Monthly
An out-of-bounds write in the screen-image decoder of TeamViewer Full Client for Linux and macOS allows a remote attacker to execute arbitrary code on the victim's machine when the victim takes a user-driven action. Every build below 15.83 is affected, including the older branches prior to 13.2.154007 (macOS) / 13.2.154008 (Linux) and prior to 14.7.48868; the two described paths are opening a crafted .tvs session recording supplied by the attacker or participating in a remote-control session into which crafted screen-image data is injected, which is why the assessed vector carries UI:R with PR:N at CVSS 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the issue is prioritized for remediation this week given the code-execution impact on unpatched endpoints.
Local privilege escalation in the BioStar Temperature Monitor Utility (1.2.1806.2200, all versions flagged by CPE) lets a low-privileged process on an affected Windows host write attacker-controlled data to an arbitrary physical address through the bundled BS_HWMIO64_W10.sys kernel driver, escalating to SYSTEM and gaining full control of the machine. According to the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local low-privilege code execution able to open the driver's device object and send the crafted IOCTL, with no user interaction and no non-default configuration once the signed driver is loaded. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and the disclosure states the exploit was released publicly), but there is no indication of confirmed active exploitation in the wild and no CISA KEV listing; the vendor was contacted and did not respond, so no vendor patch was identified at time of analysis.
Local privilege escalation in BioStar VALKYRIE AURORA 2.10.2411.0800 allows an authenticated low-privileged local attacker to abuse the BS_RVSIO64.sys IOCTL handler and manipulate a PhysicalAddress value, triggering a write-what-where condition in the kernel driver. Successful exploitation can corrupt kernel memory and elevate privileges to SYSTEM or administrator level on an affected host. Publicly available exploit code exists, and exploitation requires prior local code execution plus the vulnerable driver to be installed and loaded, making this a post-access escalation rather than a remote foothold.
A write-what-where flaw in the BS_LED64.sys kernel driver shipped with BioStar VIVID LED DJ 4.0.2411.1500 lets an authenticated local user on a Windows host escalate to SYSTEM-level privileges by sending a crafted IOCTL that causes the driver to write attacker-controlled data to an attacker-chosen kernel address. The defect sits in the driver's IOCTL handler (sub_1105C), where the AssociatedIrp value is used without adequate validation, and the CVSS 4.0 base score of 8.5 (assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total loss of confidentiality, integrity, and availability of the host. Publicly available exploit code exists and was released after the vendor was contacted and failed to respond; it is not confirmed actively exploited (not in CISA KEV). The realistic attack surface is limited: the attacker must already hold standard-user code execution and the RGB control utility and its signed driver must be present, though the signed BS_LED64.sys also functions as a bring-your-own-vulnerable-driver (BYOVD) candidate on machines where the product is not installed.
Memory corruption in OpenSlide's Ventana BIF parser (versions 3.4.1 through 4.0.1) allows a crafted whole-slide image to write attacker-chosen values to attacker-chosen memory offsets, crashing the process that opens the slide or potentially achieving arbitrary code execution. Any application, viewer, or server-side tiling/conversion service that uses the affected library to ingest untrusted Ventana .bif files is exposed, since the defect is not configuration-dependent and affects all supported platforms; exploitation requires a user or process to open the malicious file, and reliable code execution (as opposed to a crash) further depends on controlling heap layout. No public exploit code or confirmed active exploitation was identified at time of analysis, but the underlying write-what-where primitive makes this a high-severity risk for digital-pathology pipelines that accept third-party or uploaded slides.
Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (CWE-123), enabling arbitrary memory writes that can corrupt data, crash the inference service, or leak sensitive information. The flaw carries a CVSS 7.4 (High) score with a local attack vector and high attack complexity, and affects the TensorRT-LLM library used to build and serve optimized large-language-model inference on NVIDIA GPUs. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file write in remotion-dev Remotion v4.0.409 allows remote attackers to write attacker-controlled content to arbitrary filesystem locations without authentication, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) and CWE-123 (Write-what-where) classification. Remotion is a React-based programmatic video rendering framework, and the flaw can lead to integrity and availability compromise of the host running the rendering engine. No public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates low predicted exploitation likelihood despite the high CVSS score.
Page-cache corruption in FreeBSD's kTLS-RX subsystem (CVE-2026-45257 / FreeBSD-SA-26:26.kTLS) enables an unprivileged local user to overwrite arbitrary bytes in the backing physical page of any world-readable file, including SUID-root binaries, by exploiting in-place AES-GCM decryption running directly over sendfile(2)-produced EXTPG mbufs via the kernel direct map (DMAP). The write bypasses the VFS layer entirely, defeating file permissions, mount options, and chflags schg immutable flags - making this the FreeBSD functional equivalent of Linux CVE-2022-0847 (Dirty Pipe). A public exploit (bumsrakete.c) is included in the oss-security disclosure and achieves reliable root LPE in approximately 1.5 seconds on default FreeBSD 13.0 through 15.0 on amd64, arm64, and riscv; no public KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel's Generic Receive Offload (GRO) networking path allows local attackers to corrupt kernel memory and potentially achieve privilege escalation or denial of service. The flaw stems from skb_gro_receive() merging fragment lists between socket buffers without honoring the SKBFL_MANAGED_FRAG_REFS zero-copy flag, leaving page refcounts inconsistent. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02% (5th percentile).
An out-of-bounds write in the screen-image decoder of TeamViewer Full Client for Linux and macOS allows a remote attacker to execute arbitrary code on the victim's machine when the victim takes a user-driven action. Every build below 15.83 is affected, including the older branches prior to 13.2.154007 (macOS) / 13.2.154008 (Linux) and prior to 14.7.48868; the two described paths are opening a crafted .tvs session recording supplied by the attacker or participating in a remote-control session into which crafted screen-image data is injected, which is why the assessed vector carries UI:R with PR:N at CVSS 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the issue is prioritized for remediation this week given the code-execution impact on unpatched endpoints.
Local privilege escalation in the BioStar Temperature Monitor Utility (1.2.1806.2200, all versions flagged by CPE) lets a low-privileged process on an affected Windows host write attacker-controlled data to an arbitrary physical address through the bundled BS_HWMIO64_W10.sys kernel driver, escalating to SYSTEM and gaining full control of the machine. According to the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local low-privilege code execution able to open the driver's device object and send the crafted IOCTL, with no user interaction and no non-default configuration once the signed driver is loaded. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and the disclosure states the exploit was released publicly), but there is no indication of confirmed active exploitation in the wild and no CISA KEV listing; the vendor was contacted and did not respond, so no vendor patch was identified at time of analysis.
Local privilege escalation in BioStar VALKYRIE AURORA 2.10.2411.0800 allows an authenticated low-privileged local attacker to abuse the BS_RVSIO64.sys IOCTL handler and manipulate a PhysicalAddress value, triggering a write-what-where condition in the kernel driver. Successful exploitation can corrupt kernel memory and elevate privileges to SYSTEM or administrator level on an affected host. Publicly available exploit code exists, and exploitation requires prior local code execution plus the vulnerable driver to be installed and loaded, making this a post-access escalation rather than a remote foothold.
A write-what-where flaw in the BS_LED64.sys kernel driver shipped with BioStar VIVID LED DJ 4.0.2411.1500 lets an authenticated local user on a Windows host escalate to SYSTEM-level privileges by sending a crafted IOCTL that causes the driver to write attacker-controlled data to an attacker-chosen kernel address. The defect sits in the driver's IOCTL handler (sub_1105C), where the AssociatedIrp value is used without adequate validation, and the CVSS 4.0 base score of 8.5 (assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total loss of confidentiality, integrity, and availability of the host. Publicly available exploit code exists and was released after the vendor was contacted and failed to respond; it is not confirmed actively exploited (not in CISA KEV). The realistic attack surface is limited: the attacker must already hold standard-user code execution and the RGB control utility and its signed driver must be present, though the signed BS_LED64.sys also functions as a bring-your-own-vulnerable-driver (BYOVD) candidate on machines where the product is not installed.
Memory corruption in OpenSlide's Ventana BIF parser (versions 3.4.1 through 4.0.1) allows a crafted whole-slide image to write attacker-chosen values to attacker-chosen memory offsets, crashing the process that opens the slide or potentially achieving arbitrary code execution. Any application, viewer, or server-side tiling/conversion service that uses the affected library to ingest untrusted Ventana .bif files is exposed, since the defect is not configuration-dependent and affects all supported platforms; exploitation requires a user or process to open the malicious file, and reliable code execution (as opposed to a crash) further depends on controlling heap layout. No public exploit code or confirmed active exploitation was identified at time of analysis, but the underlying write-what-where primitive makes this a high-severity risk for digital-pathology pipelines that accept third-party or uploaded slides.
Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (CWE-123), enabling arbitrary memory writes that can corrupt data, crash the inference service, or leak sensitive information. The flaw carries a CVSS 7.4 (High) score with a local attack vector and high attack complexity, and affects the TensorRT-LLM library used to build and serve optimized large-language-model inference on NVIDIA GPUs. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file write in remotion-dev Remotion v4.0.409 allows remote attackers to write attacker-controlled content to arbitrary filesystem locations without authentication, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) and CWE-123 (Write-what-where) classification. Remotion is a React-based programmatic video rendering framework, and the flaw can lead to integrity and availability compromise of the host running the rendering engine. No public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates low predicted exploitation likelihood despite the high CVSS score.
Page-cache corruption in FreeBSD's kTLS-RX subsystem (CVE-2026-45257 / FreeBSD-SA-26:26.kTLS) enables an unprivileged local user to overwrite arbitrary bytes in the backing physical page of any world-readable file, including SUID-root binaries, by exploiting in-place AES-GCM decryption running directly over sendfile(2)-produced EXTPG mbufs via the kernel direct map (DMAP). The write bypasses the VFS layer entirely, defeating file permissions, mount options, and chflags schg immutable flags - making this the FreeBSD functional equivalent of Linux CVE-2022-0847 (Dirty Pipe). A public exploit (bumsrakete.c) is included in the oss-security disclosure and achieves reliable root LPE in approximately 1.5 seconds on default FreeBSD 13.0 through 15.0 on amd64, arm64, and riscv; no public KEV listing has been identified at time of analysis.
Use-after-free in the Linux kernel's Generic Receive Offload (GRO) networking path allows local attackers to corrupt kernel memory and potentially achieve privilege escalation or denial of service. The flaw stems from skb_gro_receive() merging fragment lists between socket buffers without honoring the SKBFL_MANAGED_FRAG_REFS zero-copy flag, leaving page refcounts inconsistent. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02% (5th percentile).