Monthly
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated, low-privileged attacker who already has code execution on the host to gain SYSTEM-level privileges. The root cause is an improper null-termination defect (CWE-170) in the service, which is present and running by default on affected Windows 11 23H2/24H2/25H2/26H1/26H2 builds and Windows Server 2022/2025 (including Server Core installations); the CVSS vector (AV:L/AC:L/PR:L/UI:N) means no user interaction and low attack complexity, but a prior local foothold and valid low-privileged credentials are prerequisites, making this a post-compromise escalation primitive rather than a remotely reachable flaw. Microsoft has published fixed builds and no public exploit has been identified (SSVC exploitation: none), so this is a credible patching priority rather than an emergency.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Uninitialized memory dereference in the Linux kernel's dma-fence subsystem allows a local low-privileged user on AMD GPU-equipped systems to trigger memory corruption via the amdgpu userqueue wait path. The root cause is an off-by-one logic error in `dma_fence_dedup_array()` that returns 1 instead of 0 for empty input, which the primary caller guards against but `amdgpu_userq_wait_*()` does not, exposing an uninitialized fence slot to dereference. Patch commits are available for stable branches 6.18.40 and 7.1.5; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low real-world exploitation activity.
Out-of-bounds string handling in the Linux kernel RDMA subsystem (drivers/infiniband/core) allows a local actor with RDMA netlink access to trigger reads past the end of a supplied netlink attribute. The affected code declared configuration attributes as NLA_STRING and then passed them directly to strcmp()/%s formatting without guaranteeing a NUL terminator, so a crafted, unterminated attribute can cause the kernel to read adjacent memory, potentially leaking information or crashing the host. No public exploit identified at time of analysis; the fix simply switches the attributes to NLA_NUL_STRING to enforce termination.
Remote code execution and denial of service in Zephyr RTOS HTTP server (versions 3.7.0 through 4.3.0) allow unauthenticated network attackers to corrupt stack memory by sending a crafted Sec-WebSocket-Key header during WebSocket upgrade. The flaw is a CWE-170 improper NUL-termination issue where a bounded copy fails to terminate the header buffer, causing strlen() and subsequent concatenation to read and write past stack bounds. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivially reachable attack surface make this a high-priority issue for any Zephyr deployment with CONFIG_HTTP_SERVER_WEBSOCKET enabled.
Silent password truncation in the Perl module Crypt::OpenSSL::PKCS12 versions up to and including 1.94 causes any password bytes at or after the first embedded NULL byte to be dropped without warning. The flaw stems from password parameters being declared as char* in PKCS12.xs, routing through Perl's default typemap to SvPV_nolen and discarding the Perl-known length before C strlen() truncates the buffer. The result is severe entropy loss for binary, KDF-derived, or HMAC-derived passwords used to protect PKCS12 keystores, with no public exploit identified at time of analysis.
Local privilege escalation and information disclosure in Linux kernel netfilter x_tables subsystem allows authenticated local users to leak memory contents or crash the system due to improper null-termination validation of string names passed to c-string functions. CVSS 7.1 (High/Confidentiality, High/Availability impact) but low real-world priority: EPSS 0.02% (7th percentile) indicates minimal observed exploitation likelihood. Patches available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). No active exploitation confirmed, no POC identified, requires local authenticated access with low privileges.
Denial of service in mod_qos can crash an individual Apache worker process when the module's non-default JSON body filtering is enabled, triggered by a crafted percent-encoded JSON request that exploits improper string termination (CWE-170) and causes an out-of-bounds read. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (score 3.7), so the issue is remotely reachable without authentication but has high attack complexity and only low availability impact. No public exploit code or CISA KEV active-exploitation status is identified in the provided intelligence.
Local information disclosure in Windows Modern Device Management (MDM) lets an authenticated, low-privileged attacker who already holds a foothold on the host read residual memory contents returned by the MDM subsystem. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this is a local-only, low-complexity, no-user-interaction bug whose sole impact is confidentiality loss - there is no integrity or availability effect and no scope change. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial, which places this in the moderate-priority patch cycle rather than the emergency one.
