Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.
Integer underflow and heap out-of-bounds read in llama.cpp's DRY sampler (builds b3978 through b9058) allows remote unauthenticated attackers to crash the inference server or corrupt token sampling probabilities by sending a single crafted HTTP request. Setting the `dry_allowed_length` parameter to INT32_MIN triggers arithmetic wrap-around in the sampler, causing it to read memory before the allocated heap buffer and producing a SIGSEGV that terminates service for all connected users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially reproducible single-parameter trigger makes this a high-priority issue for any deployment exposing the llama.cpp HTTP API on a network.
Server-Side Request Forgery in Foxit PDF Services API allows low-privileged remote attackers to bypass local file access restrictions by embedding redirect-chain URLs in PDF creation requests, causing the server to fetch arbitrary internal resources and disclose sensitive information. The CVSS vector (S:C/C:H) confirms the scope change extends to internal backend systems inaccessible to the attacker directly, making this a meaningful lateral-visibility primitive in environments where the API reaches internal network segments. No public exploit identified at time of analysis, and no KEV listing, though the low attack complexity elevates urgency for internet-exposed deployments.
Heap buffer overflow in FFmpeg's DVB subtitle parser (libavcodec/dvbsub_parser.c) affects all releases from version 0.5 through 8.x, enabling potential remote code execution when a victim processes a crafted WTV file. A signed integer overflow causes the bounds-check guard to wrap to INT_MIN, silently bypassing the PARSE_BUF_SIZE comparison and allowing attacker-controlled data to be written out-of-bounds on the heap via memcpy(). No active exploitation has been confirmed by CISA KEV and no public POC has been identified at time of analysis, but the RCE-capable heap corruption primitive in a ubiquitously embedded media library represents material risk for any pipeline that ingests untrusted media files.
Integer overflow in llama.cpp's llama_batch_init() function across builds b1283 through b9058 enables heap corruption via unchecked multiplicative arithmetic in malloc() size calculations - when computed allocation sizes wrap past INT32_MAX, the resulting under-sized heap buffer is overwritten by subsequent batch operations, creating a credible path to arbitrary code execution in the context of the host process. The vulnerability affects versions 0.4.0 through 0.17.1 and any application embedding the affected build range of the library. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but the heap corruption primitive paired with the RCE tag warrants expedited patching in production AI inference pipelines.
Integer overflow in the llama.cpp LLaMA-Android JNI wrapper (builds b1886 through b7445) allows heap corruption through a crafted n_seq_max parameter, enabling denial of service or arbitrary code execution within Android applications that load untrusted GGUF model files. The flaw exists in the new_1batch() function, which multiplies sizeof(llama_seq_id) by an attacker-controlled value without bounds checking, causing heap allocation to wrap and undersize the buffer. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV; a patched release (b7446) is confirmed available from the upstream ggml-org repository.
Heap corruption via mismatched memory management in llama.cpp's LLaMA-Android JNI wrapper affects builds b1886 through b7445, where new_1batch() allocates memory with malloc() but free_1batch() releases it using the C++ delete operator, triggering undefined behavior and heap metadata corruption. This mismatch guarantees denial of service via process crash and, depending on allocator state, may enable arbitrary code execution within the affected Android application process. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV; a vendor-released patch exists as build b7446.
CatchPulse endpoint security software exposes an unrestricted kernel filter communication port that any non-administrative local user can connect to, enabling complete bypass of its security policy enforcement. The CVSS scope-changed vector (S:C, I:H, A:H) reflects that a low-privileged local user can subvert kernel-level security controls - effectively neutralizing the host's endpoint protection layer. No public exploit code has been identified at time of analysis, but the CSA Singapore advisory (AL-2026-098) indicates official government-level disclosure.
Use-after-free in the WebGL subsystem of Google Chrome for Android (prior to 151.0.7922.109) enables sandbox escape for an attacker who has already achieved renderer-process compromise. By directing a victim to a crafted HTML page, an adversary with existing renderer access can exploit freed memory corruption in WebGL to break out of Chrome's sandbox and reach OS-level execution on the Android device. No public exploit code or active exploitation has been identified; SSVC rates exploitation as none and automatable as no, though technical impact is assessed as total given the full scope change.
