Arbitrary file deletion in the GeoDirectory WordPress plugin (all versions through 2.8.169) permits authenticated attackers with subscriber-level access to delete any file the web server process can reach, trivially enabling remote code execution by targeting wp-config.php. The attack exploits a query-string consistency-check bypass in the delete_revision handler, which dereferences attacker-supplied attachment metadata paths without any post-type or filesystem-path validation. No public exploit code or CISA KEV listing was identified at time of analysis, though the description is sufficiently detailed to enable independent exploit development; any site with open user registration should treat this as an immediate priority.
Denial of service via improper input validation in Intel Active Management Technology (AMT) and Intel Standard Manageability firmware allows unauthenticated network-adjacent attackers to disrupt the out-of-band management interface. The CVSS 4.0 AT:P designation confirms that specific prerequisites - namely AMT being provisioned and network-accessible - must independently exist before exploitation is possible. No public exploit has been identified at time of analysis, and Intel has disclosed the issue under advisory INTEL-SA-01427.
Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URLs for arbitrary object keys - including other tenants' private paths - by supplying an attacker-controlled filePath parameter to a deprecated public upload endpoint. Exploitation requires only knowledge of a valid public typebotId and blockId, both of which are typically visible in chatbot embed codes or share links. No public exploit has been confirmed at time of analysis, and this CVE does not appear in CISA KEV, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates trivial remote unauthenticated exploitation against any Typebot deployment with S3 storage configured.
Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.
Webhook signature verification bypass in AutoGPT Platform before 0.6.70 allows unauthenticated remote attackers to trigger execution of secret-protected generic webhook graphs as their registered owner. The flaw stems from the ingress router selecting the webhook manager from the untrusted URL provider path segment rather than from the stored webhook record, meaning a request routed through the /compass/ path invokes CompassWebhookManager's inherited no-op verify_signature instead of GenericWebhooksManager.verify_signature, neutralizing the X-Webhook-Secret guard entirely. No public exploit or CISA KEV listing has been identified at time of analysis, but the fix is available in the confirmed release v0.6.70.
Remote code execution via a stack-based buffer overflow in the Windows kernel TCP/IP driver (CWE-121) affects all major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An unauthenticated remote attacker who can deliver crafted TCP/IP packets to an exposed system may gain kernel-level code execution without requiring user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, though the kernel-mode attack surface and network-accessible delivery make this a high-priority patching target; Microsoft has released patches for all affected platforms.
ishankportfolio exposes contact form submissions containing personally identifiable information (PII) due to client-side database credentials being publicly accessible and database access rules being insufficiently restrictive. Versions prior to 1.0.1 are affected, and the CVSS vector (PR:N, AV:N) confirms unauthenticated remote access is possible without any special preconditions. Any actor who discovers the exposed API keys embedded in client-side code can read or modify stored form submissions - including names, email addresses, phone numbers, and messages - directly against the database. No public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Heap-based buffer overflow in the Windows iSCSI Target Service enables an unauthenticated remote attacker to trigger denial of service across a wide range of Windows Server versions from 2012 through 2025. The vendor-assigned CVSS vector of C:H/I:H/A:H suggests potential impact beyond the description's stated denial-of-service scope, warranting attention to whether memory corruption could extend to confidentiality or integrity compromise. No public exploit or active exploitation has been identified at time of analysis; however, SSVC designates the attack as automatable, elevating the urgency for organizations running exposed iSCSI targets to apply available patches.
Remote code execution in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on a connecting client system by exploiting a heap-based buffer overflow triggered when the client processes a maliciously crafted RDP server response. All major Windows 10, Windows 11, and Windows Server editions from 2012 through 2025 are affected across x86, x64, and ARM64 architectures. No public exploit has been identified at time of analysis and CISA SSVC confirms no current exploitation; a vendor patch is available through the Microsoft Security Response Center.
Remote code execution in the Windows Remote Desktop Client exposes client machines across Windows 10, 11, and multiple Windows Server generations when connecting to an attacker-controlled RDP server. The heap-based buffer overflow (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) allows a remote unauthenticated attacker to gain full control over a vulnerable client machine, though the AC:H rating reflects non-trivial exploitation preconditions. Microsoft has released patches across all affected product lines; no active exploitation is confirmed per SSVC and the absence of a CISA KEV listing, with EPSS at 0.64% (47th percentile) indicating low near-term exploitation probability.
