Time-of-check time-of-use (TOCTOU) race condition in the TraceEvent() system call of BlackBerry QNX Neutrino RTOS permits local attackers holding the PROCMGR_AID_TRACE kernel capability to trigger information disclosure, data tampering, or a kernel crash across three distinct product lines including safety- and medical-certified variants. Affected deployments span QNX Software Development Platform 7.0-7.1, QNX OS for Safety through 2.2.8, and QNX OS for Medical through 2.0.2. No public exploit or active exploitation has been identified; EPSS places this in the 1st percentile for near-term in-the-wild exploitation probability, and SSVC confirms exploitation status as none, though SSVC technical impact is rated total reflecting the kernel-level blast radius when conditions are met.
Stored Cross-Site Scripting in the News Kit Addons For Elementor WordPress plugin (versions ≤1.4.6) permits authenticated contributors to persistently inject arbitrary JavaScript into pages via the Site Logo Title and Single Author Box widgets by manipulating the elementor_ajax AJAX save request to bypass client-side tag-name restrictions. Every user who subsequently visits an injected page executes the attacker's script in their browser, enabling session hijacking, credential theft, or admin-level actions on their behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in version 1.4.7.
Memory exhaustion in elixir-mint's HTTP/2 client library (mint) allows a malicious or attacker-controlled HTTP/2 server to crash any BEAM application using the library by streaming unbounded zero-length CONTINUATION frames that bypass the existing byte-size guard. Affected versions span mint 0.1.0 through 1.9.1; a vendor-released patch is confirmed in 1.9.2. No public exploit or CISA KEV listing exists at time of analysis, but the explicit SSRF and redirect attack vectors meaningfully increase realistic exposure for server-side Elixir applications that proxy user-supplied URLs.
HTTP request smuggling in Eclipse Grizzly before 5.0.2 stems from the framework's inability to correctly parse malformed trailer header lines in chunked HTTP requests, enabling CWE-444 boundary-confusion attacks. Remote unauthenticated attackers who can send crafted chunked requests through a front-end proxy to a GlassFish-backed server can cause the proxy and Grizzly to disagree on request boundaries, smuggling attacker-controlled content as the prefix of a subsequent legitimate user's request. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 4.0 AT:P condition signals that specific deployment prerequisites must be met.
Server-side request forgery in Simple Machines Forum's image proxy allows any authenticated forum member to force the SMF host to make arbitrary internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags. Because SMF automatically generates HMAC signatures authorizing any image URL the proxy encounters, an attacker can obtain a valid signed request targeting cloud instance metadata endpoints (169.254.169.254), RFC1918 internal web applications, and container network services - with no public exploit code identified at time of analysis and no CISA KEV listing. The highest-impact exposure is in cloud-hosted deployments where IMDS credential theft via SSRF could enable lateral movement beyond the SMF host itself.
Unauthorized command execution on NETGEAR DGND3700v1 routers (firmware ≤ V1.0.0.17) is achievable by any unauthenticated attacker present on the same local WiFi or LAN segment, exploiting improper input validation that effectively bypasses authentication controls. The CVSS 4.0 vector (AV:A/PR:N/VC:H/VI:H/VA:H) reflects full confidentiality, integrity, and availability impact on the vulnerable device. No public exploit code or confirmed active exploitation exists; NETGEAR identified this issue and published a July 2026 security advisory, though testing was conducted only against a simulated firmware environment and has not been verified on physical production hardware.
MIME type restriction bypass in TYPO3 CMS 14.2.0-14.3.5 allows unauthenticated attackers to upload files of arbitrary MIME types through forms configured with FileUpload or ImageUpload elements, circumventing the allowedMimeTypes restriction entirely. The flaw originates from a lifecycle ordering defect in the server-side form framework: MimeTypeValidator is registered before concrete form definition properties are applied, so it is absent from the validation pipeline at runtime. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network-accessible, zero-prerequisite-auth nature of the bypass elevates practical risk wherever affected forms are publicly exposed.
