Threats Tagged 'cwe-823'

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition.

CVE-2026-102757 is a high-severity vulnerability in the Eclipse Foundation's ThreadX real-time operating system. It allows an unprivileged, memory-protected module to manipulate kernel memory in privileged mode, bypassing isolation boundaries by clearing the MPU enable bit. This occurs due to improper validation in the Module Manager's object dereference logic, enabling an attacker to craft addresses that pass checks incorrectly and gain privileged memory access.

CVE-2026-31912 is a medium severity vulnerability in libpcap's BPF interpreter where improper validation of filter program offsets can cause out-of-bounds memory reads. Specifically, the interpreter does not detect reaching the end of the filter buffer without a return instruction or jumps to offsets outside the buffer. This can lead to reading large areas of OS process memory on both 32-bit and 64-bit architectures.

CVE-2026-45199 is a high-severity vulnerability in Imagination Technologies Graphics DDK where kernel software running inside a Guest VM can send improper commands to the GPU firmware. This triggers out-of-bounds writes outside the Guest's virtualized GPU memory, potentially allowing privilege escalation.

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process.

CVE-2026-49746 is a high-severity vulnerability in Imagination Technologies Graphics DDK involving improper validation of array indices. This flaw allows software running as a non-privileged user to perform out-of-bounds (OOB) read accesses to kernel memory via GPU system calls. In some cases, it can lead to use-after-free (UAF) conditions on arbitrary GPU memory pages, potentially causing denial of service or information disclosure.

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries.

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device. An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to am out-of-bounds write.

Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory. A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.