CVE-2025-4096
published 2025-05-05CVE-2025-4096: Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page…
PriorityP347high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.47%
37.7th percentile
Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 136.0.7103.59-2~deb12u2 | 136.0.7103.59-2~deb12u2 |
| chromium | chromium | >= 0 < 136.0.7103.59-2 | 136.0.7103.59-2 |
| chromium | chromium | >= 0 < 136.0.7103.59-2 | 136.0.7103.59-2 |
| debian | chromium | < chromium 136.0.7103.59-2~deb12u2 (bookworm) | chromium 136.0.7103.59-2~deb12u2 (bookworm) |
| ericsson | codechecker | >= 0 < 6.26.2 | 6.26.2 |
| chrome | < 136.0.7103.59 | 136.0.7103.59 | |
| chrome | >= 136.0.7103.59 < 136.0.7103.59 | 136.0.7103.59 | |
| chrome_chrome | — | — | |
| linux | linux_kernel | >= 0 < 6.1.159 | 6.1.159 |
| linux | linux_kernel | >= 3.19.0 < 6.6.112 | 6.6.112 |
| linux | linux_kernel | >= 6.13.0 < 6.17.3 | 6.17.3 |
| linux | linux_kernel | >= 6.13.0 < 6.14.9 | 6.14.9 |
| linux | linux_kernel | >= 6.17.0 < 6.17.3 | 6.17.3 |
| linux | linux_kernel | >= 6.2.0 < 6.6.114 | 6.6.114 |
| linux | linux_kernel | >= 6.7.0 < 6.12.53 | 6.12.53 |
| linux | linux_kernel | >= 6.7.0 < 6.12.31 | 6.12.31 |
| msrc | cbl2_dnsmasq_2.89-2_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_dnsmasq_2.85-2_on_cbl_mariner_1.0 | — | — |
| msrc | microsoft_edge | — | — |
| paloalto | prisma_browser | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
ghsa·2026-01-13
CVE-2026-22812 [HIGH] CWE-306 OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
*Previously reported via email to [email protected] on 2025-11-17 per the security policy in [opencode-sdk-js/SECURITY.md](https://github.com/sst/opencode-sdk-js/blob/main/SECURITY.md). No response received.*
### Summary
OpenCode automatically starts an unauthenticated HTTP server that allows any local process—or any website via permissive CORS—to execute arbitrary shell commands with the user's privileges.
### Details
When OpenCode starts, it spawns an HTTP server (default port 4096+) with no authentication. Critical endpoints exposed:
- `POST /session/:id/shell` - Execute shell commands (`server.ts:1401`)
- `POST /pty` - Create interactive terminal sessions (`server.ts:267`)
- `GET /file/content?path=` - Read a
OSV
btrfs: fix symbolic link reading when bs > ps
osv·2025-11-12
CVE-2025-40128 btrfs: fix symbolic link reading when bs > ps
btrfs: fix symbolic link reading when bs > ps
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix symbolic link reading when bs > ps
[BUG DURING BS > PS TEST]
When running the following script on a btrfs whose block size is larger
than page size, e.g. 8K block size and 4K page size, it will trigger a
kernel BUG:
# mkfs.btrfs -s 8k $dev
# mount $dev $mnt
# mkdir $mnt/dir
# ln -s dir $mnt/link
# ls $mnt/link
The call trace looks like this:
BTRFS warning (device dm-2): support for block size 8192 with page size 4096 is experimental, some features may be missing
BTRFS info (device dm-2): checking UUID tree
BTRFS info (device dm-2): enabling ssd optimizations
BTRFS info (device dm-2): enabling free space tree
------------[ cut here ]------------
kernel BUG at /h
OSV
f2fs: fix to truncate first page in error path of f2fs_truncate()
osv·2025-11-12
CVE-2025-40137 f2fs: fix to truncate first page in error path of f2fs_truncate()
f2fs: fix to truncate first page in error path of f2fs_truncate()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to truncate first page in error path of f2fs_truncate()
syzbot reports a bug as below:
loop0: detected capacity change from 0 to 40427
F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
------------[ cut here ]------------
kernel BUG at fs/inode.c:753!
RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
Call Trace:
evict+0x504/0x9c0 fs/inode.c:810
f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
get_tree_bdev_flags+
GHSA
CodeChecker has a buffer overflow in the log command
ghsa·2025-09-22
CVE-2025-40843 [MEDIUM] CWE-121 CodeChecker has a buffer overflow in the log command
CodeChecker has a buffer overflow in the log command
### Summary
CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal `ldlogger` library, which is executed by the `CodeChecker log` command.