Privilege escalation in the Windows USB Print Driver affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, exploitable by a physically-present attacker with low-privilege credentials via a race condition in the driver's shared resource handling. The flaw requires both physical device access and precise timing to win the synchronization window, making exploitation non-trivial. No public exploit identified at time of analysis; EPSS stands at 0.17% (7th percentile), and SSVC rates exploitation as none - consistent with high attack complexity and the physical access prerequisite.
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally authenticated, high-privileged attacker to influence the code generation pipeline under complex, interaction-dependent conditions, potentially leading to arbitrary code execution, data tampering, and information disclosure. Despite the high CIA impact ratings, the attack prerequisites - local access, high privileges, high complexity, and required user interaction - severely constrain real-world exploitability. No public exploit exists, EPSS sits at the 2nd percentile (0.12%), and CISA SSVC records exploitation status as none.
Local information disclosure in Windows DirectX exposes sensitive data to unauthorized local actors across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-200) achieves high confidentiality impact per the CVSS vector while producing no integrity or availability impact, meaning an attacker gains read access to protected data without disrupting system operation. No public exploit has been identified at time of analysis; EPSS at 0.38% (30th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability despite the wide affected surface.
Windows Kernel information disclosure across a broad range of Microsoft Windows desktop and server editions allows a local, unprivileged attacker to read sensitive kernel memory or system state not intended for user-space access. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:N confirms local code execution with no special privileges is sufficient to trigger the flaw. EPSS sits at 0.38% (30th percentile) with no CISA KEV listing and SSVC exploitation status of 'none,' indicating no confirmed or publicly observed active exploitation at time of analysis; however, kernel information leaks of this class are routinely used to stage ASLR-bypass steps in multi-stage privilege escalation chains.
Open redirect in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows remote unauthenticated attackers to construct malicious URLs that silently forward victims to attacker-controlled phishing sites, enabling credential theft and account takeover. The flaw spans the full product family across multiple supported version branches and was disclosed by Adobe via Security Bulletin APSB26-73 with patches released in July 2026. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as 'none' with EPSS at 0.74% (50th percentile), indicating limited real-world exploitation signal despite broad product prevalence.
Improper input validation in Adobe's Content Credentials suite (C2PA Rust SDK, JS SDK, and c2patool CLI) allows a local attacker without privileges to crash the application by supplying malformed C2PA manifest content, resulting in a denial-of-service condition. Affected components span the Rust library (c2pa ≤ 0.84.0), the Node.js web SDK (@contentauth/c2pa-web ≤ 0.7.0), and the command-line tool (c2patool ≤ v0.16.5). No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable attack paths.
Integer underflow in Adobe's C2PA Content Credentials SDKs (Rust, JavaScript/Node.js, and CLI tool) allows an attacker to crash the host application by supplying a maliciously crafted C2PA manifest, resulting in a denial-of-service condition. All three release tracks are affected - the Rust SDK (≤0.84.0), the JS SDK (≤0.7.0), and c2patool (≤0.16.5) - with vendor-released patches available for each. No public exploit code has been identified at time of analysis, and EPSS sits at the 5th percentile, consistent with SSVC's 'exploitation: none' assessment.
Uncontrolled resource consumption in Adobe's C2PA Content Credentials Rust SDK, CLI tool (c2patool), and JavaScript web SDK allows a local attacker supplying a crafted input to exhaust system resources and crash the application. All three library families are affected across distinct runtimes - Rust, Node.js, and native binary - with patched releases available for each. No public exploit exists, SSVC classifies exploitation as none, and EPSS sits at the 5th percentile, indicating low real-world exploitation pressure despite the zero-user-interaction requirement.
Integer overflow in Adobe's Content Credentials SDK family (c2pa Rust SDK, c2pa-web JS SDK, and c2patool CLI) allows a local attacker to crash any application that processes a specially crafted C2PA manifest, resulting in denial of service. All three components share the vulnerable parsing logic and are affected across versions up to c2pa-v0.84.0, @contentauth/c2pa-web@0.7.0, and c2patool-v0.16.5 respectively. No public exploit exists and SSVC confirms no observed exploitation; however, patches are available and should be applied given the zero-privilege-required local trigger condition.
