Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote unauthenticated attackers to execute arbitrary code on affected Windows systems when a user opens or previews a specially crafted image file. Affected platforms span Windows 10/11 desktop editions and Windows Server 2012 through 2025, covering a core OS image-processing library consumed by Explorer, Office, and countless third-party applications. No public exploit identified at time of analysis, but the unauthenticated network-reachable vector with a low-friction user-interaction trigger makes this a high patch-priority item given the enormous install base.
Heap-based buffer overflow in Microsoft Office enables remote unauthenticated attackers to achieve arbitrary code execution by convincing a target user to open a specially crafted Office document delivered over a network. All major Office perpetual and subscription releases are affected, spanning versions from Office 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024. Vendor-released patches are available via Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis, though the high-impact, low-complexity CVSS profile warrants prioritized patching in enterprise environments.
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable via a heap-based buffer overflow triggered when a victim opens a specially crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates unauthenticated network-reachable exploitation requiring only that the target developer open an attacker-supplied artifact - a realistic social-engineering scenario in development environments. Full compromise of confidentiality, integrity, and availability of the victim's system is possible upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a user opens a specially crafted Access database file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network delivery requiring only a single user interaction - consistent with a malicious file attachment or download attack pattern. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) and broad affected version range spanning Office 2016 through Microsoft 365 Apps make this a high-priority patch-cycle item.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows an authenticated low-privileged attacker to execute arbitrary code over the network by exploiting an improper access control flaw (CWE-284). The vulnerability affects build versions from 16.0.0 up to but not including 16.0.20326.20090, which Microsoft has patched. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows any low-privileged authenticated user to execute arbitrary code on the server over the network via an improper access control flaw (CWE-284). The vulnerability carries a CVSS 8.8 with full C:H/I:H/A:H impact triad, meaning successful exploitation yields complete compromise of the SharePoint server. No confirmed active exploitation or public proof-of-concept is identified at time of analysis, but on-premises SharePoint deployments represent high-value enterprise targets warranting priority patching.
Remote code execution in Microsoft 365 Apps for Enterprise PowerPoint (versions below 16.0.20326.20136) is possible via a use-after-free (CWE-416) triggered when a user opens a specially crafted PowerPoint file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full CIA impact achievable without attacker authentication, requiring only that the victim opens a malicious document. No public exploit code or CISA KEV listing has been confirmed at time of analysis, but Microsoft has released a patch and the memory corruption primitive makes this a high-priority update for enterprise environments.
Security feature bypass in Visual Studio Code before 1.136.2 allows a local attacker to circumvent an input-validation blocklist (CWE-184), resulting in high confidentiality, integrity, and availability impact. The vulnerability requires user interaction - most plausibly opening a crafted workspace or file - but no elevated privileges. Microsoft shipped a vendor patch capping affected versions below 1.136.2; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Print Spooler Components (Windows 11 24H2, build < 10.0.26100.9445) via a heap-based buffer overflow triggered over the network. An unauthenticated remote attacker can exploit this by delivering a maliciously crafted print-related payload that a victim user must interact with, resulting in full C:H/I:H/A:H compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible vector and zero-privilege requirement make this a meaningful patching priority.
Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.
Code injection via the Apache Nutch Server REST API allows low-privileged remote attackers to execute arbitrary code on hosts running Nutch versions 1.11 through 1.22. The vulnerability chains missing authorization controls with unsafe reflection and dynamic code execution in the Nutch REST API, enabling full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis; the vendor's definitive fix in version 1.23 removes the Nutch Server component entirely.
Unauthenticated access to the Private Metrics Server component in Commvault Cloud allows network-adjacent or internet-facing attackers to interact with the metrics upload functionality without credentials. The CVSS 4.0 vector (PR:N, VA:H, VI:L) confirms the endpoint lacks authentication entirely, enabling service disruption and limited metrics data manipulation. No public exploit code has been identified at time of analysis, and the vendor has released a maintenance update resolving the condition.
Heap-based buffer overflow in Microsoft SQL Server allows a low-privileged local attacker to execute arbitrary code with full confidentiality, integrity, and availability impact on the SQL Server host. Affected versions span four major release generations - SQL Server 2017 through 2025 - across both Cumulative Update and GDR servicing tracks, indicating a systemic code path defect rather than an isolated regression. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected builds.
