Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library lets an attacker who already holds low-privileged, authenticated code execution on a Windows host trigger an out-of-bounds read inside a higher-integrity compositing component, and the resulting memory-safety failure can be leveraged to execute code in the DWM security context and escape the attacker's original privilege level. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction and no non-default configuration, and affects every supported Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025 build, including Server Core installations. Vendor-released patch builds are available via the Microsoft Security Response Center update guide; no public exploit code has been identified at time of analysis and CISA's SSVC evaluation records exploitation as none, so this is a post-compromise escalation primitive rather than an initial-access or remote vector.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvr) lets an attacker who already holds low-privilege code execution on a Windows 10 or Windows 11 host corrupt memory and elevate to a higher-integrity context. The defect is a use-after-free (CWE-416) triggered through the per-user DVR/broadcast service, and it carries a CVSS 3.1 base of 7.8 under the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction and unchanged scope but high confidentiality, integrity, and availability impact once the service context is abused. This is a purely local escalation primitive, not a remote entry point: no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no', though technical impact is rated 'total'.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege escalation in the Microsoft Windows Fax and Scan Service lets an authenticated low-privileged user on the host trigger a heap-based buffer overflow (CWE-122) and gain code execution at a higher integrity level, including SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a local foothold and valid credentials but needs no user interaction and faces low attack complexity; hosts where the Fax and Scan Service is disabled, removed, or unreachable by standard users are not exposed. Per CISA SSVC the exploitation status is "none" and the issue is not automatable, and no public exploit code has been identified at time of analysis - this is a credible but second-tier patch-priority item rather than an active emergency.
Privilege escalation in the Windows Storage Spaces Controller allows an authenticated attacker with existing low-privileged local code execution to corrupt kernel heap memory and elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a heap-based buffer overflow (CWE-122) reachable locally with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it functions as a post-compromise escalation primitive rather than a remote entry point; prior local access and valid credentials are required. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released fixed builds across all affected branches.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated, low-privileged code execution on a host to trigger a use-after-free in the installer service and execute code in a higher-privileged context. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-416), the flaw requires an existing foothold and is therefore a second-stage escalation primitive rather than a remotely reachable or pre-authentication vector, with no user interaction needed once that local access exists. No public exploit code has been identified at time of analysis, and no confirmed active exploitation has been reported; Microsoft has released fixes covering all supported Windows client and server branches, including fixed builds such as 10.0.26100.9711 for Windows 11 24H2 and 10.0.26100.33650 for Windows Server 2025.
Local privilege escalation in Windows Management Services lets an authenticated attacker who already holds a standard-user session on a Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 host drive a use-after-free to gain high-integrity code execution with full confidentiality, integrity, and availability impact on the affected machine (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is only reachable after the attacker has obtained local code execution, making it a post-compromise escalation primitive rather than a remote entry point; the CISA SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis. A vendor patch is available through Microsoft's update guide, and the impact is total for the host once the UAF is successfully converted into elevation.
Local privilege escalation in the Windows Print Spooler allows an attacker who already holds an authenticated, low-privileged foothold on a Windows host to elevate to SYSTEM-level code execution. The root cause is a use-after-free memory corruption flaw (CWE-416) that requires no user interaction and has low attack complexity, so it can be triggered reliably once local code execution is obtained; the local-only vector means it is a post-compromise escalation primitive rather than an initial-access path. Microsoft has released patched builds for all affected client and server versions, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based memory corruption in the Windows Remote Access Connection Manager (RasMan) service lets a locally authenticated, low-privileged user corrupt heap memory and escalate privileges into the service's elevated security context on affected Windows 10, Windows 11 and Windows Server builds. The path is purely local and requires an existing foothold with standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), and CISA's SSVC rates exploitation as none with non-automatable attacks but total technical impact. There is no public exploit identified at time of analysis, and Microsoft has released fixed builds, so this is a credible but not emergency-tier priority - highest for hosts where untrusted or semi-trusted users already have interactive local access.
