CVE-2026-80723High· 8.4▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dynamic regions are defined On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
8.4 → 5.5
high → medium
5.5 → 8.4
medium → high
In the Linux kernel, the following vulnerability has been resolved:
of: reserved_mem: prevent OOB when too many dynamic regions are defined
On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS.
If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, fdt_scan_reserved_mem() writes past the end of the local array.
Add a bounds check that logs an error and skips the excess regions, restoring the original behavior.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97631High· 8.8edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)
CVE-2026-100229Medium· 6.5A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers)
CVE-2026-100231Medium· 6.1A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux)
CVE-2026-110247High· 8.8Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks
CVE-2026-109256Medium· 5.3FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure
CVE-2026-109250Medium· 6.6FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration