Monthly
Uninitialized heap memory disclosure in Pillow 5.3.0 through 12.x allows remote attackers to read stale process memory by supplying a crafted TIFF that uses JPEG (COMPRESSION=7) or Group 4 fax compression and triggers a libtiff 'short decode', after which the library converts rows from a buffer whose unwritten tail was never cleared. The tile decode path has been affected since 5.3.0 and the strip path since 6.0.0, and the impact is confidentiality-only (memory disclosure with no corruption, crash, or code execution) - an application is only exposed if it both decodes the attacker-supplied image and returns or re-encodes the resulting pixel data, since that output channel is the only way the stale bytes reach the attacker. No public exploit code or active exploitation is indicated in the available data, and the issue is fixed in Pillow 13.0.0.
SSL session ticket key handling in NGINX Plus and NGINX Open Source can let a remote unauthenticated attacker forge client SSL sessions and bypass client certificate verification, but only on instances that enforce mutual TLS and rely on NGINX's automatic ticket key rotation. Exploitation is conditional and non-deterministic: the affected deployments must be configured with ssl_session_cache shared:name:size and must not set an explicit ssl_session_ticket_key file, and the resulting forgery is beyond the attacker's control (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5). There is confirmed data-plane information exposure potential but no control-plane exposure, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Word (part of Microsoft 365 Apps, Office LTSC 2021/2024, and Office for Mac) allows an unauthenticated attacker to execute arbitrary code in the context of a user who opens a crafted document. The vulnerability arises from use of an uninitialized resource (CWE-908) in Word's document parsing; although user interaction is required (UI:R), no privileges are needed on the attacker side (PR:N) and successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code has been identified at time of analysis, but Microsoft has released patches for affected builds.
Local privilege escalation in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged local user to elevate to a higher-integrity context, with a vendor CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only Windows 10, Windows 11, and Windows Server systems running builds older than the fixed revisions listed in the Microsoft advisory are affected; BITS is enabled by default on all editions, so no special configuration is needed to reach the vulnerable code. Exploitation is strictly local (post-compromise escalation, not initial access), no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Local privilege escalation in Windows Error Reporting (WER) allows an attacker who already holds low-privilege, authenticated access to a vulnerable Windows host to elevate to higher privileges, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use of uninitialized resource (CWE-908) inside the WER component, reachable without user interaction once the attacker can execute code or hold a session on the target; there is no remote vector, so prior local access is the key limiting factor. Unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025 builds below the vendor-published fixed build numbers are affected; a vendor patch is available and no public exploit code or confirmed active exploitation has been identified at the time of analysis (CISA SSVC exploitation: none, automatable: no).
Sandbox escape in Mozilla Firefox before 158 and Firefox ESR before 153.5 stems from uninitialized memory handling in the DOM Web Serial component. Unauthenticated remote attackers can induce a victim to load crafted web content that triggers the flaw and escapes the browser sandbox, with high confidentiality, integrity, and availability impact; user interaction is required. The issue is rated CVSS 9.6, but EPSS is only 0.19% and no public exploit was identified at time of analysis.
Sandbox escape in the Mozilla Firefox Graphics component allows an attacker who can get a victim to render attacker-controlled web content to break out of the browser's content-process sandbox, with Low-rated confidentiality, integrity and availability impact but a changed security scope. Affected are unpatched Firefox builds below 158 and ESR builds below 115.43 and 153.5; no authentication is required, but exploitation is gated by mandatory user interaction (UI:R) such as visiting a crafted page, which precludes zero-click mass exploitation. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is very low at 0.19% (8th percentile), making this a moderate-severity but low-priority issue in practice; vendor-released patches are available.
FreeRDP clients before 3.0.0 and in the 3.6.0-before-3.32.0 range can be coerced by a malicious RDP server into painting uninitialized heap memory onscreen or into aborting the client process via crafted WBT_TILE_FIRST and WBT_TILE_UPGRADE progressive codec messages. This client-side uninitialized heap read (CWE-908) occurs because the tile->current buffer is allocated without zeroing, and exploitation requires the victim to connect to an attacker-controlled or man-in-the-middle RDP server while the session negotiates the RemoteFX/progressive codec. No public exploit identified at time of analysis, and confirmed active exploitation has not been reported; the CVSS 4.0 score is 7.1 (High), driven primarily by availability impact (client abort) with a low, opportunistic confidentiality impact.
Local privilege escalation and kernel-level code execution in the NVIDIA GPU Display Driver for Windows and Linux, where the kernel-mode layer follows an error-handling path that operates on an improperly initialized resource (CWE-908). The flaw is reachable by an authenticated, low-privileged local user (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) on any host where the affected driver is installed and loaded, granting full confidentiality, integrity, and availability impact within the kernel-mode driver's scope. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); risk is concentrated on shared multi-tenant GPU hosts such as VDI, cloud GPU instances, and vGPU guests where untrusted local users coexist with the driver, and success may be probabilistic because the attacker must reliably trigger the failing error path.
