Fade In
Monthly
Out-of-bounds write in the XML parsing component of GCC Productions' Fade In 4.2.0 lets an attacker corrupt memory on a target system when a victim opens a specially crafted .fadein project file. Because the flaw is triggered by parsing malformed XML content, successful exploitation depends entirely on user interaction - the victim must be persuaded to open an attacker-supplied file - and code execution is confined to the privileges of the user running Fade In (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High). Publicly available exploit code exists per the Talos vulnerability report TALOS-2025-2250, but EPSS is low at 0.34% (25th percentile) and there is no evidence of confirmed active exploitation (CISA KEV), so this is a legitimate memory-corruption bug that is a lower operational priority than its High score suggests.
A use-after-free in the XML parsing component of GCC Productions' Fade In 4.2.0 lets an attacker corrupt heap memory by getting a victim to open a specially crafted .xml file, with the assessed impact being high confidentiality, integrity, and availability loss in the context of that user. The flaw is a local, user-interaction-dependent (AV:L/UI:R, PR:N) client-side issue rather than a remotely reachable server bug, and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is low at 0.34% (25th percentile), reflecting the situational, file-delivery nature of the attack; this is a genuine but narrow client-side risk, not a mass-exploitation threat.
Out-of-bounds write in the XML parsing component of GCC Productions' Fade In 4.2.0 lets an attacker corrupt memory on a target system when a victim opens a specially crafted .fadein project file. Because the flaw is triggered by parsing malformed XML content, successful exploitation depends entirely on user interaction - the victim must be persuaded to open an attacker-supplied file - and code execution is confined to the privileges of the user running Fade In (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High). Publicly available exploit code exists per the Talos vulnerability report TALOS-2025-2250, but EPSS is low at 0.34% (25th percentile) and there is no evidence of confirmed active exploitation (CISA KEV), so this is a legitimate memory-corruption bug that is a lower operational priority than its High score suggests.
A use-after-free in the XML parsing component of GCC Productions' Fade In 4.2.0 lets an attacker corrupt heap memory by getting a victim to open a specially crafted .xml file, with the assessed impact being high confidentiality, integrity, and availability loss in the context of that user. The flaw is a local, user-interaction-dependent (AV:L/UI:R, PR:N) client-side issue rather than a remotely reachable server bug, and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). EPSS is low at 0.34% (25th percentile), reflecting the situational, file-delivery nature of the attack; this is a genuine but narrow client-side risk, not a mass-exploitation threat.