Integer underflow (CWE-191) in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa), JavaScript/Node.js SDK (c2pa-web), and c2patool command-line utility - crashes the application when processing a maliciously crafted C2PA manifest or media file, resulting in a denial-of-service condition. All three components share the same vulnerable code path, broadening the attack surface across toolchains. No public exploit has been identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm this is not currently being targeted.
Unbounded GPU resource allocation in NVIDIA TensorRT-LLM's OpenAI-compatible inference API allows an attacker to exhaust GPU resources on the host system, resulting in denial of service. Affected versions span all releases up to and including v1.3.0 rc14. No public exploit or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none and technical impact as partial, consistent with a localized availability-only impact.
Denial of service in NVIDIA TensorRT-LLM (versions through v1.3.0 rc15) allows an attacker who can submit requests to the OpenAI-compatible inference API to trigger a reachable assertion in the sampler thread, crashing the inference service. The impact is limited strictly to availability - no confidentiality or integrity compromise is possible. No public exploit has been identified, EPSS sits at 0.12% (2nd percentile), and CISA SSVC rates exploitation status as none, placing this at low operational priority for most teams.
NVIDIA TensorRT-LLM versions through v1.3.0 rc14 exposes a gRPC server chat API endpoint susceptible to improper input validation (CWE-20), enabling a local attacker to crash the inference service and cause denial of service. The impact is strictly limited to availability - no code execution, confidentiality breach, or integrity compromise is possible. No public exploit code exists, EPSS sits at the 2nd percentile (0.12%), and CISA SSVC rates exploitation as 'none' with technical impact as 'partial', collectively indicating low urgency despite the moderate CVSS 6.2 score.
Kernel crash in BlackBerry QNX Neutrino is triggerable by any local, unprivileged user via a malformed SchedGet() system call, resulting in full system availability loss. Affected platforms include QNX Software Development Platform 7.0 and 7.1, QNX OS for Safety (multiple branches up to 2.2.8), and QNX OS for Medical 2.0.2 and earlier. No active exploitation has been identified (EPSS 0.11%, CISA SSVC exploitation: none), but the safety-critical operational contexts in which QNX is deployed - automotive, medical devices, industrial automation - make a kernel crash disproportionately consequential relative to the moderate CVSS score.
Open redirect in Ivanti Xtraction before 2026.2.1 enables remote unauthenticated attackers to craft URLs that silently forward users to arbitrary external destinations. The vulnerability carries a Scope:Changed rating (S:C) in the CVSS vector, reflecting that the impact extends beyond the vulnerable application to the user's browser environment - a hallmark of effective phishing and credential harvesting campaigns. No public exploit code and no CISA KEV listing exist at time of analysis, and the AC:H metric in the vendor-provided vector suggests exploitation may not be trivially reliable in all configurations.
Out-of-bounds read in Microsoft Excel's spreadsheet parser (CWE-125) exposes affected systems to both local information disclosure and application crash when a victim opens a specially crafted file, spanning Excel 2016 through Office LTSC 2024 and Office 365 for Mac. The CVSS vector (AV:L/UI:R/A:H) reveals that while the CVE description emphasizes information disclosure, the primary real-world impact is application availability - the invalid memory read can crash Excel (A:H), with incidental memory content leakage (C:L) as a secondary effect. No public exploit code has been identified at time of analysis and CISA SSVC assigns exploitation status of none, consistent with a low EPSS score of 0.31% at the 23rd percentile.
Reflected or stored cross-site scripting in Fortinet FortiOS, FortiPAM, and FortiProxy web interfaces allows a remote unauthenticated attacker to execute JavaScript in the browser session of an authenticated administrator via crafted HTTP requests. The CVSS temporal metric E:P confirms publicly available proof-of-concept exploit code exists, and the RL:O metric confirms Fortinet has released an official fix. No active exploitation has been confirmed by CISA KEV at time of analysis, but the combination of a POC and the high-value targets (network security appliances and privileged access management systems) elevates real-world risk beyond what the base CVSS score of 6.1 suggests.
Security feature bypass in the Windows System component on Windows 11 and Windows Server allows an authenticated local attacker with standard user privileges to circumvent an access control protection, yielding high confidentiality exposure and limited integrity impact. Affected platforms span Windows 11 versions 24H2 through 26H1 and Windows Server 2022 and 2025. No public exploit has been identified and CISA SSVC rates exploitation as none with non-automatable delivery, making this a moderate-priority local threat despite the high confidentiality impact signal in the CVSS vector.
