HTTP request smuggling in System.Net.HttpListener across .NET 8.0, 9.0, and 10.0 enables unauthenticated remote attackers to bypass security features on Linux and macOS deployments. The flaw stems from inconsistent HTTP request interpretation (CWE-444), allowing crafted requests to circumvent authentication or access controls with high confidentiality impact. Exploitation carries high attack complexity (AC:H), no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in a monitored-but-not-emergency posture for most organizations.
Privilege escalation in Microsoft OneDrive for macOS exploits improper symbolic link resolution (CWE-59), enabling a locally authorized high-privileged attacker to redirect OneDrive file operations to unintended filesystem locations and gain elevated access beyond their sanctioned scope. Affected versions span 26.0.0.0 up to but not including 26.095.0519.0003 on macOS exclusively. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog, though the full high-high-high CIA impact within the unchanged scope warrants prompt patching for any enterprise deploying OneDrive on macOS endpoints.
Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality data to a local attacker when a user opens a crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the high confidentiality impact and wide deployment footprint make patching a clear priority.
Microsoft Office Word's document parsing logic fails to properly validate input (CWE-20), enabling a local attacker to read sensitive information from a target system when a victim opens a specially crafted Word document. The flaw affects a broad range of Microsoft Office releases on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, and all LTSC variants through 2024. SSVC assessment confirms no current exploitation activity and the attack is not automatable due to required user interaction, though the CVSS confidentiality impact is rated High.
Out-of-bounds read in Microsoft Office Word's document parser enables local information disclosure across Windows and Mac product lines, including Office 2016, 2019, 2021, 2024 LTSC, and Microsoft 365 Apps. An attacker who supplies a crafted Word document can cause the application to read beyond allocated memory boundaries, leaking high-confidence memory contents to the attacker. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, though the broad affected product surface and low attack complexity make it a credible phishing delivery vehicle.
Out-of-bounds read in Microsoft Office Word exposes high-confidentiality memory contents when a user opens a specially crafted document locally. Affected products span Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise, confirmed via EUVD-2026-56423. No public exploit identified at time of analysis and no CISA KEV listing; vendor patch is available, placing this in the routine-patch-cycle priority tier rather than emergency response.
Out-of-bounds read in Microsoft Office Word exposes sensitive memory contents to local attackers via crafted document files. Affected products span Word 2016 through Microsoft 365 Apps for Enterprise on both Windows and Mac platforms, covering a broad enterprise install base. Exploitation requires user interaction - a victim must open a malicious document - but yields high confidentiality impact with no integrity or availability loss. No public exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables a local, unauthenticated attacker to disclose sensitive memory contents by enticing a user to open a maliciously crafted document. Affected products span Microsoft Word 2016, Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, and Office LTSC/365 on macOS. No public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and Microsoft has released patches via the standard Office update channel.
Out-of-bounds read in Microsoft Word's document parsing engine exposes sensitive in-process memory to a local attacker across Office 2016 through LTSC 2024 and macOS variants. Exploitation requires a victim to open a specially crafted document, making social engineering or phishing the primary delivery mechanism. No public exploit code exists and no active exploitation has been identified (not in CISA KEV); SSVC assessment rates exploitation status as none and technical impact as only partial.
Out-of-bounds read in Microsoft Office Word exposes potentially sensitive memory contents to local attackers when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021 and 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise across both Windows and macOS platforms, with vendor-confirmed patches available. No public exploit code exists and CISA SSVC rates exploitation likelihood as none with only partial technical impact, making this a medium-priority patching item despite the High confidentiality score assigned by CVSS.
Out-of-bounds read (CWE-125) in Microsoft Office Word exposes memory contents to a local, unauthenticated attacker who can trick a user into opening a crafted document, resulting in high-confidence information disclosure with no integrity or availability impact. The vulnerability spans eight distinct Office product lines across Windows and Mac, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, broadening the exposure surface considerably. No public exploit code or active exploitation has been identified per SSVC (Exploitation: none); Microsoft has released patches via the standard Office update channel.
