Monthly
Local privilege escalation in the Windows TCP/IP stack allows an authenticated, low-privileged user who can already execute code on a Windows host to escalate to a higher privilege level, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a numeric type-conversion error (CWE-681) in a component shipped by default in all affected Windows 10, Windows 11, and Windows Server builds, so no non-default feature needs to be enabled; the only meaningful barrier is that the attacker must first obtain local code execution. Per available intelligence there is no CISA KEV listing and no public exploit identified at time of analysis (CISA SSVC exploitation: none), so this is assessed as a credible but not emergency-level priority - a post-compromise chaining primitive rather than a remotely reachable bug - and vendor-released patches are already available for all listed builds.
Local privilege escalation in NVIDIA GPU Display Driver for Windows and Linux allows a low-privileged user to trigger an incorrect conversion between numeric types in the kernel mode layer, potentially leading to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. The vulnerability requires local access and low-level privileges (CVSS vector PR:L) with no user interaction, and it is not remotely exploitable. No public exploit code has been identified at time of analysis, but the risk is materially higher on shared or multi-tenant GPU hosts such as VDI, vGPU, or Tesla datacenter deployments where untrusted users can reach the driver.
Incorrect interpretation of the NPU_SET_IFM/OFM_PRECISION field by the Linux kernel's accel/ethosu driver on Arm Ethos-U65 hardware lets a local user with access to the accelerator character device corrupt command-stream processing. Because bits 15:14 are read as an activation storage mode instead of the U65 rounding mode, natural rounding (value 2) streams are rejected with -EINVAL, and truncating rounding (value 1) streams are misrouted to the two-tile address path where a feature-map size is computed from tile bases the stream never initialized, degrading integrity of NPU operations and potentially crashing the affected subsystem. Authentication is required (CVSS vector PR:L, local vector AV:L); no public exploit code has been identified at time of analysis, and exploitation is limited to systems running the driver bound to real Ethos-U65 silicon, such as NXP i.MX93 SoCs. Vendor-released patches are available in the referenced kernel stable commits, with EUVD listing Linux 7.2.7 and 7.3-rc2 as fixed.
Denial of service in NanoSVG (commit 239e102ec) where a crafted SVG document carrying oversized geometry coordinates drives the rasterizer's fixed-point-scaled edge values past the range of a 32-bit int during nsvg__addActive(), producing undefined behavior that can terminate the process. The issue is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), i.e. unauthenticated and low-complexity, but availability-only: there is no code execution, data disclosure, or integrity impact per the assessed vector. Exploitation requires the embedding application to actually rasterize attacker-supplied SVG content rather than merely parse it, so tools that only handle locally trusted assets face a local-input scenario; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though the vendor issue tracker reference (GitHub issue 292) makes root-cause details publicly discoverable.
Denial of service in the MuJS embeddable JavaScript interpreter (git revision e892c9fdb) allows remote attackers to crash the hosting process by supplying JavaScript that builds an excessively large numeric array index, which jsR_isindex() in jsrun.c converts from floating point to integer without validating the value fits in the target integer range. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I/A:H), the attack is network-reachable and unauthenticated, but the impact is availability-only: no confidentiality or integrity loss, with exploitability gated by whether the embedding application evaluates untrusted JavaScript. Exploitation requires the host to feed attacker-controlled script to the embedded interpreter (for example, opening a document or file that MuJS parses), and no public exploit code or CISA KEV entry was identified at time of analysis; EPSS is 0.15% (4th percentile), indicating low near-term exploitation likelihood. The upstream project has published a fix commit, but no tagged patched release has been independently confirmed.
Denial of service in NanoSVG at commit 239e102ec affects applications that parse attacker-supplied SVG documents, where a crafted arc command with extreme radius values drives the arc delta-angle calculation to NaN and the subsequent unchecked NaN-to-int conversion causes undefined behavior and process termination. The published CVSS vector is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so the unauthenticated network attack path is constrained by the requirement that the target actually process a malicious SVG, and manual SVG opening can effectively require user interaction; EPSS is 0.16% and no public exploit identified at time of analysis.