Sandbox escape in Google Chrome prior to 151.0.7922.109 enables a remote attacker who has already compromised the renderer process to break out of Chrome's OS-level security sandbox via a crafted HTML page. This is a second-stage, chained vulnerability - not directly exploitable in isolation - making it a high-value component in multi-step browser attacks that pair a renderer exploit with this UI input validation flaw to achieve full OS-level code execution. No public exploit has been identified and SSVC rates exploitation status as none at time of analysis, though the total technical impact and confirmed scope change (S:C) make this a critical priority when chained with any renderer compromise.
Heap buffer overflow in the CrashReporting component of Google Chrome prior to 151.0.7922.109 enables sandbox escape when an attacker has already compromised the renderer process and can deliver a crafted HTML page. The CVSS scope change (S:C) and total technical impact rating confirm full host system compromise is achievable as the second stage of a chained exploit. No public exploit code or active exploitation has been identified at time of analysis, per SSVC exploitation status of 'none' and absence from CISA KEV.
Use-after-free in Chrome's Views component prior to version 151.0.7922.109 enables a sandbox escape for remote attackers who have already compromised the renderer process, via a crafted HTML page. The CVSS scope change (S:C) confirms the potential for OS-level code execution beyond Chrome's renderer sandbox, earning a Critical severity designation from the Chromium security team despite an NVD score of 8.3. No public exploit code or CISA KEV confirmation has been identified at time of analysis, though this vulnerability class is a high-value target frequently weaponized as the second stage of browser exploit chains by sophisticated threat actors.
Sandbox escape in Google Chrome on Android (prior to 151.0.7922.109) via a use-after-free vulnerability in the Skia graphics library allows a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox through a crafted HTML page. The CVSS vector (S:C, C:H/I:H/A:H) confirms full cross-boundary compromise, elevating an attacker from renderer-level code execution to broader Android OS access. No active exploitation is confirmed at time of analysis (SSVC exploitation: none; not listed in CISA KEV), though Technical Impact is rated total by CISA's SSVC framework.
Use-after-free exploitation in Google Chrome's Media component on Windows enables sandbox escape for attackers who have already compromised the renderer process. Chrome versions prior to 151.0.7922.109 on Windows are affected, with a crafted HTML page serving as the trigger mechanism to corrupt freed memory and break out of the renderer sandbox. SSVC rates current exploitation as none and non-automatable, though the total technical impact class reflects full OS-level compromise if the two-stage attack chain is completed successfully.
Use-after-free in the Payments component of Google Chrome prior to 151.0.7922.109 enables a sandbox escape when an attacker has already compromised the renderer process. Exploitation requires chaining a prior renderer compromise with delivery of a crafted HTML page, placing this firmly in the category of multi-stage browser exploitation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and SSVC classifies exploitation status as none, though the technical impact is rated total due to the full sandbox escape capability.
Sandbox escape via GPU use-after-free in Google Chrome prior to 151.0.7922.109 enables a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox by delivering a crafted HTML page. The vulnerability resides in Chrome's GPU component and, if successfully chained after an initial renderer compromise, yields full confidentiality, integrity, and availability impact on the host system. No public exploit code has been identified at the time of analysis, and SSVC classifies exploitation status as none with automatable set to no, indicating no evidence of active or mass exploitation.
Use-after-free in Chrome's Resources component on Android enables sandbox escape for attackers who have already established a foothold in the renderer process. Affected versions are all Chrome for Android releases prior to 151.0.7922.109. The CVSS scope change (S:C) and High ratings across Confidentiality, Integrity, and Availability confirm that successful exploitation breaks out of the browser sandbox, exposing the underlying Android OS. No public exploit code or CISA KEV listing exists at time of analysis, though the chained exploit capability (renderer-to-sandbox-escape) represents a critical capability for advanced threat actors.
Cryptographic timing side-channel in OMICRON StationScout before version 3.05 allows unauthenticated network attackers to forge valid authentication credentials, bypass authentication and authorization entirely, and impersonate legitimate clients - granting full access to system configuration and the ability to inject traffic into the connected substation network. The CVSS 4.0 vector confirms unauthenticated remote exploitability (PR:N, AV:N) with high complexity (AC:H) reflecting the statistical measurement precision timing attacks require, and scope-change indicators (SC:H/SI:H/SA:H) capture downstream risk to connected OT systems. No public exploit has been identified at time of analysis, and the CVSS 4.0 supplemental metric E:U corroborates absence of confirmed exploitation.
