By weakness (CWE)

CWE-787: related vulnerabilities

CVEs classified under CWE-787. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

210 published vulnerabilities · page 1 of 3

• CVE-2026-0146HIGH 8.8

  CVE-2026-0146 is a memory safety defect in Android's video codec processing layer that permits an authenticated attacker to write data beyond allocated buffer boundaries. The vulnerability resides in metadata parsing during video decoding and requires no user interaction—an attacker with local system privileges can trigger malicious video streams to overwrite kernel or system memory, potentially executing arbitrary code with elevated permissions. The absence of bounds validation on a critical parsing function creates a direct path from untrusted video input to kernel-level code execution.

• CVE-2026-0147HIGH 8.8

  CVE-2026-0147 is a memory safety vulnerability in Android's MFC (Media Framework Component) that allows an authenticated attacker to write data beyond allocated buffer boundaries. The flaw resides in metadata parsing logic and can be exploited remotely without user interaction to execute arbitrary code. This is a serious vulnerability because it bridges the gap between standard user privileges and full system compromise through a relatively straightforward attack path.

• CVE-2026-0148HIGH 8.8

  A flaw in Android's video decoding component allows an attacker with basic network access and valid user credentials to execute arbitrary code on a device without requiring any additional privileges or user interaction. The vulnerability stems from improper handling of numeric values during video stream processing, which can cause the system to write data beyond intended memory boundaries. This is a critical remote code execution risk affecting the media processing pipeline.

• CVE-2026-0149HIGH 8.8

  CVE-2026-0149 is a heap buffer overflow vulnerability in Android's RTP (Real-time Transport Protocol) session handling code. An attacker with local network access and basic authentication credentials can send a specially crafted RTCP packet that causes the RtpSendRtcpPacket function to write beyond allocated memory boundaries. This out-of-bounds write allows arbitrary code execution with the privileges of the affected process, requiring no user interaction or additional escalation. The vulnerability affects authenticated attackers on the same network as the target device.

• CVE-2026-0151HIGH 8.8

  A vulnerability in Google Android's graphics interface code allows an attacker with basic authentication credentials to remotely trigger an out-of-bounds memory write by sending a specially crafted input that causes an integer overflow. The flaw leads directly to remote code execution without requiring any elevated privileges or user interaction. Attackers can exploit this over a network to gain unauthorized code execution on affected devices.

• CVE-2026-0161HIGH 8.8

  A vulnerability exists in Android's RTP (Real-time Transport Protocol) session handling that allows an authenticated attacker to write data beyond the bounds of allocated memory. An integer overflow in the numberOfReportBlocks function causes a buffer to be undersized, enabling an attacker to corrupt memory and gain elevated privileges on the device. The attack requires valid credentials but no special user interaction, making it a practical concern in environments where network access is partially restricted.

• CVE-2026-0164HIGH 8.8

  A flaw in Android's Modem component allows an attacker with network access and valid system privileges to write data beyond allocated memory boundaries, potentially leading to remote code execution. The vulnerability requires no user interaction and does not need elevated execution privileges to trigger, making it a serious concern for devices that expose modem access to network-facing services.

• CVE-2026-10883HIGH 8.8

  A type confusion vulnerability in Google Chrome's ANGLE graphics library allows attackers to corrupt heap memory through specially crafted web pages. The flaw requires user interaction (visiting a malicious site) but can lead to complete system compromise—confidentiality, integrity, and availability are all at risk. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-10897HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the GPU rendering engine handles certain HTML constructs. An attacker can craft a malicious web page that, when visited by a user, exploits this flaw to break out of Chrome's security sandbox—the isolation layer that normally prevents malicious code from accessing the underlying operating system. This is a serious issue because sandbox escapes give attackers direct access to your computer's resources, files, and credentials.

• CVE-2026-10907HIGH 8.8

  A memory safety vulnerability in Google Chrome's ANGLE rendering library allows an attacker to craft a malicious webpage that, when visited by a user, could corrupt the browser's memory heap. This out-of-bounds write flaw can lead to code execution with the privileges of the user running Chrome. The vulnerability requires user interaction—someone must visit the compromised or attacker-controlled page—but needs no special browser configuration or user permissions to trigger the exploit.

• CVE-2026-10941HIGH 8.8

  A memory access vulnerability in the Skia graphics engine used by Google Chrome allows attackers to run malicious code within Chrome's sandbox by tricking users into visiting a specially crafted webpage. The attack requires user interaction (clicking a link or visiting a site) but needs no special privileges. While the code runs in a sandbox environment, successful exploitation could compromise data confidentiality, integrity, and availability within that isolated context.

• CVE-2026-11091HIGH 8.8

  A flaw in Google Chrome's graphics rendering engine (Dawn) allows attackers to trick users into visiting malicious web pages that can read sensitive data, modify files, or crash the browser. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted website—but once triggered, it bypasses Chrome's memory protections. This affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11173HIGH 8.8

  A memory writing vulnerability in Google Chrome's V8 JavaScript engine (used to execute web code) allows a specially crafted webpage to trigger an out-of-bounds write operation. An attacker who has already compromised the browser's rendering process can exploit this flaw to break out of the sandbox and run arbitrary code with the privileges of the Chrome process. This requires an attacker to first gain control of the renderer, making it a post-compromise escalation vector rather than a direct entry point.

• CVE-2026-11933HIGH 8.8

  MongoDB Server contains a use-after-free vulnerability in its server-side JavaScript engine when processing BSON documents. An authenticated user with read access who can execute server-side JavaScript code—through operators like $where or $function—can trigger the server to read memory that has already been freed. This can leak sensitive data from the mongod process or crash the server entirely.

