Out-of-bounds read in Microsoft Excel enables local information disclosure when a user opens a specially crafted spreadsheet. Multiple product lines are affected across Windows and macOS, spanning Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise. Microsoft has released patches; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Windows Hyper-V across a broad range of Windows 10, Windows 11, and Windows Server releases contains a heap-based buffer overflow (CWE-122) that enables a locally authenticated low-privileged attacker to disclose confidential memory contents. The CVSS vector (AV:L/PR:L/UI:R/S:U/C:H/I:N/A:N) constrains the attack to local access with required user interaction and produces no integrity or availability impact. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Microsoft Defender for Endpoint for Mac exposes sensitive information to low-privileged local users due to a CWE-200 access control failure in versions below 101.26042.0020. A locally authenticated attacker with standard user privileges can access high-confidentiality data handled by the endpoint agent - without any user interaction - making this an insider-threat and post-compromise escalation risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available.
Windows Management Services on Windows 11 contains an improper link resolution flaw (CWE-59) that allows an authenticated local attacker to crash or disable the service by planting a malicious symbolic link or directory junction at a file path the service accesses. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, with patched builds confirmed by Microsoft via MSRC. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory contents to a locally authenticated low-privilege attacker across a wide swath of Windows desktop and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. The impact is strictly information disclosure - high confidentiality loss with no integrity or availability effect - making this most practically useful as a KASLR-bypass building block in a multi-stage local privilege escalation chain. No public exploit or active exploitation has been identified; SSVC classifies exploitation status as none and technical impact as partial.
Out-of-bounds read in Windows Management Instrumentation (WMI) enables a locally authenticated, low-privileged attacker to disclose potentially sensitive information from process memory. Affecting a broad sweep of Windows client and server releases from Windows Server 2012 through Windows 11 26H1, the flaw is rooted in a memory safety defect in the WMI subsystem (CWE-125). No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected product lines.
Windows Wired AutoConfig Service (dot3svc) exposes a buffer over-read (CWE-126) that allows a locally authenticated, low-privileged attacker to read beyond allocated memory boundaries and disclose potentially sensitive information from adjacent memory. Affected scope spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface broad despite the local-only attack vector. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis, placing this squarely in the routine patching tier rather than emergency response.
Out-of-bounds memory read in Windows Desktop Window Manager (DWM) Core Library exposes sensitive memory contents to locally authenticated attackers across a broad range of Windows client and server versions. Exploitation requires an authenticated local session with at least low-privilege access (PR:L per CVSS), making this an insider-threat or post-compromise escalation primitive rather than an initial-access vector. No public exploit code has been identified and CISA KEV does not list this vulnerability; Microsoft has released patches via the July 2026 Patch Tuesday cycle.
Out-of-bounds read in Windows DWM Core Library (Desktop Window Manager) exposes potentially sensitive memory contents to locally authenticated attackers on Windows 11 and Windows Server 2025. The flaw is exploitable by any standard user account without elevated privileges or user interaction, making it a realistic post-access information disclosure primitive for lateral movement or privilege escalation chains. No public exploit code and no KEV listing are identified at time of analysis; SSVC rates exploitation as none and technical impact as partial.
Information disclosure in Windows Graphics Device Interface (GDI) via an untrusted pointer dereference exposes sensitive memory contents to a local low-privileged attacker across virtually all supported Windows client and server releases. The vulnerability (CWE-822) allows an authorized local user to trigger a controlled pointer dereference within GDI's rendering subsystem, resulting in high-impact confidentiality loss with no integrity or availability effect. No public exploit identified at time of analysis, though the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025 - makes this a broad-footprint patching concern.
Information disclosure in the Windows Event Logging Service exposes high-confidentiality data to any locally authenticated attacker via a CWE-126 buffer over-read, with no code execution possible. The vulnerability spans an exceptionally broad surface: every supported Windows client and server release from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 is affected. Microsoft has released patched builds via its monthly update cycle; no public exploit or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the wide footprint.
Windows Event Logging Service on multiple Windows desktop and server versions exposes uninitialized memory contents to locally authenticated attackers via CWE-908, enabling information disclosure without elevated privileges or user interaction. The CVSS vector (AV:L/PR:L/C:H) confirms that an authorized local user can trigger the flaw to read stale memory that may contain sensitive data from other processes or OS operations. No public exploit exists and CISA SSVC rates current exploitation as none, but the breadth of affected Windows versions - spanning Server 2012 through Windows 11 26H1 - makes patch prioritization worthwhile for any environment with untrusted local users.