Sandbox escape in Google Chrome's Aura display layer on Linux allows a remote attacker with an already-compromised renderer process to break out of the Chrome sandbox via a crafted HTML page, achieving full system-level code execution. Affected versions are all Chrome builds prior to 151.0.7922.109 on Linux. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS scope-changed rating (S:C) and High across C/I/A reflect the severe post-exploitation impact of a successful sandbox escape in a privileged browser context.
Out-of-bounds write in Skia enables sandbox escape in Google Chrome prior to 151.0.7922.109, allowing a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is explicitly a second-stage chaining vulnerability - it does not independently achieve initial code execution but elevates a renderer-level compromise to full OS-level access. No public exploit code or active exploitation has been identified at time of analysis, though the scope-changing nature of this vulnerability makes it a high-value target for chained browser exploit chains.
Sandbox escape in Google Chrome prior to 151.0.7922.109 allows a remote attacker who has already compromised the renderer process to break out of Chrome's isolation boundary via a crafted HTML page exploiting insufficient Navigation policy enforcement (CWE-693). This is a second-stage exploit primitive: it elevates a sandboxed renderer breach into full host OS code execution at browser-process privilege, crossing Chrome's core security boundary as reflected in the CVSS Scope:Changed metric. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-confirmed patch shipped in the 151.0.7922.109 stable channel update.
Out-of-bounds write in the GPU process of Google Chrome on Linux enables sandbox escape when an attacker has already compromised the renderer process. Specifically, an attacker controlling the renderer can deliver a crafted HTML page that triggers CWE-787 memory corruption in the GPU process, which operates with higher OS-level privileges than the sandboxed renderer, allowing full sandbox escape. Versions prior to 151.0.7922.109 on Linux are affected; no public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of no public exploit identified at time of analysis.
Session hijacking via missing source address validation in Sonic 3 A.I.R.'s OxygenEngine ConnectionManager allows an on-path network attacker to inject arbitrary UDP packets into any established multiplayer session. The flaw exists because established connections are resolved solely by a two-byte local connection handle with no verification that the packet's source address matches the registered remote address, enabling session termination, channel message forgery, and response spoofing without IP address spoofing. No public exploit or CISA KEV listing exists, but the CVSS 4.0 score of 8.3 (AC:H) reflects that network on-path positioning is required, limiting opportunistic mass exploitation.
Quadratic CPU and memory exhaustion in html_sanitize_ex affects all applications that accept user-supplied HTML for sanitization, regardless of scrubber configuration. The traversal engine's list clause performs a redundant List.flatten over the entire remaining sibling tail at every recursion step, making sanitization cost O(n²) in sibling count rather than O(n). A 160 KB input of 20,000 sibling elements monopolizes a BEAM scheduler for approximately 1.7 seconds per request; no public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the attack requires no authentication and no special server configuration.
CPU exhaustion via quadratic regex backtracking in rrrene/html_sanitize_ex, an Elixir HTML sanitization library, allows unauthenticated remote attackers to saturate the BEAM scheduler pool and render applications unresponsive. The CSS scrubber's declaration regex applies an unbounded greedy quantifier on the property-name token; a crafted 80 KB style body containing no valid CSS colon costs approximately 2.4 seconds of scheduler time per request, meaning a handful of concurrent requests fully deny service. Affected versions span 0.3.1 through 1.5.2 inclusive; impact is strictly availability — no confidentiality or integrity loss occurs. No public exploit or CISA KEV listing is identified at time of analysis.
JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over GraphQL-over-WebSocket connections, bypassing @authentication and @subscriptionsAuthorization directive controls. Affected library versions prior to 7.5.6 (v7 branch) and 5.12.14 (v5 branch) accept client-supplied, pre-decoded JWT objects in subscription connectionParams without any cryptographic verification, meaning the library treats attacker-controlled identity claims as authenticated. No public exploit or KEV listing has been identified at time of analysis, but the exploitation barrier is low given the network-accessible vector and absence of authentication requirements.