• CVE-2026-13033HIGH 8.8

  A memory safety vulnerability in Google Chrome's interest groups feature allows attackers to read and write data outside intended memory boundaries. An attacker can craft a malicious HTML page that, when visited by a user, triggers the flaw to execute arbitrary code on the victim's machine. The vulnerability affects Chrome versions before 149.0.7827.197 and is classified as critical by Chrome's security team.

• CVE-2026-14087HIGH 8.8

  A heap buffer overflow vulnerability exists in the WebNN (Web Neural Network) component of Google Chrome on Windows systems. The flaw allows a remote attacker who has already compromised the Chrome renderer process to trigger heap memory corruption by crafting a malicious HTML page. While Chromium classifies this as low severity, the CVSS 3.1 assessment reflects the potential for significant impact if exploited, including confidentiality, integrity, and availability violations.

• CVE-2026-14385HIGH 8.8

  A heap buffer overflow vulnerability exists in the ANGLE graphics rendering component within Google Chrome on macOS. An attacker can exploit this by hosting a malicious HTML page—when a user visits the page, Chrome's rendering engine writes data beyond allocated memory boundaries, potentially compromising the confidentiality, integrity, and availability of the browser process. This is a remote attack requiring no special privileges, though it does require user interaction (visiting a crafted page).

• CVE-2026-14395HIGH 8.8

  Google Chrome versions before 150.0.7871.46 contain an out-of-bounds write vulnerability in the V8 JavaScript engine that allows attackers to run malicious code within the browser's sandbox. An attacker can exploit this by crafting a malicious HTML page and tricking a user into visiting it. Once triggered, the vulnerability permits arbitrary code execution inside the sandboxed environment. While the sandbox provides a containment boundary, successful exploitation still represents a serious security risk.

• CVE-2026-14422HIGH 8.8

  A memory safety vulnerability exists in Chrome's Tint rendering component that allows attackers to read and write beyond allocated memory boundaries. When a user visits a malicious website, the attacker can craft HTML that triggers out-of-bounds memory access, potentially compromising confidentiality, integrity, and availability. The vulnerability requires user interaction (visiting a malicious page) but no special privileges, making it a significant risk for typical browsing scenarios.

• CVE-2026-15114HIGH 8.8

  A memory safety vulnerability in Google Chrome's video codec processing allows attackers to corrupt heap memory by tricking users into opening a specially crafted video file. The flaw combines an out-of-bounds read with an out-of-bounds write, potentially enabling arbitrary code execution on affected systems. Users must update to Chrome 150.0.7871.115 or later to patch the issue.

• CVE-2026-34195HIGH 8.8

  A vulnerability in GPU sparse memory handling allows non-privileged applications to trigger out-of-bounds memory writes in the kernel through carefully crafted API calls. An attacker with local user access can exploit this to read sensitive kernel data, modify kernel state, or cause a denial of service. The flaw stems from incorrect indexing logic during sparse memory allocation remapping, a graphics subsystem operation that manages virtual-to-physical memory mapping for GPU resources.

• CVE-2026-42985HIGH 8.8

  A use-after-free memory vulnerability exists in Microsoft's Remote Desktop Client and related Windows components. An attacker can trigger this flaw over the network by sending specially crafted packets, potentially gaining code execution on a victim's machine without requiring prior authentication. User interaction is needed for successful exploitation.

• CVE-2026-44421HIGH 8.8

  FreeRDP, an open-source Remote Desktop Protocol client, contains a memory safety flaw that can be exploited by a malicious RDP server. When a FreeRDP client connects to an attacker-controlled server with graphics acceleration enabled, the attacker can send specially crafted network packets that trigger a heap buffer overflow during graphics operations. This memory corruption can crash the client or potentially allow remote code execution on the user's machine. The vulnerability requires user interaction (initiating an RDP connection) but does not require authentication, making it a practical attack vector against organizations that rely on remote desktop functionality.

• CVE-2026-47653HIGH 8.8

  A use-after-free vulnerability in Microsoft's Remote Desktop Client allows an attacker to execute arbitrary code on a victim's computer over the network. The attacker does not need valid credentials, but the user must interact with the application (such as clicking a link or opening a file) for the attack to succeed. This is a serious flaw affecting many versions of Windows 10, Windows 11, and Windows Server editions.

• CVE-2026-48095HIGH 8.8

  7-Zip, the widely used file compression utility, contains a critical flaw in how it handles NTFS compressed disk images. When a specially crafted image is opened—even with an innocuous file extension—the application miscalculates memory buffer sizes, leading to a situation where attackers can write massive amounts of data into a tiny allocated space. This memory corruption can overwrite the application's internal control structures, giving attackers the ability to execute arbitrary code on the affected system. Versions 26.00 and earlier are vulnerable; version 26.01 and later have been patched.

• CVE-2026-56340HIGH 8.8

  vLLM, a popular open-source framework for large language model inference, contains a validation gap in how it handles tensor data for multimodal embeddings. Versions 0.10.2 through 0.12.x fail to properly validate tensor indices when the prompt-embeddings feature is active. An authenticated attacker can send specially crafted embedding requests with invalid tensor indices (negative or out-of-bounds values) to crash the service, exhaust resources, or potentially corrupt memory. This is a follow-up to an earlier vulnerability (CVE-2025-62164) where the fix only disabled the feature by default rather than validating the input itself.

• CVE-2026-7838HIGH 8.8

  UltraVNC viewer versions through 1.8.2.2 contain a critical memory corruption flaw in how they parse error messages from VNC servers. When a malicious or compromised server sends a specially crafted error message during the initial connection phase, the viewer attempts to read far more data than it allocated, overwriting adjacent heap memory. An attacker can exploit this without any valid credentials, potentially executing arbitrary code on the user's machine. The vulnerability occurs before authentication succeeds, making it exploitable by hostile servers or network intermediaries.

