Monthly
Local privilege escalation in Android's Bluetooth stack lets an app running with ordinary privileges corrupt control flow in the privileged Bluetooth process and inherit its elevated rights. The root cause is an uninitialized-pointer dereference (CWE-824) in handle_le_monitor_device_event of msft.cc, the Microsoft HCI vendor-extension handler, affecting Android 16, Android 16-qpr2 and Android 17 per EUVD. This is a second-stage escalation rather than a remote entry point: the attacker must already have local code execution and be able to reach the Bluetooth LE monitoring path (CVSS AV:L, PR:L, UI:N), and no public exploit code has been identified at time of analysis; Google addresses the issue in its October 2026 Android Security Bulletin.
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.
Local attackers with low privileges can exploit an uninitialized pointer access flaw (CWE-824) in the firmware of NVIDIA Display Driver for Windows and Linux to achieve code execution, denial of service, privilege escalation, information disclosure, or data tampering. The vulnerability requires local access (AV:L) and authenticated low-privilege credentials (PR:L); no public exploit identified at time of analysis. Affected products include GeForce, RTX/Quadro/NVS, and Tesla product lines, including vGPU Manager deployments.
Memory corruption in Mozilla Firefox's JavaScript and WebAssembly engine (CWE-824, access of uninitialized pointer) allows a crafted or compromised web page to trigger an invalid-pointer dereference in the browser's content process, potentially resulting in information disclosure or code execution within that process. Exploitation requires the victim to navigate to attacker-controlled content in a pre-patch build - Firefox before 157, Firefox ESR before 153.4, or Firefox ESR before 140.17 - and is unauthenticated per the assessed CVSS vector (AV:N/PR:N), although the vendor's 9.8 score assumes no user interaction while our independent assessment requires UI:R, so the effective risk should be reconciled before treating this as an emergency. No public exploit code has been identified at time of analysis (no KEV listing, no POC) and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stores - to any network attacker who can reach the management interface. The vulnerability chains an uninitialized principal pointer (CWE-824) in /jsproxy session allocation with an encrypted URI path traversal, allowing pre-authentication escalation of file-read rights followed by namespace escape. Fixed versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) are available; a public exploit writeup exists, and CERT-PL's September 2026 reporting references active exploitation of this class of MikroTik vulnerabilities.
Denial of service in Mozilla Firefox before version 153 arises from an invalid pointer access (CWE-824) in the PSM (Personal Security Manager) security component, which brokers TLS/certificate and NSS cryptographic operations. Remote content processed by the browser can trigger the invalid pointer dereference, crashing the affected process; the assigned CVSS 3.1 vector scopes impact to availability only (A:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.13% (3rd percentile), consistent with a stability/crash bug rather than a code-execution primitive.
Arbitrary code execution in Adobe Dreamweaver Desktop versions 21.7 and earlier allows attackers to run code in the context of the current user when a victim opens a malicious file. The flaw stems from access of an uninitialized pointer (CWE-824) and is tracked under Adobe advisory APSB26-62. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an attacker controlling a DNSSEC-signed domain to crash the resolver process with a single crafted query. The DNSSEC validator uses an incorrect counter when computing write offsets for ADDITIONAL section rrsets while building chase-reply messages, leaving an uninitialized pointer that is later dereferenced. No public exploit identified at time of analysis, and the issue is fixed in Unbound 1.25.1.
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles on virtual servers. Remote unauthenticated attackers can crash TMM using undisclosed malicious traffic patterns, causing complete service disruption. CVSS 7.5 High severity with network vector and low complexity. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. Vendor patch available per F5 K000160945.
Uninitialized pointer access in Siemens Solid Edge SE2026 enables arbitrary code execution when processing malicious PAR files. Attackers must deliver a crafted PAR file and convince users to open it (CVSS:4.0 AV:L/UI:P), achieving full compromise of the victim's workstation with high confidentiality, integrity, and availability impact. No active exploitation confirmed at time of analysis, though the local attack vector and user interaction requirement limit automated mass exploitation. EPSS data not available for risk calibration.