Reflected cross-site scripting in AIL Framework's /tag/add_tags endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of any authenticated AIL user who opens a specially crafted link. The flaw originates from the error-handling path in tags_ui.py, which returned raw Python string output via str(res[0]) directly as an HTML response without output encoding, permitting attacker-controlled content to be reflected and rendered by the victim's browser. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix has been committed to the GitHub repository.
Unauthenticated broken access control in BoldGrid's Total Upkeep WordPress backup plugin (versions up to and including 1.17.2) permits remote unauthenticated attackers to invoke privileged backup management functions without any authentication. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no prerequisites beyond network reachability. The high availability impact (A:H) alongside low integrity impact (I:L) suggests attackers can delete, overwrite, or disrupt backup data, eliminating an organization's ability to recover from other incidents. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in WPMU DEV Dashboard (WordPress plugin) versions up to and including 5.0.0 enables unauthenticated remote attackers to invoke privileged Hub actions - including remote code execution by installing a plugin from an attacker-controlled URL, takeover of an administrator account via SSO, deletion of plugins and themes, and forced WordPress core upgrades - on any site not yet connected to the WPMU DEV Hub. The default post-installation state is unconnected, meaning every fresh installation is immediately exposed until Hub onboarding is completed. No public exploit or CISA KEV listing has been identified at time of analysis, though the impact ceiling (unauthenticated RCE) and the breadth of default-state exposure make this a high-priority remediation target.
Account takeover in Statamic CMS allows unauthenticated network attackers to authenticate as any existing user - including super admins - by exploiting email-based OAuth user matching against providers that do not guarantee verified email addresses. Affected are all Statamic 5.x releases before 5.74.1 and all 6.x releases before 6.24.0 when OAuth is explicitly enabled with an untrusted provider. No public exploit code has been identified at time of analysis, but the published patch diff (PR #14887) fully discloses the vulnerable code path, materially lowering the barrier for independent exploit development.
Local File Inclusion in the e2pdf WordPress plugin (versions up to and including 1.32.40) enables unauthenticated remote attackers to include arbitrary PHP files from the server filesystem, potentially yielding full confidentiality, integrity, and availability compromise. Reported by Patchstack and registered under ENISA EUVD-2026-53913, the flaw stems from CWE-98 (PHP file inclusion without proper input sanitization). No public exploit code or CISA KEV entry has been identified at time of analysis, but the network-accessible, zero-authentication attack path makes patching a priority for any WordPress operator running this plugin.
Authentication bypass in OMICRON StationGuard before version 4.10 enables unauthenticated remote attackers to forge valid credentials by exploiting a cryptographic timing side-channel in the backend authentication mechanism (CWE-208). Successful exploitation grants full administrative control over the substation monitoring system configuration, including the ability to modify, reset, or alter system parameters - a high-consequence outcome in operational technology environments where configuration integrity is safety-relevant. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the network-reachable, zero-privilege attack surface warrants priority patching in OT network segments.
Site isolation bypass in Google Chrome Workers allows a remote attacker who has already compromised the renderer process to cross origin boundaries and access data from other sites via a crafted HTML page. All Chrome versions prior to 151.0.7922.109 are affected. EPSS sits at 0.26% (17th percentile) and SSVC confirms exploitation status as none, meaning no public exploit or active exploitation has been identified at time of analysis - the elevated CVSS of 8.1 reflects worst-case impact if this flaw is chained with a renderer exploit, rather than standalone exploitability.
Authentication bypass in the Login with Phone Number WordPress plugin (≤1.8.70) allows remote, unauthenticated attackers to circumvent the login mechanism via an authentication capture-replay technique (CWE-290), achieving full account takeover with high confidentiality, integrity, and availability impact. Exploitation carries high attack complexity (CVSS AC:H), meaning a specific race condition, token-interception window, or knowledge of a registered phone number is likely required. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is any internet-accessible WordPress site running the affected plugin.