Local privilege escalation in the Windows Message Queuing (MSMQ) Queue Manager allows an authenticated, low-privilege attacker with an existing foothold on the host to trigger a use-after-free in the queue manager and elevate to SYSTEM (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable only locally, requires MSMQ - an optional Windows component that is not installed or running by default - and provides no path to initial access, so the realistically exposed population is limited to hosts where MSMQ is enabled and to attackers who have already obtained a local account. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a vendor patch; the risk is credible but not a drop-everything emergency.
A stack-based buffer overflow (CWE-121) in the Windows Installer component (msiexec/MSI package processing) allows an authenticated local attacker holding a low-privileged session to elevate to higher privileges, including SYSTEM, with high confidentiality, integrity, and availability impact (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable in the default configuration of all supported Windows client and server editions, but exploitation requires an existing local foothold and no victim interaction, so it is best characterized as a privilege-escalation link in a broader intrusion chain rather than an initial-access vector. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as total. A vendor patch is available per Microsoft's MSRC update guide.
Local privilege escalation in the Windows Clipboard User Service lets an authenticated low-privileged attacker who can already run code on a target host raise their rights to SYSTEM-level by triggering a use-after-free in the service's memory handling. Exploitation is timing-sensitive rather than trivial: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that the attacker needs local authenticated access and must win a race to reclaim freed memory, but no victim interaction and no network path are required, and the resulting scope change means full compromise of confidentiality, integrity, and availability on the host. Microsoft has released fixed builds for all affected Windows branches, and as of analysis there is no public exploit code and no confirmed active exploitation (CISA SSVC exploitation: none); this is a moderate-priority, real-but-not-urgent elevation-of-privilege flaw that matters most on multi-user, RDP, or kiosk-style systems where untrusted users share a session host.
Local privilege escalation in the Windows Clipboard User Service allows an authenticated low-privileged attacker who already holds a foothold on the host to elevate to higher integrity via a use-after-free (CWE-416) in the service's object handling. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and because the Scope metric is Changed the successful exploit crosses a privilege boundary rather than merely corrupting the vulnerable process. Exploitation is constrained by high attack complexity - the attacker must win a timing window and reliably reclaim the freed object, so CISA's SSVC assessment rates it non-automatable with exploitation observed as none, and no public exploit code has been identified at time of analysis. All supported Windows 10, Windows 11 and Windows Server branches up to the January-class build cutoffs listed in the advisory are affected, and a vendor patch is available.
Local privilege escalation in the Internet Explorer/MSHTML engine affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) as enumerated by EUVD. An attacker who already holds low-privileged local access on the host (PR:L, AV:L) and requires no user interaction (UI:N) can trigger a use-after-free (CWE-416) in the freed-component path to cross a security boundary and gain higher privileges, with the scope change (S:C) indicating the compromise escapes the original security context; C/I/A impacts are all High. Exploitation is constrained by high attack complexity (AC:H), which in practice means winning a memory-timing race and successfully grooming the heap to reclaim the freed object - there is no public exploit identified at time of analysis, SSVC assessed exploitation as 'none' and automatable as 'no', and no CISA KEV entry exists. Risk is genuine but non-emergency: the limiting factors are the prerequisite local foothold and the unreliable, complexity-bound trigger rather than any non-default configuration.
Local privilege escalation in OpenSSH for Windows allows an authenticated attacker to elevate privileges by triggering a double-free memory corruption. Affected builds include Windows 10, Windows 11, and Windows Server versions prior to the fixed builds listed in Microsoft's advisory. No public exploit identified at time of analysis; a vendor-released patch is available.
Privilege escalation in Microsoft Exchange Server allows an authenticated local attacker to gain elevated privileges on the server. The vulnerability, tracked as CVE-2026-87695, affects Exchange Server 2016 CU23, 2019 CU14 and CU15, and Subscription Edition RTM before specific patched builds. Exploitation requires the attacker to already have low-privileged access on the Exchange server itself (CVSS PR:L, AV:L), which significantly limits the attack surface; no public exploit has been identified at time of analysis. A vendor patch is available.