Uncontrolled resource consumption in Django REST Framework prior to 3.17.2 allows unauthenticated remote attackers to exhaust server memory and CPU by sending arbitrarily large request bodies via application/json or application/x-www-form-urlencoded content types. The framework's Request._parse() method passes the raw HttpRequest stream directly to JSONParser and FormParser, silently bypassing Django's built-in DATA_UPLOAD_MAX_MEMORY_SIZE guard. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the attack requires no authentication and no special configuration, making any exposed DRF API endpoint a viable target.
Brute-force credential attacks against Mira's cloud authentication endpoints are unrestricted due to the complete absence of per-account rate limiting, per-IP throttling, and account lockout controls, as disclosed in CISA ICS Medical Advisory ICSMA-26-223-01. Affected products include Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 from Quanovate Tech Inc. (operating as Mira / Mira Care), a healthcare-focused IoT platform. An unauthenticated remote attacker can systematically enumerate credentials at arbitrary scale to gain unauthorized access to user accounts, with no public exploit code or CISA KEV listing identified at time of analysis.
Session token exposure in the Mira Android app (Quanovate Tech Inc.) leaks live authentication credentials to third-party web properties and referrer logs whenever users trigger in-app WebView flows such as shop redirects. The app appends the active session token as a URL query string parameter and embeds a persistent user identifier in the WebView User-Agent header, both of which are transmitted to any destination or JavaScript context receiving that traffic. Reported by ICS-CERT under medical advisory ICSMA-26-223-01, this vulnerability affects a healthcare-adjacent platform, amplifying the sensitivity of exposed credentials; no public exploit code or CISA KEV listing has been identified at time of analysis.
Resource exhaustion in Malcolm's archive extraction component allows authenticated network users to deny service to the entire processing pipeline. Prior to version 26.07.0, the `safe-extract.py` script imposes no limits on the count, depth, or output size of entries extracted from uploaded archives, enabling a low-privilege attacker to craft a small archive that expands into an unbounded number of filesystem objects. The resulting inode exhaustion affects the filebeat container and any co-mounted service, effectively halting network traffic analysis. No public exploit code or active exploitation has been identified at time of analysis.
AdminRenderer in Django REST Framework prior to 3.17.2 discloses unauthorized GET resource data to authenticated users who hold write-but-not-read permissions on a DRF view. When a POST request fails validation and returns a 400 Bad Request, the renderer internally calls view.get() without first invoking view.check_permissions(), embedding the full GET representation in the HTML error response visible to the requester. No public exploit is confirmed in CISA KEV, but SSVC rates exploitation as POC-level; risk is targeted rather than widespread.
Command injection in Visual Studio Code versions prior to 1.132.1 enables remote unauthenticated attackers to disclose sensitive information from a victim's system over a network. Exploitation requires user interaction - the victim must open or engage with attacker-controlled content such as a malicious workspace, configuration file, or repository - consistent with the CVSS UI:R metric. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch (1.132.1) is available via the Microsoft Security Response Center.
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated network attacker to exfiltrate sensitive data when a target user opens a specially crafted document. The WPF document parser resolves external references from attacker-controlled URIs - an SSRF-adjacent primitive (CWE-829, CWE-918) - causing outbound network requests that can expose authentication tokens or internal metadata to the attacker's infrastructure. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected .NET and Visual Studio versions.
Security feature bypass in Microsoft Visual Studio Code Copilot Chat Extension (versions 0.27.0 through pre-1.132.1) enables network-based attackers to circumvent a protective control without authentication, resulting in high integrity impact and low availability impact. The attack requires user interaction - consistent with a scenario where a victim must engage with crafted content delivered over the network. No public exploit code has been identified at time of analysis, and a vendor patch (1.132.1) is available via the Microsoft Security Response Center.
Privilege escalation via use-after-free in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, requiring physical device access to exploit. An attacker with physical proximity can trigger kernel memory corruption under high-complexity conditions to gain full control of the affected system, achieving complete confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and CISA SSVC confirms exploitation status as none.
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary directories outside the intended extraction root on the filebeat processing container. All Malcolm releases prior to 26.07.0 are affected via the `safe-extract.py` component, which inconsistently applies traversal protections - libarchive secure flags guard file entries, but directory entries are passed directly to an unguarded `os.makedirs()` call. No confirmed active exploitation or public proof-of-concept has been identified; the vendor released a complete fix in version 26.07.0.