### Details
Unsafe usage of `strcpy()` function in the internal `ldlogger` library allows attackers to trigger a buffer overflow by supplying crafted inputs from the command line. Specifically, the destination buffer is stack-allocated with a fixed size of 4096 bytes, while `strcpy()` is called without any length checks, enabling an attacker to overrun the buffer.
### PoC
Example script is included below to illustrate how this vulnerability can be exploited.
```bash
#!/bin/bash
export CC_LOGGER_DEF_DIRS=1;
payload=''; for i in $(seq 1 4090); do payload+='A'; done
OSV
block: fix race between set_blocksize and read paths
osv·2025-06-18
CVE-2025-38073 block: fix race between set_blocksize and read paths
block: fix race between set_blocksize and read paths
In the Linux kernel, the following vulnerability has been resolved:
block: fix race between set_blocksize and read paths
With the new large sector size support, it's now the case that
set_blocksize can change i_blksize and the folio order in a manner that
conflicts with a concurrent reader and causes a kernel crash.
Specifically, let's say that udev-worker calls libblkid to detect the
labels on a block device. The read call can create an order-0 folio to
read the first 4096 bytes from the disk. But then udev is preempted.
Next, someone tries to mount an 8k-sectorsize filesystem from the same
block device. The filesystem calls set_blksize, which sets i_blksize to
8192 and the minimum folio order to 1.
Now udev resumes, still holding
GHSA
GHSA-v9xg-688g-r69h: Heap buffer overflow in HTML in Google Chrome prior to 136
ghsa_unreviewed·2025-05-05
CVE-2025-4096 [HIGH] CWE-122 GHSA-v9xg-688g-r69h: Heap buffer overflow in HTML in Google Chrome prior to 136
Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
OSV
CVE-2025-4096: Heap buffer overflow in HTML in Google Chrome prior to 136
osv·2025-05-05·CVSS 8.8
CVE-2025-4096 [HIGH] CVE-2025-4096: Heap buffer overflow in HTML in Google Chrome prior to 136
Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Red Hat
kernel: f2fs: fix to truncate first page in error path of f2fs_truncate()
vendor_redhat·2025-11-12
CVE-2025-40137 kernel: f2fs: fix to truncate first page in error path of f2fs_truncate()
kernel: f2fs: fix to truncate first page in error path of f2fs_truncate()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to truncate first page in error path of f2fs_truncate()
syzbot reports a bug as below:
loop0: detected capacity change from 0 to 40427
F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
------------[ cut here ]------------
kernel BUG at fs/inode.c:753!
RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
Call Trace:
evict+0x504/0x9c0 fs/inode.c:810
f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
get_tree_bdev_f
Red Hat
kernel: mm: fix uprobe pte be overwritten when expanding vma
vendor_redhat·2025-07-04·CVSS 5.5
CVE-2025-38207 [MEDIUM] CWE-911 kernel: mm: fix uprobe pte be overwritten when expanding vma
kernel: mm: fix uprobe pte be overwritten when expanding vma
In the Linux kernel, the following vulnerability has been resolved:
mm: fix uprobe pte be overwritten when expanding vma
Patch series "Fix uprobe pte be overwritten when expanding vma".
This patch (of 4):
We encountered a BUG alert triggered by Syzkaller as follows:
BUG: Bad rss-counter state mm:00000000b4a60fca type:MM_ANONPAGES val:1
And we can reproduce it with the following steps:
1. register uprobe on file at zero offset
2. mmap the file at zero offset:
addr1 = mmap(NULL, 2 * 4096, PROT_NONE, MAP_PRIVATE, fd, 0);
3. mremap part of vma1 to new vma2:
addr2 = mremap(addr1, 4096, 2 * 4096, MREMAP_MAYMOVE);
4. mremap back to orig addr1:
mremap(addr2, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr1);
In step 3, the vma1 range [a
Palo Alto
PAN-SA-2025-0009 Chromium: Monthly Vulnerability Update (May 2025)
vendor_paloalto·2025-05-14·CVSS 8.8
[HIGH] PAN-SA-2025-0009 Chromium: Monthly Vulnerability Update (May 2025)
PAN-SA-2025-0009 Chromium: Monthly Vulnerability Update (May 2025)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_8.html https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.html CVE Summary CVE-2025-3066 Use after free in Site Isolation CVE-2025-3067 Inappropriate implementation in Custom Tabs CVE-2025-3068 Inappropriate implementation in Intents CVE-2025-3069 Inappropriate implementation in Extensions CVE-2025-3070 Insufficient validation of untrusted input in Extensions
Microsoft
Chromium: CVE-2025-4096 Heap buffer overflow in HTML
vendor_msrc·2025-05-13·CVSS 8.8
CVE-2025-4096 [HIGH] Chromium: CVE-2025-4096 Heap buffer overflow in HTML
Chromium: CVE-2025-4096 Heap buffer overflow in HTML
Description: This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
FAQ: What is the version information for this release?
