Our findings

The Linux kernel's NFC/NCI subsystem can expose uninitialized kernel stack memory when processing crafted RF discovery or interface-activation notifications with zero-length technology-specific parameters. The affected handlers pass uninitialized data into NFC target records that can later be returned to user space.

The Linux kernel's NFC/NCI subsystem can write beyond its fixed-size discovered-target array when an NFC controller repeatedly restarts discovery and reports automatically activated targets. The unchecked target count causes a kernel heap out-of-bounds write and can also make subsequent code walk beyond the array.

An authentication state-management flaw in macOS Screen Sharing can allow a remote attacker to establish a session without valid credentials. Bynario demonstrated that the resulting unauthorized session could be chained with privileged Screen Sharing file-copy behavior to achieve remote root command execution.

The Linux kernel's TIPC broadcast path can read beyond a network packet buffer when processing a malformed Gap ACK blocks record. An unauthenticated network peer can advertise an oversized block count in a short broadcast state message, potentially disclosing kernel memory or crashing the system.

A race in the Linux kernel's Bluetooth MGMT interface can cause add_device_complete() to read an hci_conn_params object after a concurrent device-removal operation has freed it. Triggering the flaw requires high local privileges and a successful race, and can disclose a small amount of kernel memory or crash the system.

When legacy VNC-password access is enabled for macOS Screen Sharing, its file-copy helpers can retain root filesystem privileges after authentication. An attacker who knows the configured VNC password can remotely create and read root-owned files; Bynario used this primitive to obtain a root shell, demonstrating post-authentication remote root command execution.

An oversized directory entry returned by a malicious FUSE server can overflow a Linux kernel page-cache page by 24 attacker-controlled bytes. Bynario demonstrated a working local privilege escalation on Ubuntu 26.04 by steering the overflow into the cached code of the SUID /usr/bin/su binary and executing the corrupted binary to obtain a root shell.

A race in the Linux kernel's CAN raw socket handling can leave raw_rcv() accessing per-CPU uniqueness data after it has been freed, resulting in a use-after-free. A local, low-privileged attacker could exploit the flaw without user interaction, potentially affecting system confidentiality, integrity, and availability.

An out-of-bounds read in Apple operating systems could allow a local app to cause a denial-of-service. Apple addressed the issue with improved bounds checking in iOS and iPadOS 18.7.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1.