Local privilege escalation in Google Android 14, 15, 16, 16-QPR2 and 17: a heap buffer overflow (CWE-122) in getEntryFileName in ZipFileRO.cpp, the native ZIP central-directory entry-name read path, can be driven by an attacker who already has local code execution on the device - typically an installed unprivileged app - to corrupt heap memory and gain code execution in the context of the privileged component that parses the archive, with no additional execution privileges and no user interaction required (CVSS 8.4, AV:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and its exploitation prerequisite is prior local execution; the exact malformed ZIP input that triggers the overflow is not detailed in the available sources. EPSS is low at 0.12% (2nd percentile) and no public exploit has been identified at time of analysis, but the vendor has published a fix in the 2026-11-01 Android Security Bulletin, and the priority assessment places remediation in the current week.
Local privilege escalation in Google Android 17 arises from a path traversal in ProfilingService.sendAnomalyProfile, allowing an attacker who can execute code locally to gain elevated privileges without additional execution privileges or user interaction. The issue is confined to the local attack vector and the affected Android 17 release; no public exploit was identified at time of analysis, and EPSS is low at 0.11%.
Local privilege escalation in Google Android 16, Android 16-qpr2, and Android 17 allows an attacker who can already execute code on the device to turn an integer overflow into an out-of-bounds write and gain elevated privileges without additional privileges or user interaction. No public exploit was identified at time of analysis; EPSS is 0.11% (1st percentile) and CISA KEV does not list it. Apply the November 2026 Android Security Bulletin update.
A missing permission check in the insertInternal method of Android's MmsProvider.java lets a locally installed application cross multiuser isolation boundaries and read or modify SMS/MMS data belonging to another user or profile, yielding local escalation of privilege with high confidentiality and integrity impact. Android 14, 15, 16, 16-qpr2 and 17 are listed as affected, and the flaw is rated 8.4 by the vendor-scale CVSS vector AV:L/AC:L/PR:N/UI:N, but exploitation is strictly local: the attacker must already have code running on the device and a multi-user or secondary-profile configuration must exist for the boundary to be meaningfully crossed. No public exploit code or CISA KEV entry was identified in the supplied data, and EPSS is low at 0.11% (1st percentile), consistent with a second-tier, this-week priority rather than an emergency.
Local escalation of privilege on Android 14, 15, 16, 16-QPR2 and 17 stems from misleading or insufficient consent UI in the platform's AllowBindAppWidgetActivity, where a user's reject action can be misunderstood as consent when binding an app widget. Exploitation requires a malicious app already installed and running on the device plus a victim who is fooled by the deceptive dialog, so the flaw is neither remotely reachable nor silently triggerable; the assessed vector is AV:L/AC:L/PR:N/UI:R with high confidentiality, integrity and availability impact. Risk telemetry is modest - EPSS 0.11% (1st percentile), no CISA KEV entry, and no public exploit identified at time of analysis - consistent with a this_week, moderate-priority decision rather than an emergency.
Local privilege escalation to code execution in Android 16, 16-qpr2 and 17 stems from a missing permission check (CWE-862) in nfa_t4tnfcee_store_rx_buf, part of the NFCEE Type-4-Tag receive-buffer handling in nfa_nfcee_act.cc. An attacker who already has a foothold on the device - an installed unprivileged or malicious app able to reach that NFC code path - can exploit it without any additional execution privileges, and no user interaction is required, yielding high confidentiality, integrity and availability impact as an NFC/Android-system-level component. Exploitation is local (CVSS AV:L, PR:N/UI:N); there is no confirmed active exploitation and no verified public exploit code, and EPSS is very low (0.11%, 1st percentile), so this is a this_week-priority hardening item for devices not yet on the 2026-11-01 Android security patch level.