Missing authentication enforcement in the Microsoft Windows DNS component allows a low-privileged local attacker to tamper with DNS configuration or records without requiring elevated credentials. Affected platforms span Windows 10 (versions 1809 through 22H2), Windows 11 (versions 24H2 through 26H1), and Windows Server 2019 through 2025 - a broad deployment footprint across enterprise environments. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' with partial technical impact, but the high integrity impact (CVSS I:H) warrants attention in multi-user environments and on DNS server infrastructure where record integrity is critical.
CSS stylesheet injection in SAP @ui5/webcomponents-base allows unauthenticated remote attackers to load arbitrary cross-origin stylesheets into victim pages by bypassing the sap-allowed-theme-origins allowlist enforcement inside setThemeRoot(). The ?sap-themeRoot URL query parameter is a direct delivery vector, making socially-engineered exploitation trivial - no authentication is required from the attacker (CVSS PR:N), only a victim page load (UI:R). Successful exploitation enables UI redressing, clickjacking, phishing overlays, visual defacement, and limited CSS attribute-selector-based data exfiltration; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal enables unauthenticated remote attackers to inject arbitrary JavaScript into URL parameters that are echoed back unencoded in server responses. When a victim with an active portal session visits a crafted URL, the injected script executes in their browser under the portal's origin, permitting session token theft, unauthorized manipulation of portal content, or forced redirection to attacker-controlled resources. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the unauthenticated network-accessible attack surface and low complexity make phishing-based delivery operationally straightforward.
Active Directory Federation Services (AD FS) on multiple Windows Server and Windows 10 platforms contains an infinite loop flaw (CWE-835) that a remote unauthenticated attacker can trigger to exhaust service resources and cause a sustained denial of service. The attack requires high complexity (CVSS AC:H) but no authentication, targeting organizations that expose AD FS endpoints to the network. No public exploit code exists and CISA SSVC confirms no known exploitation at time of analysis; Microsoft has released patches across all affected platforms.
Denial of service in Siemens SIMATIC S7-PLCSIM Advanced (all versions) allows an unauthenticated attacker on the same local network segment to exhaust the application's memory by flooding it with high-volume multicast traffic, rendering the PLC simulation instance inaccessible until manually restarted. Exploitation is limited to instances running a specific active project configuration, and no project data is lost. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of Service in Trellix HX (versions 10.0.0 and earlier) allows an authenticated network attacker to exhaust appliance resources by submitting a specially crafted highly-compressed file to the HX console, triggering the product's own detection engine to perform runaway decompression. The impact is limited to availability - the EDR appliance becomes unresponsive - but disruption of an endpoint detection and response platform carries secondary operational risk by creating a monitoring blind spot. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Incorrect Authorization (CWE-863) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe Commerce Webhooks Plugin exposes sensitive data to unauthenticated remote attackers who can bypass security controls to gain unauthorized read access. Exploitation is constrained by high attack complexity - conditions beyond the attacker's control must be satisfied - which aligns with the SSVC assessment of non-automatable exploitation and the low EPSS score of 0.61% (45th percentile). No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog as of analysis date; Adobe has released July 2026 patches across all affected product lines per advisory APSB26-73.
Incorrect authorization in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin exposes sensitive data to remote unauthenticated attackers who can bypass security controls to gain unauthorized read access. Classified as CWE-863 (Incorrect Authorization), the flaw carries a CVSS 3.1 score of 5.9 with high confidentiality impact but is gated by high attack complexity - exploitation depends on conditions outside the attacker's control. No public exploit has been identified at time of analysis, EPSS stands at 0.61% (45th percentile), and CISA SSVC assesses exploitation as none and not automatable, indicating meaningful barriers to opportunistic mass exploitation.