• CVE-2026-8461HIGH 8.8

  FFmpeg's MagicYUV video decoder contains a flaw that allows an attacker to write data outside the boundaries of an allocated memory region. When exploited, this can crash the application (denial-of-service) or potentially allow the attacker to execute arbitrary code on the victim's system. The vulnerability is triggered when processing specially crafted video files, and requires user interaction—specifically, the victim must open or process the malicious file. All FFmpeg versions before 8.1.2 are affected.

• CVE-2026-8915HIGH 8.8

  A critical buffer overflow vulnerability exists in Samsung's Escargot JavaScript engine that allows an attacker to write data beyond the boundaries of allocated memory. The vulnerability can be triggered through user interaction (such as opening a malicious webpage or file) and could lead to complete system compromise, including unauthorized data access, system modification, and denial of service. This is a high-severity issue affecting the open-source Escargot project at commit 36f5fb58366a67b713c02f6fd985e924fcc09e31.

• CVE-2026-9879HIGH 8.8

  A memory safety bug in Chrome's graphics rendering engine (ANGLE) allows attackers to write data outside of allocated memory boundaries. An attacker can craft a malicious HTML page that, when opened in vulnerable versions of Chrome, triggers this out-of-bounds write to execute arbitrary code on the user's system. The vulnerability requires user interaction—specifically, the victim must visit or be directed to the malicious webpage—but no special privileges are needed and the attack works over the network.

• CVE-2026-9896HIGH 8.8

  A flaw in Google Chrome's V8 JavaScript engine allows attackers to write data outside intended memory boundaries. By crafting a malicious HTML page, an attacker can trigger arbitrary code execution within Chrome's sandbox. The vulnerability requires user interaction—the victim must visit or be directed to a malicious website—but no special privileges are needed. Chrome versions prior to 148.0.7778.216 are affected across Windows, macOS, and Linux platforms.

• CVE-2026-9910HIGH 8.8

  A memory safety bug in Google Chrome's graphics engine (ANGLE) allows an attacker to run malicious code within Chrome's sandbox by sending a specially crafted web page to a victim. The vulnerability requires user interaction—specifically visiting a malicious webpage—but no special privileges. Once triggered, an attacker could read sensitive data, modify browser state, or crash the application. This affects Chrome on Windows, macOS, and Linux.

• CVE-2026-9965HIGH 8.8

  A memory vulnerability in Google Chrome's ANGLE graphics library allows attackers to corrupt heap memory through a specially crafted webpage. When a user visits a malicious site, the attacker can trigger an out-of-bounds write operation that overwrites data beyond intended memory boundaries. This could lead to arbitrary code execution with the privileges of the browser process. The vulnerability requires user interaction (visiting a malicious page) but is otherwise trivial to deliver via normal web browsing.

• CVE-2026-9973HIGH 8.8

  CVE-2026-9973 is a memory corruption vulnerability in Google Chrome's V8 JavaScript engine that allows attackers to run malicious code within the browser's sandbox by hosting a specially crafted HTML page. An attacker would need to trick a user into visiting the malicious site, but once there, the flaw provides a direct path to arbitrary code execution. Chrome versions before 148.0.7778.216 are vulnerable.

• CVE-2026-10643HIGH 8.7

  A flaw in Zephyr's network socket handling allows a local attacker to write beyond the boundary of a caller-supplied buffer when receiving network packets with ancillary data (control messages). The vulnerability stems from incomplete validation of buffer size before writing packet information metadata. An attacker with local user privileges can trigger this by receiving a specially crafted packet, potentially corrupting memory and gaining elevated permissions or crashing the system. The issue affects Zephyr versions 3.6.0 through 4.4.0.

• CVE-2026-54410HIGH 8.6

  nanoMODBUS versions up to and including v1.23.0 contain a critical flaw in how the Modbus/TCP server processes incoming network messages. An attacker can send a specially crafted message that causes the application to write data one byte beyond the intended buffer boundary. On systems without memory protection—common in embedded and real-time environments—this overflow can crash the service, leak sensitive data, or allow unauthorized writes to device registers. No authentication is required; an attacker on the network can exploit this remotely.

• CVE-2026-58049HIGH 8.6

  FFmpeg's RASC video decoder contains a flaw that allows memory corruption when processing specially crafted video files. The decoder reads and writes data at incorrect memory locations before properly checking boundaries, and miscalculates region sizes in a way that permits access beyond allocated buffer space. An attacker can craft a malicious video file that, when decoded, writes to and reads from memory outside intended bounds, potentially enabling code execution or system compromise.

• CVE-2026-45461HIGH 8.4

  A use-after-free memory flaw in Microsoft Office could allow an attacker with local access to run malicious code on your system with the same privileges as the logged-in user. The vulnerability requires no special permissions or user interaction beyond having access to the machine, making it a serious risk in environments where multiple users or untrusted software might run on the same device.

• CVE-2026-45472HIGH 8.4

  Microsoft Office contains a use-after-free memory vulnerability that allows an attacker with local access to execute arbitrary code without requiring special user privileges or interaction. This is a serious flaw because it affects multiple versions of Office across both subscription (Microsoft 365) and perpetual licensing models. The vulnerability stems from improper memory management when handling certain Office objects, creating a window where freed memory is accessed, potentially leading to full system compromise.

• CVE-2026-45474HIGH 8.4

  A use-after-free vulnerability in Microsoft Office allows an attacker to execute arbitrary code on a local system without requiring user interaction or special privileges. This is a memory safety issue where the application references memory that has already been freed, potentially enabling complete system compromise through malicious Office documents or crafted input.