Out-of-bounds read in the Windows Encrypting File System (EFS) driver exposes sensitive memory contents to any locally authenticated attacker holding standard user privileges. Affected systems span the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the patch surface extremely broad. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the combination of a low-complexity local attack and high confidentiality impact warrants prompt patching on systems where EFS is actively used.
Windows Imaging Component (WIC) across a broad span of Windows 10, Windows 11, and Windows Server releases contains an uninitialized memory read flaw (CWE-908) that an authorized local user with low privileges can exploit to disclose sensitive information from process memory. The CVSS vector (AV:L/PR:L/C:H/I:N/A:N) confirms this is strictly a local, low-privilege information disclosure with no network attack surface and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; a vendor-released patch is confirmed via the Microsoft MSRC advisory.
Windows GDI+ (Graphics Device Interface Plus) exposes uninitialized memory contents to local low-privileged attackers across a broad range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1. The root cause is CWE-908 (use of uninitialized resource), where a graphics operation returns memory that has not been zeroed or populated, potentially leaking sensitive in-memory data. No active exploitation is confirmed and CISA SSVC rates exploitation as none; however, the wide affected surface and high confidentiality impact make this a priority patch in shared-access environments such as RDP or VDI deployments.
Uninitialized resource use in Microsoft COM for Windows enables a locally authenticated attacker to read sensitive memory contents, constituting a high-confidence information disclosure. Affected systems span virtually the entire supported Windows ecosystem, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. No public exploit exists at time of analysis and SSVC assessment rates exploitation as none, though the breadth of affected platforms elevates patching urgency.
OS command injection in SAP NetWeaver Application Server ABAP and ABAP Platform enables an attacker holding high-privilege credentials to bypass missing security controls on an internal ABAP code path and execute arbitrary commands on the underlying operating system. Affected releases span kernel versions 7.22 through 9.16, placing a broad range of production SAP landscapes at risk of service disruption or unauthorized OS-level writes. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high availability impact (A:H) makes it a meaningful patch priority for SAP Basis teams.
Improper input validation in Microsoft Office Excel enables a local attacker to disclose sensitive information when a target user opens a specially crafted file. The vulnerability affects a broad swath of Microsoft Office product lines - including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, Office 365 for Mac, and Word 2016 - across both Windows and macOS platforms. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches are available across all affected product lines.
Out-of-bounds read in Microsoft Office exposes sensitive in-process memory contents to local attackers who socially engineer a victim into opening a crafted document. The flaw spans the full Microsoft Office portfolio across Windows and macOS - from Office 2016 through Microsoft 365 Apps for Enterprise - making it broadly relevant for enterprise patch management. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to local attackers who can socially engineer a victim into opening a malicious document. Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise across both Windows and macOS. No public exploit code is identified and SSVC rates exploitation as none, but the high confidentiality impact warrants timely patching for organizations whose users regularly handle documents from untrusted sources.
Symlink-following in the Windows Container Isolation FS Filter Driver (unionfs.sys) enables a locally authenticated attacker with low privileges to tamper with files outside the expected isolation boundary. Affected systems run Windows 11 version 26H1 builds prior to 10.0.28000.2704. A vendor patch is available; no public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Local information disclosure in Microsoft Office PowerPoint exposes sensitive data when a user opens a crafted file. The flaw, rooted in improper input validation (CWE-20), affects a broad range of Office versions across Windows and macOS including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches via its August 2026 update cycle.
Out-of-bounds read in Microsoft Office Excel exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a victim to open a crafted spreadsheet file. The flaw affects a wide range of Office versions across both Windows and macOS platforms, including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. No public exploit or active exploitation has been identified at time of analysis; SSVC assessment rates exploitation as none and the attack as non-automatable, indicating moderate real-world urgency despite the High confidentiality impact rating.
Incomplete resource cleanup in Microsoft Office PowerPoint exposes sensitive document data to local attackers across multiple supported product lines, including Microsoft 365 Apps for Enterprise, Office LTSC 2024, LTSC 2021, Office 2019, and PowerPoint 2016. Exploitation requires a victim to open or interact with a PowerPoint file (UI:R), after which residual data - likely temporary files, memory buffers, or cached presentation content - persists in a locally accessible state without requiring attacker privileges. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, keeping real-world risk moderate despite the high confidentiality impact rating.
