credentials are obtainable.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attackers to execute arbitrary code by submitting a malformed qosIndex parameter to the /goform/delQos endpoint. The vulnerable formQOSRuleDel function fails to validate input length before writing to a fixed-size stack buffer in the QoS Rule Deletion component. A public proof-of-concept exploit is confirmed available on GitHub, significantly elevating real-world risk for any deployment with the management interface reachable by untrusted parties.

Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers to execute arbitrary code by supplying an oversized qosListConnecttedNum argument to the lstAdd function via the /goform/editQos endpoint. The vulnerability affects the QoS Edit component of this SOHO router and carries high impact across confidentiality, integrity, and availability - consistent with full device takeover. A publicly available proof-of-concept exploit exists on GitHub, meaningfully elevating operational urgency despite the absence of CISA KEV confirmation.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.

Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis.

Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows low-privileged remote attackers to corrupt stack memory by sending a crafted `staticRouteNet` argument to the `/goform/module` endpoint, potentially enabling arbitrary code execution on the device. All firmware versions up to and including build 20260625 are confirmed affected. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk; however, no CISA KEV listing has been identified, indicating active exploitation is not yet confirmed at scale.

Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows network-adjacent or remote authenticated attackers to corrupt stack memory by supplying an oversized value to the portMirrorMirroredPorts argument of the formSetPortMirror function at the /goform/module endpoint. All G0 firmware builds through 20260625 are confirmed affected per EUVD-2026-58575 and NVD CPE data. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation; no CISA KEV listing has been identified, so active widespread exploitation is not confirmed at time of analysis.

Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interface to remote code execution via a crafted guest WiFi configuration request. The vulnerable function `set_wl_guest_iplist` at the `/goform/WifiGuestSet` endpoint fails to validate the length of the `shareSpeed` argument before copying it onto a fixed-size stack buffer, enabling an attacker with low-privilege router access to overwrite the return address and seize control of the `httpd` process - which typically runs as root on embedded router firmware. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the barrier to exploitation; no CISA KEV listing is present, so confirmed active exploitation in the wild is not established at time of analysis.

Stack-based buffer overflow in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01 allows a remotely authenticated attacker to overflow a fixed-size stack buffer in the `set_device_name` function by sending an excessively long `devName` value to the `/goform/SetOnlineDevName` endpoint of the httpd web management interface. Successful exploitation could yield arbitrary code execution on the device with the privileges of the httpd process. A public proof-of-concept exploit has been published on GitHub, elevating real-world risk despite the absence of a CISA KEV listing.

Stack buffer overflow in PostgreSQL's argument name matching logic allows a database object creator to crash backend processes and achieve low integrity impact by supplying a crafted OUT parameter count. Affected are all active major branches: versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. No public exploit or CISA KEV listing has been identified at time of analysis; however, the constrained-write nature of the overflow (limited to 0x0 and 0x1 bytes) caps realistic impact at availability loss rather than arbitrary code execution, making this a high-priority patch rather than an emergency incident response trigger.

Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a stack buffer (CWE-121), affecting Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on all listed platforms. Successful exploitation can crash the database engine or lead to code execution in the Db2 server process, yielding total loss of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as 'none'.

Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the context of the user who opens the dialog. The flaw is triggered when a DSN configuration containing an over-length file path is loaded into the setup dialog and a file or folder selection is initiated, due to an incorrect buffer capacity calculation in that handler. No public exploit exists and no CISA KEV listing is present; however, a confirmed vendor-released patch is available in v1.4.9, which clamps DSN path field sizes.

Remote code execution in IBM Informix Dynamic Server 14.10, 12.10.x, and 15.0 is possible through a stack-based buffer overflow (CWE-121) in the oninit daemon's sq_sgkprepare function, triggered when processing a SQL interface request containing an unchecked length field. An authenticated, network-adjacent attacker with low-privilege SQL credentials can exploit this to achieve full compromise of the database server, resulting in complete confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; IBM has released a patch via Security Advisory 7283143.

Stack-based buffer overflow in Fortinet FortiOS, FortiProxy, and FortiPAM allows unauthenticated remote attackers to execute arbitrary code or commands within the WAD (Web Application Daemon) process via crafted sockets - but only on devices where the explicit proxy is simultaneously configured with Kerberos authentication and SOCKS enabled. Exploitation further requires defeating stack canary protection and ASLR, elevating real-world attack complexity well above the raw CVSS base score implies. No public exploit or active exploitation has been confirmed; Fortinet PSIRT published advisory FG-IR-26-161 disclosing the issue.

Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.

Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.

Stack-based buffer overflow in Microsoft Office Excel enables local arbitrary code execution when a user opens a specially crafted file. The vulnerability (CWE-121) carries a CVSS 7.8 High score, with high confidentiality, integrity, and availability impact upon successful exploitation. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis.

Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a crafted file. The vulnerability (CWE-121) is triggered through user interaction with malicious content, requiring no privileges on the target system beyond access to run Excel. No public exploit code or CISA KEV listing is identified at time of analysis, though the high-impact CVSS 7.8 score reflects full compromise of confidentiality, integrity, and availability upon successful exploitation.

Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution on the victim's local machine when a specially crafted Excel file is opened. The vulnerability carries a CVSS base score of 7.8 with high confidentiality, integrity, and availability impact, affecting the victim's user-level security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, reducing immediacy compared to actively exploited file-format parsing flaws.

Stack-based buffer overflow in Microsoft Office enables local arbitrary code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation is local and requires user interaction - most likely triggered by opening a maliciously crafted Office file delivered via phishing or other social engineering. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the high-impact triad (C:H/I:H/A:H) and Microsoft Office's ubiquitous deployment footprint make this a notable patching priority.

Stack-based buffer overflow in Microsoft Office Access enables a local unauthenticated attacker to achieve arbitrary code execution when a victim opens a specially crafted Access database file. Affected products span Microsoft Access 2016 (32-bit and 64-bit), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit has been identified at time of analysis, and a vendor-released patch is available through the Microsoft Security Response Center.

Stack-based buffer overflow in Microsoft Office Access enables local code execution with high impact across confidentiality, integrity, and availability. Affected products span Microsoft Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - all at version 16.0.x or 19.0.x prior to the patched releases. An attacker who can deliver a malicious Access file and induce a local user to open it can achieve arbitrary code execution in the context of that user. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Stack-based buffer overflow in Microsoft Office Word enables local arbitrary code execution when a user opens a maliciously crafted document. Affected products span Word 2016 through Microsoft 365 Apps for Enterprise and LTSC 2021/2024 on both Windows and macOS. No public exploit identified at time of analysis, but Microsoft has released patches across all affected product lines via the August 2026 security update cycle.

Stack-based buffer overflow in Microsoft Office Word enables arbitrary code execution when a victim opens a specially crafted document, affecting Word 2016 through Microsoft 365 Apps and Office LTSC 2024 on both Windows and macOS. The flaw (CWE-121) scores CVSS 7.8 with high impacts across confidentiality, integrity, and availability, constrained by local attack vector and mandatory user interaction. No public exploit has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.

Stack-based buffer overflow in Microsoft Office (CWE-121) enables local code execution across a broad range of affected builds including Office 2016, 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, LTSC for Mac 2021/2024, and Microsoft 365 Apps for Enterprise. Exploitation requires user interaction - consistent with a maliciously crafted document delivery model - and achieves full confidentiality, integrity, and availability compromise within the Office process context. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via the MSRC advisory.

Remote code execution in the Windows DNS component allows an unauthenticated network attacker to run arbitrary code by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Microsoft platforms from Windows 10 1607/1809 through Windows Server 2012 to Server 2025, including Server Core installations, and carries a CVSS 9.8 rating with no required privileges or user interaction. Microsoft has shipped fixes; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.

Stack-based buffer overflow in Microsoft's Remote Desktop Client (mstsc.exe) enables remote code execution on unpatched Windows 10 1607 and Windows Server 2012/2016 systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no attacker privileges, but demands that a victim actively connect to an attacker-controlled RDP server - a meaningful but achievable social-engineering hurdle. Microsoft has released patches for all affected version branches; no public exploit identified at time of analysis.

Remote code execution via a stack-based buffer overflow in the Windows kernel TCP/IP driver (CWE-121) affects all major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An unauthenticated remote attacker who can deliver crafted TCP/IP packets to an exposed system may gain kernel-level code execution without requiring user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, though the kernel-mode attack surface and network-accessible delivery make this a high-priority patching target; Microsoft has released patches for all affected platforms.

Stack-based buffer overflow in Windows Installer enables local privilege escalation across a wide range of Microsoft Windows desktop and server editions. An authenticated low-privileged local user can exploit the flaw (CWE-121) to achieve SYSTEM-level code execution, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and broad affected surface spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025 make this a high-priority patching target.

Stack-based buffer overflow in the Windows DHCP Client service enables a low-privileged local attacker to elevate privileges to SYSTEM level with full confidentiality, integrity, and availability impact. The flaw spans virtually every supported Windows desktop and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad in any environment where interactive or local logon access is possible. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches via the standard update guide.

Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.

Stack-based code execution in Simcenter Nastran allows an attacker who can supply maliciously crafted string arguments to an affected application binary to overflow a stack buffer and execute arbitrary code within the running process context. All versions of Siemens' finite-element analysis solver prior to V2606 are affected, as confirmed by Siemens ProductCERT advisory SSA-069220. No public exploit code has been identified and this vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Stack-based buffer overflow in libril_sem.so - Samsung's Radio Interface Layer shared library - enables privileged local attackers to execute arbitrary code on affected Samsung Mobile Devices prior to SMR Aug-2026 Release 1. The CVSS 4.0 vector (AV:L/PR:H) confirms exploitation requires established local access with high privileges, limiting the realistic attacker pool to already-compromised or insider-threat scenarios. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in UTT HiPER 1200GW firmware (versions up to 2.5.3-170306) enables authenticated remote attackers to corrupt stack memory via the EncryptionMode parameter in the PPTP VPN configuration endpoint, potentially achieving arbitrary code execution on the device. The root cause is unsafe use of strcpy() without bounds validation in the /goform/pptpSrvGlobalConfig handler. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis. No public exploit identified at time of analysis as KEV, but POC lowers the practical exploitation barrier significantly.

Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially corrupt memory on affected Cisco Secure Endpoint deployments. The root cause is a faulty endian conversion in the GPT parser that writes out-of-bounds on the stack (CWE-121), reachable by any attacker who can submit a file for scanning - a condition met by default in mail gateway, web proxy, and endpoint deployments. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means exploitation requires no special access and is trivially automatable.

Stack buffer overflow in rxi's microtar C library allows memory corruption when an application archives files with attacker-influenced names longer than 99 characters. The mtar_write_file_header() and mtar_write_dir_header() functions use an unbounded strcpy() into a fixed 100-byte stack buffer, so any calling program that feeds externally-controlled filenames into these APIs is exposed to potential code execution or crash. No public exploit identified at time of analysis, and the library is not listed in CISA KEV, but the missing length check is trivially reachable in code that tars user-supplied paths.

Stack-based buffer overflow in tinyobjloader-c's MTL material file parser allows an attacker who can supply a crafted 3D asset to corrupt the call stack of any application that loads it, potentially achieving arbitrary code execution. All versions of syoyo/tinyobjloader-c are affected because the only bounds guard in tinyobj_parse_and_index_mtl_file() is an assert() call that compiles to a no-op under -DNDEBUG - the standard flag for release builds - leaving memcpy(linebuf, p, p_len) completely unchecked. The identical vulnerable pattern is duplicated in a second function in the same header file, and no vendor-released patch has been identified at time of analysis. No public exploit code and no CISA KEV listing have been identified.

Stack-based buffer overflow in Domoticz's MochadTCP component allows an unauthenticated attacker on the local network to corrupt the Domoticz worker thread's stack and potentially achieve arbitrary code execution. The MochadTCP::MatchLine() handler in hardware/MochadTCP.cpp uses strcpy() to copy up to 1028 bytes of network-received data into a fixed 50-byte stack buffer (tempRFSECbuf) across three separate device-type branches, with no length validation whatsoever. No CISA KEV listing and no public exploit code have been identified at time of analysis; exploitation requires adjacency to the Domoticz host's network and benefits from the complete absence of authentication on port 1099.

Stack-based buffer overflow in Apache Lucy (all versions) enables potential arbitrary code execution through crafted input triggering memory corruption in the retired C-based search library. All versions are affected with no patch planned, as the Apache Software Foundation has officially retired the project. No public exploit or active exploitation has been identified at time of analysis, but the absence of any future fix makes this a permanent unresolved risk for any remaining deployments.

Stack-based buffer overflow in UTT HiPER 1200GW firmware up to v2.5.3-170306 enables network-reachable authenticated attackers to corrupt stack memory and achieve arbitrary code execution on the device. The vulnerable C runtime function strcpy in the web management endpoint /goform/ConfigAdvideo performs no bounds validation on the timestart HTTP parameter, allowing oversized input to overwrite return addresses and redirect execution flow. A public proof-of-concept exploit is available on GitHub; no vendor patch exists as UTT did not respond to the coordinated disclosure.