Uninitialized heap memory disclosure in Pillow 5.3.0 through 12.x allows remote attackers to read stale process memory by supplying a crafted TIFF that uses JPEG (COMPRESSION=7) or Group 4 fax compression and triggers a libtiff 'short decode', after which the library converts rows from a buffer whose unwritten tail was never cleared. The tile decode path has been affected since 5.3.0 and the strip path since 6.0.0, and the impact is confidentiality-only (memory disclosure with no corruption, crash, or code execution) - an application is only exposed if it both decodes the attacker-supplied image and returns or re-encodes the resulting pixel data, since that output channel is the only way the stale bytes reach the attacker. No public exploit code or active exploitation is indicated in the available data, and the issue is fixed in Pillow 13.0.0.
SSL session ticket key handling in NGINX Plus and NGINX Open Source can let a remote unauthenticated attacker forge client SSL sessions and bypass client certificate verification, but only on instances that enforce mutual TLS and rely on NGINX's automatic ticket key rotation. Exploitation is conditional and non-deterministic: the affected deployments must be configured with ssl_session_cache shared:name:size and must not set an explicit ssl_session_ticket_key file, and the resulting forgery is beyond the attacker's control (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5). There is confirmed data-plane information exposure potential but no control-plane exposure, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Word (part of Microsoft 365 Apps, Office LTSC 2021/2024, and Office for Mac) allows an unauthenticated attacker to execute arbitrary code in the context of a user who opens a crafted document. The vulnerability arises from use of an uninitialized resource (CWE-908) in Word's document parsing; although user interaction is required (UI:R), no privileges are needed on the attacker side (PR:N) and successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code has been identified at time of analysis, but Microsoft has released patches for affected builds.
Local privilege escalation in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged local user to elevate to a higher-integrity context, with a vendor CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only Windows 10, Windows 11, and Windows Server systems running builds older than the fixed revisions listed in the Microsoft advisory are affected; BITS is enabled by default on all editions, so no special configuration is needed to reach the vulnerable code. Exploitation is strictly local (post-compromise escalation, not initial access), no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Local privilege escalation in Windows Error Reporting (WER) allows an attacker who already holds low-privilege, authenticated access to a vulnerable Windows host to elevate to higher privileges, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use of uninitialized resource (CWE-908) inside the WER component, reachable without user interaction once the attacker can execute code or hold a session on the target; there is no remote vector, so prior local access is the key limiting factor. Unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025 builds below the vendor-published fixed build numbers are affected; a vendor patch is available and no public exploit code or confirmed active exploitation has been identified at the time of analysis (CISA SSVC exploitation: none, automatable: no).
Sandbox escape in Mozilla Firefox before 158 and Firefox ESR before 153.5 stems from uninitialized memory handling in the DOM Web Serial component. Unauthenticated remote attackers can induce a victim to load crafted web content that triggers the flaw and escapes the browser sandbox, with high confidentiality, integrity, and availability impact; user interaction is required. The issue is rated CVSS 9.6, but EPSS is only 0.19% and no public exploit was identified at time of analysis.
Sandbox escape in the Mozilla Firefox Graphics component allows an attacker who can get a victim to render attacker-controlled web content to break out of the browser's content-process sandbox, with Low-rated confidentiality, integrity and availability impact but a changed security scope. Affected are unpatched Firefox builds below 158 and ESR builds below 115.43 and 153.5; no authentication is required, but exploitation is gated by mandatory user interaction (UI:R) such as visiting a crafted page, which precludes zero-click mass exploitation. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is very low at 0.19% (8th percentile), making this a moderate-severity but low-priority issue in practice; vendor-released patches are available.
FreeRDP clients before 3.0.0 and in the 3.6.0-before-3.32.0 range can be coerced by a malicious RDP server into painting uninitialized heap memory onscreen or into aborting the client process via crafted WBT_TILE_FIRST and WBT_TILE_UPGRADE progressive codec messages. This client-side uninitialized heap read (CWE-908) occurs because the tile->current buffer is allocated without zeroing, and exploitation requires the victim to connect to an attacker-controlled or man-in-the-middle RDP server while the session negotiates the RemoteFX/progressive codec. No public exploit identified at time of analysis, and confirmed active exploitation has not been reported; the CVSS 4.0 score is 7.1 (High), driven primarily by availability impact (client abort) with a low, opportunistic confidentiality impact.
Local privilege escalation and kernel-level code execution in the NVIDIA GPU Display Driver for Windows and Linux, where the kernel-mode layer follows an error-handling path that operates on an improperly initialized resource (CWE-908). The flaw is reachable by an authenticated, low-privileged local user (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) on any host where the affected driver is installed and loaded, granting full confidentiality, integrity, and availability impact within the kernel-mode driver's scope. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); risk is concentrated on shared multi-tenant GPU hosts such as VDI, cloud GPU instances, and vGPU guests where untrusted local users coexist with the driver, and success may be probabilistic because the attacker must reliably trigger the failing error path.