Heap Overflow
Monthly
Heap buffer overflow in FreeRDP before 3.32.0 can let a local attacker corrupt heap memory and potentially execute code when the victim loads a crafted persistent bitmap cache v2 file, because persistent_cache_read_entry_v2 miscalculates bitmap sizes via integer wraparound and then performs fixed 16 KiB reads against mismatched entry-size accounting. Exploitation requires the local attacker to place a malicious cache file in the client's load path and relies on low-level local privileges plus user interaction (PR:L/UI:P), so there is no remote unauthenticated path; no public exploit identified at time of analysis. No CISA KEV entry was provided, making this a moderate-priority local risk rather than a mass-exploitation threat.
Heap buffer overflow in FreeRDP before 3.32.0 allows a local attacker with low privileges to corrupt memory and potentially execute code by supplying a crafted v3 persistent bitmap cache file. The vulnerability is triggered when the FreeRDP client processes a malicious cache file with crafted width and height values, causing an integer overflow in size calculation and a subsequent heap overflow via fread. Exploitation requires the victim to load the poisoned cache during a session (passive user interaction); no public exploit code has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Outlook is possible through a heap-based buffer overflow that an unauthenticated, network-based attacker can trigger by convincing a victim to open or preview a crafted email message or Office document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365 for Mac, but a vendor patch is available. Exploitation carries a high attack complexity due to required heap grooming and memory-layout control, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word allows unauthenticated remote attackers to execute code on vulnerable systems when a user opens a crafted document, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The attack requires user interaction (opening a malicious file) and executes code in the context of the opening user without privilege escalation, resulting in a CVSS score of 8.8. No public exploit code or active exploitation has been identified, and a vendor patch is available; this is a high-priority vulnerability but not an emergency based on current signals.
Heap-based buffer overflow in Microsoft Word allows remote, unauthenticated attackers to execute arbitrary code when a user opens a maliciously crafted document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS editions, with a CVSS score of 8.8; no public exploit identified at time of analysis, and CISA KEV does not list active exploitation, though high impact and low attack complexity make this a genuine high-priority issue. The primary limiting factor is the required user interaction to open the weaponized file, and code runs with the victim's privileges rather than SYSTEM.
Heap-based buffer overflow in Microsoft Word (CWE-122) allows an unauthorized attacker to execute code in the context of the victim when a specially crafted Word document is opened, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw affects Word as shipped in Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and macOS. Exploitation is unauthenticated from the attacker's side but requires the victim to open an attacker-supplied file, so success depends on social engineering and on getting past Protected View or Mark-of-the-Web warnings for documents downloaded from the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); patch data indicates a vendor fix is available via the Microsoft Security Response Center advisory.
Heap-based buffer overflow in Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024) allows a remote, unauthenticated attacker to execute code in the context of the victim when a crafted document is opened, matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Exploitation is not interaction-free: the vector's UI:R component and the assessed conditions require file delivery plus a user open action, so Protected View and Mark-of-the-Web prompts materially limit real-world success. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available from Microsoft and this remains a genuine priority for patching.
Heap-based buffer overflow in Microsoft Word allows remote unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted document. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. No public exploit identified at time of analysis, but this is a genuine high-priority issue given the potential for code execution and widespread product deployment; exploitation requires user interaction (opening or previewing the malicious file).
Heap-based memory corruption in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 - lets a remote, unauthenticated attacker execute arbitrary code in the context of the victim, but only when that victim opens or previews a specially crafted Word document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms the trigger is entirely dependent on user interaction, so there is no zero-click or server-side path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available. That combination - high technical severity but a required user action and an available fix - makes this a high-priority vulnerability rather than an emergency.
A heap-based buffer overflow in Microsoft Word's document-parsing code lets an unauthenticated remote attacker execute arbitrary code when a victim opens a maliciously crafted Word file, affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. The attack is network-deliverable (typically a phishing attachment or downloaded document) but cannot trigger without user interaction, since the victim must open or preview the file; successful exploitation runs code in that user's security context rather than SYSTEM. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patching item - rated 8.8 with the vendor patch already available - rather than an emergency zero-day response.
