Feng Xue

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions prior to 3.5.3-8.1 **Description** A double free issue exists in the QUIC server when processing an INITIAL packet. The default packet handler `port default packet handler()` creates a QRX (QUIC record layer RX) object for packet validation. If the subsequent channel creation via `port bind channel()` fails, the QRX object is freed. However, `port default packet handler()` also attempts to free the same QRX object upon detecting the failure, leading to heap corruption and a Denial of Service (DoS) through process termination. This condition can be triggered by sending a malformed INITIAL packet where the `DCID` (destination connection ID) is shorter than 8 bytes, causing `port bind channel()` to fail after `ossl quic lcidm enrol odcid()` detects the invalid length. **Recommendations** Update to version 3.5.3-8.1 or later.

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 **Description** A heap-based buffer overflow in the Bluetooth AVRCP Profile protocol dissector can lead to a crash, resulting in a denial of service. **Recommendations** Update Wireshark versions 4.6.0 through 4.6.7 to a newer version. Update Wireshark versions 4.4.0 through 4.4.18 to a newer version.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 **Description** A kernel vulnerability exists where an application may be able to leak sensitive kernel state. This issue is caused by insufficient input sanitization. **Recommendations** Update iOS to version 26.5.2. Update iPadOS to version 26.5.2. Update macOS Tahoe to version 26.5.2.