Monthly
Untrusted pointer dereference (CWE-822) in IBM AIX's Virtual SCSI (vSCSI) initiator driver allows a low-privileged local user within a client LPAR to trigger kernel memory corruption, with outcomes spanning denial of service, privilege escalation, or full compromise of the client LPAR kernel. Affecting IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, the CVSS 3.1 score of 8.8 with scope change (S:C) reflects the cross-LPAR isolation risk inherent in PowerVM virtualization environments where VIOS mediates I/O for multiple tenants. No public exploit code or active exploitation has been identified at time of analysis; however, CISA's SSVC framework rates the technical impact as total, meaning successful exploitation fully undermines the security of the affected system.
Arbitrary code execution on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a CWE-822 untrusted pointer dereference, where a locally authenticated, low-privilege attacker can supply a crafted pointer value that the OS or VIOS component fails to validate before dereferencing. Successful exploitation yields full confidentiality, integrity, and availability compromise of the affected system (CVSS 7.8 High, C:H/I:H/A:H). No public exploit or CISA KEV listing exists at time of analysis; SSVC rates exploitation status as none and the attack as non-automatable.
Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.
Unprivileged user-mode threads in Zephyr RTOS can crash the kernel or disclose arbitrary kernel memory by exploiting a missing validation step in the logging subsystem's syscall verifier, directly violating the user/kernel isolation boundary that CONFIG_USERSPACE is designed to enforce. Any Zephyr build compiled with CONFIG_USERSPACE=y is affected, as the __syscall-decorated z_log_msg_static_create() function accepted fully attacker-controlled pointer and length arguments without any K_SYSCALL_* bounds checking in its verifier function z_vrfy_z_log_msg_static_create(). No public exploit identified at time of analysis; an upstream fix has been committed to zephyrproject-rtos/zephyr and documented in GitHub Security Advisory GHSA-h7rf-g9mg-g23f.
Untrusted pointer dereference in Microsoft Office Excel enables local arbitrary code execution when a user opens a crafted document. The flaw (CWE-822) allows an attacker who can deliver a malicious file to achieve full code execution with high confidentiality, integrity, and availability impact on the victim's system. No public exploit has been identified at time of analysis, and Microsoft has not listed this in CISA's Known Exploited Vulnerabilities catalog.
Local code execution via untrusted pointer dereference in Microsoft Office affects multiple product lines - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and Mac editions - when a victim opens a specially crafted document. The root cause (CWE-822) enables memory corruption through unvalidated pointer values sourced from attacker-controlled file content, yielding full confidentiality, integrity, and availability compromise of the targeted user session. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available through Microsoft Update channels.
Windows Win32K contains an untrusted pointer dereference (CWE-822) that allows a locally authenticated attacker to disclose sensitive kernel or process memory contents. Affected systems include multiple Windows 11 release branches (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, both full and Server Core installations. No public exploit has been identified at time of analysis and exploitation has not been confirmed by CISA KEV; Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in the Windows Kernel via an untrusted pointer dereference (CWE-822) enables a low-privileged, locally authenticated attacker to gain full SYSTEM-level control with high confidentiality, integrity, and availability impact. Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core configurations. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) makes this a reliable second-stage privilege escalation primitive for adversaries who have already achieved local access through any initial foothold.
Information disclosure in Windows Graphics Device Interface (GDI) via an untrusted pointer dereference exposes sensitive memory contents to a local low-privileged attacker across virtually all supported Windows client and server releases. The vulnerability (CWE-822) allows an authorized local user to trigger a controlled pointer dereference within GDI's rendering subsystem, resulting in high-impact confidentiality loss with no integrity or availability effect. No public exploit identified at time of analysis, though the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025 - makes this a broad-footprint patching concern.
Privilege escalation via untrusted pointer dereference in ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll exposes local attackers to arbitrary kernel memory writes through vulnerable IOCTL handlers in the associated kernel-mode drivers. The flaw (CWE-822) permits a caller supplying an attacker-controlled pointer to force the driver to write a specific value to an arbitrary memory address, enabling elevation of privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the high CVSS 4.0 score of 8.4 and confirmed arbitrary-write primitive make this a meaningful local privilege escalation risk on affected systems.
