Insufficient session expiration in Eleveo Call Recording Software (versions up to and including 10.3.0) leaves the Keycloak OpenID Connect logout endpoint at /auth/realms/default/protocol/openid-connect/logout unable to fully invalidate session state, so a session can persist after a user believes they have logged out (CWE-613). Exploitation requires an attacker to already hold a low-privileged authenticated account (PR:L) and depends on passive user interaction (UI:P), such as a victim performing or relying on a logout action; the resulting impact is limited to minor confidentiality exposure (VC:L) with no integrity or availability effect. Publicly available exploit code exists, no confirmed active exploitation has been reported, and with a CVSS 4.0 base score of 2.0 this is a genuinely low-priority issue despite being remotely reachable.
Local file disclosure in ImageMagick before 7.1.2-32 stems from a time-of-check time-of-use symlink race in the MagickWand script-token loader, which lets an attacker who can already invoke a magick script replace an authorized path with a symlink in the window between the policy check and the actual file open. The impact is limited: it only matters on installations that deploy a restrictive policy.xml ReadPolicyRights (there is nothing to bypass on default configurations), the attacker must win a non-deterministic race, and the result is read-only disclosure of files the policy intends to block - consistent with the low assessed severity. No public exploit was identified at time of analysis, the issue is not listed in CISA KEV, and a vendor-released patch is available in ImageMagick 7.1.2-32.
Denial of service in ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32, where a type confusion in the INFO, JSON and YAML encoders lets a locally positioned low-privilege user crash the ImageMagick process (SIGABRT or SIGSEGV) when an image is written to a compressed or blob-backed output stream. The flaw is reached only when the write targets a non-FILE stream such as zip:, bzip2: or a blob/FIFO destination, so ordinary file, pipe and standard-stream output are unaffected; impact is limited to availability of the single process, with no confidentiality or integrity loss. This is a genuinely low-priority issue - the assessed vector is local, low-privilege and availability-only - and no public exploit identified at time of analysis, though vendor patches are available.
ImageMagick 7.1.0-20 through 7.1.2-31 can crash or corrupt memory through a use-after-free in the MagickCore -fx expression evaluator, which is reached when the internal RPN element table must grow and the underlying memory allocation fails. Exploitation is constrained: it requires a local, low-privileged caller who can supply crafted -fx expressions to a process that is simultaneously under genuine memory pressure (the AT:P precondition in the CVSS 4.0 vector, base score 2.0), and the independent assessment caps impact at low availability loss with no confidentiality or integrity effect. The condition is not attacker-deterministic under ordinary conditions, no public exploit code has been identified at time of analysis, and this is not confirmed actively exploited (no CISA KEV listing), making it a genuinely low-priority issue whose signals are consistent rather than conflicting.
An invalid memory free in ImageMagick's fx expression evaluator (MagickCore/fx.c) lets a local attacker with low privileges crash the process by forcing initialization of an FX runtime entry to fail, producing a denial-of-service condition in applications that pass attacker-controlled input to the -fx operator. Only the error-cleanup path is defective - the code frees fxrts[t] instead of fxrts[t2] - so the bug does not trigger during normal FX usage or default processing of benign images, and there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis and the issue is not referenced by CISA KEV; the independent assessment rates it low (CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), and vendor fixes are available.
ImageMagick 6.9.13-57 and earlier and 7.1.2-32 and earlier allow a local attacker to bypass configured security policy restrictions by pointing a symbolic link at a policy-restricted path, because the IsRightsAuthorizedByName rights check fails to account for symlinks and evaluates the wrong target. Exploitation requires a pre-existing local account with permission to create symlinks (low privileges, PR:L) plus a deployment that actually enforces ImageMagick policy.xml as a trust boundary; where no such policy is configured there is nothing to bypass. Impact is confined to low-level confidentiality and integrity loss with no availability impact, and no public exploit code has been identified at time of analysis.
Heap buffer over-write in ImageMagick versions before 6.9.13-57 (6.x) and before 7.1.2-32 (7.x) is triggered when the security policy is read and written concurrently by multiple threads, crashing the application and causing a denial of service. Exploitation requires local low-privileged code execution (CVSS:4.0 AV:L/PR:L) inside a process that embeds the library and that modifies its policy at runtime, combined with winning a probabilistic timing race (AT:P); the flaw yields no confidentiality or integrity impact, only availability loss. No public exploit code has been identified at time of analysis, and vendor-released patches are available as 6.9.13-57 and 7.1.2-32.
Local process termination in Yungengxin Cloud Billing 2024.11.28.11 allows any authenticated local user who can reach the bundled LWBilling64.sys kernel driver to kill arbitrary processes running on the host, because the IOCTL handler at sub_14000443C acts on a caller-supplied Pid without adequate access control. Exploitation requires only local low-privileged access (CVSS 3.1 AV:L/AC:L/PR:L/UI:N), with no user interaction and no elevation beyond that, and the impact is confined to integrity and availability - no data disclosure and no remote path exist. Publicly available exploit code has been published and may be used, but the issue is not in CISA KEV, the scored severity is low (CVSS 4.0 base 1.9, E:P), and the software's narrow deployment footprint limits real-world reach; the vendor was contacted prior to disclosure and did not respond.
Local authenticated attackers with low privileges can bypass or break the Sandbox component in deepseek-harness up to 0.1.1-rc.2 by manipulating the 'Profile' argument to the spawn function, resulting in a sandbox issue that may lead to limited privilege escalation. Publicly available exploit code exists, but the impact is capped at Low for confidentiality, integrity, and availability with no scope change, making this a low-priority issue. The vendor did not respond to disclosure, and no patch has been identified.
Eleveo Call Recording Software up to 10.3.0 transmits the OpenID Connect id_token_hint JWT as a GET query-string parameter on its logout endpoint (/auth/realms/default/protocol/openid-connect/logout), allowing that token to be captured from browser history, referrer headers, proxy caches, or server access logs. Exploitation is remote but constrained: the CVSS vector indicates a low-privileged authenticated context (PR:L), passive user interaction (UI:P), and high attack complexity (AC:H), with the vendor itself stating exploitability is difficult, and impact limited to low confidentiality disclosure of the token - no integrity or availability effect. Publicly available exploit code exists and the disclosure has been published, but there is no evidence of confirmed active exploitation (not in CISA KEV); the overall CVSS base score is only 1.2, making this a very low-priority issue.