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.
Cleartext credential logging in the MongoDB Java Driver exposes outbound network connectivity credentials to any party with log read access during routine client initialization. Affected applications automatically write the credential to log output as part of normal operation - no special trigger, elevated privileges, or attacker interaction with the driver is required to produce the disclosure. While no public exploit or active exploitation has been confirmed, the CVSS 4.0 score of 8.2 reflects that recovered credentials can authenticate an attacker to separate network infrastructure beyond the affected application, producing a scope-changed confidentiality impact.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.
Remote code execution via heap-based buffer overflow in the Windows iSCSI Target Service affects a broad range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). An unauthenticated network attacker can send a malformed iSCSI protocol request to trigger CWE-122 heap corruption and achieve arbitrary code execution on the target host. No public exploit identified at time of analysis and no CISA KEV listing, though the CVSS score of 8.1 (AC:H) reflects real exploitation complexity; the full C:H/I:H/A:H impact triad makes this a credible priority for environments running the iSCSI Target role.
Remote code execution via heap-based buffer overflow in the Windows RPC Runtime affects every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated remote attacker who can reach an exposed RPC endpoint can corrupt heap memory and achieve arbitrary code execution, yielding full confidentiality, integrity, and availability compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions, combined with network accessibility and no authentication requirement, elevates operational priority for internet-facing and laterally-reachable Windows infrastructure.
Privilege escalation via use-after-free in the Windows DNS service exposes a broad range of Windows Server and Windows 10 systems to network-based attacks by unauthenticated adversaries. The race condition root cause (CWE-362) forces high attack complexity, as an attacker must win a precise timing window to corrupt freed memory and gain elevated privileges, reflected in the CVSS 8.1 score. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the full C/I/A impact across thirteen distinct product versions from Windows Server 2012 through Server 2025 warrants prompt patching.
Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.
Remote code execution via use-after-free memory corruption in Windows DNS enables unauthenticated network attackers to achieve full system compromise against exposed DNS servers. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network-reachable, zero-privilege exploitation, though high attack complexity signals that reliable triggering requires precise memory state manipulation rather than simple packet delivery. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Remote code execution in Windows DNS Server allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing to achieve full system compromise. The flaw spans Windows Server 2016 through 2025 and select Windows 10 builds, targeting the server-side DNS component; the 'Authentication Bypass' tag indicates the race window undermines an internal access control that would otherwise gate execution. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network vector and full C/I/A impact make this a high-priority patching target for any organization running the Windows DNS Server role.
Remote code execution via race condition in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on affected systems across a broad sweep of Windows versions - from the aging Windows Server 2012 through the current Windows 11 26H1 and Windows Server 2025. The flaw (CWE-362) arises from improper synchronization of shared resources during concurrent execution within the RDP client stack, allowing an adversary who can win a precise timing window to achieve full code execution. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the CVSS base score of 8.1 and total technical impact classification make this a meaningful patching priority.
Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.
Remote code execution in Red Hat JBoss Enterprise Application Platform (EAP) via the openjdk-orb CORBA bridge allows unauthenticated network attackers to load and instantiate arbitrary Java classes from attacker-controlled URLs during IIOP object unmarshalling. The attack targets port 3528 and executes before EJB security interceptors are invoked, meaning EAP's own authorization layer provides no protection once the malicious payload is in flight. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CWE-829 root cause class and full CIA:HHH CVSS impact reflect genuine arbitrary-code-execution potential under the required configuration.
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker-controlled files to arbitrary locations on the victim's filesystem. The `fileInfo.name` field from the RDP CLIPRDR protocol - fully controlled by the server - is passed unsanitized to `osResolve`, enabling `../` sequences to escape the user-selected save directory. No public exploit is identified at time of analysis; exploitation requires the victim to connect to a malicious RDP server and receive a clipboard file transfer.
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-controlled content to arbitrary locations on the victim's filesystem, bypassing the user-selected download directory. The root cause is in `src/client/components/file-transfer/transfer.jsx` where server-supplied `file.name` and `folder.name` values are passed unsanitized to Node.js `resolve()`, permitting traversal sequences such as `../../` to escape the intended directory. No public exploit or CISA KEV listing exists at time of analysis, but SSVC rates the technical impact as total and the patch is confirmed in release v3.15.120.