Denial of service in the official RabbitMQ Go client library amqp091-go (versions prior to 1.13.0): a malicious, compromised, or impersonated AMQP 0.9.1 broker can crash any application that connects to it. By encoding a byte-array field length as 0xFFFFFFFF (decoded into a signed int32 as -1) inside the connection.start server-properties table or a message header field table, the broker drives readField() to call make() with a negative size, producing a 'len out of range' runtime panic that escapes the reader goroutine and terminates the client process. Attackers must sit on the broker side of the connection - a trusted-broker deployment is largely unaffected - and the outcome is availability loss only, with no code execution or data disclosure. No public exploit code or confirmed active exploitation has been identified at time of analysis; vendor-released patch 1.13.0 is available.
Remote code execution in Microsoft JScript's numeric type conversion logic allows unauthenticated network attackers to execute arbitrary code on affected Windows hosts. The vulnerability stems from CWE-681 (incorrect conversion between numeric types) in jscript.dll, the legacy Windows scripting engine, and affects the full span of supported Windows releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, but the network-reachable, zero-interaction CVSS vector (AV:N/UI:N) indicates exploitation via server-side JScript processing contexts such as IIS Classic ASP, without requiring user interaction.
Privilege escalation in su-exec through version 0.3 allows local attackers with low-privilege access to execute arbitrary programs as root by supplying crafted oversized numeric user or group identifiers. The root cause is an unchecked integer truncation: strtol() returns a 64-bit long on modern Linux, but su-exec assigns the result directly to uid_t and gid_t (32-bit unsigned integers) without range validation - values like 4294967296 (2^32) silently truncate to UID/GID 0, the root account. A public proof-of-concept is available and no vendor-released patch has been identified at time of analysis, making this an active remediation gap for container deployments dependent on su-exec.
Local privilege escalation in the Windows NTFS file-system driver lets an authenticated low-privileged user gain elevated (likely SYSTEM) privileges by exploiting an incorrect conversion between numeric types (CWE-681). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Microsoft reported the flaw and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated, low-privileged user who can already execute code on a Windows host to escalate to a higher privilege level, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a numeric type-conversion error (CWE-681) in a component shipped by default in all affected Windows 10, Windows 11, and Windows Server builds, so no non-default feature needs to be enabled; the only meaningful barrier is that the attacker must first obtain local code execution. Per available intelligence there is no CISA KEV listing and no public exploit identified at time of analysis (CISA SSVC exploitation: none), so this is assessed as a credible but not emergency-level priority - a post-compromise chaining primitive rather than a remotely reachable bug - and vendor-released patches are already available for all listed builds.
Local privilege escalation in NVIDIA GPU Display Driver for Windows and Linux allows a low-privileged user to trigger an incorrect conversion between numeric types in the kernel mode layer, potentially leading to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. The vulnerability requires local access and low-level privileges (CVSS vector PR:L) with no user interaction, and it is not remotely exploitable. No public exploit code has been identified at time of analysis, but the risk is materially higher on shared or multi-tenant GPU hosts such as VDI, vGPU, or Tesla datacenter deployments where untrusted users can reach the driver.
Incorrect interpretation of the NPU_SET_IFM/OFM_PRECISION field by the Linux kernel's accel/ethosu driver on Arm Ethos-U65 hardware lets a local user with access to the accelerator character device corrupt command-stream processing. Because bits 15:14 are read as an activation storage mode instead of the U65 rounding mode, natural rounding (value 2) streams are rejected with -EINVAL, and truncating rounding (value 1) streams are misrouted to the two-tile address path where a feature-map size is computed from tile bases the stream never initialized, degrading integrity of NPU operations and potentially crashing the affected subsystem. Authentication is required (CVSS vector PR:L, local vector AV:L); no public exploit code has been identified at time of analysis, and exploitation is limited to systems running the driver bound to real Ethos-U65 silicon, such as NXP i.MX93 SoCs. Vendor-released patches are available in the referenced kernel stable commits, with EUVD listing Linux 7.2.7 and 7.3-rc2 as fixed.
