ASI-2026-0015
MEDIUM
CVSS 6.8
2026-09-01
In fmt_num() of editors/awk.c in BusyBox's awk applet, the user-controllable OFMT and CONVFMT awk variables are passed directly to snprintf() as the format string, with validation that inspects only the final character o...
BusyBox (git < commit 9958bbd7)
CWE-134
ASI-2026-0013
MEDIUM
CVSS 5.5
2026-08-14
In keyboard_poll() of keyboard.c, an unconditional sti at the end of the function re-enabled maskable interrupts regardless of the caller's context. keyboard_poll() is reachable from keyboard_getchar(), which a ring3 .t ...
Artfical tOS < 0.9.156
CWE-667, CWE-362, CWE-696
ASI-2026-0014
HIGH
CVSS 8.4
2026-08-14
syscall_handler() in syscall.c ignores the page tables' PTE_USER bit entirely once execution reaches ring0, meaning nothing in the paging setup stops the kernel from dereferencing any address a ring3 .t program passes as...
Artfical tOS 0.9.156 (< 90bdc6a)
CWE-787, CWE-125, CWE-284
ASI-2026-0002
HIGH
CVSS 7.1
2026-07-20
In tar_extract of tarfmt.c and the extraction routine of zipfmt.c, archive entry names are used to construct destination file paths without sanitizing '.' or '..' path components or absolute paths. This allows a speciall...
Artfical tOS < 0.9.105
CWE-22, CWE-73
ASI-2026-0003
MEDIUM
CVSS 5.3
2026-07-20
In dns_resolve of dns.c, the DNS response parser advances a read position through a fixed-size stack buffer using length values taken directly from the received UDP response, without validating that the position stays wi...
Artfical tOS < 0.9.107
CWE-125, CWE-20
ASI-2026-0004
HIGH
CVSS 7.1
2026-07-20
In png_decode of png.c, the row stride is computed as width multiplied by channel count using 32-bit arithmetic before being validated against the maximum allowed image size. An attacker-controlled width value in the IHD...
Artfical tOS < 0.9.108
CWE-190, CWE-125
ASI-2026-0005
HIGH
CVSS 7.8
2026-07-20
In decode_ics of aac_decoder.c, the max_sfb field is read directly from the AAC bitstream as an unvalidated 6-bit value (0-63) and used as a loop bound when populating the sfb_top and sf_val stack arrays, which are only ...
Artfical tOS < 0.9.109
CWE-787, CWE-121, CWE-125
ASI-2026-0006
MEDIUM
CVSS 6.8
2026-07-20
In ntfs_name_decode of ntfs.c, the name_length field is read directly from the on-disk $FILE_NAME attribute of an NTFS directory index entry (a value up to 255, fully controlled by whoever crafts the mounted volume or di...
Artfical tOS < 0.9.110
CWE-121, CWE-20
ASI-2026-0007
MEDIUM
CVSS 5.9
2026-07-20
In ext2_vfs_readdir of ext2.c, a directory entry's name_len and rec_len fields are read directly from an on-disk ext2 directory block without validating that the resulting name data actually fits within the bounds of the...
Artfical tOS < 0.9.111
CWE-125, CWE-20
ASI-2026-0008
MEDIUM
CVSS 5.9
2026-07-20
In xfs_vfs_readdir of xfs.c, the XFS_DINODE_FMT_LOCAL (shortform directory) code path parses on-disk directory entries without validating the entry pointer or its derived name length against the bounds of the inode buffe...
Artfical tOS < 0.9.112
CWE-125, CWE-20
ASI-2026-0009
HIGH
CVSS 7.1
2026-07-20
In the M4A demuxer of m4a_demux.c, the first_chunk field of an stsc box entry is read directly from an untrusted M4A/MP4 file with no validation that it is at least 1, as required by the ISO-BMFF specification. A crafted...
Artfical tOS < 0.9.113
CWE-191, CWE-125
ASI-2026-0010
MEDIUM
CVSS 5.9
2026-07-20
In the btrfs mount routine of btrfs.c, the sys_chunk_array_size field of an on-disk btrfs superblock is passed directly as the walk bound to btrfs_parse_sys_chunk_array without being validated against the actual size of ...
Artfical tOS < 0.9.114
CWE-125, CWE-20
ASI-2026-0011
MEDIUM
CVSS 5.5
2026-07-20
In the MP3 decoder of mp3_decoder.c, a raw 5-bit region-address field (value range 0-31) read directly from an MP3 frame's side-information bytes is used as an index into the 16-entry ra1tab lookup table without any boun...
Artfical tOS < 0.9.115
CWE-125, CWE-129
ASI-2026-0012
HIGH
CVSS 8.1
2026-07-20
In recv_record of tls.c, the 16-bit record-length field of an incoming TLS record is validated only against the generic TLS_RX_BUF constant (8192 bytes) rather than the actual capacity of the caller-supplied destination ...
Artfical tOS < 0.9.116
CWE-121, CWE-20
ASI-2026-0001
HIGH
CVSS 8.4
2026-07-19
In elf_load_dynamic of elf.c, there is a possible arbitrary kernel memory write due to a missing bounds check on the p_vaddr field of a PT_LOAD segment. This could lead to local escalation of privilege with no additional...
Artfical tOS < 0.9.105
CWE-787, CWE-284, CWE-269