Ivanti Xtraction versions prior to 2026.4 are vulnerable to a path traversal flaw in the template export feature, allowing an authenticated attacker with low privileges to read arbitrary files accessible to the service account. Exploitation requires a valid session but no user interaction, and while confidentiality is compromised, no public exploit code or active exploitation has been identified; this is a genuine but second-tier priority rather than an emergency.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a low-privileged authenticated attacker to make the ColdFusion server issue requests to internal or otherwise restricted resources, potentially escalating access and reading sensitive data. The vulnerability is rated CVSS 3.1 7.7 with scope changed and high confidentiality impact only; authentication as a low-privileged user is required (PR:L), no user interaction is needed, and no public exploit code was identified at time of analysis.
Local privilege elevation on supported Windows builds stems from the Windows Key Distribution Center (KDC) accepting cryptographic signatures it should have rejected, letting an attacker who already holds low-privileged credentials and local access to an affected host reach high integrity and confidentiality impact (CVSS 7.8, AV:L/PR:L/UI:N). The KDC role normally runs only on Windows Server Domain Controllers, although the vulnerable code ships across every client and server build enumerated in the EUVD data - Windows 10 1607/1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025. Microsoft has published a fix through the MSRC update guide; no public exploit code and no CISA KEV entry were identified at time of analysis, and the independent assessment rates this as a genuine but second-tier priority because exploitation requires a pre-existing foothold and validated credentials rather than a remote or unauthenticated path.
Arbitrary code execution in Adobe Photoshop Desktop (27.x up to and including 27.10, and 26.x up to and including 26.11.7) is possible when a user opens a specially crafted file, because an integer overflow or wraparound during file parsing corrupts memory and lets attacker-controlled code run in the context of the current user. Exploitation is local in nature - the attacker must deliver a malicious file and convince the victim to open it - and, per the CVSS vector (AV:L, PR:N, UI:R, S:U), no prior authentication is needed but no privilege escalation is gained, since code executes only with the victim's own rights. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is a credible but not top-tier priority driven by targeted social engineering rather than opportunistic mass exploitation.
Integer overflow (CWE-190) in Adobe Photoshop Desktop lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file. Affected installations are Photoshop 27.x up to and including 27.10 and Photoshop 26.x up to and including 26.11.7, per Adobe advisory APSB26-158 (tracked as EUVD-2026-100691). The vector is local (AV:L) and unauthenticated (PR:N) but gated by mandatory user interaction (UI:R), so there is no network-facing, no-click exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority client-side file-parsing flaw rather than a mass-exploitation emergency.
Opening a maliciously crafted file in Adobe Photoshop Desktop (27.10 and earlier, and 26.11.7 and earlier) can trigger a double-free memory-corruption condition that results in arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that the attacker cannot reach the target over the network and must rely on the victim opening the file, and that code executes only with the privileges of the logged-on user rather than escalating to system level; adversary value is therefore tied to social-engineering delivery of a weaponised document, and there is no public exploit identified at time of analysis. The independent assessment rates this as a credible but not emergency-level priority, consistent with the local attack vector and user-interaction requirement; no CISA KEV listing or public proof-of-concept was supplied in the source data.
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Out-of-bounds write in Adobe FrameMaker allows arbitrary code execution in the context of the current user when a victim opens an attacker-crafted document. Rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787), the flaw is reached locally and requires user interaction, so exploitation depends on social engineering to deliver a malicious file that the target then opens; no authentication is required of the attacker and no non-default configuration is implicated, meaning any installation that opens the file is affected. Impact is bounded by the privileges of the user running FrameMaker (S:U), and there is no public exploit code or confirmed active exploitation identified at time of analysis.
An out-of-bounds write (CWE-787) in Adobe FrameMaker allows arbitrary code execution in the context of the current user when a victim opens a crafted FrameMaker document. Exploitation is file-based and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 7.8 HIGH): the attacker must socially engineer the target into opening malicious content, and the resulting code runs with only that user's privileges rather than gaining system-level control. No confirmed active exploitation or publicly available exploit code was identified at time of analysis, but the full confidentiality, integrity, and availability impact makes prompt patching important for engineering and technical-publishing environments that routinely exchange FrameMaker files.
Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).
Opening an attacker-supplied crafted file in Adobe Dimension 4.1.8 or earlier can trigger a stack-based buffer overflow that allows arbitrary code execution in the context of the victim's user account. Scoring 7.8 under CVSS 3.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is delivered purely through social engineering - a target must open a malicious file - and requires no network reachability, credentials, or elevated privileges, though any resulting code runs only at the victim's privilege level with no scope change. No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a credible but moderate-priority patching item rather than an emergency.
Heap-based buffer overflow in Adobe FrameMaker enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted file. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) confirms the attack is local and requires user interaction, with no privileges needed to trigger the flaw but no remote or automatable path either. No public exploit was identified at time of analysis, exploitation is bounded to systems where FrameMaker is installed and used to open untrusted documents, and code runs only with the current user's privileges - there is no automatic elevation of privilege.
Out-of-bounds write in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) allows an attacker to execute arbitrary code in the context of the current user when the victim opens a malicious file. The flaw is a local, client-side memory corruption issue (AV:L, UI:R) that requires user interaction but no privileges; no public exploit has been identified at time of analysis. This is a high-severity flaw but not an emergency-tier internet-facing threat due to the human-in-the-loop prerequisite and user-level impact.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.
Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).
Out-of-bounds write in Adobe Photoshop Desktop running builds at or below 26.11.7 (and at or below 27.10 per ENISA EUVD data) allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. Because exploitation requires the victim to manually open a malicious file on their own system, the attack vector is local-only and depends on user interaction, and any code that runs inherits only the opening user's privileges (no privilege escalation). This is a genuine but operationally moderate-priority issue: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local plus user-interaction prerequisites materially reduce real-world risk.
Out-of-bounds write in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) allows an attacker to execute arbitrary code in the context of the current user when a victim opens a malicious file. The vulnerability requires user interaction (opening the file) and has a local attack vector, with a CVSS 3.1 base score of 7.8 High. No public exploit code has been identified at time of analysis.
Opening an attacker-supplied file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds write that leads to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is strictly local and client-side: there is no network-facing service to hit, and the victim must be socially engineered into opening a malicious asset in their own session. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the practical risk is bounded by the required user interaction and the specialized deployment of this creative tooling, which favors targeted delivery over opportunistic mass exploitation.
Local privilege escalation in Windows Credential Providers allows an attacker who already holds authenticated low-privileged access on a host to trigger a race condition in concurrently accessed shared resources and escalate privileges. Exploitation is complicated by a high attack-complexity rating (AC:H) - the attacker must repeatedly invoke the credential provider code path and win a narrow, non-deterministic timing window, so success is probabilistic rather than reliable. There is no remote or unauthenticated vector and no user-interaction requirement (AV:L, PR:L, UI:N, S:C), and no public exploit code or confirmed active exploitation was identified at time of analysis; risk is concentrated on multi-user, shared, or already-foothold Windows systems rather than single-user desktops without untrusted local access.
Arbitrary code execution in Adobe Substance 3D Stager (versions 3.1.8 and earlier) is possible when a victim opens a maliciously crafted file, which overflows a stack buffer during parsing and lets the malformed input corrupt memory in the context of the current user. The attack cannot be triggered remotely or without the target's cooperation - it is a local vector (AV:L) that requires user interaction (UI:R), so delivery depends on social engineering that convinces the victim to open the file - and code executes with the privileges of that user only (S:U), meaning a non-administrative victim limits the blast radius to that account. Adobe's PSIRT assigned a 7.8 base score (CWE-121), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Opening a crafted file in Adobe Substance 3D Stager 3.1.8 or earlier can trigger a stack-based buffer overflow that leads to arbitrary code execution in the context of the current user. The attack is local in nature (AV:L) and requires the victim to open an attacker-supplied file (UI:R), while requiring no privileges on the target (PR:N), so practical exploitation depends on socially engineering a user into opening a malicious asset rather than on any remotely reachable network service. There is no public exploit identified at time of analysis and nothing in the supplied intelligence indicates confirmed active exploitation, so this is a genuine but not emergency-priority issue at a CVSS 3.1 base score of 7.8, with impact bounded by the privileges of the user who opens the file.