• CVE-2026-10925HIGH 8.3

  A memory corruption flaw exists in the Skia graphics library within Google Chrome on macOS. An attacker who has already compromised Chrome's renderer process can exploit this out-of-bounds write to break out of the browser sandbox and gain system-level access. The attack requires user interaction (visiting a malicious webpage) but bypasses Chrome's primary security boundary once the renderer is under attacker control.

• CVE-2026-11672HIGH 8.3

  A heap buffer overflow vulnerability exists in the GPU component of Google Chrome on Android versions prior to 149.0.7827.103. An attacker who has already compromised Chrome's renderer process can exploit this flaw through a specially crafted HTML page to escape the browser sandbox and gain higher privileges on the device. This is a post-compromise escalation vector that requires the renderer to be compromised first.

• CVE-2026-12019HIGH 8.3

  A heap buffer overflow vulnerability exists in Google Chrome's codec handling on Linux and ChromeOS. An attacker who has already compromised Chrome's renderer process—the sandboxed component that processes web content—could exploit this flaw to break out of the sandbox and gain elevated privileges on the system. The vulnerability requires user interaction (visiting a malicious webpage) and is triggered through a specially crafted HTML page. Chrome versions prior to 149.0.7827.115 are affected.

• CVE-2026-14400HIGH 8.3

  A memory writing flaw in Google Chrome's ANGLE graphics library allows an attacker who has already compromised the renderer process to escape the browser sandbox and gain broader system access. The attacker would need to serve a specially crafted webpage, but exploitation requires the renderer to be compromised first. Chrome versions before 150.0.7871.46 are affected.

• CVE-2026-58592HIGH 8.3

  Ladybird, a web browser engine, has a memory-safety vulnerability in how it handles WebAssembly modules imported through the ESM (ECMAScript Modules) standard. When JavaScript code imports a WebAssembly function, the browser temporarily creates a function descriptor on the stack. If that descriptor is destroyed before the WebAssembly code finishes using it, the WebAssembly code ends up holding a reference to memory that's no longer valid. An attacker can exploit this stale reference to make the WebAssembly code write data to arbitrary memory locations, potentially achieving code execution within the browser's content process. The flaw requires user interaction (clicking or otherwise engaging with a malicious web page) to trigger, but no special browser features need to be enabled.

• CVE-2026-9889HIGH 8.3

  A memory safety vulnerability in Google Chrome's graphics rendering engine (Dawn) on Android devices allows an attacker to read and write memory outside intended boundaries. By crafting a malicious HTML page, a remote attacker could potentially escape the Chrome sandbox and gain elevated system privileges. This requires user interaction—the victim must visit the malicious page—but poses a critical threat to Android users.

• CVE-2026-9900HIGH 8.3

  A memory safety bug in Chrome's graphics rendering engine (ANGLE) allows attackers to write data outside allocated memory bounds. If an attacker can compromise Chrome's renderer process—the part that displays web content—they can exploit this flaw to break out of Chrome's sandbox and gain full system access. This requires both process compromise and a user to visit a malicious page, but the consequences are severe.

• CVE-2026-9906HIGH 8.3

  Google Chrome versions prior to 148.0.7778.216 contain a memory safety flaw in GPU processing that could allow an attacker with control of the browser's renderer process to break out of the sandbox and gain system-level access. The attack requires the renderer to already be compromised and the user to visit a malicious webpage, but success would bypass Chrome's primary security boundary.

• CVE-2026-9916HIGH 8.3

  A memory safety flaw exists in the ANGLE graphics library component of Google Chrome. An attacker who has already compromised the browser's renderer process could exploit this out-of-bounds write to break out of the browser sandbox and gain system-level access. Exploitation requires the attacker to deliver a crafted HTML page and needs user interaction to trigger. The vulnerability affects Chrome versions before 148.0.7778.216.

• CVE-2026-9974HIGH 8.3

  CVE-2026-9974 is a memory safety bug in Google Chrome's GPU rendering component that can allow an attacker to escape the browser's sandbox if they first compromise the renderer process. The vulnerability stems from an out-of-bounds write operation, meaning the code writes data outside its intended memory boundaries. An attacker would need to trick a user into visiting a malicious webpage while already having control of Chrome's renderer, making this a secondary exploit that amplifies damage from other browser compromises.

• CVE-2026-9975HIGH 8.3

  A memory safety vulnerability in Google Chrome's ANGLE graphics library allows an attacker who has already compromised the browser's renderer process to break out of Chrome's sandbox and gain full system access. The flaw involves reading and writing memory beyond intended boundaries, creating a bridge from the restricted renderer environment to the host operating system. This requires the attacker to first successfully compromise the renderer (through a separate browser exploit or vulnerability) and then craft a malicious HTML page to trigger the escape.

• CVE-2021-4478HIGH 8.2

  Dräger CC-Vision Basic (versions before 7.5.3) and Dräger CC-Vision E-Cal (versions before 7.2.5.0) are vulnerable to a buffer overflow when processing specially crafted .gdt files. An attacker can create a malicious file that, when opened by a user, causes the application to crash or potentially execute arbitrary code on the system. The vulnerability requires user interaction—someone must open the malicious file—but does not require elevated privileges to trigger.

• CVE-2026-12292HIGH 8.1

  A boundary condition flaw in Firefox and Thunderbird's Web Audio component allows attackers to corrupt memory through specially crafted content. The vulnerability requires user interaction—such as visiting a malicious webpage or opening a hostile document—but once triggered, it can lead to information disclosure or arbitrary code execution. Mozilla has released patches across all affected product lines.

• CVE-2026-2674HIGH 8.1

  RTI Connext Professional contains an out-of-bounds write vulnerability affecting three key components: the Queueing Service, Core Libraries, and Persistence Service. An authenticated attacker can send a crafted message over the network to trigger a buffer overflow, potentially corrupting memory and causing a denial of service or allowing code execution. The vulnerability affects multiple version branches and requires network access plus valid credentials to exploit.