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlled file content to arbitrary locations on the connecting user's filesystem, bypassing the intended temporary directory confinement. All electerm releases prior to 3.15.120 are affected across all supported platforms (Linux, macOS, Windows). No public exploit code or CISA KEV listing exists at time of analysis, but the patch commit and GitHub security advisory are publicly visible, lowering the bar for independent reproduction. CVSS 8.1 reflects high integrity and availability impact gated by required user interaction with a malicious server.
Broken access control in Peppermint helpdesk (through commit ba6e217) allows any authenticated user to read, modify, or delete tickets, clients, and users owned by any other account. The root cause is that the `Config.roles_active` flag defaults to `false` on all default installations, rendering every permission check on ticket, client, and user handlers a no-op - ownership and administrative access controls are silently bypassed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is trivially exploitable by any user with a valid account on a default-configured instance.
Privilege escalation via integer underflow in Windows HTTP.sys (the kernel-mode HTTP protocol stack) allows an authenticated local attacker to gain SYSTEM-level access on a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. The flaw is rooted in an integer wraparound condition (tagged by the reporter as a heap overflow mechanism) in the HTTP.sys kernel driver, enabling full compromise of confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Privilege escalation via heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged local attacker to gain full SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans virtually all supported Windows versions, from Windows 10 1809 and Server 2019 through Windows 11 26H1 and Server 2025. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and broad platform coverage make this a credible post-exploitation privilege escalation primitive for threat actors who have already obtained a local foothold.
Broken access control in Ghost Foundation Ghost 5.x enables any authenticated Author-role user to delete posts owned by other users, including content published by Editors and Administrators. The authorization failure originates in the post model's permissible() cascade, where the combined isAuthor-and-isDestroy condition is not handled, causing the guard to fall through and approve the deletion. No public exploit code has been identified at time of analysis, but the low attack complexity and minimal privilege requirement mean the flaw is trivially abusable by any Author-role account holder on the platform.
Broken access control in BadChoice Handesk (all versions through 2026-07-10) permits any authenticated agent to modify, escalate, or corrupt ticket records belonging to teams they have no membership in, by directly targeting the TicketsController@update endpoint. The endpoint performs neither an authorize() policy check nor a team-scoped ownership validation, meaning a low-privilege agent account is the only barrier to cross-team data tampering. No public exploit has been identified at time of analysis, but exploitation requires only a valid agent credential and a single crafted HTTP request, making this a low-friction privilege abuse risk in any multi-team deployment.
Cross-team lead record overwrite in BadChoice Handesk (all versions through 2026-07-10) is exploitable by any authenticated agent via the LeadsController@update endpoint, which performs no team-ownership authorization check. The Lead model's $guarded property is set to an empty array, disabling Laravel mass-assignment protection and allowing the attacker to set any column value on any lead record regardless of team boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:L/AC:L vector makes this trivially exploitable by any insider or compromised agent account in a multi-team deployment.
SAML authentication bypass in PicketLink's Service Provider signature validation allows a network-accessible attacker with low privileges to forge a SAML response and authenticate as any principal with any role on the protected application. The flaw, rooted in CWE-347 (Improper Verification of Cryptographic Signature), arises because the signature check vacuously passes when the SAML response contains zero matching assertion elements, giving the attacker full control over identity and role claims presented to the SP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact on confidentiality and integrity make this a critical authentication control failure.
Privilege escalation in Windows Desktop Window Manager (DWM) Core Library via a use-after-free memory corruption flaw allows a locally authenticated, low-privileged attacker to achieve full SYSTEM-level code execution. Affected systems span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core), representing a broad cross-section of the active Microsoft OS estate. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide version coverage make patching a near-term priority.
Privilege escalation in the Windows Remote Access Connection Manager (RASMAN) service enables a low-privileged local attacker to achieve SYSTEM-level access through a heap-based buffer overflow. Affecting Windows 10 (from version 1809), Windows 11 (through version 26H1), Windows Server 2019 through Server 2025, this vulnerability requires only a valid local user account and no user interaction. Microsoft has released patches via MSRC; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Privilege escalation via use-after-free in the Windows Kernel affects Windows 11 (versions 23H2, 24H2, 25H2, and 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to elevate to SYSTEM-level control. The CWE-416 root cause combined with high attack complexity (AC:H) indicates exploitation likely requires precise timing or race-condition engineering rather than a trivial one-shot trigger. Vendor patches are available via MSRC; no active exploitation has been confirmed by CISA KEV at time of analysis.