Out-of-bounds read in Microsoft Excel exposes process memory to local information disclosure across a wide range of Office versions, from Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC releases on both Windows and macOS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms exploitation requires the victim to open a specially crafted spreadsheet file, making phishing-delivered documents the realistic delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Excel triggers information disclosure when a victim opens a specially crafted spreadsheet file, exposing potentially sensitive memory contents to a local attacker. The flaw spans multiple Office product lines - Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and corresponding Mac variants - with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified and SSVC confirms no known exploitation; a vendor patch is available via the Microsoft Security Response Center.
Information disclosure in Microsoft Excel arises from use of uninitialized memory (CWE-908), exposing potentially sensitive heap or stack contents to an attacker when a victim opens a maliciously crafted Excel file. Affected products span the full Microsoft Office portfolio on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, Excel 2016, and their Mac counterparts. No public exploit identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Out-of-bounds read in Microsoft Office exposes memory contents to local information disclosure across a wide range of affected products including Word 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office 365/LTSC for Mac. The CVSS vector (AV:L/UI:R/C:H) indicates exploitation requires a victim to open a specially crafted Office document, after which sensitive in-process memory can be disclosed to the attacker. No public exploit has been identified at time of analysis, no KEV listing exists, and Microsoft has released patches across all affected product lines.
Out-of-bounds memory read in Microsoft Office exposes potentially sensitive process memory contents when a victim opens a specially crafted document locally. The vulnerability affects the full Office suite across Windows and macOS - spanning Office 2016 through LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - with High confidentiality impact per CVSS but no integrity or availability consequence. No public exploit has been identified at time of analysis; CISA SSVC classifies exploitation status as none and the attack is not automatable, significantly reducing real-world prioritization urgency despite the High C rating.
Out-of-bounds read (CWE-125) in Microsoft Office enables a local, unauthenticated attacker to disclose sensitive memory contents by convincing a user to open a specially crafted Office document. Affected products span the full modern Office portfolio - Office 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable delivery, placing this in a lower operational urgency tier despite the High confidentiality impact rating.
Out-of-bounds read (CWE-125) in Microsoft Office exposes sensitive memory contents to local attackers who can persuade a user to open a specially crafted document. Affected products span multiple Office generations including Office 2016, 2019, 2021, 2024, LTSC variants, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable delivery, aligning with the local, user-interaction-dependent CVSS vector.
Information disclosure in the Microsoft Windows Search Component allows a locally authenticated low-privileged attacker to bypass weak authentication controls and access sensitive indexed content outside their authorized scope. Affected systems span Windows Server 2012 through Server 2025 and Windows 10/11 across all current supported versions, representing an exceptionally broad exposure surface. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the ubiquitous deployment footprint of Windows makes timely patching a priority for all organizations.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Windows Win32K contains an untrusted pointer dereference (CWE-822) that allows a locally authenticated attacker to disclose sensitive kernel or process memory contents. Affected systems include multiple Windows 11 release branches (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, both full and Server Core installations. No public exploit has been identified at time of analysis and exploitation has not been confirmed by CISA KEV; Microsoft has released patches addressing all affected build ranges.
Out-of-bounds read in the Windows NTFS driver exposes sensitive memory contents to locally authenticated attackers across a wide range of Microsoft Windows and Windows Server releases. The flaw (CWE-125) allows a low-privileged local user to read kernel or process memory beyond intended boundaries, resulting in information disclosure with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Information disclosure in the Windows NTFS filesystem driver allows a local low-privileged attacker to read beyond buffer boundaries and expose sensitive memory contents. Affecting virtually every supported Windows desktop and server release - from Windows 10 1607 through Windows Server 2025 and Windows 11 26H1 - the vulnerability requires only a standard local user account and no special configuration, making it a realistic threat in multi-tenant, shared, or cloud environments where local access is granted to semi-trusted users. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem allows any locally authenticated low-privilege user to disclose sensitive kernel memory contents without user interaction. The flaw spans an exceptionally broad range of affected Windows versions, from Server 2012 through Windows 11 25H2, significantly widening enterprise exposure. No active exploitation has been confirmed in CISA KEV and no public exploit has been identified at time of analysis, though kernel memory disclosure from Win32K is strategically valuable as a KASLR-bypass primitive in chained privilege escalation attacks.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.