• CVE-2026-42055HIGH 8.1

  NGINX Plus and NGINX Open Source contain a heap buffer overflow vulnerability in their HTTP/2 and gRPC proxy modules. When specific configuration conditions are met—proxy_http_version set to 2 or grpc_pass enabled, ignore_invalid_headers turned off, and large_client_header_buffers exceeding 2MB—an attacker can craft oversized headers to trigger a buffer overflow. This can crash the NGINX worker process or, under certain circumstances (particularly when ASLR is disabled), lead to remote code execution. The vulnerability requires specific configuration and network conditions but poses significant risk to affected deployments.

• CVE-2026-7383HIGH 8.1

  OpenSSL contains a flaw in how it calculates memory buffer sizes when converting text strings to Unicode formats. When processing very large inputs—on the order of half a gigabyte or more—the size calculation wraps around to an incorrect (much smaller) value due to signed integer overflow. This causes OpenSSL to allocate a tiny buffer but then write far more data into it, corrupting the heap. An attacker who can supply specially crafted input directly to the affected functions could crash the application or potentially execute arbitrary code, though real-world exploitation requires unusual circumstances.

• CVE-2026-9753HIGH 8.1

  CVE-2026-9753 is a memory safety vulnerability in MongoDB's aggregation pipeline that allows any authenticated user to crash the server or read sensitive data from server memory. An attacker with valid database credentials can exploit the $_internalApplyOplogUpdate stage by submitting a specially crafted document diff with malformed binary data, triggering an out-of-bounds memory access. This does not require special privileges beyond basic database authentication.

• CVE-2020-9695HIGH 7.8

  Adobe Acrobat Reader contains a memory corruption flaw that allows attackers to execute arbitrary code on a user's system when a victim opens a specially crafted PDF file. The vulnerability affects multiple versions across Windows and macOS platforms. While the flaw is serious, it requires an attacker to socially engineer a user into opening a malicious document, making it a targeted rather than worm-like threat.

• CVE-2025-14098HIGH 7.8

  Avira Antivirus contains a critical flaw in its scanning engine that can be triggered when examining a specially crafted MS-DOS executable file. The vulnerability stems from an integer overflow that causes the engine to write data beyond the bounds of a heap buffer. An attacker can exploit this by tricking a user into scanning a malicious file, potentially leading to arbitrary code execution with the privileges of the antivirus process or crashing the antivirus engine entirely. This affects Windows, macOS, and Linux installations.

• CVE-2025-59605HIGH 7.8

  CVE-2025-59605 is a memory corruption flaw affecting Qualcomm wireless and networking chipsets. When a device processes identifier strings longer than designed, the software fails to properly validate input length, allowing the overflow to corrupt adjacent memory regions. An attacker with local access and standard user privileges can exploit this to read sensitive data, modify system behavior, or crash the device. The vulnerability requires direct local access and cannot be exploited remotely.

• CVE-2025-7004HIGH 7.8

  A heap buffer overflow flaw exists in multiple antivirus products from Gen Digital (Avast, AVG, and Norton) across Windows, macOS, and Linux. When the antivirus engine scans a deliberately malformed Windows PE (executable) file, it can write data beyond allocated memory boundaries. An attacker who can trick a user into opening a malicious file on a system running vulnerable antivirus software could either crash the antivirus process entirely or, in some cases, execute arbitrary code with the privileges of that process. The vulnerability is resolved through an automatic virus definition update; once your antivirus definitions reach build VPS 25040308 or later, you are protected regardless of which Gen Digital product you use.

• CVE-2026-0138HIGH 7.8

  CVE-2026-0138 is a memory corruption vulnerability in Android's light-weighted image stabilization (LWIS) subsystem that allows a local attacker with system-level privileges to write data beyond allocated buffer boundaries. An attacker who can trigger the vulnerable code path gains the ability to escalate privileges and execute arbitrary code with system permissions. No user interaction is required—the exploit can run silently once triggered.

• CVE-2026-0150HIGH 7.8

  A flaw in Google Android's EdgeTPU firmware allows a local attacker with basic user privileges to overflow a buffer and gain root-level control of the device. The vulnerability stems from an integer overflow in the ExecuteGraph command handler that fails to properly validate array bounds before writing data. No special user interaction is required—an attacker with local access can trigger the issue directly.

• CVE-2026-0153HIGH 7.8

  A buffer overflow vulnerability exists in Android's msg_to_host_buffer.cc component where the system fails to properly validate the size of data before writing to memory. An attacker with local access to a device can exploit this flaw to write data beyond the allocated buffer, potentially gaining elevated privileges without requiring special system permissions or user interaction. This is a straightforward but dangerous memory-safety issue that could allow unauthorized code execution at higher privilege levels.

• CVE-2026-10046HIGH 7.8

  Bitdefender Napoca is a bare-metal hypervisor—a foundational piece of virtualization software that runs directly on hardware. A vulnerability exists in how it handles a legacy BIOS memory lookup request (INT 0x15). When a guest operating system makes this request with specific register values, the hypervisor fails to check whether the destination memory address is valid, allowing data to be written beyond the allocated buffer. An attacker with access to a guest system can exploit this to write data into the hypervisor's internal memory, potentially compromising the entire virtualization layer. Importantly, Napoca is end-of-life and no longer receives vendor support.

• CVE-2026-10047HIGH 7.8

  Bitdefender's Napoca bare-metal hypervisor contains a memory safety flaw that allows a local attacker with limited privileges to write data beyond the boundaries of an internal memory buffer. By crafting specific processor register values, an attacker can overflow into the hypervisor's heap memory, potentially corrupting critical hypervisor state or executing arbitrary code. This vulnerability affects an end-of-life product that is no longer receiving security updates.