Local privilege escalation in Google Android 16, Android 16-qpr2 and Android 17 allows an application already running on the device to bypass an activity-navigation permission check and obtain elevated read, write and execute-equivalent access to protected data and components. The flaw is a logic error in navigateUpTo within ActivityClientController.java, classified as a protection-mechanism failure (CWE-693), and is rated CVSS 8.4 with a local attack vector, low complexity, no required privileges and no user interaction. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as none and the attack as not automatable, although technical impact is rated total; the vendor reference is the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in the Android kernel allows unprivileged code running on the device to trigger a use-after-free in do_fault_around during fault-around page-fault handling, potentially corrupting kernel memory and leading to elevated code execution or denial of service. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, so no additional privileges or user interaction are needed once local code execution is achieved, and there is no remote exploitation path. No public exploit code or confirmed active exploitation was identified at time of analysis; SSVC rates exploitation as none and the decision label is this_week, making this a genuine but not emergency-grade priority.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 lets code already running on the device bypass a permission check in WindowState.java's prepareWindowToDisplayDuringRelayout and obtain high-integrity code execution, with no additional Android permissions (PR:N) and no user interaction (UI:N) required. The defect is a CWE-693 protection-mechanism failure in the window relayout path, scored CVSS 8.4 with total technical impact per SSVC. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and SSVC records the flaw as not automatable.
Local privilege escalation in the Android common kernel's FUSE backing passthrough code (fuse_backing_mmap in backing.c) lets an unprivileged app already executing on the device corrupt kernel memory through a use-after-free and obtain elevated privileges, with high confidentiality, integrity and availability impact. The attack is local only (AV:L) with no privileges or user interaction required once code runs (PR:N/UI:N), so a separate initial-access step such as installing or compromising an app is a prerequisite. Exploitation status is not confirmed: SSVC records Exploitation as none, no KEV entry is present, and no public exploit code has been identified at time of analysis; severity is rated 8.4 and vuln.today assigns a 'this_week' priority, with fixes shipped in the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in the Android common kernel's DMA-BUF subsystem allows an app that is already running on the device to convert a race-condition use-after-free in dma-buf.c into kernel-level code execution with system privileges. The assessed vector (AV:L/AC:H/PR:N/UI:N) means the attacker needs an existing local foothold but no additional privileges and no user interaction, and the timing dependency of the race is what makes reliable exploitation difficult; the published CVSS base score is 8.4, though the assessed complexity is High rather than the Low implied by the CVE record's own vector. No public exploit code and no active exploitation have been identified at time of analysis, and SSVC automation is rated 'no', so this is a serious but not currently weaponized local escalation issue.
A local privilege escalation exists in the Android kernel's process-creation code (fork.c), where a logic error across multiple functions leaves a freed object reachable and produces a use-after-free (CWE-416). Per the CVSS vector (AV:L/PR:N/UI:N), any party able to run unprivileged code on an affected device can trigger it without additional execution privileges or user interaction, and successful exploitation yields high confidentiality, integrity and availability impact at kernel level. Exploitation requires local code execution on the device and is not remotely reachable; SSVC records exploitation as none and no public exploit has been identified at time of analysis, so despite the 8.4 base score the practical urgency is measured rather than emergency-grade, with fixes delivered through the November 2026 Android Security Bulletin.
A logic error in multiple functions of SaveUi.java on Android 14, 15, 16, 16-qpr2 and 17 lets a locally installed application bypass package-installation requirements, yielding local escalation of privilege with high confidentiality, integrity and availability impact (CVSS 8.4, AV:L/PR:N/UI:N). The principal constraint is the local attack vector: the attacker must already have code running on the device, typically through an installed app, and the exact feature-level trigger inside SaveUi.java is not described in the available sources. No public exploit code and no active exploitation are indicated (SSVC Exploitation: none, Automatable: no), so this is a patch-this-week item rather than an emergency; the vendor bulletin is dated 2026-11-01.
Local privilege escalation in Google Android 15, 16, 16-qpr2, and 17 lets an attacker who can already execute code on the device trigger a use-after-free memory corruption and gain elevated privileges without additional execution privileges or user interaction. The flaw is not remotely reachable; the local-access prerequisite is the main barrier. No public exploit identified at time of analysis, no confirmed active exploitation, and SSVC records exploitation as none.
Local privilege escalation in the Android kernel allows code running in an unprivileged app context to escalate to kernel-level compromise, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.4, AV:L/AC:L/PR:N/UI:N). The root cause is a use-after-free (CWE-416) arising from a logic error present in multiple kernel locations; the description states no additional execution privileges and no user interaction are required, so a zero-permission application suffices as the entry point. No public exploit has been identified at time of analysis and SSVC records exploitation as none, but the fix is tracked through the November 2026 Android Security Bulletin, so exposure persists on any device that has not taken that patch level.