Local privilege escalation in the Windows Kernel affects Windows 11 (23H2 through 26H1) and Windows Server 2025, exploitable by any authenticated local user to gain SYSTEM-level access. The root mechanism is a use-after-free condition triggered through a race condition in kernel memory management, classified under CWE-362. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis; however, the kernel-level impact (C:H/I:H/A:H) makes it a high-priority patch target in enterprise and server environments.
Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 installations. The flaw (CWE-416) involves kernel memory mismanagement where freed memory can be accessed under specific high-complexity timing conditions, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all affected versions.
Credential forgery via type confusion in the TCG TPM 2.0 reference code (versions through v184) allows a local attacker holding high-privilege access to submit a falsified TPM key - such as an Attestation Key, DevID Key, or TLS authentication key - to a TPM-aware Certificate Authority and receive a legitimate credential for it. With that credential, the attacker can forge subsequent TPM 2.0 attestations, silently undermining the platform integrity guarantees that downstream security controls depend on, including measured boot verification, zero-trust device posture checks, and DevID-based network admission. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.22% at the 13th percentile is consistent with a targeted, post-compromise technique rather than a commodity attack.
SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. No public exploit or active exploitation has been identified at time of analysis, but the CVSS scope change (S:C) signals that successfully decrypted credentials can be used to compromise systems beyond the BI platform itself.
Local privilege escalation in Microsoft Office exploits a command injection flaw (CWE-77) that allows an authenticated local attacker to gain elevated privileges on the affected system. The vulnerability requires only low-level privileges to trigger, making it accessible to any standard user account on a compromised or shared system. No public exploit code or CISA KEV listing is identified at time of analysis, but the high-impact CVSS score and Microsoft's own disclosure warrant prompt patching.
Use-after-free memory corruption in Microsoft Office enables an attacker to execute arbitrary code in the context of the victim user, scoring CVSS 7.8 (High). Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. Exploitation requires a victim to open a specially crafted Office document - a delivery mechanism trivially achieved via phishing - and no public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft Office's ubiquitous enterprise footprint and adversary interest in document-borne malware elevate this beyond a theoretical risk.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/PR:N/UI:R) confirms exploitation requires no prior privileges but depends on user interaction - consistent with a malicious document delivery scenario. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a high-severity concern for any environment running unpatched Excel installations.
Heap-based buffer overflow in Windows Imaging Component (WIC), Microsoft's built-in image processing framework, enables local code execution across virtually every supported Windows client and server release from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. The flaw is triggered when a user opens or previews a specially crafted image file, requiring no prior authentication or elevated privileges, and yields full confidentiality, integrity, and availability impact on the compromised system. Vendor-released patches are available via Microsoft's July 2026 update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Excel enables local arbitrary code execution when a user opens a specially crafted file. The vulnerability (CWE-121) carries a CVSS 7.8 High score, with high confidentiality, integrity, and availability impact upon successful exploitation. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel enables local code execution when a user opens a specially crafted spreadsheet file. The vulnerability (CWE-125) carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability, and is reported directly by Microsoft via the MSRC update guide. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) indicates reliable exploitability once a working exploit is developed.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The vulnerability triggers during file parsing, allowing an attacker who can deliver a malicious document to execute arbitrary code with the privileges of the logged-in user. No KEV listing or public exploit code has been identified at time of analysis, but the local-execution-via-document vector makes this a meaningful phishing and spear-phishing enabler.
Out-of-bounds write (CWE-787) in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file, yielding full confidentiality, integrity, and availability impact at CVSS 7.8. The attack is file-delivery based - typical phishing or drive-by download - requiring no system privileges from the attacker but requiring the victim to open the malicious document. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in Microsoft Office Access enables local code execution when a user opens a specially crafted database file, with full high-impact compromise of confidentiality, integrity, and availability (CVSS 7.8). Affected products span Microsoft Access 2016 through Microsoft 365 Apps for Enterprise and Office LTSC 2024. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.