Windows Defender Firewall Service across Windows 10, Windows 11, and Windows Server 2019 through 2025 contains a missing authorization flaw (CWE-862) that enables a locally authenticated low-privileged attacker to bypass firewall security controls and manipulate firewall rules without the required authorization. The vulnerability carries a CVSS score of 5.5 with High integrity impact, reflecting the attacker's ability to fully undermine the local firewall enforcement boundary from a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the post-exploitation value as a lateral movement enabler is notable given the breadth of affected Windows versions.
Incorrect authorization in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a local authenticated attacker on Windows 11 26H1 to disclose sensitive information beyond their authorized filesystem scope. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact confined to the local system, with no integrity or availability consequence. No public exploit code exists and SSVC rates exploitation as none, placing this as a routine patching priority rather than an emergency response item.
Path traversal in Adobe's CAI Content Credentials ecosystem - spanning the Rust SDK (c2pa-v0.90.5 and earlier), the JavaScript/Web SDK (@contentauth/c2pa-web@0.12.0 and earlier), and the c2patool command-line utility (v0.27.5 and earlier) - enables arbitrary file system reads outside the intended access scope. The flaw is triggered when a victim processes a maliciously crafted file or visits a compromised web page that causes the SDK to resolve attacker-controlled path sequences. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; patched releases exist for all three components.
Certificate validation bypass in Adobe's Content Credentials SDK undermines the C2PA provenance chain across three SDK variants - JavaScript/WASM (@contentauth/c2pa-web through 0.12.0), Rust (c2pa through v0.90.5), and CLI (c2patool through v0.27.5) - allowing an attacker-controlled certificate to be accepted as legitimate when a victim visits a malicious URL or interacts with a compromised web page. Successful exploitation grants unauthorized write access to content credentials, enabling an attacker to forge provenance metadata and defeat the product's core integrity guarantee. No public exploit has been identified at time of analysis; vendor-released patches exist for all three affected SDK variants.
Cross-site scripting in Microsoft Exchange Server 2016 and 2019 enables authenticated low-privilege users to inject malicious scripts rendered within Exchange web interfaces, allowing spoofing of higher-privileged users over the network. Affected builds span Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available and should be applied promptly given the high confidentiality and integrity impact of successful exploitation.
ColdFusion 2023 and ColdFusion 2025 contain an improper output encoding flaw (CWE-116) enabling low-privileged network attackers to circumvent security controls, achieve limited unauthorized write access, and cause modest availability disruption. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable, requires only a low-privileged account, and needs no user interaction. No public exploit code has been identified and CISA SSVC assigns exploitation status of none; vendor-released patches are available as ColdFusion 2023 update 2023.0.23 and ColdFusion 2025 update 2025.0.12 per Adobe advisory APSB26-90.
Server-Side Request Forgery (SSRF) in Typebot's WhatsApp status webhook forwarding allows an authenticated workspace user to pivot the Typebot server into probing or interacting with internal network hosts, cloud metadata endpoints, or localhost services. The vulnerability exists in all Typebot versions prior to 3.17.0 and is triggered server-side whenever the public WhatsApp webhook receives a status payload, requiring no further interaction after the malicious URL is configured. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is straightforward for any workspace member with WhatsApp integration configuration access.
Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated, low-privilege attacker to inject malicious scripts that execute in other users' browsers upon interaction, enabling session hijacking and spoofing attacks within the SharePoint context. The CVSS 7.3 score reflects high confidentiality and integrity impact bounded to the SharePoint application scope, gated by both valid credentials and victim interaction. Microsoft has released patches for all three affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated, low-privileged attacker to inject malicious script content that renders in a victim's browser upon interaction with a crafted page, enabling spoofing and potential session compromise. All three actively-supported on-premises SharePoint product lines are affected, with patched builds available via Microsoft's Security Response Center advisory. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the routine patching tier rather than an emergency-response scenario.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to inject malicious script that, when rendered by a victim's browser, performs network-based spoofing within the SharePoint web application. All three current on-premises SharePoint product lines are affected across the 16.0.x branch, with specific fixed builds identified by EUVD-2026-56718. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released patches for all affected versions.
Remote code execution in Microsoft Edge (Chromium-based) below version 151.0.4129.78 stems from a type confusion flaw (CWE-843) in the browser engine, exploitable over the network when a user visits or interacts with attacker-controlled content. The vendor has confirmed patch availability and the flaw is tagged as causing memory corruption, which aligns with the typical consequence of type confusion in browser engines. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the unauthenticated network vector with low attack complexity warrants prioritized patching in enterprise environments.