Firmware version spoofing in the Mira cloud API allows authenticated users to submit arbitrary firmware version strings for their own registered devices, bypassing server-side validation entirely. Affected products are Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 by Quanovate Tech Inc., operating in a medical IoT context and reported under CISA ICS-CERT advisory ICSMA-26-223-01. An attacker exploiting this flaw can cause the vendor backend to misrecord their device's patch state, suppressing security update prompts and distorting fleet-wide vulnerability analytics - with no public exploit identified at time of analysis.
Denial-of-service in Siemens Desigo building automation controllers (DXR2, PXC3, PXC4, PXC5.E003, PXC5.E24, PXC7) allows an unauthenticated adjacent-network attacker to permanently halt BACnet communication on the device by sending a single malformed BACnet packet. The device stops responding to all BACnet queries and requires a manual reset or reboot to recover, making this operationally disruptive in building management environments where HVAC, access control, or other OT functions may depend on continuous BACnet availability. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated arbitrary file write in AVideo's aVideoEncoderChunk.json.php endpoint allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests, requiring no credentials of any kind. All AVideo versions (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) with this endpoint network-exposed are affected, as confirmed by the patch commit diff which shows authentication gating was entirely absent prior to the fix. Exploitation can cause denial of service via disk exhaustion, corrupt the video encoding pipeline, or - when chained with a local file inclusion vulnerability - escalate to remote code execution; no public exploit has been identified at time of analysis.
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
Denial of service in Nmap versions through 7.99 allows a remote party to crash the application by returning a crafted TCP packet containing a zero-length option to a host actively scanning their infrastructure. The vulnerable code path is in the NSE library packet.lua, where the Packet:parse_options() function allocates objects indefinitely when it encounters a zero-length TCP option, exhausting memory and terminating the process. No active exploitation has been confirmed and no formal patched release version has been identified, though an upstream source-level fix is available via GitHub commit.
Authentication bypass in Windows Schannel allows a network-based attacker to circumvent cryptographic signature validation, achieving high-integrity impact without requiring prior privileges. Schannel, Microsoft's TLS/SSL security provider, fails to properly verify cryptographic signatures - tagged as a JWT attack vector - enabling forged or malformed tokens to pass validation and bypass security feature enforcement. No active exploitation is confirmed (SSVC: exploitation=none; not listed in CISA KEV), and the high attack complexity and required user interaction constrain opportunistic mass exploitation despite the broad Windows version footprint.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows (Ring 2: Device Drivers) enables a denial-of-service condition exploitable from adjacent network position without authentication. The memory corruption flaw in the Windows WiFi driver stack can be triggered with passive user interaction, causing high availability impact to the vulnerable system and a residual low availability impact to subsequently connected systems. No public exploit code has been identified at time of analysis, and Intel has published advisory INTEL-SA-01422 addressing this issue.
Path traversal weakness in Craft CMS's Local volume file system class exposes servers running versions 5.0.0-RC1 through 5.10.5 or 4.0.0-RC1 through 4.18.1 to a theoretical desanitization-style flaw in the `ensurePathIsContained` function. The validate-before-normalize ordering allows a crafted path to pass validation in its raw form yet resolve outside the intended volume directory after normalization, potentially enabling reads of files beyond the designated asset directory. The vendor explicitly confirms no exploitable scenario has been discovered and classifies this as a hardening fix; no public exploit exists and this CVE does not appear in the CISA KEV catalog.
Server-side request forgery in Craft CMS's GraphQL API exposes internal networks and cloud metadata endpoints to attackers holding asset-creation-scoped tokens. The `save<Volume>Asset` GraphQL mutation fetches caller-supplied URLs server-side, and the `validateIp()` guard omits CGNAT (100.64.0.0/10) and NAT64 (64:ff9b::/96) ranges while also executing after the HTTP request has already been dispatched - meaning the check cannot prevent the unauthorized outbound connection. Affected are all 5.x installations from 5.0.0-RC1 through 5.10.5 and all 4.x installations from 4.0.0-RC1 through 4.18.1; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Intel Neural Processing Unit (NPU) Driver across all versions exposes systems to local denial of service via a low-privilege authenticated attacker operating in Ring 3 (user application space). The CVSS 4.0 score of 6.9 reflects high availability impact with a local, low-complexity, no-interaction attack path, alongside minor integrity degradation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Denial of service in Intel(R) NPU Driver affects all versions via an improper conditions check (CWE-754) reachable from Ring 3 (user applications). A locally authenticated, low-privileged user can trigger the flaw without any special attack prerequisites or user interaction, resulting in high availability impact to the vulnerable system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low complexity of exploitation combined with the growing deployment of NPU-equipped Intel platforms warrants prompt patching.
Uncontrolled resource consumption in the Intel PROSet/Wireless WiFi Software for Windows device driver (Ring 2) enables a local denial-of-service condition triggerable by an unprivileged process. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) confirms a low-complexity, local-access scenario requiring no authentication and no user interaction, with high availability impact on the vulnerable system and a secondary low availability impact on the subsequent system. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in Intel Open Volume Kernel Library (Open VKL) before version 2.0.2 allows a local authenticated attacker with low privileges to cause denial of service against applications consuming the library. Operating entirely in Ring 3 (user space), the flaw requires no user interaction and carries low attack complexity, making it straightforward to trigger for any local account on an affected system. No public exploit code and no active exploitation have been identified; Intel has released version 2.0.2 as the corrective fix per advisory INTEL-SA-01459.
Denial of service in the Intel NPU Driver firmware (all versions) is achievable by any local authenticated low-privileged user through an improper conditions check (CWE-754) in the Ring 1 device driver layer. The flaw allows an unprivileged software process operating under an authenticated user context to trigger a high-availability-impact disruption - likely a driver crash or system hang - with no attack requirements and no user interaction beyond the attacker's own actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low complexity and minimal privilege bar make it straightforward to exploit on any affected Intel Core Ultra system where the NPU driver is loaded.
Improper buffer restrictions in the Intel NPU Driver (Ring 3: User Applications) expose all driver versions to a denial-of-service condition triggerable by a local, low-privileged authenticated user. The CVSS 4.0 vector confirms local-only access (AV:L/PR:L) with high availability impact (VA:H) and a minor integrity side-effect (VI:L), but no confidentiality loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, which tempers real-world urgency despite the potentially system-disrupting availability impact.
Information disclosure in Nuxt's development server exposes the project's absolute filesystem root path and a persistent per-project workspace UUID to unauthenticated LAN-adjacent attackers via the Chrome DevTools workspace endpoint. The prior security fix (GHSA-rq7w-g337-39qq) introduced a local-request gate that trusts the attacker-supplied Host header instead of the actual TCP peer address, meaning a non-browser client such as curl can bypass it by omitting Sec-Fetch-Site, Origin, and Referer headers while forging Host: localhost. Impact is confined to information disclosure; no public exploit has been independently identified at time of analysis, though the official advisory provides a working proof-of-concept curl command. Production builds are entirely unaffected.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) enables kernel-level code execution through physical insertion of maliciously crafted UDF media, affecting every supported Windows client and server release from Server 2012 through Windows 11 26H1. The physical attack vector (AV:P) is the dominant risk constraint - a vendor patch is available from Microsoft and the vulnerability is not listed in CISA KEV. No public exploit has been identified at time of analysis, though the breadth of affected builds and the kernel execution context make this high priority in environments where physical access is not strictly controlled.
Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences into the Insights API URL path by manipulating the ClusterID value it controls, redirecting authenticated hub-side requests to unintended API endpoints. Affected deployments include any multi-cluster Red Hat Insights configuration where a spoke cluster could be under adversary control. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-organizational data exfiltration in Rapid7 Velociraptor's gRPC API allows authenticated ROOT org users to read datastore files belonging to other tenant organizations by bypassing the VFSGetBuffer endpoint's path prefix deny-list. The bypass undermines Velociraptor's multi-tenant isolation model, exposing sensitive DFIR artifacts - forensic evidence, endpoint memory, and investigation files - from organizations the attacker is not authorized to access. No public exploit code has been identified at time of analysis, and exploitation requires pre-existing high-privilege credentials in the ROOT organization.
