Out-of-bounds read in Adobe Acrobat Reader (≤26.002.21900) and Acrobat 2024 (≤24.001.30383) exposes sensitive process memory when a victim opens a specially crafted PDF file. The vulnerability stems from CWE-125, an out-of-bounds read, allowing an attacker who delivers a malicious document to obtain memory contents that could facilitate ASLR bypass or exfiltrate in-memory data such as document content or credentials. No public exploit has been identified at time of analysis; exploitation requires user interaction via file opening.
Out-of-bounds read in Adobe Acrobat Reader and Adobe Acrobat (all editions through version 26.002.21900, and Acrobat 2024 through 24.001.30383) enables sensitive process memory disclosure when a victim opens a specially crafted document. Rooted in CWE-125 improper bounds enforcement during file parsing, the flaw leaks adjacent memory contents including potential pointers or cached sensitive data. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Use-after-free in Adobe Acrobat Reader and Acrobat exposes sensitive heap memory contents when a victim opens a specially crafted PDF file. The vulnerability affects Acrobat and Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, with confidentiality impact rated High by Adobe PSIRT. No public exploit code has been identified at time of analysis, and exploitation requires the victim to open a malicious file.
Use After Free (CWE-416) in Adobe Acrobat and Acrobat Reader permits sensitive memory disclosure when a victim opens a maliciously crafted document. Affected versions span Acrobat and Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. The memory-corruption primitive exposes heap contents - potentially including credentials, key material, or in-process data - but the CVSS vector confirms no integrity or availability impact, making this a pure information-disclosure issue. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Adobe Acrobat and Acrobat Reader - versions up to 26.002.21900 and Acrobat 2024 up to 24.001.30383 - allows disclosure of sensitive process memory when a victim opens a specially crafted document file. The confidentiality impact is rated high (C:H), meaning leaked memory contents could include pointers, session data, or other in-process secrets, though there is no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-141 addressing the issue.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader exposes sensitive process memory to attackers who can deliver malicious PDF files. Affected versions include Acrobat Reader and Acrobat 2024 up to 26.002.21900 and 24.001.30383 respectively. Exploitation requires a victim to open a crafted file, but no system privileges are needed - the barrier is solely user interaction, making phishing and email-borne delivery effective vectors.
Integer underflow (CWE-191) in Adobe Acrobat Reader allows an attacker to disclose sensitive process memory contents by tricking a victim into opening a crafted PDF or Acrobat file. Affected across all current Acrobat 2024 (≤24.001.30383) and Acrobat/Acrobat Reader continuous-track (≤26.002.21900) releases. No active exploitation confirmed in CISA KEV; no public exploit code identified at time of analysis, though Adobe-class memory disclosure flaws are frequently chained with code execution primitives.
Out-of-bounds read in Adobe Acrobat Reader and Acrobat (Continuous Track ≤26.002.21900; Classic 2024 Track ≤24.001.30383) allows an attacker to disclose sensitive memory contents from a victim's process by delivering a crafted PDF file that the victim must open. The flaw is rooted in CWE-125 and carries a CVSS 5.5 score reflecting its local, user-interaction-dependent attack vector with high confidentiality impact but no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis.
Uncontrolled resource consumption in Adobe Acrobat Reader and Acrobat 2024 enables application-level denial of service when a victim opens a specially crafted document. Affecting Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, the flaw (CWE-400) allows a malicious file to exhaust system resources and crash or freeze the application. Adobe has released patches via advisory APSB26-141; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker to inject malicious script into page output, enabling spoofing attacks against other users. Successful exploitation requires the victim to interact with attacker-controlled content but can result in high confidentiality and integrity impact within the victim's SharePoint session context. Microsoft has released patch version 16.0.20326.20090 addressing this flaw, reported internally via secure@microsoft.com.