Local privilege escalation in Android's UriGrantsManagerService (Android 14, 15, 16 and 16-qpr2) lets code already running on the device bypass URI permission checks through improper input validation in writeGrantedUriPermissions. Per the CVSS vector (AV:L/AC:L/PR:N/UI:N) a local attacker needs no additional app permissions and no user interaction, yielding high confidentiality, integrity and availability impact. No public exploit is identified at time of analysis and CISA SSVC records no observed exploitation, though an Android Security Bulletin reference is provided for the fix.
A logic error in Android's background activity launch handling (tracked as CVE-2026-58837, CWE-693 protection mechanism failure) allows a locally installed app to escalate privileges and gain high confidentiality, integrity and availability impact on the device. Affected branches are Android 14, 15, 16, 16-QPR2 and 17, with a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the trigger is local only - a hostile or compromised app must already be running on the handset, but once it is, no elevated privileges and no user interaction are required. There is no public exploit identified at time of analysis (CISA SSVC Exploitation: none), and the flaw is addressed through the Android Security Bulletin dated 2026-11-01; the vendor does not name the specific components ('multiple locations'), so no configuration-specific precondition can be confirmed.
A logic error in AccountManagerService.onResult on Android 14, 15, 16, 16-qpr2 and 17 lets a locally installed app produce an untrusted or misleading result or UI, escalating privileges without any additional execution privileges and without user interaction. Google rates the impact as full loss of confidentiality, integrity and availability (CVSS 3.1 8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the attacker must already be running code on the device because the vector is strictly local with no remote reachability. No public exploit code has been identified at time of analysis, and CISA SSVC marks exploitation as none and the flaw as not automatable, so the practical constraint remains the requirement for prior on-device code execution; the trigger sequence beyond the onResult logic error is not described in the available sources.
Local privilege escalation in Google Android 15, 16, 16-qpr2, and 17 arises from a confused-deputy permission bypass in NFC AID conflict resolution within RegisteredAidCache.resolveAidConflictLocked. A locally installed, unprivileged app can manipulate AID registration or routing so a more-privileged NFC or system component acts on its behalf, with no additional execution privileges and no user interaction required; the CVSS 3.1 score is 8.4. No public exploit was identified at time of analysis, SSVC exploitation is none, and the issue is serious but not urgent because the attacker must first get code running locally; builds at the November 2026 security patch level are fixed.
Local privilege escalation in Google Android 16 QPR2 and Android 17 lets an unprivileged app already running on the device bypass permission checks through a confused-deputy flaw and gain elevated access, with no user interaction required. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, C/I/A High) produces a score of 8.4, but the attack surface is confined to local code execution on the affected builds. No public exploit was identified at the time of analysis, CISA SSVC records exploitation as none with total technical impact, and the Android security bulletin dated 2026-11-01 is the vendor reference for fixes.
Local privilege escalation in Google Android's MusicFX helper (MusicFxHelper.java, handleAudioEffectBroadcast) lets a locally installed, unprivileged application bypass a permission check through a confused-deputy condition, causing a more privileged Android component to act on the attacker's behalf and yielding high confidentiality, integrity and availability impact. Affected branches listed by the EUVD are Android 14, 15, 16, 16-qpr2 and 17; remote attackers cannot reach the flaw because the attacker must already be running code on the device, and no user interaction or additional execution privileges are required. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a genuine but not emergency-level priority scheduled for this week's remediation cycle.
Local privilege escalation in Android 17 allows an app already installed on the device to bypass permission checks and gain elevated access by invoking a privileged system component that fails to validate the caller's identity. The CVSS 8.4 score reflects high confidentiality, integrity and availability impact with no user interaction required, but the attack surface is strictly local - an attacker must first get code running on the device, and no network path exists. Exploitation is not confirmed: no public exploit code or KEV listing was identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', while technical impact is rated total; no EPSS score was supplied in the source data.
