Our findings

The Linux kernel's SMB1 client parses length and offset fields from synchronous read responses before confirming that the complete response header was received. A malicious or compromised SMB1 server can return a truncated response that causes the client to read beyond its receive buffer.

The Linux kernel's SMB1 client fails to validate a server-supplied data offset before copying a synchronous read response. A malicious or compromised SMB1 server can make the client read beyond the received response buffer, potentially disclosing adjacent kernel heap data or crashing the system.

GNOME Remote Desktop does not enforce a deadline for unauthenticated clients to complete the RDP handshake. A remote attacker can hold admitted connections open indefinitely, exhaust the service's global connection limit, and prevent new RDP clients from connecting until a holding socket is closed.

A bounds-checking flaw in macOS's HFS+ B-tree code allows a malicious disk image to drive a write past a fixed stack traversal buffer while the image is being mounted. The resulting kernel stack corruption can cause unexpected system termination and may corrupt kernel memory.

A flaw in the Linux kernel's NTFS3 LZNT decompression path can expose uninitialized kernel page contents when reading a crafted compressed file. Bynario demonstrated that the disclosure can recover kernel pointers and determine the randomized kernel base, defeating KASLR and providing information useful for follow-on exploitation.

An unauthenticated client can bypass a FreeRDP server's configured transport policy and enter RDSTLS after receiving a terminal negotiation failure. Improper failure-state handling causes an error code to be interpreted as a protocol bitmask, exposing RDSTLS parsers and callbacks before the required NLA authentication; the flaw does not by itself authenticate the peer.

An RDP client with an established RDPDR static channel using SHOW_PROTOCOL can trigger an out-of-bounds write in FreeRDP's channel tracker, overwriting an adjacent live pointer and potentially causing server-side code execution or a controlled crash. The flaw is an integer underflow in versions 3.28.0 through 3.30.0; assertion-enabled builds abort before the overwrite, while affected assertion-disabled builds reach it.

An RDP client with an active AUDIN dynamic virtual channel can trigger a server-side heap use-after-free by racing FreeRDP's DRDYNVC parser against closure of that channel. The flaw can crash the server and may permit broader memory corruption through stale stream and queue pointers; code execution was not demonstrated.

An RDP client that has negotiated an active RDPGFX dynamic virtual channel can remotely disclose up to 300 bytes of uninitialized server heap memory in a single FreeRDP `ResetGraphics` response. This information disclosure can reveal heap and module addresses and affects versions 2.0.0 through 3.30.0.

An RDP client responding to an outstanding redirected-smartcard request can trigger stack- and heap-based out-of-bounds reads in FreeRDP's server-side decoder by returning oversized ATR lengths. The flaw can terminate servers with smartcard redirection enabled; no remote data-disclosure or code-execution path was demonstrated.

The Linux kernel's NFC/NCI subsystem can expose uninitialized kernel stack memory when processing crafted RF discovery or interface-activation notifications with zero-length technology-specific parameters. The affected handlers pass uninitialized data into NFC target records that can later be returned to user space.

The Linux kernel's NFC/NCI subsystem can write beyond its fixed-size discovered-target array when an NFC controller repeatedly restarts discovery and reports automatically activated targets. The unchecked target count causes a kernel heap out-of-bounds write and can also make subsequent code walk beyond the array.

An authentication state-management flaw in macOS Screen Sharing can allow a remote attacker to establish a session without valid credentials. Bynario demonstrated that the resulting unauthorized session could be chained with privileged Screen Sharing file-copy behavior to achieve remote root command execution.

The Linux kernel's TIPC broadcast path can read beyond a network packet buffer when processing a malformed Gap ACK blocks record. An unauthenticated network peer can advertise an oversized block count in a short broadcast state message, potentially disclosing kernel memory or crashing the system.

A race in the Linux kernel's Bluetooth MGMT interface can cause add_device_complete() to read an hci_conn_params object after a concurrent device-removal operation has freed it. Triggering the flaw requires high local privileges and a successful race, and can disclose a small amount of kernel memory or crash the system.

When legacy VNC-password access is enabled for macOS Screen Sharing, its file-copy helpers can retain root filesystem privileges after authentication. An attacker who knows the configured VNC password can remotely create and read root-owned files; Bynario used this primitive to obtain a root shell, demonstrating post-authentication remote root command execution.

An oversized directory entry returned by a malicious FUSE server can overflow a Linux kernel page-cache page by 24 attacker-controlled bytes. Bynario demonstrated a working local privilege escalation on Ubuntu 26.04 by steering the overflow into the cached code of the SUID /usr/bin/su binary and executing the corrupted binary to obtain a root shell.

A race in the Linux kernel's CAN raw socket handling can leave raw_rcv() accessing per-CPU uniqueness data after it has been freed, resulting in a use-after-free. A local, low-privileged attacker could exploit the flaw without user interaction, potentially affecting system confidentiality, integrity, and availability.

An out-of-bounds read in Apple operating systems could allow a local app to cause a denial-of-service. Apple addressed the issue with improved bounds checking in iOS and iPadOS 18.7.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1.