Monthly
Opening a maliciously crafted file in Adobe Photoshop Desktop (27.10 and earlier, and 26.11.7 and earlier) can trigger a double-free memory-corruption condition that results in arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that the attacker cannot reach the target over the network and must rely on the victim opening the file, and that code executes only with the privileges of the logged-on user rather than escalating to system level; adversary value is therefore tied to social-engineering delivery of a weaponised document, and there is no public exploit identified at time of analysis. The independent assessment rates this as a credible but not emergency-level priority, consistent with the local attack vector and user-interaction requirement; no CISA KEV listing or public proof-of-concept was supplied in the source data.
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
Remote code execution in Microsoft Excel affects Office LTSC 2021, LTSC 2024, Office Online Server, Microsoft 365 Apps, and Mac editions when a victim opens a specially crafted spreadsheet (UI:R). An unauthenticated attacker (PR:N) can trigger a double free (CWE-415) to corrupt memory and execute code in the context of the user; no public exploit has been identified. Although high severity (CVSS 8.8), exploitation requires user interaction and is not zero-click, and vendor patches are available.
Arbitrary code execution in Microsoft Office Excel is possible when a user opens a specially crafted workbook, because the parser mishandles memory and triggers a double free (CWE-415). The flaw is remotely deliverable by an unauthenticated attacker (CVSS 3.1 AV:N/AC:L/PR:N), but exploitation depends on the victim opening the malicious file (UI:R), limiting the attack to social-engineering delivery; successful exploitation runs code with the privileges of the opening user. Affected software includes Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac builds, and Office Online Server builds below the fixed versions, and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Unauthenticated remote code execution in Microsoft Outlook is reachable when a vulnerable build parses attacker-controlled message content that triggers a double free (CWE-415), allowing the attacker to run code in the context of the Outlook process. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise builds, per the EUVD affected-version data. The static profile is severe (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but no KEV listing, no EPSS value, and no public exploit code were provided; exploitation status is therefore "no public exploit identified at time of analysis," and a vendor patch is available (exact fixed builds known for the LTSC lines, not resolvable for Microsoft 365 Apps from the supplied input).
Unauthenticated remote code execution in the Microsoft Failover Cluster Virtual Driver affects Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809 installations that have the Failover Clustering role enabled, where a double free (CWE-415) during processing of cluster network traffic allows an attacker to corrupt kernel memory and run code with SYSTEM privileges (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Exposure is conditional rather than universal: the vulnerable driver is only loaded and reachable on clustered nodes, and in well-architected deployments the cluster communication path sits on a dedicated, isolated interconnect, which materially limits remote reach despite the network vector. There is no public exploit identified at time of analysis and no CISA KEV entry, but the vulnerability is fully automatable (SSVC: Exploitation none, Automatable yes, Technical Impact total) and vendor patches are available for all affected builds.
Elevation of privilege in the Windows Connected Devices Platform Service (Cdpsvc) allows a local, low-privileged attacker to gain SYSTEM-level privileges by exploiting a double-free memory corruption issue. The flaw affects Windows 11 versions 23H2 through 26H2 and Windows Server 2025 (including Server Core) prior to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation has been identified, but exploitation requires high attack complexity due to a race condition.
Remote code execution in Microsoft Windows DHCP Server allows unauthenticated network attackers to execute arbitrary code on affected servers by triggering a double free, though exploitation requires high attack complexity (AC:H) due to precise heap manipulation or a race condition. Affected systems include Windows Server 2012 through 2025 (including Server Core) and certain Windows 10 builds that have the DHCP Server role installed and reachable. No public exploit has been identified at time of analysis, and a vendor patch is available; this is a serious but not top-tier-urgent flaw given the exploitation complexity.
Local privilege escalation in Microsoft Windows through the Ancillary Function Driver for WinSock (afd.sys) lets an attacker who already holds low-privileged local code execution corrupt kernel pool memory and raise privileges to SYSTEM, yielding high confidentiality, integrity, and availability impact. Exploitation is gated by valid local credentials (PR:L, authenticated) and is further constrained by high attack complexity (AC:H), because the CWE-415 double free depends on winning a non-deterministic kernel memory race that may require repeated attempts; there is no network vector and no victim interaction (UI:N). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the exposure is broad - Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 - with vendor patches available.
