Pwn Day 2026

Two pre-authentication RCE classes in core request lifecycles: OOM bailout corruption and stale cross-request global state.

DNS and TLS hostname validation, Brotli memory corruption, keep-alive response confusion, snapshot entropy reuse, and permission-model bypasses.

Integer overflows in regcomp can produce incorrect allocations and out-of-bounds heap writes.

One CVSS-10 unauthenticated regexp-compiler RCE plus authentication, cache, authorization, credential, and policy flaws in the same patch release.

Unauthenticated ImageMagick argument injection, proxy IAM request signing, and two TLS session-resumption/session-pooling identity-confusion vulnerabilities.

Standalone Java trust stores included the compromised eMudhra intermediate CA certificates, allowing affected chains to authenticate through JSSE (CVSS 9.1).

Multi-frame image mode transitions can reuse undersized native storage, causing out-of-bounds writes and reads; command execution was demonstrated in some runtime profiles. Fixed in 13.0.0.

One forged-token superuser authorization bypass plus cross-tenant data/package access, proxy privilege escalation, destructive admin authorization gaps, and related policy failures. Fixed in 4.0.14, 4.2.5 and 5.0.0.

Two unauthenticated remote stack overflows in cstecgi.cgi: setStaticDhcpConfig via Comment and setWiFiAclAddConfig via macAddress. Public exploits exist for firmware 5.2.3c.7200.