• CVE-2026-14191HIGH 7.8

  WinRAR and UnRAR contain a critical memory corruption vulnerability in how they handle RAR5 recovery volume sets (.rev files). When processing multiple recovery files together, the software fails to properly validate file boundaries, allowing an attacker to write malicious data to unintended memory locations. An attacker can exploit this by providing a crafted set of recovery files that, when a user attempts to repair or test an archive, corrupt the application's internal data structures. This can lead to information disclosure, data corruption, or potential code execution depending on what adjacent objects occupy the corrupted memory.

• CVE-2026-20455HIGH 7.8

  CVE-2026-20455 is a local privilege escalation vulnerability in MediaTek's geniezone component affecting a wide range of SoC firmware versions. An attacker who already holds system-level privileges can exploit a missing bounds check in memory write operations to escalate their access further. The vulnerability requires no user interaction and impacts dozens of MediaTek chipset families used in Android devices and embedded systems.

• CVE-2026-34700HIGH 7.8

  Adobe InDesign versions 21.3, 20.5.3 and earlier contain a memory vulnerability that allows an attacker to execute arbitrary code on a victim's computer. The attack requires social engineering—a user must be tricked into opening a malicious file. Once opened, the flaw allows the attacker to run code with the same privileges as the InDesign user, potentially compromising the entire system. This is a serious but not trivial threat: it requires user interaction and affects only specific InDesign versions, but the payoff for an attacker is significant.

• CVE-2026-34706HIGH 7.8

  Adobe InCopy, a professional editorial software tool, contains a vulnerability that allows attackers to execute malicious code on a user's system when the user opens a specially crafted file. The flaw stems from improper memory handling (out-of-bounds write) that can be exploited to gain full control of the affected system under the privileges of the logged-in user. Affected versions include InCopy 21.3, 20.5.3, and earlier releases. The attack requires social engineering—convincing a user to open a malicious document—but once successful, the impact is severe.

• CVE-2026-34709HIGH 7.8

  Adobe Substance3D Sampler versions 6.0.0 and earlier contain a memory corruption flaw that could allow attackers to execute arbitrary code on a victim's computer. The vulnerability requires a user to open a specially crafted malicious file, making social engineering the primary attack vector. Once exploited, an attacker gains the same privileges as the logged-in user, potentially compromising sensitive design assets, credentials, or system access.

• CVE-2026-34710HIGH 7.8

  Adobe Substance3D Sampler versions 6.0.0 and earlier contain a flaw that allows attackers to execute arbitrary code on a user's computer. The vulnerability is triggered when a user opens a specially crafted malicious file in the application. Once the file is opened, an attacker gains the ability to run code with the same privileges as the logged-in user, potentially compromising design assets, stealing credentials, or pivoting to other systems on the network.

• CVE-2026-42910HIGH 7.8

  A memory safety flaw in Windows Hotpatch Monitoring Service allows a person with local access and standard user privileges to write data beyond the intended buffer boundaries, potentially gaining elevated system permissions. The vulnerability requires an attacker already logged into the machine, but does not require user interaction once access is obtained.

• CVE-2026-45258HIGH 7.8

  A memory validation flaw in FreeBSD's audio device driver allows unprivileged users to bypass security boundaries and access kernel memory. The `/dev/dsp` device—typically world-readable—permits any local user to exploit an integer overflow in the memory mapping validation logic, enabling them to read and modify kernel data, escalate privileges, or crash the system. The vulnerability exists because the kernel checks an arithmetic sum that can wrap around, making the overflow check unreliable.

• CVE-2026-45645HIGH 7.8

  CVE-2026-45645 is a high-severity memory safety vulnerability in Microsoft Office that enables local code execution. An attacker who gains access to a user's system can craft a malicious Office document that, when opened by the user, exploits improper pointer handling to run arbitrary code with the privileges of the person viewing the file. This requires user interaction (opening a document) but no special permissions to trigger.

• CVE-2026-46136HIGH 7.8

  A flaw in the Linux kernel's MT7921 Wi-Fi driver can cause a buffer length counter to drop below zero under specific conditions when the driver processes country power settings from the Carrier List Configuration (CLC). This underflow triggers either an excessive loop that nearly hangs the system or applies an invalid power setting, preventing the driver from initializing properly. An attacker with local access could exploit this to degrade Wi-Fi functionality or trigger a denial of service.

• CVE-2026-46145HIGH 7.8

  CVE-2026-46145 is a memory corruption vulnerability in the Linux kernel's RDMA/mana driver. An unprivileged local user can manipulate a parameter called rx_hash_key_len from user space to cause an unbounded memory copy operation, corrupting kernel memory. The vulnerability stems from insufficient validation of user-supplied input before it is passed to a memory copy function, creating a path for local privilege escalation or system crash.

• CVE-2026-46173HIGH 7.8

  A vulnerability in the Linux kernel allows a task that is already exiting to encounter a coding error that violates critical scheduling rules. Specifically, when a dying task encounters an oops (kernel panic) during its shutdown sequence, the kernel attempts to complete the exit process while preemption is still enabled—a state that violates explicit safety requirements in the scheduler. If the oopsing task is preempted at the wrong moment, the scheduler loses track of the fact that the task is dead and can no longer run, leading it to reuse the task's memory stack. Multiple tasks can then execute on the same stack space, causing memory corruption that can lead to data corruption, information disclosure, or system compromise.