Heap buffer over-read in libsoup's HTTP/2 GOAWAY frame parser allows remote unauthenticated attackers to crash applications or leak heap memory fragments by sending a malformed frame with a non-NUL-terminated Additional Debug Data payload. Affected deployments include applications built on libsoup running on Red Hat Enterprise Linux 10 that accept or initiate HTTP/2 connections. A proof-of-concept exists per SSVC data, though exploitation is rated non-automatable and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Memory leak in libsoup's HTTP/2 implementation allows a remote, unauthenticated attacker to incrementally exhaust heap memory and crash the affected application through a sustained out-of-memory condition. Affected deployments include any application linking libsoup on Red Hat Enterprise Linux 6 through 10 that handles HTTP/2 connections from untrusted peers. No public exploit code has been identified and CISA has not listed this in KEV; however, the network-accessible attack surface with no authentication requirement makes it relevant for internet-facing services using libsoup. Notably, the provided CVSS vector (C:H/I:N/A:N) is internally inconsistent with the DoS-only description - the correct impact metrics should reflect Availability, not Confidentiality, and this discrepancy is flagged in the risk assessment.
Security feature bypass in Adobe Premiere Pro allows a local attacker to gain unauthorized write access by exploiting improper input validation (CWE-20). Both the 25.x and 26.x release branches are affected - versions up to and including 25.6.5 and 26.2.2 respectively - with scope change noted in the CVSS vector, indicating the write-access impact extends beyond Premiere Pro's own security boundary. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.16% (5th percentile), and SSVC classifies exploitation as none with partial technical impact, suggesting this is a theoretical-to-low real-world risk despite the integrity-focused impact.
Incorrect listener-rule priority ordering in AWS Load Balancer Controller before v3.4.2 enables authenticated Kubernetes users to intercept, spoof, or deny gRPC traffic belonging to other namespaces on a shared Gateway. The controller incorrectly assigned ALB listener rule priority by route kind (HTTPRoute vs GRPCRoute) rather than route specificity, causing all HTTPRoutes to be evaluated before GRPCRoutes at the ALB layer regardless of which was more specific or narrower in scope. No public exploit has been identified at time of analysis, but the SSVC framework rates technical impact as total for the subsequent system, reflecting that cross-namespace traffic confidentiality, integrity, and availability are fully compromised when conditions are met.
Denial of service in Windows Hyper-V allows an authorized, adjacent-network attacker to crash or disrupt the hypervisor by triggering a buffer over-read (CWE-126). Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, covering a broad slice of Microsoft's enterprise footprint. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but a vendor-issued patch is available via Microsoft MSRC.
Stack-based buffer overflow in multiple NETGEAR Orbi mesh WiFi models (RBR860, RBRE950/960, RBE970/971, RBS860, RBSE950/960) enables an unauthenticated adjacent-network attacker to crash or force a restart of the affected device, causing a loss of network connectivity. The root cause is CWE-121 (stack-based buffer overflow), meaning a crafted network payload can overwrite stack memory and destabilize the device process. The CVSS 4.0 supplemental metric E:P indicates a proof-of-concept exploit exists, elevating practical risk despite the moderate base score of 5.7.
Information disclosure in Windows File Explorer exposes sensitive memory contents to local attackers due to CWE-908 use of an uninitialized resource. Triggered when a local user interacts with File Explorer, the flaw allows memory contents - potentially including sensitive data from other processes or the OS - to be read without elevated privileges. No public exploit code has been identified and CISA has not listed this in KEV, but the breadth of affected platforms (Windows 10 through 11 and Windows Server 2012 through 2025) makes patching broadly applicable.
Uninitialized memory exposure in the Microsoft Windows Codecs Library enables a local attacker to disclose sensitive process memory contents on affected Windows systems. The flaw (CWE-908) requires user interaction - specifically opening or processing a specially crafted media file - but demands no elevated privileges. No public exploit code exists and no active exploitation is confirmed; EPSS sits at 0.51% (40th percentile), consistent with SSVC's 'Exploitation: none' assessment, making this a medium-severity, low-urgency issue relative to the breadth of affected platforms.
Out-of-bounds read in Microsoft Office and SharePoint Server exposes local memory contents to an unauthorized attacker, resulting in information disclosure. The vulnerability (CWE-125) is triggered when a user opens a specially crafted Office document, making exploitation dependent on user interaction rather than remote network access. No active exploitation has been confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as none, and EPSS probability sits at 0.51% (40th percentile), collectively indicating low real-world threat activity despite the wide deployment footprint of affected products.