Arbitrary code execution is possible in Adobe Substance 3D Stager 3.1.8 and earlier, where a use-after-free (CWE-416) is triggered while the application processes a crafted file. The CVSS v3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) shows no authentication is required, but the attacker must deliver the malicious file locally and convince the victim to open it, after which code runs only with the privileges of the current user. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the practical risk is driven by social-engineering delivery and by the fact that a crash (denial of service) is also achievable from the same corrupting file.
Arbitrary code execution in mp4v2 2.0.0 can be triggered when a victim or application opens a specially crafted MP4 file containing an undersized RTP ('rtp ') atom; MP4RtpAtom::ReadHntiType() performs an unchecked offset subtraction that underflows to a near-2^64 allocation size, leading to memory corruption and potential code execution. The assessed vector is local with user interaction required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so the malicious file must be parsed on the target system rather than delivered to a listening network service. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile), and the upstream fix is available as a PR/commit but no released patched version is independently confirmed.
An out-of-bounds read when parsing a crafted file in Adobe Substance 3D Stager 3.1.8 and earlier can be leveraged to execute code in the context of the current user, though exploitation is constrained by mandatory user interaction - a victim must open a maliciously crafted file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is triggered locally through file loading rather than over the network, requires no attacker-held privileges, and yields only the privileges of the user who opens the document. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a genuine but not emergency-grade priority requiring timely patching rather than urgent incident response.
Parsing a maliciously crafted 3D asset or project file in Adobe Substance 3D Stager 3.1.8 and earlier can drive an out-of-bounds read that leads to code execution in the context of the user running the application. Exploitation is local and socially engineered - the victim must open the attacker-supplied file (AV:L, UI:R, PR:N) - and impact is confined to that user's privileges (S:U), so a non-administrative account limits the blast radius. No public exploit code and no CISA KEV entry were identified at time of analysis, making this a targeted, per-user risk rather than a mass-exploitation threat.
An out-of-bounds read (CWE-125) in Adobe Substance 3D Stager 3.1.8 and earlier can lead to arbitrary code execution in the context of the current user when a victim opens a crafted file with the application. Exploitation is local in vector terms (AV:L) and requires user interaction (UI:R), so an attacker must first deliver a malicious asset and persuade the target to open it; code execution is confined to the victim's privileges because the scope is unchanged (S:U). Rated CVSS 7.8 (High), with no public exploit identified at time of analysis and no CISA KEV listing, making this a genuine but not top-tier priority that should be handled through routine patch cycles rather than emergency response.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) is possible when a low-privileged authenticated attacker with local or adjacent access exploits an incorrect authorization flaw (CWE-863) to operate outside the intended security scope and run code in the context of the current user. Adobe notes the exploit depends on conditions beyond the attacker's control, which is reflected in the high attack complexity (AC:H), and no user interaction is required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the combination of authenticated low privilege (PR:L), local vector (AV:L) and high complexity makes reliable mass exploitation unlikely.
Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.
An out-of-bounds write in Adobe Photoshop Desktop (builds up to and including 27.10, and the 26.x line up to and including 26.11.7) lets an attacker corrupt process memory and achieve arbitrary code execution with the privileges of the user who opened the file. Exploitation is not remote: it requires a victim to open a crafted image or project file (CVSS 3.1 base 7.8, AV:L/PR:N/UI:R), so a successful attack depends on social engineering to deliver and convince the user to open the document. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) is possible via an out-of-bounds write when a victim opens a crafted file. Exploitation requires user interaction and is limited to the context of the current user; no public exploit identified at time of analysis. The CVSS score is 7.8, and the vulnerability is not known to be actively exploited.