Heap-based out-of-bounds reads and writes in bincookie prior to 0.1.9 occur when an application calls bincookie_init_file() on an attacker-supplied .binarycookies file, allowing the crafted input to drive byte-swap and iteration loops past a heap buffer sized only to the real file length. The vulnerable parser trusts file-controlled num_pages, page_sizes, and cookie_offsets as loop bounds, so malformed files can crash the host application or corrupt heap metadata in ways that could potentially lead to code execution. Exploitation requires local delivery of the crafted file and user interaction to make the target application parse it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8); no authentication to the parsing application is needed, and there is no public exploit identified at time of analysis. Version 0.1.9 fixes the issue by rejecting malformed files.
A heap-based buffer overflow in the api.cgi management handler of Wavlink WN530HG4B routers (firmware M30HG4B_V260724) allows unauthenticated remote attackers to corrupt heap memory by sending a crafted request to the api=info&client=app endpoint. The vulnerability is rated 9.3 under CVSS 4.0 (assessed 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting no authentication requirement, no user interaction, and full loss of confidentiality, integrity, and availability on the affected device. Publicly available exploit code exists, and while the issue is not confirmed as actively exploited (not in CISA KEV), the weaponizable nature of an unbounded parameter flowing into a shell-invoked handler makes patching exposed devices a priority; the vendor has released firmware 2026-09-24-841a51c6d5_tclinux.bin that resolves the flaw.
An authenticated local user on an HPE NonStop system can trigger a heap buffer overflow in the HPE NonStop Debug Utilities to corrupt a saved resume-execution address, potentially redirecting the flow of the debugged process. The flaw is rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) - the attacker needs an existing local foothold with only low privileges, but cannot reach the component remotely, no user interaction is required, and confidentiality is not impacted while integrity and availability are rated High. A vendor security bulletin is published, but no exact fixed version is given in the supplied data, and no public exploit code or CISA KEV entry has been identified at time of analysis; the practical risk is moderate and bounded by the requirement for local access and the platform-specific, diagnostic nature of the utility.
Heap-based buffer overflow in HPE NonStop Inspect Subsystem allows an authenticated local attacker with low privileges to corrupt a saved resume-execution address and potentially redirect control flow. The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects no confidentiality impact but high integrity and availability impact. No public exploit code or active exploitation is identified at time of analysis, and exploitation requires prior authenticated local access plus interaction with the Inspect debugging subsystem.
A heap buffer overflow in HPE NonStop OCAX lets an authenticated local actor corrupt the component's address space and potentially redirect execution flow, producing high integrity and availability impact with no confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Because the vector is AV:L with PR:L, exploitation requires pre-existing local access and at least low-privilege credentials on the NonStop system plus the ability to feed input to OCAX; it is not remotely reachable, so realistic exposure is limited to insiders or attackers who have already compromised a low-privilege account. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a medium-severity authenticated local issue rather than a top-tier emergency. HPE is the reporting vendor and the linked HPE Security Bulletin (hpesbns05148en_us) is the authoritative source for fixed versions.
Heap buffer overflow in HPE NonStop NDSREST (CVSS 7.1) can corrupt a resume-execution address and potentially redirect execution flow, producing high integrity and availability impact without confidentiality impact. Exploitation requires authenticated low-privilege local access (AV:L, PR:L), no user interaction, and low attack complexity; if NDSREST is network-exposed in a given deployment, effective reachability may be broader than the local vector suggests. No public exploit identified at time of analysis, and CISA KEV does not confirm active exploitation.
Heap out-of-bounds write in the FreeBSD RACK TCP stack (CVE-2026-101307) lets a remote, unauthenticated attacker who completes a TCP handshake and sends a sufficient number of ACKs cause a 16-bit PCM sample-array growth counter to wrap to zero, producing a near-zero-length kernel heap allocation that is then overwritten with roughly 512 KB of existing sample data. The result is a kernel panic - availability impact only, with no confidentiality or integrity loss - and only FreeBSD 15.1-RELEASE before p5 hosts that have explicitly enabled the non-default RACK stack are exposed; stock FreeBSD hosts using the default stack are unaffected. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and EPSS is 0.17% (6th percentile), so the practical near-term risk is moderate and conditional on RACK being enabled.
Local attackers with low-privilege access can exploit a heap-based buffer overflow in HPE NonStop TNS/X Native Inspect to corrupt memory and potentially redirect execution flow, leading to code execution or denial of service. The vulnerability requires local, authenticated access (CVSS vector: AV:L/PR:L) and the ability to invoke the Native Inspect debugger utility. No public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).