Permanent local denial-of-service in Android's PackageInstallerService allows a low-privilege local attacker to irreversibly disable an affected device through a logic error in the createSessionInternal session-creation path. Affected releases are Android 16-qpr2 and Android 17, as confirmed by Google's September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the monthly Android security update.
Persistent local denial of service in Android's VoiceInteractionManagerService affects versions 14 through 17 via resource exhaustion in the initForUserNoTracing method. A low-privilege local attacker - such as a malicious installed app - can exhaust system resources without any user interaction, rendering the device persistently unavailable. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with limited real-world exploitation interest.
Persistent denial-of-service in Android's WifiNetworkSuggestionsManager affects versions 15 through 17, including 16-QPR2. The `add` method in WifiNetworkSuggestionsManager.java fails to enforce resource consumption limits (CWE-400), allowing a low-privileged local application to exhaust system resources and render the device unresponsive or degraded without any user interaction. No confidentiality or integrity impact exists; the risk is purely availability-based, but the 'persistent' characterization implies the DoS survives reboots or normal recovery paths.
Permanent local denial of service in Android's GameManagerService affects devices running Android 14 through 16-qpr2, exploitable by any low-privilege application without user interaction. The vulnerable code path - `parseInterventionFromXml` in `GameManagerService.java` - fails to bound resource consumption during XML parsing of game mode intervention data, allowing a locally installed app to exhaust system resources and render the service permanently unavailable until device reboot. No public exploit has been identified; the September 2026 Android Security Bulletin addresses this vulnerability.
Heap-based buffer overflow in Cesanta mJS up to version 1.26 allows unauthenticated remote attackers to achieve partial memory corruption by supplying crafted JavaScript input that triggers the `skip_spaces_and_comments` tokenizer function in `src/mjs_tok.c`. All release versions from 1.0 through 1.26 are confirmed affected per EUVD-2026-73943. A public proof-of-concept exploit has been disclosed via VulDB, the vendor has not responded to the issue report, and no patch has been released at time of analysis.
Hard-coded database credentials in ningzichun Student Management System expose MySQL connection secrets in the publicly accessible GitHub repository, allowing any attacker who reads the source to authenticate directly to the backend database. The vulnerability resides in config/database.php where mysqli_connect() is called with literal credential strings (CWE-259), affecting all commits up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Publicly available exploit code exists (E:P per the CVSS 4.0 supplemental); the project maintainer has not responded to the responsible disclosure issue.
Authentication bypass in aircheng-org iWebShop-5 (all versions 5.0-5.15) allows unauthenticated remote attackers to access the seller management panel by manipulating the `Name` parameter in the `Login` function of `controllers/systemseller.php`. A public exploit exists (referenced via GitHub issue #6), and SSVC confirms automatable exploitation with partial technical impact. The vendor has not responded to responsible disclosure, and no patch is available.
Out-of-bounds read in Microsoft Office Excel's file parser allows a local attacker to disclose process memory contents when a victim opens a specially crafted Excel document. Affected across all major release channels including Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac variants. No public exploit has been identified at time of analysis, and SSVC classifies exploitation as none with non-automatable delivery.
Buffer over-read (CWE-126) in Microsoft Word's document parsing code allows local disclosure of in-process memory when a victim opens a specially crafted file. All currently-supported Office release lines on Windows - 365 Apps for Enterprise, Office 2019, 2021, 2024 LTSC, and Word 2016 standalone - are affected across both x86 and x64 architectures. No public exploit code has been identified, and SSVC rates exploitation as 'none' with technical impact 'partial', consistent with the moderate CVSS 5.5 rating.
Buffer over-read (CWE-126) in Microsoft Office Word allows local information disclosure when a user opens a specially crafted document, exposing process memory contents with high-confidentiality impact. Affected builds span Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across both x86 and x64 architectures. No public exploit has been identified at time of analysis, SSVC rates exploitation as none and the attack as non-automatable, and vendor patches are available for all affected product lines.