Local privilege escalation in Android's Wi-Fi system service (WifiServiceImpl.startTetheredHotspotRequest) allows an already-installed application to bypass permission checks through a confused-deputy pattern, gaining access to privileged tethering/hotspot operations without holding any granted permissions. Affected branches are Android 14, 15, 16, 16-qpr2 and 17, with a CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting local-only attack, no required permissions and no user interaction. Exploitation is not confirmed in the wild - SSVC records Exploitation: none and no public exploit code was identified at time of analysis - and the fix ships in the November 2026 Android Security Bulletin. The attack surface is bounded: an attacker must already have code execution on the device (a malicious or trojanized app), and SSVC marks the issue as not automatable.
Local privilege escalation in Android's telecom framework (queryRemoteConnectionServices in ConnectionServiceWrapper.java) allows a malicious or compromised app installed on the device to induce the privileged telecom service to act on its behalf, bypassing a permission check through a confused-deputy pattern (CWE-441). The flaw is rated CVSS 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no granted privileges and no user interaction are required, but it is not remotely reachable - the attacker must already have local code execution, in practice the ability to install and run an app. Android 14, 15, 16 and 16-qpr2 are listed as affected; no public exploit has been identified at time of analysis and fixes are addressed in the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in Android's GrantCredentialsPermissionActivity allows an installed application to obtain account credentials it should not be granted, by presenting a misleading or insufficiently informative permission dialog to the user. Affected platforms are Android 14, 15, 16, 16-qpr2 and 17 according to EUVD version data, with the vendor bulletin covering the Android Open Source Project component. The vector is local (AV:L) with no privileges required and high confidentiality, integrity and availability impact, rated 8.4; no public exploit has been identified at time of analysis and SSVC marks the flaw as not automatable, so the practical barrier is first obtaining app-level code execution on the device.
Local privilege escalation in Google Android's NotificationManagerService (affecting Android 14, 15, 16, 16-qpr2 and 17) lets an app running on the device drive a policy desynchronization in notification-listener access grants, yielding high confidentiality, integrity and availability impact. Per the CVSS vector (AV:L, PR:N, UI:N) the attacking app needs no previously granted privileges and no user interaction; it only needs a foothold on an affected build, so remote exploitation is not possible. No public exploit has been identified at time of analysis (SSVC exploitation: none) and the issue is scheduled in the vendor's November 2026 Android Security Bulletin, placing it in the current weekly patching cadence rather than an emergency response.
Local privilege escalation in the Android framework's UsbDialogHelper component, caused by misleading or insufficient UI (CWE-451) in the USB dialog path, affecting Android 14, 15, 16, 16-qpr2 and 17. Per the assessed vector (AV:L/AC:L/PR:N/UI:N), code already running on the handset can trigger the flaw without elevated privileges and without user interaction, yielding high confidentiality, integrity and availability impact; network reachability does not apply. Exploitation status is none per SSVC and no public exploit has been identified at time of analysis, so this is a real but non-urgent priority for the current week rather than an emergency.
Android's Storage Access Framework contains an access-control logic error in ExternalStorageProvider.java, specifically in the shouldBlockDirectoryFromTree method, allowing a locally-present app to reach protected data by abusing the document-tree interface. Because the vector is AV:L with PR:N and UI:N, any permission-less app already installed on the device can trigger the flaw without user interaction, yielding high confidentiality and integrity impact (our assessment scores it 8.4 with availability unaffected). The vendor lists the fix in the November 2026 Android security bulletin; no public exploit code or confirmed active exploitation is identified in the available data, and the this_week decision label reflects a serious but locally-gated issue rather than an urgent remote threat.
Android 14, 15, 16, 16-qpr2 and 17 contain a confused deputy flaw (CWE-441) in the AppTimeTracker deliverResult path that lets a locally installed app trigger a background activity launch and escalate to the privileges of a more trusted component, yielding high confidentiality and integrity impact. Per the independent assessment the malicious app needs no extra execution privileges and no user interaction (PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must first get code onto the device with no remote path available. No public exploit code or active exploitation is confirmed at time of analysis - SSVC Exploitation is 'none' and Automatable is 'no' - and the vendor bulletin is the November 2026 Android security release.
Local privilege escalation in Android's ActivityStarter component (resolveToHeavyWeightSwitcherIfNeeded in ActivityStarter.java) lets an app already installed on the device abuse a confused-deputy condition to make a privileged system component perform a background activity launch on its behalf, yielding high confidentiality, integrity and availability impact with no user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) confirms the attacker needs local code execution - in practice a locally installed application - but no additional execution privileges and no user tap; remote exploitation is not possible without first getting code onto the device. Affected versions reported are Android 14, 15, 16, 16-QPR2 and 17; SSVC rates technical impact as total but marks the flaw as not automatable with no exploitation observed, and there is no public exploit identified at time of analysis.
Background activity launch in Google Android 14, 15, 16, 16-qpr2, and 17 allows a locally installed app to start activities in the background by exploiting a confused deputy in ActivityTaskManagerService.moveTaskToFrontLocked, bypassing the task-ordering checks that are supposed to prevent exactly that. Per the assessed CVSS vector (AV:L/PR:N/UI:N), the attacker needs no special permissions and no user interaction once an untrusted app is running on the device, yielding high confidentiality and integrity impact with local escalation of privilege. The flaw is rated this-week priority rather than emergency: it is not marked as actively exploited in CISA KEV, SSVC records exploitation as none and automatable as no, and no public exploit code was identified at time of analysis. Fixes are delivered through the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 lets an unprivileged application already installed and running on the device abuse a confused-deputy flaw in AddAccountSettings.java, causing a privileged component to launch a background activity on the attacker's behalf and yielding high confidentiality and integrity impact with no additional execution privileges and no user interaction. The attack surface is strictly local (AV:L, PR:N, UI:N), so there is no remote vector, and the attacker must first get code running on the target. No public exploit identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and the issue carries a this-week priority, meaning it should be scheduled into the current patch cycle rather than treated as an emergency.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2, and 17 allows an app already installed on the device to exploit a missing permission check in AccessibilityWindowManager.setAccessibilityWindowAttributes and create untrusted or misleading UI. The independent assessment rates the issue AV:L/AC:L/PR:L/UI:N with high confidentiality and integrity impact, requiring a local app foothold but no user interaction, while SSVC records Exploitation: none and Technical Impact: total. No public exploit has been identified at time of analysis, and the vendor reference is the Android Security Bulletin for 2026-11-01.
Local privilege escalation in Google Android 17 allows an app already running on the device to abuse a confused-deputy component and execute sensitive USSD codes without additional execution privileges or user interaction, with high confidentiality and integrity impact. The issue is rated CVSS 8.4, no active exploitation is confirmed in the supplied data, and no public exploit identified at time of analysis; the vendor reference is the November 2026 Android Security Bulletin. This is a genuine prioritization candidate but not an emergency, matching the this_week decision label.
Intent redirection in Android 17's ContactsPickerActivity lets a locally installed malicious app relay an attacker-controlled intent into a more privileged handler, gaining the privileges of that handler and thereby escalating from an ordinary app sandbox to a higher-integrity context (CVSS 8.4, AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H). The confused-deputy flaw sits in forwardToPreferredActionPickHandler within ContactsPickerActivity.kt and requires no user interaction and no permissions granted to the calling component, but the attacker must already be able to run code or deliver an intent on the device - typically through a separately installed application. Affected scope is stated as Android 17 only; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so this is a genuine but non-emergency local privilege-escalation issue slated for remediation in the current patch cycle.
A confused-deputy flaw in multiple Android onActivityResult handlers allows a locally installed app to read contact data belonging to a protected profile (such as a work or managed profile) without holding any permission for it. Per the assessed vector (AV:L/AC:L/PR:N/UI:N) the attacker needs only an installed app - no granted privileges and no user interaction - but the device must actually be configured with a separate protected profile holding the contacts, since without that boundary there is nothing to cross. Affected builds span Android 14, 15, 16, 16-qpr2 and 17 per EUVD; no public exploit code was identified at time of analysis and there is no CISA KEV entry, so priority follows the vendor bulletin rather than observed exploitation.
Stored cross-site scripting in FOSSBilling 0.1.0 through 0.8.8 lets an authenticated staff member holding only the support.manage_tickets permission plant HTML or JavaScript in a support ticket note via admin/support/note_create; the note is persisted unsanitized and later written into the DOM with innerHTML by the admin ticket list template. The payload executes in the browser session of any staff member who opens that ticket's notes, including a Super Administrator, allowing CSRF-token theft, exfiltration of accessible client and invoice data, and any administrative action the viewer's account permits. The vendor-released patch is 0.8.9; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor notes there is no complete workaround without patching.
Authorization bypass in NLnet Labs Krill lets an authenticated Krill operator assert an arbitrary child identity during parent-child provisioning when the target CA's parent CA is hosted on the same Krill server, bypassing the signed CMS verification normally used in the RFC 6492 exchange. The issue is conditional on a shared or multi-tenant deployment with co-located parent and child CAs; single-tenant setups with remote parents are not reachable through this path. CVSS 3.1 rates it 8.4 with high confidentiality and integrity impact, and no public exploit has been identified at time of analysis.
An authorization bypass in NLnet Labs Krill allows an account whose role is deliberately scoped to a subset of CAs (cas = [...]) to exercise its full permission set on any API request that is not tied to a specific CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. Exploitation requires a valid, provisioned Krill account holding such a restricted role (PR:L in the CVSS vector, so this is an authenticated insider or compromised-credential scenario), but a successful attacker can create a child CA beneath any existing CA, hand it that CA's resources, and mint the ROAs supplied in the request, affecting other tenants sharing the instance (S:C). No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the vendor advisory is the authoritative source.
Nonce reuse in Krill's login-session token encryption lets an attacker who captures multiple encrypted tokens across Krill restarts exploit a repeated (key, nonce) pair to recover or forge session-token plaintext. The flaw stems from a nonce counter that resets to zero on every restart, so deployments that restart Krill periodically accumulate ciphertexts encrypted under identical key/nonce combinations. Exploitation is not anonymous: it requires low-privilege authenticated access to the login flow, several restarts the attacker cannot directly trigger, and cryptanalytic effort (AC:H), so realistic risk sits below the raw 8.4 score; no public exploit code or active exploitation was identified at time of analysis, and the vuln.today decision label is this_week.
Missing permission checks in the MediaTek GPU pdma driver, paired with a use-after-free, allow local privilege escalation on MT8910 and MT6993 chipsets: code running without privileges can reach the pdma interface and gain elevated execution with no user interaction and no additional execution privileges. MediaTek assigned patch ALPS11365075 (issue MSV-9546) and published it in the November 2026 product security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and SSVC records exploitation as none and the flaw as not automatable, but the total technical impact and CVSS 8.4 severity support this-week rather than emergency-grade prioritization, since the vector is local-only and confined to the listed chipset models.
Out-of-bounds write in the MediaTek modem component allows code that is already running locally on an affected device to corrupt memory and escalate privileges, with no authentication or user interaction required (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/SU/ C:H/I:H/A:H, base score 8.4). Roughly 77 MediaTek MT-series chipsets are enumerated as affected, ranging from entry-level parts such as MT6739, MT6761 and MT6765 through premium SoCs such as MT6989, MT6991 and MT6993. No public exploit code has been identified at time of analysis and SSVC records exploitation as none with no automatable path, but technical impact is rated total and the only complete fix is MediaTek patch MOLY01778991 (issue MSV-8900), published in the November 2026 product security bulletin.
Local privilege escalation in the GPU pdma path of MediaTek MT8910 and MT6993 chipsets allows an unprivileged local process to gain elevated privileges through a use-after-free condition in memory handling. Per the CVSS vector (AV:L/AC:L/PR:N/UI:N), no prior privileges and no user interaction are required once code is running on the device, but the attacker must already have local execution - the flaw is not remotely reachable. Exploitation activity is not confirmed (CISA SSVC: Exploitation none) and no public exploit code has been identified at time of analysis; MediaTek has issued patch ALPS11365070, so exposure is confined to firmware predating that fix.
Absolute Secure Access server versions 13.0 up to but not including 14.61 mishandle attacker-supplied input, allowing a low-privilege authenticated remote user to cause a persistent denial of service. The flaw affects availability only, with an independent CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and a vendor CVSS 4.0 vector that adds subsequent-system availability impact (SA:H); no public exploit code or CISA KEV entry was identified at the time of analysis.