Heap-based buffer overflow in the secure-dot1xd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service by sending a crafted EAPOL frame to an 802.1X-authenticated interface. Exploitation requires the targeted interface to be configured for 802.1X port-based authentication and Layer 2 adjacency, and no public exploit has been identified at time of analysis. With a CVSS 4.0 score of 8.7, this is a high-priority flaw for affected deployments using 802.1X.
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default map directive with regex matching is configured so that the root directive or access log format references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under specific conditions. The flaw is remotely reachable without authentication (CVSS PR:N) but has high attack complexity (AC:H) because exploitation depends on conditions beyond the attacker's control and on a non-default configuration; the realistic outcome on systems with ASLR enabled is worker-process restart/DoS, while code execution is limited to systems with ASLR disabled or bypassed. F5 rates this CVSS 4.0 9.2 (Critical), and no public exploit identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through crafted HTTP requests, but only when a non-default configuration uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log format directive. Successful exploitation causes a heap buffer overflow in the NGINX worker process, leading to a restart (denial of service) and potentially allowing code execution on systems with ASLR disabled or bypassable. No public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Google Chrome's Animation component allows a remote attacker to execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page in any build prior to 155.0.8059.79. The bug carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication or special configuration is required, but exploitation depends on the user rendering attacker-controlled content, and because the scope is unchanged the resulting code execution is confined to the sandboxed renderer process rather than the host OS. No public exploit code and no confirmed active exploitation have been identified at time of analysis - CISA's SSVC evaluation rates Exploitation as 'none' - so this is a patch-promptly item rather than an emergency, with Google rating the issue High severity.
A heap-based buffer overflow in PDFium, the PDF rendering engine embedded in Google Chrome, allows a remote attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to open a crafted HTML page. All desktop Chrome builds prior to 155.0.8059.79 (stable and extended-stable channels) are affected, and exploitation requires user interaction (UI:R), which limits mass or automated abuse. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none; however, CISA assigns a total technical impact once the bug is triggered, and Google rates the Chromium security severity as High. The primary constraint on real-world impact is that code execution is confined to the renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape vulnerability.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.
Heap-based buffer overflow in Microsoft SQL Server lets an authenticated attacker who holds any valid, low-privileged database login - and can reach the instance's listening port over the network - execute code in the context of the SQL Server service process, with high confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no user interaction). The vendor has released patched builds for SQL Server 2017, 2019, 2022 and 2025, and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible priority rather than an emergency. Because exploitation needs only ordinary credentials rather than sysadmin rights, the practical exposure is concentrated on instances reachable from untrusted networks and on estates where database logins are shared or weakly managed.
Local privilege elevation in Microsoft SQL Server 2019, 2022, and 2025 stems from a heap-based buffer overflow that a low-privileged authenticated user with local access can trigger to gain elevated rights on the database host. Exploitation is not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:N) demands an existing authorized database session plus successful heap manipulation, and no public exploit has been identified at time of analysis, with no CISA KEV listing. Vendor patches are available, so this is a moderate-priority hardening item rather than a drop-everything emergency.
Privilege elevation on Microsoft SQL Server 2019, 2022, and 2025 instances can be achieved by an authenticated, low-privileged user who already has local access to the host or instance and can drive crafted input into a vulnerable heap-allocation code path. Successful exploitation corrupts heap memory and, because the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0), yields high confidentiality, integrity, and availability impact within the database engine's security context; the High attack complexity reflects the non-deterministic heap-grooming required for reliable code execution, and no end-user interaction is needed. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available per the Microsoft advisory, and unaffected instances are those already running the corrected cumulative-update or GDR builds.
Heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds a valid low-privilege database login execute arbitrary code on the database engine over the network, with impact crossing a security scope boundary (CVSS 8.5; AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected builds span SQL Server 2017, 2019, 2022, and 2025 across both the GDR (security-only) and cumulative-update branches, so most unpatched enterprise estates that still run older builds are in scope. Exploitation is not trivial - the high attack complexity implies reliable heap layout/grooming or a timing-sensitive corruption window must be achieved - and there is no public exploit identified at time of analysis, but a vendor patch is available and the flaw should be prioritized on internet-exposed or broadly accessible database listeners.
Privilege elevation in Microsoft SQL Server (2017, 2019, 2022 and 2025 builds below their patched levels) allows an authenticated, low-privileged database principal to trigger a heap-based buffer overflow in the database engine over a network connection and gain higher privileges, with impact crossing a security boundary (CVSS 8.5, S:C). Exploitation is not anonymous: the attacker must already hold a valid SQL Server login (PR:L) and satisfy a hard-to-control heap-state or race condition (AC:H), so the flaw is not automatable or scalable (SSVC Automatable: no, Exploitation: none), and no public exploit code has been identified at time of analysis. Microsoft has published fixed builds via its update guide, so this is a legitimate but not top-tier emergency priority - patch promptly, with urgency driven by the total technical impact and the broad installed base.
Authenticated code execution in Microsoft SQL Server 2017 through 2025 arises from a heap-based buffer overflow (CWE-122) that allows a low-privileged database login to execute code on the database server over the network. Exploitation is not available to unauthenticated attackers: valid credentials for a SQL Server login are mandatory (CVSS PR:L) and the high attack complexity (AC:H) reflects the heap-layout grooming normally required for a reliable overflow, so the practical bar is considerably higher than the 8.5 base score alone suggests. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds across every affected servicing branch.
Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).
Heap-based buffer overflow in Microsoft Office Visio allows unauthenticated remote attackers to execute arbitrary code in the context of the user who opens a specially crafted Visio document, with the only barrier being user interaction (UI:R) - the victim must be socially engineered into opening the file. Affected builds are Microsoft 365 Apps for Enterprise (16.0.1, patched via the current channel at https://aka.ms/OfficeSecurityReleases), Office LTSC 2021 below 16.0.14334.20974, and Office LTSC 2024 below 16.0.17932.21056. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the 8.8 CVSS score, network attack vector, and complete confidentiality/integrity/availability impact make prompt patching a high priority for any environment where Visio is installed.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
An authenticated, low-privileged local attacker can trigger a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) to corrupt kernel memory and elevate to SYSTEM on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 hosts. Exploitation is local-only and high-complexity (CVSS 7.0, AC:H), requiring precise kernel heap grooming or a race window, so this is a moderate-priority privilege-escalation issue rather than a remote or wormable emergency. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds that remove the vulnerable condition.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Local privilege escalation in the Windows 11 26H1 kernel allows a low-privileged local user to corrupt heap memory and escalate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so an attacker who already holds a foothold as any user or service account can reliably and non-interactively raise their privileges to the highest level on the host. Exploitation is post-compromise, not a remote entry point; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Microsoft has shipped a vendor patch addressing it.
Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.
Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.
Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.
Heap-based buffer overflow in Microsoft Excel enables remote code execution when a user opens or previews a specially crafted spreadsheet, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Any affected build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft Office 365 for Mac, or Office Online Server - that processes the malicious file is at risk; no authentication or non-default configuration is required, but the attacker must convince the victim to open the document. No public exploit identified at time of analysis, and the flaw is not confirmed as actively exploited, though the high confidentiality, integrity, and availability impact makes it a priority patch for Office endpoints.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute code by convincing a user to open a specially crafted Excel file. Exploitation requires user interaction and can be blocked by Protected View, but the high impact (CVSS 8.8) makes patching a high priority even though no public exploit has been identified at the time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of a victim user by convincing them to open a crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), confirming no attacker credentials are needed but requiring user interaction (opening the file, typically via phishing or a malicious download); the code executes with the victim's privileges, so a low-privileged account limits the immediate impact. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 and LTSC for Mac, Office 365 for Mac, and Office Online Server below patched versions like 16.0.14334.20974, 16.0.17932.21056, and 16.0.10417.20228, and no public exploit or KEV listing is confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code in the context of the user who opens a maliciously crafted workbook, with the file delivered over the network (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office LTSC for Mac; no public exploit identified at time of analysis, and vendor patches remove the condition.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted workbook, driven by a heap-based buffer overflow. Affected versions include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the listed macOS Office builds; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis and no CISA KEV entry is provided, but the mandatory user interaction makes social engineering the practical attack path, and vendor patches are available.
