CWE-126 vulnerabilities

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.

Memory corruption while processing escape code in API.

A heap buffer over-read vulnerability exists in the libsoup library within the sniff_feed_or_html() and skip_insignificant_space() functions. This flaw may cause the application to read beyond allocated memory boundaries, potentially leading to information disclosure or application instability. The vulnerability has a CVSS score of 6.5 (medium severity).

CVE-2025-32052 is a medium severity vulnerability in libsoup, an HTTP client and server library for GNOME. The flaw exists in the sniff_unknown() function and may lead to a heap buffer over-read. This vulnerability can cause a denial of service or potentially other impacts related to memory safety. Red Hat has issued a security advisory with an update that addresses this and several other related vulnerabilities in libsoup.

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

CVE-2024-42333 is a low-severity buffer over-read vulnerability in Zabbix Server that allows leaking a small amount of server memory. The flaw exists in the email media handling component (src/libs/zbxmedia/email.c) and requires high privileges to exploit. It does not impact integrity or availability and has no known exploits in the wild.

ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file

CVE-2024-43595 is a medium severity buffer over-read vulnerability in Microsoft Edge (Chromium-based) that could lead to remote code execution. The flaw affects versions from 1.0.0 up to but not including 130.0.2849.46. Microsoft has released an official fix in version 130.0.2849.46 to address this issue.

CVE-2024-38265 is a high-severity remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) affecting multiple versions of Microsoft Windows Server 2008 Service Pack 2 and later. The flaw is due to improper input validation, allowing an unauthenticated attacker to execute arbitrary code remotely. Microsoft has released official patches that address this vulnerability.

CVE-2024-43500 is a medium severity vulnerability in Microsoft Windows 11 version 22H2 involving a buffer over-read in the Windows Resilient File System (ReFS). This flaw could lead to information disclosure. Microsoft has released official fixes for affected versions.

CVE-2024-38261 is a high-severity vulnerability in Microsoft Windows Server 2008 Service Pack 2 and related versions affecting the Routing and Remote Access Service (RRAS). It involves improper input validation that could lead to remote code execution. The vulnerability has been officially fixed in multiple Windows versions. No known exploits are reported in the wild as of the published date.

Microsoft Windows Admin Center Information Disclosure Vulnerability

Windows Graphics Component Elevation of Privilege Vulnerability

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv6 ICMPv6 packet.

A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv4 ICMP packet.