Guest-to-host code execution in Windows Hyper-V affects authorized guest VM users who can trigger an untrusted pointer dereference (CWE-822) to execute code in the hypervisor context, effectively escaping the VM sandbox. The CVSS scope-change metric (S:C) confirms this is a privilege escalation from guest to host, making it a hypervisor escape with full High C/I/A impact on the underlying host. Affected platforms span Windows Server 2022 and 2025 and multiple Windows 11 release channels (23H2 through 25H2). No public exploit or CISA KEV listing identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
SQL injection in the Private Metrics Server component of Commvault Cloud allows unauthenticated remote attackers to read sensitive database contents and perform limited data manipulation via crafted inputs to affected database operations. All active Commvault Cloud release branches - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - are affected up to specific maintenance release cutpoints documented in vendor advisory CV_2026_08_2. Commvault has released maintenance updates resolving the condition; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated adjacent-network exploitation of `l2cap_handle_data()` in Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a crafted L2CAP packet, causing a Denial of Service. The assigned CVSS vector reports C:H/I:H/A:H - substantially exceeding the described DoS-only impact - suggesting the underlying memory corruption may carry code execution potential not explicitly confirmed in the advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Local privilege escalation in Xbox Gaming Services (versions 19.0.0.0 through <37.114.10001.0) allows a low-privileged authenticated local attacker to gain full SYSTEM-level or administrator access via improper authorization checks (CWE-285). The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation requiring only an existing user session with no additional complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, and a vendor patch is available from Microsoft.
Server-side request forgery in Apache Impala 4.4.x and 4.5.x allows authenticated users with execute permission on the `ai_generate_text()` function to exfiltrate secrets stored in Hadoop Credential Providers configured via `hadoop.security.credential.provider.path` in `core-site.xml`. The attacker must know the alias (key name) of the target secret, limiting opportunistic exploitation; however, successful exfiltration yields plaintext credentials that can be leveraged for downstream compromise of connected systems. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), indicating low observed exploitation pressure.
Heap buffer overflow in Android's OAPV video codec decoder (oapv.c) enables remote code execution on Android 16 and 17 without requiring user interaction. The flaw resides in dec_frm_prepare(), where insufficient bounds checking during frame decoding preparation allows an attacker to overwrite heap memory via crafted video content. EPSS sits at 0.18% (8th percentile) with SSVC exploitation status rated 'none', but technical impact is classified as 'total' and no public exploit has been identified at time of analysis.
LocalImageResolver.java in Android 14 through 17 (including QPR2 releases) contains a DNG image rendering authorization check bypass (CWE-863) that enables remote privilege escalation with full confidentiality, integrity, and availability impact. The flaw requires only low-level privileges and no user interaction, expanding the attack surface beyond typical media-processing vulnerabilities that normally depend on explicit user file-opening. Google's Android Security Team disclosed the issue via the September 2026 Android Security Bulletin; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side code execution in CMSimple 5.22's CoAuthors plugin enables an authenticated low-privileged user who can edit page content to achieve full remote code execution by passing crafted external or uploaded text through the plugin's content import feature. The vulnerability is rooted in CWE-94 (improper code generation control), where imported content is processed server-side without sufficient sanitization, allowing arbitrary PHP or server-side logic to execute in the web server context. Publicly available exploit code exists via a GitHub gist and associated issue tracker, though EPSS stands at 0.17%, reflecting limited observed exploitation at this time.
Guest-to-hypervisor privilege escalation in Xen allows a VM guest with a PCI device assigned - where the device exposes at least one Base Address Register (BAR) mapped to IO port space - to trigger a BUG() assertion in the Xen hypervisor, crashing or potentially compromising the host. The CVSS scope-changed vector (S:C, C:H/I:H/A:H) reflects cross-boundary impact: the attack originates inside a guest VM but affects the host hypervisor. Tracked as XSA-510, no public exploit is identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with a targeted-environment issue rather than mass exploitation.
Remote code execution is achievable in Android's NFC subsystem across Android 14 through 17, including Android 16-QPR2, via a heap buffer overflow in the MIFARE Classic tag reader function rw_mfc_handle_read_op() within rw_mfc.cc. An attacker within NFC proximity can present a crafted MIFARE Classic tag that overflows a heap-allocated buffer in the NFC daemon, yielding full device control with no victim interaction required and no privileges needed on the target. No public exploit has been identified at time of analysis, though the SSVC framework rates the technical impact as total given the unauthenticated RCE capability.
Remote code execution is possible in Android's NFC Type 3 Tag processing layer (rw_t3t.cc within libnfc-nci) across Android 14 through 17 via an integer overflow that triggers a heap out-of-bounds write. No user interaction or additional privileges are required per the description, making this exploitable by any attacker within NFC proximity of an unpatched device. Google addressed this in the September 2026 Android Security Bulletin; no public exploit or active exploitation has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation status as 'none'.
