CWE-252.

Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli

• Memory corruption
• CWE-252

<1.2.7 · fixed in 1.2.7

WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service

• WatchGuard AuthPoint Authentication Gateway
• Authentication bypass
• CWE-252

NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full

• Eclipse Foundation Eclipse ThreadX
• Memory corruption
• CWE-252

NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

• Eclipse Foundation Eclipse ThreadX NetX Duo
• Memory corruption
• CWE-252

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

• CWE-252

>=5.0.0, <5.4.1 · fixed in 5.4.1

Unchecked return value in HAProxy and others

• HAProxy
• HAProxy Enterprise Edition
• CWE-252

Apache bRPC: Out-of-Bounds Write in Redis Command Parser

• Apache Software Foundation Apache bRPC
• Denial of service
• Memory corruption

libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS

• mz-automation libiec61850
• Memory corruption
• CWE-129

libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead

• mz-automation libiec61850
• Memory corruption
• Information disclosure

Null Pointer Dereference in PKCS#7 bundle with no certificates

• libreswan
• Memory corruption
• CWE-252

RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

• RIOT
• Denial of service
• CWE-252

Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated

• Sirius Computer, Inc. Crux Agent
• CWE-252
• CWE-325

Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver

• MongoDB PHP Driver
• CWE-252

SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

• Thales SConnect
• Weak cryptography or TLS
• Memory corruption

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

• CWE-248
• CWE-252

>=6.7.0, <6.28.1 || >=7.0.0, <7.29.1 || >=8.0.0, <8.10.2 · fixed in 6.28.1, 7.29.1, 8.10.2

Unchecked return value in Google Chrome

• Google Chrome
• CWE-252

RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS

• rabbitmq-server
• CWE-252

Unchecked return value in Dell Update Package Framework

• Dell Update Package Framework
• CWE-252

Unchecked return value in WebAssembly wabt

• WebAssembly wabt
• CWE-252

snipe-it before 8.7.0 Data Loss via Failed Image Write

• grokability snipe-it
• CWE-252

Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence

• grokability snipe-it
• CWE-252

Unchecked return value in xmlsoft libxml2

• xmlsoft libxml2
• CWE-252

Unchecked return value in chewkeanho software-actualizer

• chewkeanho software-actualizer
• CWE-252
• CWE-636

FIPS mode assertion failure via malicious CERT payload

• libreswan
• Denial of service
• CWE-252

rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

• CWE-252

>=0.25.0, <2.13.0 · fixed in 2.13.0

Duplicate Advisory: Nokogiri does not check the return value from xmlC14NExecute

• CWE-252

>=1.5.1 · no fixed version yet

Unchecked return value in Tor

• Tor
• CWE-252

MyBB: Buddy list corruption

• mybb
• CWE-252

Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability

• CWE-248
• CWE-252

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

ImageMagick: Heap-use-after-free via XMP profile could result in a crash

• Denial of service
• Memory corruption

<14.15.0 · fixed in 14.15.0

Unchecked return value in HAProxy

• HAProxy
• CWE-252

chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)

• CWE-252
• CWE-253

<0.6.0 · fixed in 0.6.0

tarfile opened in streaming mode mishandles EOF

• Python Software Foundation CPython
• Denial of service
• CWE-252

ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

• Memory corruption
• Denial of service

<14.13.1 · fixed in 14.13.1

nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT

• CWE-252

<=0.2.0 · no fixed version yet

Unchecked return value in AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed… and others

• AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
• AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
• CWE-252

Unchecked return value in AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed… and others

• AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
• AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
• CWE-252

BIG-IP Advanced WAF and ASM vulnerability

• F5 BIG-IP
• CWE-252

Unchecked return value in Intel(R) QAT software drivers for Windows

• Intel(R) QAT software drivers for Windows
• CWE-252

nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals

• CWE-252
• CWE-755

<=0.2.0 · no fixed version yet

uutils coreutils has an Unchecked Return Value Issue

• CWE-252

<=0.8.0 · no fixed version yet

nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index

• nimiq core-rs-albatross
• CWE-252

FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

• FreeRDP
• Memory corruption
• CWE-252

Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload

• CWE-20
• CWE-252

<5.2.0-rc.1 · fixed in 5.2.0-rc.1

ImageMagick has uninitialized pointer dereference in JBIG decoder

• Memory corruption
• CWE-252

<14.10.4 · fixed in 14.10.4

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

• CWE-252

<0.2.3 · fixed in 0.2.3

Nokogiri does not check the return value from xmlC14NExecute

• CWE-252

>=1.5.1, <1.19.1 · fixed in 1.19.1

Unchecked Return Value in GitLab

• GitLab
• CWE-252

Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash

• Juniper Networks Junos OS
• CWE-252

Unchecked return value in Lenovo ThinkPad L13 Gen 6 BIOS and others

• Lenovo ThinkPad L13 Gen 6 BIOS
• Lenovo ThinkPad L13 Gen 6 2 in 1 BIOS
• CWE-252

iccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-130

iccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cpp

• InternationalColorConsortium iccDEV
• CWE-20
• CWE-130

iccDEV has heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp

• InternationalColorConsortium iccDEV
• CWE-20
• CWE-130

iccDEV has heap-buffer-overflow in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cpp

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-20

NULL Pointer Dereference in iccDEV XML Tag Parser

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-20

NULL Pointer Dereference in iccDEV XML Calculator Parser

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-20

NULL Pointer Dereference in iccDEV Signature Parser

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-20

NULL Pointer Dereference in iccDEV Unknown Tag Parser

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-20

iccDEV ToneMap Writer has NULL Pointer Member Call

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-252

Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values in github.com/gofiber/utils

• Weak cryptography or TLS
• CWE-252

<1.2.0 · fixed in 1.2.0