Threats Tagged 'cwe-123'

CVE-2026-25262 is a write-what-where vulnerability in the Qualcomm Sahara protocol experimentally confirmed on the Snapdragon 8 Gen 1 (SM8450) platform. It allows arbitrary writes to SRAM during the Sahara handshake, bypassing signature verification and partially bypassing Firehose loader authorization. Although the loader executes and responds to commands without authorization errors, full UFS storage access has not yet been achieved. The vulnerability was previously known only on legacy 32-bit Qualcomm platforms but is now shown to affect modern 64-bit ARMv9 SoCs. No official patch or remediation guidance is currently available, and further research is ongoing to achieve full Firehose initialization and understand TrustZone dependencies.

CVE-2026-81579 is a high-severity vulnerability in WibuKey for Windows before version 6.71. It involves an untrusted pointer dereference in the WibuKey2_64.sys kernel driver on 64-bit Windows, leading to a write-what-where condition. This flaw allows a local attacker to escalate privileges to administrator level, potentially executing arbitrary code or gaining full system control.

In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: AUTO00834868; Issue ID: MSV-6533.

NVIDIA TensorRT-LLM contains a write-what-where vulnerability (CWE-123) that could allow an attacker to perform arbitrary memory writes. Exploitation may result in data tampering, denial of service, and information disclosure. The vulnerability has a high severity score of 7.4. No official patch or remediation guidance is currently available from the vendor.

An improper validation vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to escalate privileges to SYSTEM and execute arbitrary code in kernel mode via crafted messages sent through a Minifilter communication port.

Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acronis Cyber Protect Cloud Agent (Windows) before build 42183.

An improper access control vulnerability exists in Semtech LoRa LR11xxx transceivers running early versions of firmware where the memory write command accessible via the physical SPI interface fails to enforce write protection on the program call stack. An attacker with physical access to the SPI interface can overwrite stack memory to hijack program control flow and achieve limited arbitrary code execution. However, the impact is limited to the active attack session: the device's secure boot mechanism prevents persistent firmware modification, the crypto engine isolates cryptographic keys from direct firmware access, and all modifications are lost upon device reboot or loss of physical access.

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPixel stack buffers overlap in CIccTagMultiProcessElement::Apply() int IccTagMPE.cpp. This vulnerability is fixed in 2.3.1.4.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2026-25634#cwe-119

Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the corruption of the stack pointer inside an SEV-SNP guest.

MediumVulnerabilityGermanyFranceUnited Kingdom+6#cve#cve-2025-29943#cwe-123

vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead to a crash (denial-of-service) and potentially remote code execution (RCE), exists in the Completions API endpoint. When processing user-supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation. Due to a change introduced in PyTorch 2.8.0, sparse tensor integrity checks are disabled by default. As a result, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the call to to_dense(). This memory corruption can crash vLLM and potentially lead to code execution on the server hosting vLLM. This issue has been patched in version 0.11.1.

HighVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-62164#cwe-20