Remote code execution in Android's MatroskaExtractor component (MatroskaExtractor.cpp) affects Android 14, 15, 16, and 16-qpr2 via an improper type cast during Matroska/MKV media container parsing. A low-privileged remote attacker can exploit this flaw without user interaction to achieve full confidentiality, integrity, and availability compromise on the target device. No public exploit has been identified at time of analysis, and EPSS stands at 0.15%, though the zero-interaction requirement and full-impact CVSS 8.8 rating warrant prompt patching.
Privilege escalation in Adobe Acrobat Reader and Adobe Acrobat (all editions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows a low-privileged local attacker to gain full elevated access via an Incorrect Authorization flaw (CWE-863). The CVSS scope-change indicator (S:C) with C:H/I:H/A:H confirms the vulnerability crosses a privilege boundary beyond Acrobat's own security domain - almost certainly compromising the underlying OS context. No user interaction is required, enabling silent exploitation once a foothold is established. No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential disclosure in Microsoft Azure CycleCloud allows an authenticated low-privileged attacker to retrieve insufficiently protected credentials over the network, potentially gaining access to additional Azure or HPC infrastructure resources. Affected versions are Azure CycleCloud below 8.9.2, and the scope change in the CVSS vector (S:C) indicates that disclosed credentials can be leveraged against systems beyond the vulnerable CycleCloud instance itself. No public exploit identified at time of analysis; a vendor-released patch is available.
Token replay vulnerability in macropay-solutions/maravel-framework prior to version 10.74.0 enables attackers holding invalidated JWT tokens to bypass authentication and regain unauthorized API access after a predictable 2-hour window. The root cause is a lifecycle collision: the framework's O(1) Atomic Lazy Eviction model silently caps all tagged cache entries at 7,200 seconds, truncating the tymon/jwt-auth blacklist's intended 14-day retention and leaving revoked tokens cryptographically valid but logistically unblocked. No public exploit code has been identified and the CVE is not in CISA KEV, though the attack mechanism is deterministic and requires no specialized tooling.
Remote code execution in Craft CMS before 5.10.12 allows authenticated content editors to achieve full server compromise through a PHP class-injection and log-poisoning chain. By supplying a crafted criteria[withTransforms][0][class] parameter to the element-index endpoint, an attacker forces ImageTransforms::normalizeTransform() to instantiate an arbitrary PHP class; chaining this with yii\rbac\PhpManager - a built-in Yii RBAC component - the attacker can execute PHP payloads previously smuggled into request logs via the User-Agent header. No public exploit tool or CISA KEV listing is identified at time of analysis, but the fully documented multi-stage technique materially lowers the expertise barrier for exploitation.
Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows a high-privileged attacker to bypass access control boundaries and perform unauthorized writes to resources outside their intended scope, with the scope change (S:C) amplifying impact to components beyond the directly vulnerable module. All supported branches of Adobe Commerce (2.4.4-2.4.9), Magento Open Source (2.4.6-2.4.9), and Commerce B2B (1.3.3-1.5.3) prior to the August 2026 security patch cycle are affected. No public exploit or CISA KEV listing is identified at time of analysis; exploitation requires an already-authenticated admin-level session.
Heap-based buffer overflow in Microsoft's Graphics Component enables remote code execution across a broad swath of Windows operating system versions and Microsoft Office products. An unauthenticated network attacker who delivers a specially crafted file can trigger the overflow when the victim opens or renders the content, achieving full C:H/I:H/A:H compromise of the affected system. No public exploit code or CISA KEV listing is associated at time of analysis, but the breadth of affected products - spanning every supported Windows release and multiple Office generations - makes this a high-priority patching target.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow (CWE-122) triggered when a user opens a specially crafted document. The flaw affects a broad swath of Office product lines - Microsoft 365 Apps for Enterprise, Office 2016/2019/LTSC 2021/LTSC 2024 on Windows, and Office for Mac variants - with vendor patches available at specific build thresholds. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of patched-but-unconfirmed-exploited, though the enormous deployment footprint and phishing-friendly delivery model elevate real-world priority.
Heap-based buffer overflow in Microsoft's Web Media Extensions component of the Windows Codecs Library allows an unauthenticated remote attacker to achieve arbitrary code execution by delivering a specially crafted media file. The EUVD identifies all versions from 1.0.0.0 through pre-1.2.42.0 as affected. Exploitation requires a user to interact with attacker-controlled media content - for example, opening a file or visiting a page that triggers media playback - after which the heap overflow can yield full C/I/A compromise of the user's session. No public exploit or active exploitation is identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables unauthenticated remote attackers to achieve arbitrary code execution at the privilege level of the target user. The vulnerability (CWE-122) is triggered when a victim opens a specially crafted Word document, covering Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise across both Windows and Mac platforms. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the broad product coverage and high CVSS of 8.8 make this a priority patching target.
