Monthly
Crafted MVG files can crash ImageMagick versions before 6.9.13-56 and 7.x before 7.1.2-31 via an invalid memory free in the MVG decoder (CWE-763), causing denial of service. The issue is remotely reachable without authentication (CVSS 4.0 PR:N) if a target service passes attacker-controlled MVG input to ImageMagick, but exploitation requires non-trivial conditions (AC:H, AT:P) and impact is limited to availability - no code execution, confidentiality, or integrity effect is demonstrated. No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution within the browser process could be achieved in Mozilla Firefox before version 157 through an invalid pointer release in the JavaScript JIT compiler. A remote, unauthenticated attacker can trigger this by convincing a user to visit a malicious webpage, requiring user interaction but no privileges. No public exploit code has been identified at time of analysis, and the CVSS base score is 8.8.
Denial of service in YARA 4.5.8 occurs when libyara deserializes a crafted compiled rule file (.yrc): malformed external-variable pointers or an out-of-range type field are not validated in the yr_rules_load/yr_rules_from_arena path, resulting in an invalid free in yr_rules_destroy() or a wild pointer dereference in yr_object_create(). Only deployments that load compiled rules from untrusted or third-party sources are exposed, since the assessed vector requires a user or process to actively load the file (UI:R) and no authentication (PR:N); the realistic outcome is a process crash rather than code execution (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and the issue is not confirmed actively exploited (CISA KEV).
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated local user to gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-763 (Release of Invalid Pointer or Reference) - a memory-safety defect in the service's pointer lifecycle management that, when triggered, enables code execution at elevated privilege. No public exploit code or active exploitation has been identified at time of analysis, but the zero-interaction, low-complexity CVSS vector makes this a high-priority patching target for any organization running unpatched Windows endpoints or servers.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
Privilege escalation in Mozilla Firefox's Graphics component via an invalid pointer (CWE-763) exposes users running all Firefox versions prior to 155 and ESR branches prior to 115.40, 140.15, and 153.2 to full compromise of confidentiality, integrity, and availability. The CVSS 8.8 network-vector score with no required privileges but mandatory user interaction (UI:R) places this squarely in the drive-by exploitation category - a victim visiting a crafted webpage is sufficient to trigger the flaw. No active exploitation is confirmed at time of analysis (SSVC exploitation: none, no KEV listing), but the total technical impact rating and the broad Firefox install base make this a high-priority patching target.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Memory-corruption crash (and potential code execution) in Foxit PDF Reader and Foxit PDF Editor occurs when a PDF's embedded JavaScript writes annotation attributes without sufficient object-type and argument validation, corrupting the internal annotation structure so the application faults during subsequent object release (CWE-763). Local exploitation requires a user to open a crafted PDF; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV. The vendor rates full confidentiality, integrity, and availability impact (CVSS 7.8), though Foxit tags it as Denial of Service.
Local privilege escalation / memory corruption in the Linux kernel's netfilter NAT subsystem (introduced in v5.14) arises because nf_nat_register_fn() freed nf_hook_ops structures immediately rather than deferring the release via RCU. Because the v5.14-era nfnetlink_hook feature lets userspace dump active netfilter hooks by peeking into the ops blob, a concurrent dump racing the NAT (un)register error path can access ops memory after it is freed. No public exploit has been identified at time of analysis and EPSS is low (0.17%), but the high-impact CVSS vector reflects a use-after-free class flaw in a core kernel subsystem.
Memory corruption in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol stack allows remote attackers to trigger a double-free in tipc_buf_append() during message reassembly, where tipc_msg_validate() may reallocate and free the working skb while the error path frees a now-stale pointer. Affected systems are those running a vulnerable kernel (introduced around 4.15-era code, present across 5.10-7.0 branches) with the TIPC subsystem in use; successful exploitation can crash the kernel and, depending on heap conditions, potentially lead to privilege escalation. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 7th percentile), and it is not listed in CISA KEV.
