Fuzz0X

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions prior to 3.5.3-8.1 **Description** A double free issue exists in the QUIC server when processing an INITIAL packet. The default packet handler `port default packet handler()` creates a QRX (QUIC record layer RX) object for packet validation. If the subsequent channel creation via `port bind channel()` fails, the QRX object is freed. However, `port default packet handler()` also attempts to free the same QRX object upon detecting the failure, leading to heap corruption and a Denial of Service (DoS) through process termination. This condition can be triggered by sending a malformed INITIAL packet where the `DCID` (destination connection ID) is shorter than 8 bytes, causing `port bind channel()` to fail after `ossl quic lcidm enrol odcid()` detects the invalid length. **Recommendations** Update to version 3.5.3-8.1 or later.

**Name of the Vulnerable Software and Affected Versions** NanoMQ versions prior to 0.24.6 **Description** NanoMQ MQTT Broker is an all-around Edge Messaging Platform. A flaw exists in the parsing of MQTT v5 Variable Byte Integers where the `get var integer()` function does not perform sufficient bounds checking when accepting 5-byte varints. This can reliably cause an out-of-bounds read and subsequent crash when the software is compiled with AddressSanitizer (ASan). **Recommendations** Update to a version newer than 0.24.6.

**Name of the Vulnerable Software and Affected Versions** CryptoLib versions prior to 1.4.3 **Description** CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) for secure communication between spacecraft and ground stations. Versions prior to 1.4.3 contain a heap buffer overflow in the KMC crypto service integration when decoding Base64-encoded ciphertext/cleartext fields received from the KMC service. The issue arises because the Base64 decoder does not limit the size of the output written to the destination buffer, potentially leading to out-of-bounds writes on the heap. This can result in process crashes and, under certain conditions, code execution. The vulnerability is triggered by oversized Base64 strings within the KMC JSON response. The vulnerable component involves the decoding of `ciphertext` and `cleartext` fields. **Recommendations** Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

**Name of the Vulnerable Software and Affected Versions** PX4 PX4-Autopilot versions up to 1.16.0 **Description** A stack-based buffer overflow exists in the Log Handler module of PX4 PX4-Autopilot. The issue is located in the `MavlinkLogHandler::state listing`/`MavlinkLogHandler::log entry from id` function within the `src/modules/mavlink/mavlink log handler.cpp` file. This manipulation is only possible with local access. **Recommendations** Apply patch 338595edd1d235efd885fd5e9f45e7f9dcf4013d to resolve this issue.