CVE-2025-66443 is a high-severity vulnerability in Pexip Infinity versions 35.0 through 38.1 prior to 39.0, affecting non-default configurations that use Direct Media for WebRTC. It involves improper input validation in the signalling component, allowing an unauthenticated remote attacker to trigger a reachable assertion failure that causes the software to abort. This results in a temporary denial of service (DoS) condition. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires no user interaction and can be performed remotely over the network. No known exploits are currently reported in the wild. European organizations using Pexip Infinity for video conferencing with Direct Media enabled are at risk.
CVE-2025-66379 is a high-severity vulnerability in Pexip Infinity versions before 39.0, caused by improper input validation in the media implementation. A remote attacker can send a specially crafted media stream to trigger a reachable assertion failure, causing the software to abort and resulting in a denial of service (DoS). The vulnerability requires no authentication or user interaction and can be exploited over the network. While it does not impact confidentiality or integrity, it severely affects availability. No known exploits are currently reported in the wild. European organizations using Pexip Infinity for video conferencing and collaboration services are at risk of service disruption. Mitigation involves promptly upgrading to version 39.0 or later once available and implementing network-level protections to restrict untrusted media streams. Countries with significant adoption of Pexip Infinity, such as the UK, Germany, France, and the Nordics, are most likely to be affected due to their extensive use of unified communications platforms.
CVE-2025-49088 is a medium severity vulnerability in Pexip Infinity versions 32.0 through 37.1 prior to 37.2, affecting the One Touch Join (OTJ) service for Teams SIP Guest Join. The flaw is an improper input validation (CWE-617) that allows a remote attacker to send a crafted calendar invite to trigger a reachable assertion failure, causing the OTJ service to abort and resulting in a denial of service (DoS). Exploitation requires no authentication or user interaction but has a high attack complexity. This vulnerability impacts availability but does not affect confidentiality or integrity. No known exploits are currently reported in the wild. European organizations using Pexip Infinity for Teams SIP guest joining are at risk of service disruption. Mitigation involves upgrading to version 37.
CVE-2025-32096 is a high-severity vulnerability in Pexip Infinity versions 33.0 through 37.0 prior to 37.1, caused by improper input validation in the signaling component. This flaw allows an unauthenticated remote attacker to trigger a reachable assertion failure, causing the software to abort and resulting in a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires no privileges or user interaction and can be performed remotely over the network. Although no known exploits are currently in the wild, the ease of exploitation and the critical role of Pexip Infinity in video conferencing make this a significant threat. European organizations relying on Pexip for communication services could face service disruptions, impacting business continuity. Mitigation involves promptly upgrading to version 37.
CVE-2025-32095 is a high-severity vulnerability in Pexip Infinity versions prior to 37.0, caused by improper input validation in the signalling component. A remote attacker can send a specially crafted signalling message that triggers a reachable assertion failure, causing the software to abort and resulting in a denial of service (DoS). This vulnerability requires no authentication or user interaction and can be exploited over the network. While it does not impact confidentiality or integrity, the availability impact is significant. No known exploits are currently reported in the wild. European organizations using Pexip Infinity for video conferencing or unified communications should prioritize patching once updates are available. Countries with high adoption of Pexip Infinity and critical reliance on video collaboration tools are at greater risk. Mitigation involves monitoring network traffic for anomalous signalling messages and applying vendor patches promptly upon release.
wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, contain a reachable assertion vulnerability in the APRS MIC-E decoder function aprs_mic_e() located in src/decode_aprs.c. When processing a specially crafted AX.25 frame containing a MIC-E message with an empty or truncated comment field, the application triggers an unhandled assertion checking for a non-empty comment. This assertion failure causes immediate process termination, allowing a remote, unauthenticated attacker to cause a denial of service by sending malformed APRS traffic.
An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then send a query with qtype set to ANY.
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661189; Issue ID: MSV-4298.
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01270690; Issue ID: MSV-4301.
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673751; Issue ID: MSV-4644.
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01717526; Issue ID: MSV-5591.
MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2
In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation
A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. This is achieved by sending the creation of an NF with an invalid type via SBI and then requesting its data. The NRF executes a check that crashes the process, leaving the discovery service unresponsive.
Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders the discovery service unavailable.
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input sent to its listening port on the local loopback interface. This could allow an unauthenticated local attacker to cause a denial of service condition.