Stack-based buffer overflow in the UTT HiPER 1250GW firmware (all versions up to v3.2.7-210907-180535) allows authenticated remote attackers to corrupt stack memory via the tempName argument of the /goform/getOneApConfTempEntry endpoint, with potential for arbitrary code execution on the device. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path available. No CISA KEV listing exists, but the PoC availability combined with an unpatched network device significantly elevates practical risk for any exposed management interface.

Stack-based buffer overflow in UTT HiPER 1250GW firmware (all versions through 3.2.7-210907-180535) enables low-privileged remote attackers to corrupt stack memory and achieve arbitrary code execution by submitting an oversized value to the cipher parameter of the /goform/APSecurity_5g endpoint. A public proof-of-concept exploit is available on GitHub, materially increasing opportunistic abuse risk. No vendor patch exists - the vendor failed to respond to responsible disclosure - leaving no fix-based remediation path at time of analysis.

Stack-based buffer overflow in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 allows a remote unauthenticated attacker to crash worker processes by exploiting the watcherinfo XML generation path in the presence module. The attacker sends a SIP SUBSCRIBE with a From URI exceeding 200 characters, establishing an oversized watcher entry, then triggers presence.winfo generation to overflow a fixed-size stack buffer in create_winfo_xml() within notify.c. No public exploit has been identified at time of analysis, but the unauthenticated network vector and straightforward two-step attack path make this a credible denial-of-service risk for any SIP infrastructure exposing presence services.

Stack-based buffer overflow in Systerel S2OPC 1.7.3 enables remote denial of service against OPC UA client applications. A malicious or compromised OPC UA server can send a crafted DeleteMonitoredItemsResponse message that triggers an overflow in LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems within the client_wrapper state machine, crashing the client process. No public exploit or active exploitation has been identified at time of analysis, though source code references confirm the vulnerable code path exists in the published repository.

Remote code execution and denial of service in OpenSIPS SIP server (versions 4.0.0 and prior) arises from a stack buffer overflow in the sip_to_json() function, where an attacker-controlled SIP header name longer than 255 bytes is memcpy'd into a fixed 255-byte stack buffer. Because both the length and content of the overwrite are attacker-controlled, a single unauthenticated UDP packet to SIP port 5060 can crash the process or, on builds lacking stack protections, hijack the saved return address for RCE. No public exploit identified at time of analysis; the issue was not fixed at publication, making this an unpatched flaw affecting any deployment whose routing script invokes sip_to_json().

Remote code execution in Keysight IxChariot Endpoint and related Keysight network-test products (Hawkeye, IxTap, IxProbe, IxBypass) allows an unauthenticated attacker to run arbitrary code with administrative privileges by sending a single specially crafted packet. The flaw is a classic stack-based buffer overflow reachable over the network with no user interaction (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the trivial attack complexity and lack of any authentication make it a high-priority patch for any environment running these test tools.

Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.

Stack-based buffer overflow in Autodesk FBX SDK's fbxsdk::ExtractDrive function allows arbitrary code execution in the context of the current process when a user opens a maliciously crafted FBX file. Any application embedding the FBX SDK for 3D asset import - including game engines, VFX pipelines, and CAD tools - inherits this attack surface, making the blast radius broader than the SDK itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS score (7.8) and RCE primitive make this a priority for organizations ingesting untrusted 3D content.

Stack-based buffer overflow in Autodesk FBX SDK's binary file parser allows arbitrary code execution when a user opens a maliciously crafted FBX file. The vulnerable function `fbxsdk::FbxIO::BinaryReadSectionHeader` fails to properly bound-check attacker-controlled data from binary section headers, overflowing the call stack and enabling control-flow hijacking in the context of the host process. Any application embedding the affected SDK version - including Autodesk DCC tools and third-party game engine editors - is exposed when users import FBX assets from untrusted sources; no public exploit or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear.

Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis.

Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis.

Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.