Denial of service in NanoSVG (commit 239e102ec) where a crafted SVG document carrying oversized geometry coordinates drives the rasterizer's fixed-point-scaled edge values past the range of a 32-bit int during nsvg__addActive(), producing undefined behavior that can terminate the process. The issue is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), i.e. unauthenticated and low-complexity, but availability-only: there is no code execution, data disclosure, or integrity impact per the assessed vector. Exploitation requires the embedding application to actually rasterize attacker-supplied SVG content rather than merely parse it, so tools that only handle locally trusted assets face a local-input scenario; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), though the vendor issue tracker reference (GitHub issue 292) makes root-cause details publicly discoverable.
Denial of service in the MuJS embeddable JavaScript interpreter (git revision e892c9fdb) allows remote attackers to crash the hosting process by supplying JavaScript that builds an excessively large numeric array index, which jsR_isindex() in jsrun.c converts from floating point to integer without validating the value fits in the target integer range. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I/A:H), the attack is network-reachable and unauthenticated, but the impact is availability-only: no confidentiality or integrity loss, with exploitability gated by whether the embedding application evaluates untrusted JavaScript. Exploitation requires the host to feed attacker-controlled script to the embedded interpreter (for example, opening a document or file that MuJS parses), and no public exploit code or CISA KEV entry was identified at time of analysis; EPSS is 0.15% (4th percentile), indicating low near-term exploitation likelihood. The upstream project has published a fix commit, but no tagged patched release has been independently confirmed.
Denial of service in NanoSVG at commit 239e102ec affects applications that parse attacker-supplied SVG documents, where a crafted arc command with extreme radius values drives the arc delta-angle calculation to NaN and the subsequent unchecked NaN-to-int conversion causes undefined behavior and process termination. The published CVSS vector is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so the unauthenticated network attack path is constrained by the requirement that the target actually process a malicious SVG, and manual SVG opening can effectively require user interaction; EPSS is 0.16% and no public exploit identified at time of analysis.
Denial of service in the official RabbitMQ Go client library amqp091-go (versions prior to 1.13.0): a malicious, compromised, or impersonated AMQP 0.9.1 broker can crash any application that connects to it. By encoding a byte-array field length as 0xFFFFFFFF (decoded into a signed int32 as -1) inside the connection.start server-properties table or a message header field table, the broker drives readField() to call make() with a negative size, producing a 'len out of range' runtime panic that escapes the reader goroutine and terminates the client process. Attackers must sit on the broker side of the connection - a trusted-broker deployment is largely unaffected - and the outcome is availability loss only, with no code execution or data disclosure. No public exploit code or confirmed active exploitation has been identified at time of analysis; vendor-released patch 1.13.0 is available.
Remote code execution in Microsoft JScript's numeric type conversion logic allows unauthenticated network attackers to execute arbitrary code on affected Windows hosts. The vulnerability stems from CWE-681 (incorrect conversion between numeric types) in jscript.dll, the legacy Windows scripting engine, and affects the full span of supported Windows releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, but the network-reachable, zero-interaction CVSS vector (AV:N/UI:N) indicates exploitation via server-side JScript processing contexts such as IIS Classic ASP, without requiring user interaction.
Privilege escalation in su-exec through version 0.3 allows local attackers with low-privilege access to execute arbitrary programs as root by supplying crafted oversized numeric user or group identifiers. The root cause is an unchecked integer truncation: strtol() returns a 64-bit long on modern Linux, but su-exec assigns the result directly to uid_t and gid_t (32-bit unsigned integers) without range validation - values like 4294967296 (2^32) silently truncate to UID/GID 0, the root account. A public proof-of-concept is available and no vendor-released patch has been identified at time of analysis, making this an active remediation gap for container deployments dependent on su-exec.
Local privilege escalation in the Windows NTFS file-system driver lets an authenticated low-privileged user gain elevated (likely SYSTEM) privileges by exploiting an incorrect conversion between numeric types (CWE-681). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Microsoft reported the flaw and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.