Out-of-bounds read in Microsoft Office exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a user to open a crafted document. The flaw affects a wide swath of Office and SharePoint products across Windows and Mac platforms, including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, Office 365 for Mac, and SharePoint Server 2016 through the Subscription Edition. No public exploit has been identified at time of analysis, EPSS is low at 0.50% (39th percentile), and CISA SSVC rates exploitation as none and the flaw as non-automatable, placing this firmly in a patch-and-monitor risk tier rather than an emergency-response tier.
Windows Win32K information disclosure on multiple Windows 10, Windows 11, and Windows Server releases allows a locally authenticated low-privilege user to read sensitive kernel-level data that should be inaccessible to user-space processes. Rooted in CWE-200 (improper exposure of sensitive information), the flaw exposes confidentiality-impacting data via the Win32K graphical subsystem without requiring elevated rights or user interaction from another party. No public exploit code has been identified, CISA SSVC rates exploitation status as 'none,' and the EPSS score of 0.47% (38th percentile) confirms low near-term exploitation probability.
Windows Cryptographic Services on multiple Windows 10, Windows 11, and Windows Server editions contains a CWE-200 information disclosure flaw that allows a locally authenticated attacker with standard user privileges to read sensitive cryptographic material they should not be authorized to access. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is entirely local and requires a pre-existing low-privilege session, positioning this as an insider threat or post-compromise scenario rather than an initial access vector. No public exploit code has been identified, CISA SSVC rates exploitation as none, and EPSS sits at only 0.47%, collectively indicating low real-world exploitation activity at time of analysis.
Information disclosure in the Windows Quality of Service (QoS) Packet Scheduler component exposes sensitive data to locally authenticated low-privileged users across a wide range of Windows client and server releases. The flaw (CWE-200) allows a local attacker with standard user access to read memory or network-related data that should be restricted to higher-privilege contexts. No public exploit exists and SSVC classifies exploitation as none with partial technical impact, but the breadth of affected Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - makes patching a broad operational priority.
Windows File Explorer exposes sensitive information to low-privileged local authenticated users across a wide range of Windows 10, Windows 11, and Windows Server versions. Classified under CWE-200, the flaw enables an attacker already present on a system with standard user rights to access data they should not be permitted to view - no elevation of privilege or remote access is required. No public exploit code has been identified and CISA SSVC confirms no active exploitation, keeping real-world urgency moderate despite the broad affected product surface.
Windows Cryptographic Services across all supported Microsoft Windows client and server editions exposes sensitive cryptographic material to locally authenticated low-privilege users through a CWE-200 information disclosure flaw. Spanning Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, the vulnerability allows an attacker with a standard local account to read confidential data - likely cryptographic keys, certificates, or intermediate cryptographic state - without any user interaction. SSVC rates exploitation as none, EPSS at 0.47% (38th percentile) indicates low near-term exploitation probability, and no active exploitation has been confirmed by CISA KEV, positioning this as a routine patch-cycle priority rather than an emergency response.
Out-of-bounds read in Microsoft Excel's file parsing engine exposes sensitive memory contents when a victim opens a specially crafted workbook, affecting Excel 2016 through Office LTSC 2024 and Office Online Server across both Windows and macOS platforms. The CVSS vector (AV:L/UI:R/C:H/I:N/A:N) confirms impact is limited to confidentiality loss - no code execution results - and requires local user interaction to trigger. No public exploit has been identified and CISA has not listed this in KEV; with an EPSS of 0.46% and SSVC exploitation status of none, this is appropriate for standard patch cycle prioritization rather than emergency response.
Untrusted pointer dereference in Microsoft Excel exposes sensitive in-process memory to a local attacker across virtually the entire Office product family - Excel 2016 through Office LTSC 2024 on Windows and macOS, plus Office Online Server. An attacker must deliver a crafted spreadsheet and induce the victim to open it; successful exploitation yields high confidentiality impact with no integrity or availability effect. No public exploit code or active exploitation has been identified; EPSS at 0.46% (37th percentile) and SSVC exploitation status of 'none' are consistent with low real-world risk at this time.