Microsoft Edge Version
Date Released
Based on Chromium Version
136.0.3240.50
5/1/2025
136.0.7103.49
FAQ: Why is this Chrome CVE included in the Security Update Guide?
The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.
How can I see the version of the browser?
In
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2025-4096
vendor_chrome·2025-05-13·CVSS 8.8
CVE-2025-4096 [HIGH] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2025-4096
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2025-4096
Red Hat
kernel: netfs: Fix kernel async DIO
vendor_redhat·2025-01-19·CVSS 5.5
CVE-2025-21643 [MEDIUM] kernel: netfs: Fix kernel async DIO
kernel: netfs: Fix kernel async DIO
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix kernel async DIO
Netfslib needs to be able to handle kernel-initiated asynchronous DIO that
is supplied with a bio_vec[] array. Currently, because of the async flag,
this gets passed to netfs_extract_user_iter() which throws a warning and
fails because it only handles IOVEC and UBUF iterators. This can be
triggered through a combination of cifs and a loopback blockdev with
something like:
mount //my/cifs/share /foo
dd if=/dev/zero of=/foo/m0 bs=4K count=1K
losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0
echo hello >/dev/loop2046
This causes the following to appear in syslog:
WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250
Debian
CVE-2025-4096: chromium - Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a r...
vendor_debian·2025·CVSS 8.8
CVE-2025-4096 [HIGH] CVE-2025-4096: chromium - Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a r...
Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Scope: local
bookworm: resolved (fixed in 136.0.7103.59-2~deb12u2)
bullseye: open
forky: resolved (fixed in 136.0.7103.59-2)
sid: resolved (fixed in 136.0.7103.59-2)
trixie: resolved (fixed in 136.0.7103.59-2)
Microsoft
An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.
vendor_msrc·2023-03-14·CVSS 7.5
CVE-2023-28450 [HIGH] An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.
An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitr
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft May 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws
blogs_bleepingcomputer·2025-05-13·CVSS 7.8
[HIGH] Microsoft May 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws
## Microsoft May 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws
## Lawrence Abrams
Today is Microsoft's May 2025 Patch Tuesday, which includes security updates for 72 flaws, including five actively exploited and two publicly disclosed zero-day vulnerabilities.
This Patch Tuesday also fixes six "Critical" vulnerabilities, five being remote code execution vulnerabilities and another an information disclosure bug.
The number of bugs in each vulnerability category is listed below:
17 Elevation of Privilege Vulnerabilities
2 Security Feature Bypass Vulnerabilities
28 Remote Code Execution Vulnerabilities
15 Information Disclosure Vulnerabilities
7 Denial of Service Vulnerabilities
2 Spoofing Vulnerabilities
This count does not include Azure, Dataverse, Mariner, and Microsof
Bugzilla
CVE-2025-40128 kernel: btrfs: fix symbolic link reading when bs > ps
bugzilla·2025-11-12
CVE-2025-40128 CVE-2025-40128 kernel: btrfs: fix symbolic link reading when bs > ps
CVE-2025-40128 kernel: btrfs: fix symbolic link reading when bs > ps
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix symbolic link reading when bs > ps
[BUG DURING BS > PS TEST]
When running the following script on a btrfs whose block size is larger
than page size, e.g. 8K block size and 4K page size, it will trigger a
kernel BUG:
# mkfs.btrfs -s 8k $dev
# mount $dev $mnt
# mkdir $mnt/dir
# ln -s dir $mnt/link
# ls $mnt/link
The call trace looks like this:
BTRFS warning (device dm-2): support for block size 8192 with page size 4096 is experimental, some features may be missing
BTRFS info (device dm-2): checking UUID tree
BTRFS info (device dm-2): enabling ssd optimizations
BTRFS info (device dm-2): enabling free space tree
------------[ cut here ]------
Bugzilla
CVE-2025-40137 kernel: f2fs: fix to truncate first page in error path of f2fs_truncate()
bugzilla·2025-11-12
CVE-2025-40137 CVE-2025-40137 kernel: f2fs: fix to truncate first page in error path of f2fs_truncate()
CVE-2025-40137 kernel: f2fs: fix to truncate first page in error path of f2fs_truncate()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to truncate first page in error path of f2fs_truncate()
syzbot reports a bug as below:
loop0: detected capacity change from 0 to 40427
F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
------------[ cut here ]------------
kernel BUG at fs/inode.c:753!
RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
Call Trace:
evict+0x504/0x9c0 fs/inode.c:810
f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:50
Bugzilla
CVE-2025-38207 kernel: mm: fix uprobe pte be overwritten when expanding vma
bugzilla·2025-07-04·CVSS 5.5
CVE-2025-38207 [MEDIUM] CVE-2025-38207 kernel: mm: fix uprobe pte be overwritten when expanding vma
CVE-2025-38207 kernel: mm: fix uprobe pte be overwritten when expanding vma
In the Linux kernel, the following vulnerability has been resolved:
mm: fix uprobe pte be overwritten when expanding vma
Patch series "Fix uprobe pte be overwritten when expanding vma".
This patch (of 4):
We encountered a BUG alert triggered by Syzkaller as follows:
BUG: Bad rss-counter state mm:00000000b4a60fca type:MM_ANONPAGES val:1
And we can reproduce it with the following steps:
1. register uprobe on file at zero offset
2. mmap the file at zero offset:
addr1 = mmap(NULL, 2 * 4096, PROT_NONE, MAP_PRIVATE, fd, 0);
3. mremap part of vma1 to new vma2:
addr2 = mremap(addr1, 4096, 2 * 4096, MREMAP_MAYMOVE);
4. mremap back to orig addr1:
mremap(addr2, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr1);
In ste
Bugzilla
CVE-2025-38073 kernel: block: fix race between set_blocksize and read paths
bugzilla·2025-06-18
CVE-2025-38073 CVE-2025-38073 kernel: block: fix race between set_blocksize and read paths
CVE-2025-38073 kernel: block: fix race between set_blocksize and read paths
In the Linux kernel, the following vulnerability has been resolved:
block: fix race between set_blocksize and read paths
With the new large sector size support, it's now the case that
set_blocksize can change i_blksize and the folio order in a manner that
conflicts with a concurrent reader and causes a kernel crash.
Specifically, let's say that udev-worker calls libblkid to detect the
labels on a block device. The read call can create an order-0 folio to
read the first 4096 bytes from the disk. But then udev is preempted.
Next, someone tries to mount an 8k-sectorsize filesystem from the same
block device. The filesystem calls set_blksize, which sets i_blksize to
8192 and the minimum folio order to 1.
Now udev
Bugzilla
CVE-2025-21752 kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents
bugzilla·2025-02-27·CVSS 5.5
CVE-2025-21752 [MEDIUM] CVE-2025-21752 kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents
CVE-2025-21752 kernel: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents
In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents
Don't use btrfs_set_item_key_safe() to modify the keys in the RAID
stripe-tree, as this can lead to corruption of the tree, which is caught
by the checks in btrfs_set_item_key_safe():
BTRFS info (device nvme1n1): leaf 49168384 gen 15 total ptrs 194 free space 8329 owner 12
BTRFS info (device nvme1n1): refs 2 lock_owner 1030 current 1030
[ snip ]
item 105 key (354549760 230 20480) itemoff 14587 itemsize 16
stride 0 devid 5 physical 67502080
item 106 key (354631680 230 4096) itemoff 14571 itemsize 16
stride 0 devid 1 physical 88559616
item 107 key (354631680 230 32768) ite
Bugzilla
CVE-2025-21643 kernel: netfs: Fix kernel async DIO
bugzilla·2025-01-19·CVSS 5.5
CVE-2025-21643 [MEDIUM] CVE-2025-21643 kernel: netfs: Fix kernel async DIO
CVE-2025-21643 kernel: netfs: Fix kernel async DIO
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix kernel async DIO
Netfslib needs to be able to handle kernel-initiated asynchronous DIO that
is supplied with a bio_vec[] array. Currently, because of the async flag,
this gets passed to netfs_extract_user_iter() which throws a warning and
fails because it only handles IOVEC and UBUF iterators. This can be
triggered through a combination of cifs and a loopback blockdev with
something like:
mount //my/cifs/share /foo
dd if=/dev/zero of=/foo/m0 bs=4K count=1K
losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0
echo hello >/dev/loop2046
This causes the following to appear in syslog:
WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_u
2025-05-05
Published