Uninitialized resource use (CWE-908) in Microsoft Excel allows a local attacker to disclose process memory contents when a user opens a specially crafted workbook. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS, with vendor patches released across all Windows builds. No public exploit has been identified and SSVC rates exploitation as none with partial technical impact, placing real-world risk firmly in the moderate range despite the C:H CVSS metric.
Out-of-bounds read in Microsoft Excel allows a local, unauthenticated attacker to disclose potentially sensitive memory contents by convincing a user to open a specially crafted workbook. Affected builds span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code exists and CISA SSVC rates exploitation as 'none' with partial technical impact, making this a moderate-priority patch-cycle item rather than an urgent emergency.
Sensitive system information disclosure in Microsoft Excel allows a local, unauthenticated attacker to read high-confidentiality data when a victim opens a specially crafted spreadsheet. Affecting Office 2016 through LTSC 2024 on both Windows and Mac, the flaw (CWE-497) exposes internal system data - such as memory layout, environment variables, or path information - to an unauthorized control sphere during file parsing. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in Microsoft Excel discloses sensitive memory contents when a victim opens a specially crafted Excel file. The vulnerability spans a wide range of affected versions including Excel 2016, Office 2019, LTSC 2021/2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise, making the patch surface broad across enterprise environments. No public exploit or active exploitation has been identified at time of analysis; vendor patch is available via MSRC.
Out-of-bounds read in Microsoft Excel across Office 2016 through 365 Apps for Enterprise permits a local, unauthenticated attacker to disclose sensitive memory contents when a victim opens a specially crafted spreadsheet file. The vulnerability carries a CVSS 5.5 score reflecting the local delivery requirement and confidentiality-only impact, with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, and vendor patches are available for all major Windows Office editions.
Uninitialized memory disclosure in Microsoft Excel exposes potentially sensitive heap or stack contents when a victim opens a crafted document, allowing an unauthenticated attacker to read process memory with high confidentiality impact. Affected product lines span Excel 2016 through Microsoft 365 Apps for Enterprise and multiple Mac variants, making this a broad-surface vulnerability. No public exploit code and no CISA KEV listing have been identified at time of analysis; SSVC assessment rates exploitation as 'none' with non-automatable delivery, limiting realistic risk to targeted document-delivery campaigns.
Out-of-bounds read in Microsoft Office Excel's file parser allows local information disclosure when a victim opens a specially crafted workbook. Affecting Excel 2016 through Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office Online Server, and multiple macOS Office variants, the vulnerability (CWE-125) exposes process memory with high confidentiality impact but no integrity or availability consequences. Microsoft has released patched builds via MSRC; SSVC confirms no active exploitation and non-automatable delivery, placing this squarely within standard monthly patch-cycle priority.
Microsoft Office Excel exposes sensitive system information to an unauthorized control sphere (CWE-497), enabling local information disclosure when a victim opens a specially crafted Excel file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC editions on both Windows and Mac. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the C:H CVSS confidentiality rating indicates the quality or quantity of information that can be exfiltrated is significant.
Improper null termination (CWE-170) in Microsoft Office Word's document-processing pipeline allows a local attacker to read beyond a string buffer boundary, disclosing sensitive in-memory data when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and Mac variants across Windows (x64/x86) and macOS. No active exploitation is confirmed (SSVC Exploitation: none; no KEV listing), and Microsoft has released fixed builds across all affected product lines.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in the Windows SMB Server component allows a locally authenticated attacker with low privileges to read sensitive information they are not authorized to access. The flaw, rooted in CWE-862, means the SMB Server fails to enforce proper authorization checks before returning data to a requesting principal. Affecting Windows 10, Windows 11, and Windows Server 2016 through 2025, this is a moderate-severity confidentiality issue with no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.
Information disclosure in Windows Universal Plug and Play (UPnP) Device Host allows a local authenticated attacker to access private personal information they are not authorized to view. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Microsoft has released patches via the standard update cycle.