Loading story…
A public disclosure on the oss-sec mailing list reported a stack buffer overflow in BIRD/BIRD2 tied to BGP AS_PATH mask matching, with a CVE still pending and no confirmed fixed release. Researcher comments in the thread said BIRD 2.16.2 was reproduced as vulnerable, while other BIRD 2.x versions may also be affected if they use the same implementation. The discussion also highlighted conflicting views on remediation status: the reporter said maintainers indicated they did not currently plan to fix the issue, while other participants challenged whether the claim that no fix existed had been sufficiently validated against newer versions or unpublished changes.
Separately, GNU FreeIPMI 1.6.18 was released with security fixes for exploitable buffer overflows in OEM-specific ipmi-oem functionality. The project said the affected commands were ipmi-oem dell get-active-directory-config and ipmi-oem fujitsu get-sel-entry-long-text; the release also added an altbridging workaround in ipmi-sensors. An oss-sec post noted that no new CVE appeared to have been assigned for these FreeIPMI flaws at publication time and clarified that CVE-2026-33554 referred to different subcommands fixed earlier in FreeIPMI 1.6.17.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
GNU FreeIPMI released version 1.6.18 on 2026-06-02. The release fixed exploitable buffer overflows in the `ipmi-oem dell get-active-directory-config` and `ipmi-oem fujitsu get-sel-entry-long-text` commands.
An early-stage public disclosure on oss-sec described a stack buffer overflow in BIRD/BIRD2 related to BGP AS_PATH mask matching. The discussion said BIRD 2.16.2 was confirmed affected, other 2.x versions might also be affected, and no fixed version was known at disclosure time.
According to the oss-sec discussion, upstream told the reporter on 2026-05-24 that they did not currently plan to fix the reported BIRD/BIRD2 stack buffer overflow in BGP AS_PATH mask matching.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcesavannah.gnu.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FreeIPMI versions before **1.6.19** contain a critical stack-based buffer overflow, tracked as `CVE-2026-85504`, in `_ipmi_sel_oem_fujitsu_get_sel_entry_long_text`. An attacker can reportedly trigger the flaw by supplying malformed Fujitsu System Event Log (SEL) long-text responses; the issue carries a CVSS v3.1 score of **9.8** and requires neither privileges nor user interaction. FreeIPMI 1.6.19 remediates the Fujitsu SEL issue alongside other potential stack overflows found through code analysis, including flaws in Dell-focused `ipmi-oem` system-information functionality and libfreeipmi. The release also includes numerous reliability, parsing, portability, monitoring, and memory-management corrections. Organizations using FreeIPMI should upgrade to version 1.6.19 or later.
Sep 5, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026
NetBird released **v0.76.0** to fix a high-severity local privilege escalation flaw in its client daemon, tracked as **`GHSA-qcpp-8vwj-hhwr`** and rated **CVSS 8.8**. The vulnerability affected all client versions from **`v0.5.0` through `v0.75.1`** on Linux, macOS, FreeBSD, and Windows because the daemon’s local gRPC control interface accepted privileged commands from any local process without authentication. On Unix-like systems, the daemon exposed a world-readable and world-writable Unix socket; on Windows, it listened on an unauthenticated loopback TCP port at **`127.0.0.1:41731`**. NetBird said the issue was **not remotely exploitable**, did **not** affect its management server, signal server, relays, or NetBird Cloud, and that it has **no evidence of in-the-wild exploitation**. A local attacker could read configuration, change security-sensitive settings, disconnect the VPN, deregister a peer, and re-register the device to an attacker-controlled NetBird account; in some deployments, the flaw could also be chained with **NetBird SSH** to obtain a root shell. The fix, merged through pull request **`#6967`**, adds OS-level caller identity verification using kernel-derived local credentials and restricts dangerous operations such as changing the management URL, deregistering peers, and weakening SSH protections to privileged users only. NetBird said there is **no safe workaround** that preserves the exposed socket, making an upgrade to **`v0.76.0`** the required remediation for affected clients.
Jul 31, 2026