• CVE-2026-46197HIGH 7.8

  A validation flaw exists in the Linux kernel's AMD KFD (Kernel Fusion Driver) component that handles GPU compute memory management. The SVM (Shared Virtual Memory) ioctl handler fails to properly validate a user-supplied attribute count field before using it to access a buffer, creating an opportunity for an unprivileged local user to read or write memory outside the intended boundaries. This is a local privilege escalation and information disclosure vulnerability that requires an attacker to already have user-level access to the system.

• CVE-2026-46209HIGH 7.8

  A calculation error in the Linux kernel's graphics subsystem can cause memory protection checks to fail for certain image formats and dimensions. When the GPU driver prepares framebuffers for display, it validates that allocated memory is large enough. However, a mismatch in how dimensions are rounded between two validation functions can cause this check to incorrectly pass for very small images—specifically those 1 pixel tall with formats like NV12. This allows the GPU to access memory outside its allocated buffer, potentially enabling data theft or system compromise from unprivileged user processes.

• CVE-2026-46234HIGH 7.8

  A logic flaw in the Linux kernel's vsock (virtual socket) subsystem allows memory buffers to grow beyond their intended maximum size. When a user configures socket memory constraints, the kernel checks these limits in the wrong order—it enforces the minimum first, then the maximum. If someone sets a minimum larger than the maximum, the minimum wins and the buffer can balloon past the configured ceiling. This undermines memory isolation and could enable a local attacker to exhaust kernel memory or cause denial of service. The fix reorders the checks so the maximum is always enforced.

• CVE-2026-46253HIGH 7.8

  CVE-2026-46253 is a memory corruption vulnerability in the Linux kernel's pstore/ramoops subsystem—the component responsible for preserving system crash logs and diagnostic data across reboots. The flaw occurs in a function called persistent_ram_save_old() that manages historical crash data. When the kernel tries to save old crash logs, it can allocate a buffer that's too small, then later write more data into it than it can hold. This is a classic heap buffer overflow. The vulnerability requires a very specific sequence of events: a prior crash that didn't fill the entire log buffer, followed by a non-fatal kernel oops (error) that writes a larger log, combined with the pstore background timer being enabled. While the conditions are difficult to meet, when they do occur, an attacker with local access could potentially exploit this to corrupt kernel memory and escalate privileges.

• CVE-2026-46281HIGH 7.8

  A memory safety bug exists in the Linux kernel's virtual memory allocation code. When a function called vrealloc_node_align() is asked to reallocate memory under specific conditions—such as when the current allocation is on the wrong NUMA node or violates alignment requirements—it can accidentally write data beyond the boundaries of the newly allocated buffer. This happens because the code copies more data than the new buffer can hold when the reallocation is actually shrinking the requested size. An unprivileged local process can exploit this to overwrite adjacent kernel memory, potentially leading to information disclosure, privilege escalation, or system crashes.

• CVE-2026-46294HIGH 7.8

  A buffer overflow vulnerability exists in the Linux kernel's device mapper (dm) ioctl subsystem within the retrieve_status function. The flaw occurs when pointer alignment logic fails to validate boundaries before writing data, potentially allowing a local user with elevated privileges to overflow a kernel buffer. However, the practical risk is significantly constrained: the vulnerability requires root access to trigger, and mainstream device mapper libraries (libdevmapper and devicemapper-rs) use 8-byte-aligned buffers that naturally prevent the overflow condition from occurring in typical deployments.

• CVE-2026-46331HIGH 7.8

  CVE-2026-46331 is a memory corruption vulnerability in the Linux kernel's network packet scheduling subsystem. The flaw occurs in the pedit (packet editor) module, which allows authorized users to modify packet headers. The bug stems from incomplete copy-on-write (COW) handling—when the kernel prepares to modify packet data, it sometimes fails to properly protect the entire region that will be written to, leaving portions of memory vulnerable to corruption. An attacker with local access and appropriate capabilities could exploit this to corrupt page cache memory, potentially leading to data corruption or privilege escalation.

• CVE-2026-47747HIGH 7.8

  stable-diffusion.cpp, a C/C++ library for running inference on diffusion models like Stable Diffusion and Flux, contains a memory safety flaw in its checkpoint file parser. When processing .ckpt model files, a sign-confusion bug in the BINUNICODE opcode handler causes the parser to interpret a negative length value as an extremely large positive number, triggering an out-of-bounds memory copy that corrupts the heap. An attacker who controls a .ckpt file can exploit this to crash applications or potentially execute arbitrary code. The vulnerability affects versions prior to master-584-0a7ae07.

• CVE-2026-47749HIGH 7.8

  A flaw in stable-diffusion.cpp allows an attacker to corrupt the memory of applications that load malicious model checkpoint files (.ckpt format). The vulnerability exists in how the library parses PyTorch checkpoint files—specifically in the SHORT_BINUNICODE opcode handler. An improperly crafted .ckpt file can exploit a sign-handling bug to trigger an oversized memory copy operation, immediately corrupting the application's heap. If you use stable-diffusion.cpp to load model files from untrusted sources (like public model repositories), a crafted file could crash your application or potentially enable code execution. The risk is local and requires user interaction to load a malicious file.

• CVE-2026-47750HIGH 7.8

  stable-diffusion.cpp, a C/C++ library for running AI image generation models locally, contains a critical flaw in how it parses checkpoint (.ckpt) files. When processing a specially crafted malicious .ckpt file, the parser can fail to validate the expected structure, causing it to write beyond allocated memory boundaries. An attacker could exploit this by distributing a poisoned model file through public model-sharing platforms, tricking users or applications into loading it. Once loaded, the memory corruption could lead to a complete system compromise—data theft, unauthorized changes, or denial of service. The vulnerability requires user interaction (loading the file) but no special privileges to trigger.

