CVE Vulnerability Catalog

An out-of-bounds write vulnerability that could allow an attacker to cause unexpected app termination. The issue was addressed with improved bounds checking.

An authorization issue in macOS. State management was improved. A malicious app may be able to break out of its sandbox.

An out-of-bounds write vulnerability in Apple systems. An app may be able to cause a denial-of-service.

An out-of-bounds access issue was addressed with improved bounds checking. Processing maliciously crafted web content may lead to an unexpected Safari crash.

A vulnerability in Apple systems related to improper memory handling. Processing a maliciously crafted image may corrupt process memory.

The issue was addressed with improved checks. The fix is included in Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Websites may know if the user has visited a given link.

An out-of-bounds read vulnerability in Apple systems. An app may be able to cause a denial-of-service.

In the Linux kernel, KVM for ARM64 in kvm_hyp_handle_mops() lacks translation of the synthetic SPSR_EL2 value before writing to hardware in nested virtualization. This causes incorrect SPSR_EL2 restoration.

In the Linux kernel, a use-after-free vulnerability was found in the br_ip6_fragment() bridge function. The prevhdr pointer becomes stale after skb_checksum_help() reallocates the skb head, leading to a write to freed memory.

In the Linux kernel, the virtio-net driver's receive_big() function checks the device-announced length too loosely, allowing a malicious virtio backend to write out-of-bounds past the frag array in skb. This can lead to NULL pointer write and potential exploitation.

In the Linux kernel, the rmnet driver (Qualcomm) lacks MAP frame length validation before parsing in the non-aggregation path. A short frame can lead to out-of-bounds buffer read, exploitable by a malicious device or attacker.

In the Linux kernel, BPF sockmap's bpf_msg_push_data() lacks overflow check when adding copy + len, leading to undersized allocation and out-of-bounds write. An attacker with BPF privileges can exploit this to corrupt memory.

In the Linux kernel, the net1080 USB network driver's net1080_rx_fixup() reads a pad byte before checking frame length, allowing a malicious NetChip 1080 device to cause out-of-bounds buffer read by sending a short frame with a large packet_len.

In the Linux kernel, DRM EDID's drm_parse_tiled_block() reads the full displayid_tiled_block structure without checking block length, leading to heap out-of-bounds read. A crafted EDID with a small tiled-display block can cause data leak.

A vulnerability in the Linux kernel's xdp_master_redirect() function dereferences a master pointer without a NULL check. Under certain conditions during bond slave release, this can lead to a NULL pointer dereference and kernel panic.

A use-after-free vulnerability was found in the Linux kernel's TIPC subsystem in the tipc_disc_rcv() function. The bearer_disable() function frees the discoverer structure (b->disc) with kfree(), but tipc_disc_rcv() still dereferences it in RX softirq context, leading to a use-after-free. The issue affects the UDP bearer, which lacks a proper grace period before deallocation.

In the Linux kernel usbnet gl620a driver, an out-of-bounds read vulnerability exists in genelink_rx_fixup(). A malicious GeneLink (GL620A) device can send a short URB with an inflated packet size, causing data to be copied beyond the allocated buffer and leaking kernel heap memory.

A stack out-of-bounds write vulnerability was found in the Linux kernel's Bluetooth EIR component when building advertising data. The eir_create_adv_data() function may prepend a 3-byte Flags AD structure and then copy instance data without checking if it fits into the fixed 31-byte buffer, causing a stack overflow.

An integer overflow vulnerability when processing a maliciously crafted image could lead to arbitrary code execution. The issue was addressed with improved input validation.

Input sanitization was improved to fix a validation issue. A maliciously crafted app may be able to bypass code signing enforcement.