Stored cross-site scripting in OpenReception appointment-booking-software prior to version 1.0.2 allows a TENANT_ADMIN to plant malicious `javascript:` URIs in tenant link fields (`website`, `imprint`, `privacyStatement`), which execute in patients' browsers when they click the rendered links on the public landing page. The critical impact is not merely XSS but a complete collapse of the platform's stated end-to-end encryption guarantee: JavaScript executing in the patient origin can intercept and exfiltrate plaintext form data before client-side encryption is applied, meaning a malicious tenant administrator can silently read patient health appointment data the product claims the server can never access. No confirmed active exploitation (no CISA KEV entry) and no public POC have been identified at time of analysis.
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to authenticate as arbitrary users without credentials. When Keycloak is deployed as a SAML broker in IdP-Initiated flow mode, it fails to enforce the SAML OneTimeUse condition, permitting a captured assertion to be submitted multiple times. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though SSVC rates technical impact as total - reflecting the full account takeover consequence if the preconditions are met.
Credential exfiltration via the tenant API in OpenReception appointment-booking-software prior to v1.0.2 allows any authenticated TENANT_ADMIN to retrieve the full PostgreSQL connection string - including plaintext password - for the shared database instance. In default docker-compose.prod.yml deployments, those credentials belong to the postgres superuser (rolsuper=true), granting the attacker read-write access to every tenant's database, all GLOBAL_ADMIN password hashes and session records, and superuser-level PostgreSQL functions (pg_read_server_files, COPY FROM PROGRAM) usable for container-level escalation. No public exploit code or CISA KEV entry exists at time of analysis; EPSS data was not provided, but the CVSS S:C scope change and the cross-tenant blast radius make this a high-priority patch target for any operator running the affected version.
Local privilege escalation in udisks2 exploits insufficient polkit authorization on the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method, allowing a low-privileged user with an active console session to spoof the 'as-user' parameter and mount filesystems on behalf of arbitrary users, including root. The attack specifically leverages fstab entries carrying 'user' or 'users' mount options, which are common on desktop Linux installations, to bypass the authorization check entirely. A vendor-released patch exists in udisks 2.11.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel ALSA driver for TASCAM US-144MKII USB audio devices allows a local low-privileged attacker to corrupt kernel memory, with potential for privilege escalation. The flaw originates in capture_urb_complete(), where redundant usb_anchor_urb() calls on every URB completion progressively corrupt the anchor's doubly-linked list and inflate the URB reference count; when usb_kill_anchored_urbs() later traverses this list during stream stop, suspend, or device disconnect, it dereferences freed memory. No public exploit or CISA KEV listing exists, and EPSS at 0.17% (6th percentile) reflects the narrow exposure created by the required TASCAM hardware dependency.
Use-after-free in the Linux kernel's Amlogic GXL crypto driver (`crypto/amlogic`) allows a local attacker to trigger memory corruption during driver probe failure, potentially enabling privilege escalation or denial of service on affected kernels (5.5 through pre-patch stable branches). The double-cleanup defect in `meson_crypto_probe()` causes `meson_free_chanlist()` to tear down already-freed per-flow resources - confirmed via KASAN slab-use-after-free in `kthread_destroy_worker()` - when `meson_allocate_chanlist()` fails after partial initialization. No public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), consistent with the narrow hardware footprint and non-trivial triggering conditions.
Use-after-free in the Linux kernel esd_usb CAN driver exposes local privilege escalation on systems using ESD CAN USB hardware. The esd_usb_disconnect() teardown sequence frees each CAN netdev (and its embedded private struct) before calling unlink_all_urbs(), which then dereferences that already-freed per-netdev memory to kill TX anchors and reset TX contexts. Found by an in-house static analysis tool with no public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), consistent with a niche driver defect rather than a broadly targeted flaw.
Use-after-free in the Linux kernel's USB MIDI gadget driver (f_midi) exposes systems configured as USB MIDI gadgets to local privilege escalation or denial-of-service. The flaw stems from midi->work not being cancelled before struct f_midi is freed in f_midi_free(), allowing a concurrent ALSA rawmidi write via f_midi_in_trigger() to rearm the work item after f_midi_disable() returns but before the object is deallocated - causing f_midi_in_work() to dereference freed kernel memory. No public exploit has been identified and EPSS sits at 0.16% (5th percentile), but the CVSS 7.8 score and kernel-level impact make patching the correct priority on systems deploying USB gadget functionality.
