CWE-129 vulnerabilities

free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of free5GC's AMF service have a Buffer Overflow vulnerability leading to Denial of Service. Remote unauthenticated attackers can crash the AMF service by sending a specially crafted NAS Registration Request with a malformed 5GS Mobile Identity, causing complete denial of service for the 5G core network. All deployments of free5GC using the AMF component may be affected. Pull request 43 of the free5gc/nas repo contains a fix. No direct workaround is available at the application level. Applying the official patch is recommended.

CVE-2026-25585 is a high-severity vulnerability in the InternationalColorConsortium's iccDEV library prior to version 2.3.1.3. It involves improper bounds checking during ICC profile processing, specifically in IccCmm.cpp at line 5793, leading to an out-of-bounds read. This flaw can cause memory disclosure or segmentation faults by accessing memory beyond allocated arrays. Exploitation requires a user to open or process a malformed ICC profile, with no privileges needed but user interaction required. The vulnerability impacts confidentiality, integrity, and availability due to potential memory corruption and data leakage. No known exploits are currently reported in the wild, and the issue has been patched in version 2.

alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.

Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specially crafted network traffic. This requires an attacker to send a malformed payload to a monitored network interface where MongoDB protocol parsing is enabled.

CVE-2026-0528 is a medium severity vulnerability in Elastic Metricbeat affecting versions 7.0.0 through 9.2.0. It involves improper validation of array indices (CWE-129) in the Graphite and Zookeeper server metricsets, and improper input validation (CWE-20) in the Prometheus helper module. An attacker can exploit this by sending specially crafted malformed payloads or metric data, causing a Denial of Service (DoS) condition. The vulnerability requires network access but no authentication or user interaction. While no known exploits are currently in the wild, the flaw can disrupt metric collection and monitoring services. European organizations relying on Metricbeat for infrastructure monitoring may experience service outages or degraded observability.

Memory corruption when accessing resources in kernel driver.

Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and earlier, TaikoInbox._verifyBatches (packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678) advanced the local tid to whatever transition matched the current blockHash before knowing whether that batch would actually be verified. When the loop later broke (e.g., cooldown window not yet passed or transition invalidated), the function still wrote that newer tid into batches[lastVerifiedBatchId].verifiedTransitionId after decrementing batchId. Result: the last verified batch could end up pointing at a transition index from the next batch (often zeroed), corrupting the verified chain pointer.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.

A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to return the device to network visibility.

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g.hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). This issue has been patched in version 0.11.1.

Memory corruption when triggering a subsystem crash with an out-of-range identifier.

Memory corruption while processing audio streaming operations.

Memory corruption while selecting the PLMN from SOR failed list.

NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where a user may cause an out-of-bounds write by running nvdisasm on a malicious ELF file. A successful exploit of this vulnerability may lead to denial of service.

CVE-2024-21970 is a vulnerability in AMD Ryzen™ Threadripper™ 3000 Processors involving improper validation of an array index in the AMD power management firmware. This flaw could allow a privileged attacker to corrupt AGESA memory, potentially leading to a loss of integrity in the system. The vulnerability has a medium severity rating with a CVSS score of 4.4. No public exploits or patches are currently documented.

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

Memory corruption while processing DDI call with invalid buffer.

Improper array index verification vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect the audio decoding function.

Out-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.

Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability.