Monthly
Heap-based buffer overflow in snac2 before 2.93 enables unauthenticated remote attackers to crash the ActivityPub server by sending a single crafted application/activity+json POST whose JSON string contains a \u0000 escape; the vulnerable parser runs before HTTP signature verification, so federation endpoints are exposed. Publicly available exploit code exists, and the assessed impact is availability-only (server crash/denial of service), with no confirmed code execution or data exposure.
Heap buffer overflow in FreeRDP before 3.32.0 can let a local attacker corrupt heap memory and potentially execute code when the victim loads a crafted persistent bitmap cache v2 file, because persistent_cache_read_entry_v2 miscalculates bitmap sizes via integer wraparound and then performs fixed 16 KiB reads against mismatched entry-size accounting. Exploitation requires the local attacker to place a malicious cache file in the client's load path and relies on low-level local privileges plus user interaction (PR:L/UI:P), so there is no remote unauthenticated path; no public exploit identified at time of analysis. No CISA KEV entry was provided, making this a moderate-priority local risk rather than a mass-exploitation threat.
Heap buffer overflow in FreeRDP before 3.32.0 allows a local attacker with low privileges to corrupt memory and potentially execute code by supplying a crafted v3 persistent bitmap cache file. The vulnerability is triggered when the FreeRDP client processes a malicious cache file with crafted width and height values, causing an integer overflow in size calculation and a subsequent heap overflow via fread. Exploitation requires the victim to load the poisoned cache during a session (passive user interaction); no public exploit code has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Outlook is possible through a heap-based buffer overflow that an unauthenticated, network-based attacker can trigger by convincing a victim to open or preview a crafted email message or Office document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365 for Mac, but a vendor patch is available. Exploitation carries a high attack complexity due to required heap grooming and memory-layout control, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in snac2 before 2.93 enables unauthenticated remote attackers to crash the ActivityPub server by sending a single crafted application/activity+json POST whose JSON string contains a \u0000 escape; the vulnerable parser runs before HTTP signature verification, so federation endpoints are exposed. Publicly available exploit code exists, and the assessed impact is availability-only (server crash/denial of service), with no confirmed code execution or data exposure.
Heap buffer overflow in FreeRDP before 3.32.0 can let a local attacker corrupt heap memory and potentially execute code when the victim loads a crafted persistent bitmap cache v2 file, because persistent_cache_read_entry_v2 miscalculates bitmap sizes via integer wraparound and then performs fixed 16 KiB reads against mismatched entry-size accounting. Exploitation requires the local attacker to place a malicious cache file in the client's load path and relies on low-level local privileges plus user interaction (PR:L/UI:P), so there is no remote unauthenticated path; no public exploit identified at time of analysis. No CISA KEV entry was provided, making this a moderate-priority local risk rather than a mass-exploitation threat.
Heap buffer overflow in FreeRDP before 3.32.0 allows a local attacker with low privileges to corrupt memory and potentially execute code by supplying a crafted v3 persistent bitmap cache file. The vulnerability is triggered when the FreeRDP client processes a malicious cache file with crafted width and height values, causing an integer overflow in size calculation and a subsequent heap overflow via fread. Exploitation requires the victim to load the poisoned cache during a session (passive user interaction); no public exploit code has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Outlook is possible through a heap-based buffer overflow that an unauthenticated, network-based attacker can trigger by convincing a victim to open or preview a crafted email message or Office document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365 for Mac, but a vendor patch is available. Exploitation carries a high attack complexity due to required heap grooming and memory-layout control, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.