Opening a maliciously crafted file in Adobe Photoshop Desktop (27.10 and earlier, and 26.11.7 and earlier) can trigger a double-free memory-corruption condition that results in arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that the attacker cannot reach the target over the network and must rely on the victim opening the file, and that code executes only with the privileges of the logged-on user rather than escalating to system level; adversary value is therefore tied to social-engineering delivery of a weaponised document, and there is no public exploit identified at time of analysis. The independent assessment rates this as a credible but not emergency-level priority, consistent with the local attack vector and user-interaction requirement; no CISA KEV listing or public proof-of-concept was supplied in the source data.
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
Remote code execution in Microsoft Excel affects Office LTSC 2021, LTSC 2024, Office Online Server, Microsoft 365 Apps, and Mac editions when a victim opens a specially crafted spreadsheet (UI:R). An unauthenticated attacker (PR:N) can trigger a double free (CWE-415) to corrupt memory and execute code in the context of the user; no public exploit has been identified. Although high severity (CVSS 8.8), exploitation requires user interaction and is not zero-click, and vendor patches are available.
Arbitrary code execution in Microsoft Office Excel is possible when a user opens a specially crafted workbook, because the parser mishandles memory and triggers a double free (CWE-415). The flaw is remotely deliverable by an unauthenticated attacker (CVSS 3.1 AV:N/AC:L/PR:N), but exploitation depends on the victim opening the malicious file (UI:R), limiting the attack to social-engineering delivery; successful exploitation runs code with the privileges of the opening user. Affected software includes Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac builds, and Office Online Server builds below the fixed versions, and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Unauthenticated remote code execution in Microsoft Outlook is reachable when a vulnerable build parses attacker-controlled message content that triggers a double free (CWE-415), allowing the attacker to run code in the context of the Outlook process. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise builds, per the EUVD affected-version data. The static profile is severe (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but no KEV listing, no EPSS value, and no public exploit code were provided; exploitation status is therefore "no public exploit identified at time of analysis," and a vendor patch is available (exact fixed builds known for the LTSC lines, not resolvable for Microsoft 365 Apps from the supplied input).
Unauthenticated remote code execution in the Microsoft Failover Cluster Virtual Driver affects Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809 installations that have the Failover Clustering role enabled, where a double free (CWE-415) during processing of cluster network traffic allows an attacker to corrupt kernel memory and run code with SYSTEM privileges (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Exposure is conditional rather than universal: the vulnerable driver is only loaded and reachable on clustered nodes, and in well-architected deployments the cluster communication path sits on a dedicated, isolated interconnect, which materially limits remote reach despite the network vector. There is no public exploit identified at time of analysis and no CISA KEV entry, but the vulnerability is fully automatable (SSVC: Exploitation none, Automatable yes, Technical Impact total) and vendor patches are available for all affected builds.
Elevation of privilege in the Windows Connected Devices Platform Service (Cdpsvc) allows a local, low-privileged attacker to gain SYSTEM-level privileges by exploiting a double-free memory corruption issue. The flaw affects Windows 11 versions 23H2 through 26H2 and Windows Server 2025 (including Server Core) prior to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation has been identified, but exploitation requires high attack complexity due to a race condition.
Remote code execution in Microsoft Windows DHCP Server allows unauthenticated network attackers to execute arbitrary code on affected servers by triggering a double free, though exploitation requires high attack complexity (AC:H) due to precise heap manipulation or a race condition. Affected systems include Windows Server 2012 through 2025 (including Server Core) and certain Windows 10 builds that have the DHCP Server role installed and reachable. No public exploit has been identified at time of analysis, and a vendor patch is available; this is a serious but not top-tier-urgent flaw given the exploitation complexity.
Local privilege escalation in Microsoft Windows through the Ancillary Function Driver for WinSock (afd.sys) lets an attacker who already holds low-privileged local code execution corrupt kernel pool memory and raise privileges to SYSTEM, yielding high confidentiality, integrity, and availability impact. Exploitation is gated by valid local credentials (PR:L, authenticated) and is further constrained by high attack complexity (AC:H), because the CWE-415 double free depends on winning a non-deterministic kernel memory race that may require repeated attempts; there is no network vector and no victim interaction (UI:N). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the exposure is broad - Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 - with vendor patches available.