Improper null termination (CWE-170) in Microsoft Office Word's document-processing pipeline allows a local attacker to read beyond a string buffer boundary, disclosing sensitive in-memory data when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and Mac variants across Windows (x64/x86) and macOS. No active exploitation is confirmed (SSVC Exploitation: none; no KEV listing), and Microsoft has released fixed builds across all affected product lines.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated, low-privileged attacker who already has code execution on the host to gain SYSTEM-level privileges. The root cause is an improper null-termination defect (CWE-170) in the service, which is present and running by default on affected Windows 11 23H2/24H2/25H2/26H1/26H2 builds and Windows Server 2022/2025 (including Server Core installations); the CVSS vector (AV:L/AC:L/PR:L/UI:N) means no user interaction and low attack complexity, but a prior local foothold and valid low-privileged credentials are prerequisites, making this a post-compromise escalation primitive rather than a remotely reachable flaw. Microsoft has published fixed builds and no public exploit has been identified (SSVC exploitation: none), so this is a credible patching priority rather than an emergency.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Uninitialized memory dereference in the Linux kernel's dma-fence subsystem allows a local low-privileged user on AMD GPU-equipped systems to trigger memory corruption via the amdgpu userqueue wait path. The root cause is an off-by-one logic error in `dma_fence_dedup_array()` that returns 1 instead of 0 for empty input, which the primary caller guards against but `amdgpu_userq_wait_*()` does not, exposing an uninitialized fence slot to dereference. Patch commits are available for stable branches 6.18.40 and 7.1.5; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low real-world exploitation activity.
Out-of-bounds string handling in the Linux kernel RDMA subsystem (drivers/infiniband/core) allows a local actor with RDMA netlink access to trigger reads past the end of a supplied netlink attribute. The affected code declared configuration attributes as NLA_STRING and then passed them directly to strcmp()/%s formatting without guaranteeing a NUL terminator, so a crafted, unterminated attribute can cause the kernel to read adjacent memory, potentially leaking information or crashing the host. No public exploit identified at time of analysis; the fix simply switches the attributes to NLA_NUL_STRING to enforce termination.
Remote code execution and denial of service in Zephyr RTOS HTTP server (versions 3.7.0 through 4.3.0) allow unauthenticated network attackers to corrupt stack memory by sending a crafted Sec-WebSocket-Key header during WebSocket upgrade. The flaw is a CWE-170 improper NUL-termination issue where a bounded copy fails to terminate the header buffer, causing strlen() and subsequent concatenation to read and write past stack bounds. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivially reachable attack surface make this a high-priority issue for any Zephyr deployment with CONFIG_HTTP_SERVER_WEBSOCKET enabled.
Silent password truncation in the Perl module Crypt::OpenSSL::PKCS12 versions up to and including 1.94 causes any password bytes at or after the first embedded NULL byte to be dropped without warning. The flaw stems from password parameters being declared as char* in PKCS12.xs, routing through Perl's default typemap to SvPV_nolen and discarding the Perl-known length before C strlen() truncates the buffer. The result is severe entropy loss for binary, KDF-derived, or HMAC-derived passwords used to protect PKCS12 keystores, with no public exploit identified at time of analysis.
Local privilege escalation and information disclosure in Linux kernel netfilter x_tables subsystem allows authenticated local users to leak memory contents or crash the system due to improper null-termination validation of string names passed to c-string functions. CVSS 7.1 (High/Confidentiality, High/Availability impact) but low real-world priority: EPSS 0.02% (7th percentile) indicates minimal observed exploitation likelihood. Patches available across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0). No active exploitation confirmed, no POC identified, requires local authenticated access with low privileges.
Denial of service in mod_qos can crash an individual Apache worker process when the module's non-default JSON body filtering is enabled, triggered by a crafted percent-encoded JSON request that exploits improper string termination (CWE-170) and causes an out-of-bounds read. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (score 3.7), so the issue is remotely reachable without authentication but has high attack complexity and only low availability impact. No public exploit code or CISA KEV active-exploitation status is identified in the provided intelligence.
Local information disclosure in Windows Modern Device Management (MDM) lets an authenticated, low-privileged attacker who already holds a foothold on the host read residual memory contents returned by the MDM subsystem. Rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this is a local-only, low-complexity, no-user-interaction bug whose sole impact is confidentiality loss - there is no integrity or availability effect and no scope change. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none, automatable as no, and technical impact as partial, which places this in the moderate-priority patch cycle rather than the emergency one.
Improper null termination (CWE-170) in Microsoft Office Word's document-processing pipeline allows a local attacker to read beyond a string buffer boundary, disclosing sensitive in-memory data when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and Mac variants across Windows (x64/x86) and macOS. No active exploitation is confirmed (SSVC Exploitation: none; no KEV listing), and Microsoft has released fixed builds across all affected product lines.