Use-after-free and NULL pointer dereference in the Linux kernel Broadcom BDC USB Device Controller driver expose systems to local privilege escalation during device teardown. The BDC driver's teardown sequence frees DMA-coherent memory and endpoint arrays while a shared IRQ handler remains live - a structural defect introduced when the driver adopted devm_request_irq(), whose LIFO devm release order creates a window where the interrupt handler dereferences freed or NULLed kernel structures. A separately unguarded delayed_work (func_wake_notify) compounds the issue with no cancellation path anywhere in the driver, allowing post-teardown callbacks against freed memory. No public exploit exists and the vulnerability is not in CISA KEV; it was identified by in-house static analysis with EPSS at the 5th percentile (0.16%), indicating negligible current exploitation activity.
Memory ordering data races in the Linux kernel's fuse-uring subsystem expose weakly-ordered architecture systems (ARM64, PowerPC, RISC-V) to kernel-level impacts when the fuse-uring ring initializes. On kernels from commit c2c9af9a through the fix, missing acquire/release semantics around ring->ready and fiq->ops allow a CPU to observe ring->ready == true while reading a stale fiq->ops function pointer table, which could trigger undefined behavior ranging from kernel crashes to potential control-flow hijacking. No public exploit has been identified and EPSS sits at 0.15% (5th percentile), indicating low near-term exploitation probability despite the High CVSS rating; no CISA KEV listing confirms active exploitation.
Use-After-Free in Autodesk Revit's PDF parser allows arbitrary code execution, sensitive data disclosure, or application crash when a user opens a maliciously crafted PDF file. Affected versions span Revit 2026 (prior to 2026.5.0) and Revit 2027 (prior to 2027.2.0), with full high-impact potential across confidentiality, integrity, and availability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via advisory ADSK-SA-2026-0011.
Out-of-bounds read in Autodesk Revit's PDF parsing engine exposes users to crashes, sensitive memory disclosure, and arbitrary code execution within the Revit process when opening a maliciously crafted PDF file. Affected are users of Autodesk Revit across versions covered by advisory ADSK-SA-2026-0011, with the attack requiring only that a target be socially engineered into opening a weaponized PDF - a realistic threat vector for AEC-industry professionals who routinely exchange PDF documents. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the high C/I/A impact profile makes this a meaningful risk for targeted attacks against Revit users.
Untrusted pointer dereference in Autodesk products' BMP file parser enables arbitrary code execution in the context of the current process. An attacker who can convince a user to open a specially crafted BMP file gains full code execution capability (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation, but the high CVSS score and confirmed RCE impact make patching a clear priority for Autodesk-heavy environments. Vendor advisory ADSK-SA-2026-0012 is the authoritative source.
Out-of-bounds write in Autodesk Revit's PDF parser allows arbitrary code execution in the context of the current user process when a maliciously crafted PDF file is opened. The CVSS vector (AV:L/UI:R) confirms exploitation requires local user interaction - a victim must be socially engineered into opening a weaponized PDF. Impact scope covers full confidentiality, integrity, and availability of the running process (C:H/I:H/A:H), consistent with classic memory-corruption RCE chains. No public exploit identified at time of analysis and no CISA KEV listing, but the vendor-confirmed write primitive and RCE potential make this a credible threat for targeted attacks against AEC professionals.
Unbounded memory growth in GStreamer's RTP H.264 and H.265 depayloader elements allows a remote unauthenticated attacker to exhaust process memory and terminate any application consuming RTP video streams. The rtph264depay and rtph265depay elements in gst-plugins-good lack an upper bound on their internal reassembly buffer, meaning an attacker who continuously sends fragmented RTP packets while withholding the end-of-fragment marker can grow that buffer without limit. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable against any exposed GStreamer RTP pipeline.
Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers without requiring any credentials. The plugin failed to canonicalize non-standard path forms - including dot segments, duplicate slashes, percent-encoded dots, and backslashes - before matching the request path against route-based guards, allowing crafted URLs to evade the guard while the underlying send layer resolves and serves the protected file. This is an incomplete fix for a prior vulnerability in the same component; no public exploit identified at time of analysis, though the technique is a textbook path normalization bypass requiring no advanced skills.