Local privilege escalation in Android's Bluetooth stack lets an app running with ordinary privileges corrupt control flow in the privileged Bluetooth process and inherit its elevated rights. The root cause is an uninitialized-pointer dereference (CWE-824) in handle_le_monitor_device_event of msft.cc, the Microsoft HCI vendor-extension handler, affecting Android 16, Android 16-qpr2 and Android 17 per EUVD. This is a second-stage escalation rather than a remote entry point: the attacker must already have local code execution and be able to reach the Bluetooth LE monitoring path (CVSS AV:L, PR:L, UI:N), and no public exploit code has been identified at time of analysis; Google addresses the issue in its October 2026 Android Security Bulletin.
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.
Local attackers with low privileges can exploit an uninitialized pointer access flaw (CWE-824) in the firmware of NVIDIA Display Driver for Windows and Linux to achieve code execution, denial of service, privilege escalation, information disclosure, or data tampering. The vulnerability requires local access (AV:L) and authenticated low-privilege credentials (PR:L); no public exploit identified at time of analysis. Affected products include GeForce, RTX/Quadro/NVS, and Tesla product lines, including vGPU Manager deployments.
Memory corruption in Mozilla Firefox's JavaScript and WebAssembly engine (CWE-824, access of uninitialized pointer) allows a crafted or compromised web page to trigger an invalid-pointer dereference in the browser's content process, potentially resulting in information disclosure or code execution within that process. Exploitation requires the victim to navigate to attacker-controlled content in a pre-patch build - Firefox before 157, Firefox ESR before 153.4, or Firefox ESR before 140.17 - and is unauthenticated per the assessed CVSS vector (AV:N/PR:N), although the vendor's 9.8 score assumes no user interaction while our independent assessment requires UI:R, so the effective risk should be reconciled before treating this as an emergency. No public exploit code has been identified at time of analysis (no KEV listing, no POC) and EPSS is 0.16% (4th percentile), indicating low predicted exploitation activity.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stores - to any network attacker who can reach the management interface. The vulnerability chains an uninitialized principal pointer (CWE-824) in /jsproxy session allocation with an encrypted URI path traversal, allowing pre-authentication escalation of file-read rights followed by namespace escape. Fixed versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) are available; a public exploit writeup exists, and CERT-PL's September 2026 reporting references active exploitation of this class of MikroTik vulnerabilities.
Denial of service in Mozilla Firefox before version 153 arises from an invalid pointer access (CWE-824) in the PSM (Personal Security Manager) security component, which brokers TLS/certificate and NSS cryptographic operations. Remote content processed by the browser can trigger the invalid pointer dereference, crashing the affected process; the assigned CVSS 3.1 vector scopes impact to availability only (A:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.13% (3rd percentile), consistent with a stability/crash bug rather than a code-execution primitive.
Arbitrary code execution in Adobe Dreamweaver Desktop versions 21.7 and earlier allows attackers to run code in the context of the current user when a victim opens a malicious file. The flaw stems from access of an uninitialized pointer (CWE-824) and is tracked under Adobe advisory APSB26-62. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote denial of service in NLnet Labs Unbound recursive DNS resolver (versions up to and including 1.25.0) allows an attacker controlling a DNSSEC-signed domain to crash the resolver process with a single crafted query. The DNSSEC validator uses an incorrect counter when computing write offsets for ADDITIONAL section rrsets while building chase-reply messages, leaving an uninitialized pointer that is later dereferenced. No public exploit identified at time of analysis, and the issue is fixed in Unbound 1.25.1.
Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles on virtual servers. Remote unauthenticated attackers can crash TMM using undisclosed malicious traffic patterns, causing complete service disruption. CVSS 7.5 High severity with network vector and low complexity. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. Vendor patch available per F5 K000160945.
Uninitialized pointer access in Siemens Solid Edge SE2026 enables arbitrary code execution when processing malicious PAR files. Attackers must deliver a crafted PAR file and convince users to open it (CVSS:4.0 AV:L/UI:P), achieving full compromise of the victim's workstation with high confidentiality, integrity, and availability impact. No active exploitation confirmed at time of analysis, though the local attack vector and user interaction requirement limit automated mass exploitation. EPSS data not available for risk calibration.