Heap buffer overflow in QuickJS-NG before 0.16.0 allows JavaScript code executed by the embedding application to drive an integer overflow inside js_typed_array_sort(), corrupting heap memory on 32-bit hosts and crashing the process, with limited potential for code execution (vendor CVSS 4.0 score 8.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). Only 32-bit builds are affected, and exploitation requires a typed array near 2^30 elements - roughly a 1 GB ArrayBuffer - to be allocated successfully, followed by a .sort() call with a comparator; 64-bit builds do not overflow the size computation. No public exploit code was identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Denial of service in Eclipse ThreadX NetX Duo 6.0 through 6.5.2.202603a: the BSD raw IPv6 send path adds a destination-table entry and then reads that entry without first checking whether the add succeeded, so when the table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, a NULL entry is dereferenced and the sending thread crashes. The defect is only reachable in builds that enable NX_BSD_ENABLE, NX_BSD_RAW_SUPPORT and FEATURE_NX_IPV6 where the application itself sends on an AF_INET6 raw socket with IP_RAW_IPV6_HDRINCL set, and only while the default router is unresolved - preconditions a remote sender does not control. A remote party can fill the destination table only if NX_ENABLE_IPV6_PATH_MTU_DISCOVERY is compiled in (32 crafted ICMPv6 Packet Too Big messages quoting distinct destinations were measured to do it); otherwise the table fills from the device's own outbound traffic to distinct off-link destinations. Unauthenticated (PR:N in both the vendor CVSS 4.0 vector and the assessed 3.1 vector) with high attack complexity and present attack requirements; no public exploit code was identified at time of analysis.
Unauthenticated path traversal in the Fastify plugin @fastify/reply-from (all releases up to and including 12.8.0) lets a crafted request escape a configured upstream prefix and reach other upstream endpoints. The plugin's buildURL() checked proxy paths only for forward-slash dot-segments, but the WHATWG URL parser it then used collapses backslashes and %5c into forward slashes on http, https, ws and wss, so a path containing \..\ or %5c..%5c passes the check and resolves to a different upstream path - an unauthenticated request (PR:N) can therefore slip past prefix scoping or Fastify route guards placed in front of reply.from(). Impact is primarily confidentiality (C:H) with limited integrity effect (I:L); no public exploit identified at time of analysis, and exploitation is conditional on the consuming application concatenating untrusted input into the forwarded path.
http4k's Digest authentication advertises the RFC 7616 auth-int quality-of-protection but never binds the request entity body into the digest, so an on-path attacker on a cleartext channel can rewrite the body of an already-authenticated, state-changing request while leaving the Authorization header valid. Affected is the org.http4k:http4k-security-digest module from 4.9.10.0 through 6.59.0.0, and only when an operator explicitly configures ServerFilters.DigestAuth with qop = listOf(Qop.AuthInt); the default Qop.Auth is not affected. The attack is unauthenticated - no credentials are needed - but requires a non-default QoP setting, no TLS, an active MITM foothold, and a body-omitting peer such as http4k's own DigestAuthReceiver, so a strictly RFC 7616-conformant client that hashes the body would simply fail to authenticate. A public PoC reference exists (a dependency-free digest-equivalence harness published with the advisory); it is not verified as working exploit code, and there is no confirmed active exploitation.
Path traversal in http4k’s ThymeleafTemplates Caching and HotReload wrappers allows remote unauthenticated attackers to read files outside baseTemplateDir when an application lets request-controlled data reach ViewModel.template() or its ::selector suffix. The issue affects http4k before 6.62.0.0-ee and is conditional on request-derived template selection; Pug4j is protected by commit 725f1b9697’s containment check, and the pinned Handlebars 4.5.5, FreeMarker and Pebble 4.1.2 engines are not affected. A verified component-level reproduction is published with the advisory, but there is no CISA KEV entry or confirmed exploitation of deployed applications, and impact is limited to disclosure of files readable by the server process; the assessed priority is this_week.
Improper verification of cryptographic signatures in Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 allows an unauthenticated attacker with an adjacent-network position to present a forged or tampered signed object that the application accepts as trusted, resulting in arbitrary code execution and elevation of privilege. No user interaction is required, but attack complexity is rated high and reach is limited to hosts on the same adjacent network running the consumer gaming utility. No public exploit has been identified at the time of analysis, and the supplied data contains no KEV listing confirming active exploitation.