Untrusted pointer dereference (CWE-822) in IBM AIX's Virtual SCSI (vSCSI) initiator driver allows a low-privileged local user within a client LPAR to trigger kernel memory corruption, with outcomes spanning denial of service, privilege escalation, or full compromise of the client LPAR kernel. Affecting IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, the CVSS 3.1 score of 8.8 with scope change (S:C) reflects the cross-LPAR isolation risk inherent in PowerVM virtualization environments where VIOS mediates I/O for multiple tenants. No public exploit code or active exploitation has been identified at time of analysis; however, CISA's SSVC framework rates the technical impact as total, meaning successful exploitation fully undermines the security of the affected system.
Arbitrary code execution on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a CWE-822 untrusted pointer dereference, where a locally authenticated, low-privilege attacker can supply a crafted pointer value that the OS or VIOS component fails to validate before dereferencing. Successful exploitation yields full confidentiality, integrity, and availability compromise of the affected system (CVSS 7.8 High, C:H/I:H/A:H). No public exploit or CISA KEV listing exists at time of analysis; SSVC rates exploitation status as none and the attack as non-automatable.
Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.
Unprivileged user-mode threads in Zephyr RTOS can crash the kernel or disclose arbitrary kernel memory by exploiting a missing validation step in the logging subsystem's syscall verifier, directly violating the user/kernel isolation boundary that CONFIG_USERSPACE is designed to enforce. Any Zephyr build compiled with CONFIG_USERSPACE=y is affected, as the __syscall-decorated z_log_msg_static_create() function accepted fully attacker-controlled pointer and length arguments without any K_SYSCALL_* bounds checking in its verifier function z_vrfy_z_log_msg_static_create(). No public exploit identified at time of analysis; an upstream fix has been committed to zephyrproject-rtos/zephyr and documented in GitHub Security Advisory GHSA-h7rf-g9mg-g23f.
Untrusted pointer dereference in Microsoft Office Excel enables local arbitrary code execution when a user opens a crafted document. The flaw (CWE-822) allows an attacker who can deliver a malicious file to achieve full code execution with high confidentiality, integrity, and availability impact on the victim's system. No public exploit has been identified at time of analysis, and Microsoft has not listed this in CISA's Known Exploited Vulnerabilities catalog.
Local code execution via untrusted pointer dereference in Microsoft Office affects multiple product lines - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and Mac editions - when a victim opens a specially crafted document. The root cause (CWE-822) enables memory corruption through unvalidated pointer values sourced from attacker-controlled file content, yielding full confidentiality, integrity, and availability compromise of the targeted user session. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available through Microsoft Update channels.
Windows Win32K contains an untrusted pointer dereference (CWE-822) that allows a locally authenticated attacker to disclose sensitive kernel or process memory contents. Affected systems include multiple Windows 11 release branches (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, both full and Server Core installations. No public exploit has been identified at time of analysis and exploitation has not been confirmed by CISA KEV; Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in the Windows Kernel via an untrusted pointer dereference (CWE-822) enables a low-privileged, locally authenticated attacker to gain full SYSTEM-level control with high confidentiality, integrity, and availability impact. Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core configurations. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) makes this a reliable second-stage privilege escalation primitive for adversaries who have already achieved local access through any initial foothold.
Information disclosure in Windows Graphics Device Interface (GDI) via an untrusted pointer dereference exposes sensitive memory contents to a local low-privileged attacker across virtually all supported Windows client and server releases. The vulnerability (CWE-822) allows an authorized local user to trigger a controlled pointer dereference within GDI's rendering subsystem, resulting in high-impact confidentiality loss with no integrity or availability effect. No public exploit identified at time of analysis, though the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025 - makes this a broad-footprint patching concern.
Privilege escalation via untrusted pointer dereference in ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll exposes local attackers to arbitrary kernel memory writes through vulnerable IOCTL handlers in the associated kernel-mode drivers. The flaw (CWE-822) permits a caller supplying an attacker-controlled pointer to force the driver to write a specific value to an arbitrary memory address, enabling elevation of privileges. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the high CVSS 4.0 score of 8.4 and confirmed arbitrary-write primitive make this a meaningful local privilege escalation risk on affected systems.