Remote code execution in Microsoft Office Word via a double-free memory corruption flaw (CWE-415) allows a network-accessible, unauthenticated attacker to achieve full system compromise with high confidentiality, integrity, and availability impact. The vulnerability spans seven distinct product/version combinations - Word 2016, Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise on Windows, and multiple Mac editions - making the affected surface unusually broad. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and wide deployment footprint make rapid patching a clear priority.
Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) allows remote code execution on a victim's machine when the user connects to an attacker-controlled RDP server. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms full confidentiality, integrity, and availability impact at low attack complexity, constrained only by the requirement that the victim actively initiate the connection. Vendor patch has been released and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through 1.2.7279.0 exclusive) allows a remote unauthenticated attacker to execute arbitrary code on the client machine when a user connects to an attacker-controlled or compromised RDP server. The flaw carries a CVSS 8.8 with full C/I/A impact, requiring only that the victim initiate an RDP session. No public exploit identified at time of analysis, and a vendor-released patch is available at version 1.2.7279.0.
Remote code execution in Microsoft Office Word via a heap-based buffer overflow (CWE-122) allows an unauthenticated network attacker to fully compromise a victim system upon opening a crafted document. All major Office licensing tracks are affected on both Windows and macOS, spanning Office 2016 through Microsoft 365 Apps for Enterprise. No CISA KEV listing or public exploit code is referenced in available data, but the low-complexity, no-privileges-required vector with full confidentiality, integrity, and availability impact makes this a critical priority for enterprise patch cycles.
Heap-based buffer overflow in Microsoft Office Word's document parsing engine enables remote unauthenticated attackers to execute arbitrary code on target systems when a user opens a specially crafted document. The vulnerability affects a wide range of Microsoft Office releases - Word 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - making the attack surface extremely broad. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis, though UI:R interaction remains the sole barrier to exploitation.
Out-of-bounds read in Microsoft Office Excel enables remote code execution when a victim opens a crafted Excel workbook, achieving full C/I/A compromise on the target system. The vulnerability spans every major Office product line from Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS. Vendor-released patches are available for all Windows product lines with specific fixed builds enumerated; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables remote unauthenticated code execution when a victim opens a specially crafted document. Affects the full breadth of Office deployments - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Word 2016, and their Mac equivalents - making the attack surface extremely wide. No public exploit identified at time of analysis, but the CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) with full C/I/A impact places this firmly in priority patching territory for enterprise environments.
Use-after-free in Microsoft Word enables remote code execution when a victim opens or interacts with a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects delivery over the network with no authentication required and only a single user interaction - opening a malicious file - as the prerequisite. Full confidentiality, integrity, and availability compromise is achievable on the affected endpoint, spanning Microsoft Word 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and their Mac counterparts. No public exploit or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in Microsoft Word's document-parsing engine, arising from a numeric truncation error, enables remote code execution when a user opens a specially crafted Word document. The flaw spans a wide matrix of Office SKUs on both Windows and Mac - including Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - and carries CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting full compromise with the only friction being the required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the ubiquity of the Office install base makes this a high-priority patching target.
Remote code execution in Microsoft Office Word exposes virtually every Windows and macOS Office release channel - Word 2016, Office 2019, LTSC 2021/2024, 365 Apps for Enterprise, and Office for Mac - to full system compromise via a specially crafted document. The heap-based buffer overflow (CWE-122) fires during document parsing with no authentication required from the attacker, only standard user interaction to open the malicious file, yielding C:H/I:H/A:H impact under a low-complexity attack path. Microsoft has issued patches across all Windows release branches and flags macOS editions as affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Office Word via a use-after-free (CWE-416) memory corruption flaw allows an unauthenticated network attacker to compromise a target system when the victim opens a specially crafted document. All major release tracks are affected - Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS - with fixed builds published by Microsoft. No CISA KEV listing or public exploit has been identified at time of analysis, but the CVSS 8.8 PR:N/UI:R profile is characteristic of document-delivery RCE bugs historically prioritized by both criminal and nation-state actors for initial access.
Stack-based buffer overflow (CWE-121) in Microsoft Office Word enables a remote unauthenticated attacker to execute arbitrary code on a victim's machine by delivering a specially crafted Word document and inducing the target to open it. The vulnerability spans a wide swath of Office product lines - from Word 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise - on both Windows and macOS platforms. Microsoft has released patches across Windows product lines; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Code injection in Microsoft Remote Desktop Client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) enables an unauthenticated network attacker to execute arbitrary code on the connecting client machine. The vulnerability is triggered when a user connects to an attacker-controlled RDP server that delivers malicious server-side responses exploiting CWE-94 code generation flaws in the client. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.