Crafted MVG files can crash ImageMagick versions before 6.9.13-56 and 7.x before 7.1.2-31 via an invalid memory free in the MVG decoder (CWE-763), causing denial of service. The issue is remotely reachable without authentication (CVSS 4.0 PR:N) if a target service passes attacker-controlled MVG input to ImageMagick, but exploitation requires non-trivial conditions (AC:H, AT:P) and impact is limited to availability - no code execution, confidentiality, or integrity effect is demonstrated. No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution within the browser process could be achieved in Mozilla Firefox before version 157 through an invalid pointer release in the JavaScript JIT compiler. A remote, unauthenticated attacker can trigger this by convincing a user to visit a malicious webpage, requiring user interaction but no privileges. No public exploit code has been identified at time of analysis, and the CVSS base score is 8.8.
Denial of service in YARA 4.5.8 occurs when libyara deserializes a crafted compiled rule file (.yrc): malformed external-variable pointers or an out-of-range type field are not validated in the yr_rules_load/yr_rules_from_arena path, resulting in an invalid free in yr_rules_destroy() or a wild pointer dereference in yr_object_create(). Only deployments that load compiled rules from untrusted or third-party sources are exposed, since the assessed vector requires a user or process to actively load the file (UI:R) and no authentication (PR:N); the realistic outcome is a process crash rather than code execution (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and the issue is not confirmed actively exploited (CISA KEV).
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated local user to gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-763 (Release of Invalid Pointer or Reference) - a memory-safety defect in the service's pointer lifecycle management that, when triggered, enables code execution at elevated privilege. No public exploit code or active exploitation has been identified at time of analysis, but the zero-interaction, low-complexity CVSS vector makes this a high-priority patching target for any organization running unpatched Windows endpoints or servers.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
Privilege escalation in Mozilla Firefox's Graphics component via an invalid pointer (CWE-763) exposes users running all Firefox versions prior to 155 and ESR branches prior to 115.40, 140.15, and 153.2 to full compromise of confidentiality, integrity, and availability. The CVSS 8.8 network-vector score with no required privileges but mandatory user interaction (UI:R) places this squarely in the drive-by exploitation category - a victim visiting a crafted webpage is sufficient to trigger the flaw. No active exploitation is confirmed at time of analysis (SSVC exploitation: none, no KEV listing), but the total technical impact rating and the broad Firefox install base make this a high-priority patching target.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Memory-corruption crash (and potential code execution) in Foxit PDF Reader and Foxit PDF Editor occurs when a PDF's embedded JavaScript writes annotation attributes without sufficient object-type and argument validation, corrupting the internal annotation structure so the application faults during subsequent object release (CWE-763). Local exploitation requires a user to open a crafted PDF; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV. The vendor rates full confidentiality, integrity, and availability impact (CVSS 7.8), though Foxit tags it as Denial of Service.
Local privilege escalation / memory corruption in the Linux kernel's netfilter NAT subsystem (introduced in v5.14) arises because nf_nat_register_fn() freed nf_hook_ops structures immediately rather than deferring the release via RCU. Because the v5.14-era nfnetlink_hook feature lets userspace dump active netfilter hooks by peeking into the ops blob, a concurrent dump racing the NAT (un)register error path can access ops memory after it is freed. No public exploit has been identified at time of analysis and EPSS is low (0.17%), but the high-impact CVSS vector reflects a use-after-free class flaw in a core kernel subsystem.
Memory corruption in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol stack allows remote attackers to trigger a double-free in tipc_buf_append() during message reassembly, where tipc_msg_validate() may reallocate and free the working skb while the error path frees a now-stale pointer. Affected systems are those running a vulnerable kernel (introduced around 4.15-era code, present across 5.10-7.0 branches) with the TIPC subsystem in use; successful exploitation can crash the kernel and, depending on heap conditions, potentially lead to privilege escalation. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 7th percentile), and it is not listed in CISA KEV.