• CVE-2026-47911HIGH 7.8

  Adobe Acrobat Reader contains a critical flaw that allows attackers to execute arbitrary code on a user's computer by tricking them into opening a specially crafted file. The vulnerability affects multiple recent versions across Windows and macOS systems. While the flaw requires user interaction—specifically opening a malicious PDF or document—the potential impact is severe, as successful exploitation grants the attacker the same privileges as the logged-in user.

• CVE-2026-47965HIGH 7.8

  Adobe Reader contains a critical flaw that allows attackers to run malicious code on a victim's computer if the user opens a specially crafted file. The vulnerability exists in versions 24.001.30365 and 26.001.21651 of Acrobat Reader and earlier releases. While the attacker cannot exploit this remotely—the victim must actively open the malicious file—successful exploitation grants the attacker the same permissions as the logged-in user, potentially enabling data theft, system compromise, or further lateral movement.

• CVE-2026-48293HIGH 7.8

  Adobe InDesign Desktop is vulnerable to an out-of-bounds write flaw that could allow an attacker to execute arbitrary code on a victim's computer. The vulnerability affects InDesign versions 21.3, 20.5.3 and earlier running on Windows or macOS. An attacker would need to trick a user into opening a specially crafted file—there is no indication the vulnerability can be exploited remotely or without user action. Successfully exploiting this flaw gives an attacker the same privileges as the logged-in user, potentially allowing theft of data, installation of malware, or lateral movement within a network.

• CVE-2026-48305HIGH 7.8

  Adobe Substance3D - Sampler contains a memory safety flaw that could allow an attacker to execute arbitrary code on a victim's machine. The vulnerability exists in versions 6.0.0 and earlier. An attacker would need to trick a user into opening a specially crafted malicious file—the code does not execute automatically or remotely. Once the file is opened, the attacker gains the same privileges as the user running the application, potentially allowing theft of data, installation of malware, or system compromise.

• CVE-2026-48306HIGH 7.8

  Adobe Substance 3D Sampler versions 6.0.0 and earlier contain an out-of-bounds memory write flaw that allows attackers to execute arbitrary code with the privileges of the user running the application. The attack requires a victim to open a specially crafted malicious file, making it a file-based vector that could be delivered via email, file-sharing services, or compromised websites. This is a genuine code execution risk for design and creative professionals who rely on Substance 3D tools.

• CVE-2026-50264HIGH 7.8

  A memory corruption vulnerability exists in X.Org's X server and Xwayland that allows a local user to write beyond allocated memory boundaries. An attacker can craft a specially crafted request asking for multiple back-left and one front-left DRI2 buffer attachment, causing the server to write data into memory it shouldn't access. This can crash the display server or, if that server runs with elevated privileges, enable privilege escalation. The vulnerability requires local access and user-level permissions to trigger.

• CVE-2026-52935HIGH 7.8

  A memory-safety bug exists in the Linux kernel's IPsec over TCP (espintcp) implementation. When an application sends data through this encrypted tunnel, the kernel is supposed to manage one message at a time. However, under certain conditions—specifically when a blocking application calls the send function while a previous transmission is still in progress—the kernel incorrectly reuses the same internal state for a new message. This can leave stale data references pointing to the wrong memory location, potentially allowing the kernel to read data from outside its intended boundaries during the send operation. An unprivileged local user with the ability to use the espintcp feature could trigger this flaw, potentially gaining access to sensitive kernel memory.

• CVE-2026-52962HIGH 7.8

  A memory management flaw in the Linux kernel's Ceph filesystem driver causes buffer objects to persist in memory without being properly released. When extended attributes are set on files, a retry mechanism can cause a buffer reference to be overwritten without freeing the old buffer first, leading to a memory leak. While the leak itself may seem benign, it occurs in kernel-controlled memory management and could enable privilege escalation or denial-of-service conditions on affected systems.

• CVE-2026-52992HIGH 7.8

  A flaw in the Linux kernel's ADFS (Acorn Disc Filing System) driver allows a local attacker to write data outside the boundaries of an allocated memory buffer. The vulnerability occurs when the kernel encounters a specially crafted ADFS disc image with an invalid zone count of zero during filesystem mounting. Instead of rejecting this malformed image, the kernel allocates memory incorrectly and then writes beyond the allocated area, potentially leading to privilege escalation or system compromise on systems that mount untrusted ADFS filesystems.

• CVE-2026-53004HIGH 7.8

  A flaw in the Linux kernel's SCTP (Stream Control Transmission Protocol) networking code allows a local user to write data beyond the bounds of their own buffer in userspace memory. When an application queries authentication chunk information from an SCTP socket, the kernel fails to validate that the supplied buffer is large enough to hold both the header structure and the chunk list. This can cause the kernel to overwrite memory immediately following the caller's buffer with peer-controlled data, silently corrupting adjacent application data without triggering kernel memory corruption or obvious failures.

• CVE-2026-53016HIGH 7.8

  A buffer overflow vulnerability exists in the Linux kernel's AMD CCP (Cryptographic Coprocessor) crypto driver. When processing RFC3686 counter mode AES encryption requests via the AF_ALG socket interface, the driver incorrectly writes 16 bytes of data into an 8-byte buffer during IV (initialization vector) restoration. This causes memory corruption that a local, authenticated attacker can exploit to escalate privileges or crash the system. The issue stems from using a fixed block size constant instead of respecting the algorithm's actual IV size requirement.

• CVE-2026-53059HIGH 7.8

  A flaw in the Linux kernel's device-mapper logging subsystem allows a local attacker with sufficient privileges to trigger a buffer overflow in kernel memory. When setting up mirrored storage volumes with very large capacity targets, an integer truncation causes the logging layer to miscalculate how much memory it needs. Subsequent operations then write data outside the allocated buffer, crashing the system or potentially allowing code execution. The vulnerability requires local access and elevated privileges to trigger.