Remote code execution via stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's Cookie parsing logic affects all firmware versions prior to 2.8.5.1, exploitable by unauthenticated network attackers when the SafeEnhancement feature is enabled. The vulnerability (CWE-121) allows arbitrary code execution on the edge controller, an OT/IIoT device typically deployed in industrial automation environments. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the industrial attack surface warrants heightened concern due to the operational consequences of device compromise. Notably, the provided CVSS vector (C:H/I:N/A:N) is inconsistent with the described code execution impact - a discrepancy that should be verified with the vendor.

Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge controllers is possible through a stack-based buffer overflow in the device's log message handling functionality, exploitable by unauthenticated network attackers on versions prior to 2.8.5.1. Reported by the Cyber Security Agency of Singapore (CSA), the vulnerability carries a CWE-121 classification - a well-understood root cause class with a history of weaponizable exploits, particularly in embedded and OT/ICS devices. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the network-accessible, unauthenticated nature of the flaw and the industrial deployment context elevate operational risk above what the percentile alone suggests.

Stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's password handling routine enables unauthenticated remote code execution when the SafeEnhancement feature is active. All firmware versions prior to 2.8.5.1 are affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface on an industrial IoT edge device warrants prompt patching given OT environment exposure.

Stack-based buffer overflow in the Tenda W6-S wireless router (firmware 1.0.0.4(510)) lets remote attackers corrupt stack memory by sending oversized 'GO' and 'index' parameters to the /goform/wifiSSIDset endpoint, where the formwrlSSIDset handler copies them into a fixed 64-byte buffer via unbounded sprintf. Successful exploitation can crash the device or achieve arbitrary code execution with full impact to confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a detailed technical write-up, though there is no public exploit identified as weaponized and no confirmed active exploitation.

Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.

Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution and denial-of-service in the TP-Link TL-WR940N v6 router stem from a stack-based buffer overflow in the kernel-resident RTSP connection-tracking (ALG) module. An attacker who lures a LAN-side client into connecting to an attacker-controlled RTSP server can send a crafted RTSP message that the router's kernel helper mishandles, potentially yielding full device compromise. The flaw is exploitable by an unauthenticated attacker against the router's default configuration; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Remote code execution in Xlight FTP Server versions before 3.9.5 allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets once an AES-GCM cipher is negotiated during the SSH/SFTP handshake. An unvalidated length field is passed directly to the GCM decrypt routine, overwriting the stack cookie and saved return address before any authentication occurs, potentially yielding code execution as the FTP service. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the pre-auth, network-reachable nature makes it a high priority.

Denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) lets remote attackers crash the proxy by sending crafted input to the uri_signing or url_sig plugins, which recurse or copy unbounded data onto the stack until it is exhausted (CWE-121 stack-based buffer overflow). Only deployments that have loaded and enabled one of these URL-signing plugins are exposed; the impact is availability-only, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor CVSS 4.0 score of 8.2 reflects easy unauthenticated network reach against affected edge nodes.

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Stack-based buffer overflow and integer overflow in Apache Traffic Server's regex_remap plugin expose production proxy deployments to high-impact compromise via crafted substitution input. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are all affected, with confidentiality, integrity, and availability fully at risk. No public exploit identified at time of analysis, though the network-exploitable nature and full-triad impact make patching urgent for any deployment relying on regex_remap for URL rewriting.

Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).

Denial-of-service (and potential memory corruption) in Apache Traffic Server affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 when redirect following is enabled. The proxy copies the client-supplied Host header into a fixed-size stack buffer without bounds checking during redirect handling, so an over-long Host header overflows the stack and crashes the process. There is no public exploit identified at time of analysis, and the vendor-assessed impact is limited to availability (CVSS 4.0 base 8.2).

Denial-of-service

Remote denial of service in ESP32-audioI2S 3.4.5 allows unauthenticated network attackers to crash ESP32 devices by sending crafted MP3 audio data that triggers a buffer overflow in the UnpackFrameHeader() function. Public proof-of-concept code is available, enabling automated exploitation. The vulnerability does not impact confidentiality or integrity.

Remote code execution and credential exfiltration in Snowflake libsnowflakeclient versions before 2.9.2 stem from three distinct flaws in the C client library: a stack-based buffer overflow (CWE-121) and an out-of-bounds write in the file-download path, plus improper validation of connection parameters. A lower-privileged principal sharing an internal stage can plant a file with crafted encryption metadata that corrupts memory in a higher-privileged victim process, while the connection-parameter flaw can redirect outbound authentication requests carrying credentials and tokens to an attacker endpoint. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the vendor fixed all issues in 2.9.2, which users must manually install.