CVE & CISA-KEV Catalog

The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the outer structure only; the buf pointers and len values inside the embedded struct peci_buf members tx_buffer and rx_buffer remained fully caller-controlled and were passed unchecked to the driver. Every in-tree PECI driver dereferences those pointers in supervisor mode: peci_npcx_transfer() in drivers/peci/peci_npcx.c and peci_it8xxx2_transfer() in drivers/peci/peci_ite_it8xxx2.c copy hardware bytes into rx_buffer.buf[i] and read command bytes out of tx_buffer.buf[i], and peci_xec_read()/peci_xec_write() in drivers/peci/peci_mchp_xec.c

Published 2026-10-21

The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.

Published 2026-10-20

The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_rtio_cqe_get_mempool_buffer() stores the mempool buffer address and its length through them. The distinction is enforced by every architecture validator — arch_buffer_validate() on RISC-V PMP explicitly accepts the global __rom_region/__rodata_region for reads only, and the ARM MPU validators accept P_RO_U_RO and P_RW_U_RO regions for reads only — so a read-validated pointer is not necessarily writable by the calling thread. An unprivileged user-mode thread that has been granted access to an RTIO context (rtio_access_grant()) can invo

Published 2026-10-19

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to deny service over a network.

Published 2026-10-16

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

Published 2026-10-15

Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.

Published 2026-10-14

Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Published 2026-10-14

Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.

Published 2026-10-13

Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.

Published 2026-10-13

Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.

Published 2026-10-13

Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Published 2026-10-13

Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

Published 2026-10-13

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

Published 2026-10-13

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

Published 2026-10-13

Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.

Published 2026-10-13

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

Published 2026-10-13

Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Published 2026-10-13

Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.

Published 2026-10-13

Untrusted pointer dereference in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.

Published 2026-10-13

Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.

Published 2026-10-13

Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.

Published 2026-10-13

Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally.

Published 2026-10-13

Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.

Published 2026-10-13

Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.

Published 2026-10-13

Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.

Published 2026-10-13

The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.

Published 2026-10-09

Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer, potentially resulting in remote code execution.

Published 2026-10-06

Memory corruption when processing draw objects of incorrect type during graphics command list execution.

Published 2026-10-06

The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the per-target data buffers those array elements point at. Each struct i3c_ccc_target_payload carries its own data pointer and data_len, and neither was passed through K_SYSCALL_MEMORY() before the payload was handed to z_impl_i3c_do_ccc() and on to the controller driver. The verifier also operated on the caller's live structure rather than a snapshot, so validated fields could be changed by a second user thread between the check and the driver's use — unlike the sibling z_vrfy_i3c_transfer(), which has always copied its message array first. The defect is only present in CONFIG_USERSPACE bui

Published 2026-10-05

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules.

Published 2026-10-02

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.

Published 2026-10-02

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereference an object address a module named by asking only whether that address fell outside the module. The manager's object pool is outside every module, so the test was satisfied by an address shifted into the interior of one of the module's own privileged allocations, which denotes no object at all. The bytes such an address presents as a control block are bytes the module put there through ordinary create and set services, so the control block ID at the front of them could be made to read as any typ

Published 2026-09-29

Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE`. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly — no validation, no trampoline — from privileged kernel code when the trace buffer wraps. An invalid pointer faults the kernel (DoS). A pointer into the module's own code was observed running with kernel privilege (`CONTROL.nPRIV = 0`), confirmed at runtime with a register capture inside that code.

Published 2026-09-29

Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secure world to supply pointers to secure memory. The secure firmware subsequently dereferences these attacker-controlled pointers without verifying that they reference non-secure memory, resulting in unintended disclosure of secure memory contents. This violates the isolation guarantees provided by Arm TrustZone-M and can be leveraged as a memory disclosure or corruption primitive that may enable recovery of sensitive cryptographic material.

Published 2026-09-29

Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.

Published 2026-09-25