CVE-2025-13878
Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13
CVSS
7.5
High
EPSS
9.4%
p95
KEV
—
Exploit Today
29
0-100
Published: Jan 21, 2026 · Last modified: Sep 1, 2026 · CWE-617 · CWE-1286
9.2%EPSS · 30 days9.4%
2026-09-302026-10-28
Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.
- downloads.isc.orghttps://downloads.isc.org/isc/bind9/9.18.44
- downloads.isc.orghttps://downloads.isc.org/isc/bind9/9.20.18
- downloads.isc.orghttps://downloads.isc.org/isc/bind9/9.21.17
- kb.isc.orghttps://kb.isc.org/docs/cve-2025-13878
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/01/21/3
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:6935
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2025-13878
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2431600
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13878.json
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1191424.8 MED—
———Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.2hCVE-2026-1191394.8 MED—
———Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.2hCVE-2026-1191384.8 MED—
———Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.2hCVE-2026-1191354.8 MED—
———Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types map to the same component model type, crashing the embedding process.2hCVE-2026-1191324.8 MED—
———Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.2hCVE-2026-111107—29.1%
——9A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.1d