Path traversal in Nozomi Networks Arc's local web interface allows a local administrator to delete arbitrary files on the host system by submitting a crafted archive name containing directory traversal sequences to the Offline archives functionality. The Arc process executes with administrative privileges on the host, meaning the deletable file scope extends well beyond the web interface's normal reach. No public exploit code exists and this is not listed in CISA KEV; exploitation is constrained by the requirement for both local access and administrative web interface credentials.
Heap out-of-bounds write in Tesseract OCR engine prior to 5.5.3 is triggered by a crafted LSTM .traineddata model file that causes a signed integer multiplication overflow in Convolve::DeSerialize, undersizing the forward-pass output buffer while write operations use the original unwrapped element count. Any application or user that loads an attacker-controlled model file is exposed to memory corruption that can lead to arbitrary code execution or process crash in the context of the OCR engine. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and a vendor-confirmed fix is available in Tesseract 5.5.3.
Improper input validation in the vLLM Hardware Plugin for Intel Gaudi software (versions before 0.16.0) allows a locally authenticated user to cause a denial of service, crashing or degrading availability of the affected system. The vulnerability operates within Ring 3 (user application space) and requires only low-privilege local access with no user interaction, making it viable for insider threat or compromised-account scenarios. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis; Intel has released a fix in version 0.16.0.
Stack-based buffer overflow in Vim's socket server backend prior to version 9.2.0842 allows a local process with access to the Vim server socket to corrupt stack memory or crash the Vim server by flooding it with client connections. The unbounded accept loop in socketserver_accept() causes file descriptors to exceed the compile-time bounds of fd_set structures and struct pollfd arrays allocated on the stack in src/channel.c and src/os_unix.c. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Privilege escalation in Intel processor microcode stems from improper handling of overlap between protected memory ranges at the Ring 0 hypervisor privilege level, tracked as CVE-2026-20760 and EUVD-2026-56489. Exploitation requires local, low-privilege access to a system running an affected Intel processor, allowing an authorized adversary to escalate privileges or disrupt hypervisor availability without user interaction. Intel has published advisory INTEL-SA-01441 covering this issue; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the hypervisor-level attack surface warrants priority treatment in virtualized environments.
Denial of service in Intel TDX (Trust Domain Extensions) modules at Ring 0 can be triggered by a system software adversary who already holds kernel-level privileges, causing an uncaught exception that crashes Trust Domain availability. Exploitation is constrained to local access with high attack complexity and specific attack prerequisites, meaning only highly privileged, sophisticated actors in TDX-enabled environments are realistic threat actors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the impact is limited strictly to availability - no confidentiality or integrity compromise is possible through this vector.
Insecure sensitive data storage in the Intel Trust Domain Extensions (TDX) module exposes confidential memory to privileged local adversaries on affected Intel platforms. The flaw, classified under CWE-922, allows a Ring-0 system software attacker - such as a compromised or malicious hypervisor or host OS kernel - to read data that should be protected within a Trust Domain, breaking TDX's core confidential computing isolation guarantee. No public exploit has been identified at time of analysis, and exploitation demands high privilege, high complexity, and specific attack prerequisites, materially constraining real-world risk despite the high confidentiality impact rating.
Hardware logic race conditions in 3rd Gen Intel Xeon Scalable Processors expose server environments to local denial of service. The flaw resides within Ring 3 (user-space) processor logic, where a low-privileged authenticated local user can exploit the race condition - provided they possess specialized internal knowledge of processor timing - to crash or destabilize the affected system. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS 4.0 score of 6.8 reflects the high availability impact across both the vulnerable system and any subsequent workloads sharing the hardware.
Privilege escalation in Windows DNS across a broad range of Microsoft Windows releases stems from a numeric truncation error (CWE-122) that produces a heap-based buffer overflow, enabling an already high-privileged local attacker to escalate further - likely to SYSTEM level. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 consumer editions, representing a wide patching surface. No public exploit has been identified at time of analysis, and CISA SSVC confirms exploitation status as none with no automatable attack path, though technical impact is rated total.
Windows DNS Server on a broad range of Windows and Windows Server editions contains a heap-based buffer overflow rooted in a numeric truncation error, enabling an authorized local attacker with high-privilege access to escalate privileges on the affected system. Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature versions, with Microsoft confirming full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation status as none and automatable as no, and Microsoft has released patches addressed in the MSRC advisory.