By weakness (CWE)

CWE-681: related vulnerabilities

CVEs classified under CWE-681. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-45258HIGH 7.8

  A memory validation flaw in FreeBSD's audio device driver allows unprivileged users to bypass security boundaries and access kernel memory. The `/dev/dsp` device—typically world-readable—permits any local user to exploit an integer overflow in the memory mapping validation logic, enabling them to read and modify kernel data, escalate privileges, or crash the system. The vulnerability exists because the kernel checks an arithmetic sum that can wrap around, making the overflow check unreliable.

• CVE-2026-53133HIGH 7.8

  A memory addressing bug in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem can cause incorrect DMA addresses to be calculated when handling large memory blocks. The vulnerability occurs during the reassembly of scattered memory pages into contiguous blocks for I/O operations, particularly when block sizes exceed 4 GB. An unprivileged local user with the ability to perform RDMA operations can potentially read or modify sensitive memory regions or trigger a denial of service.

• CVE-2026-53923HIGH 7.5

  vLLM, a popular inference engine for large language models, contains a memory leak vulnerability in how it processes quantized model weights. When the system allocates GPU memory for output tensors, a mathematical error causes the processing kernel to only fill part of the allocated space, leaving the remainder untouched. In shared multi-user deployments, this unfilled memory may contain sensitive inference data from other users' requests—potentially exposing prompts, model outputs, or intermediate computations. The flaw affects all versions from 0.5.5 through 0.23.0, and is resolved in version 0.23.1rc0 and later.

• CVE-2026-53466MEDIUM 6.5

  ImageMagick, a widely-used image editing and manipulation library, contains an integer overflow flaw in its XCF (GIMP native format) decoder. When processing a specially crafted XCF file, the overflow can trigger an out-of-bounds memory read, potentially crashing the application. The vulnerability affects ImageMagick versions before 6.9.13-51 and 7.1.2-26. While the immediate risk is denial of service through application crashes, the out-of-bounds read could theoretically expose sensitive information from adjacent memory regions.

• CVE-2026-9143LOW 3.7

  CVE-2026-9143 is a numeric type conversion flaw in NI grpc-device that can silently truncate size values when they exceed the range of their target data type. The vulnerability stems from missing validation checks in the code generation layer. When a size value is too large for the target type, high bits are discarded without warning, potentially causing the service to operate on incorrect or undersized buffers. The issue affects NI grpc-device version 2.17.0 and earlier.