Heap-based buffer overflow in Microsoft Excel (CWE-122) lets an unauthenticated attacker execute arbitrary code in the context of the victim's user account when that user opens a specially crafted spreadsheet; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) reflects full confidentiality, integrity and availability impact but is gated by mandatory user interaction. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows and Mac, Office 365 for Mac, and Office Online Server, so both endpoint document handling and server-side file rendering are in scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but with a vendor patch already published it is a high-priority patching candidate for environments that routinely open externally sourced Office files rather than a drop-everything emergency.
Heap-based buffer overflow in Microsoft Excel enables remote attackers to execute code on a victim's machine with the privileges of the affected Office process by convincing a user to open or preview a specially crafted workbook (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Because the vector shows PR:N, no credentials or elevated privileges are needed, but the UI:R requirement means the bug cannot self-propagate and depends on social engineering to deliver and open the malicious file across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server, all of which have vendor-supplied fixes. Microsoft has published a security update (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748), and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven by unpatched, high-exposure Office deployments and phishing-delivered workbooks rather than by an observed campaign.
Opening an attacker-crafted Excel workbook in affected Microsoft 365 Apps for Enterprise, Office 365 for Mac, or Office LTSC for Mac builds can trigger a heap-based buffer overflow (CWE-122) that lets an unauthenticated remote attacker execute code in the context of the victim user, earning a CVSS 3.1 base score of 8.8 (High). Delivery is network-based and requires no credentials or special configuration, but the attacker must persuade the victim to open the malicious file (UI:R), so a successful email attachment or download plus user action is sufficient to reach the vulnerability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the mandatory user-interaction step means Protected View, Mark-of-the-Web blocking, and attachment filtering remain meaningful brakes despite the high base score.
Remote code execution in Microsoft Office Excel is possible when an unauthenticated attacker convinces a user to open a crafted spreadsheet in an unpatched build, with the underlying flaw being an integer underflow/wraparound in the document parser that corrupts memory. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server below their fixed builds; exploitation requires the user to open and enable content in the malicious document (CVSS UI:R) but needs no credentials or pre-existing privileges on the target (PR:N). No public exploit was identified at time of analysis, and Microsoft has released fixed builds, so this is a genuine patching priority even though the attack hinges on user interaction and is substantially blunted by Protected View and Mark-of-the-Web sandboxing.
Remote code execution in Microsoft Outlook allows unauthenticated attackers to execute arbitrary code by sending a crafted email that triggers a heap-based buffer overflow when the message is parsed. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. No public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 9.8) and requires no user interaction per the vendor vector, making it a serious risk for unpatched systems.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthenticated attacker to execute arbitrary code locally when a user opens a specially crafted workbook. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 before version 16.0.14334.20974, and Microsoft Office LTSC 2024 before version 16.0.17932.21056. Exploitation requires user interaction (UI:R) to open the malicious file; no public exploit identified at time of analysis, and the issue is considered a credible patch-priority item rather than an emergency. Code execution occurs in the context of the user opening the file, so a low-privilege user context limits downstream impact.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and Office for Mac. Exploitation requires user interaction (UI:R) and no public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code when a victim opens or previews a crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. No public exploit code has been identified at time of analysis, but the CVSS score of 8.8 and low attack complexity make this a credible, actionable priority; vendor patches are available. Code execution occurs in the context of the user who opens the file, and user interaction is required.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code in the context of the opening user when a crafted workbook is opened or previewed (user interaction required). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 for Windows and Mac, Office 365 for Mac, and Office Online Server. No public exploit has been identified at time of analysis, and Microsoft has released patches; risk is high but not a top-tier emergency given the reliance on social engineering.
Heap-based buffer overflow in Microsoft Word allows an unauthenticated attacker to execute arbitrary code in the context of the victim when the victim opens a crafted Word document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office LTSC/365 for Mac 2021/2024. Microsoft has released vendor patches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. User interaction (opening the document) is the primary limiting factor, and code execution is confined to the user's security context (S:U).
Opening a specially crafted document in an affected Microsoft Word build triggers a heap-based buffer overflow that lets an attacker execute code in the context of the user who opened the file. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, and Microsoft 365 Apps for Enterprise installations older than the current fixed release. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attack requires the victim to open the malicious file, but no attacker credentials or prior privileges are needed; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated remote attackers to execute arbitrary code when a user opens a crafted media file (UI:R). Affected and unpatched builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution in the optional Microsoft Windows Raw Image Extension codec (versions 2.1.0.0 up to but not including 2.4.36.0) allows an unauthenticated, remote attacker to run arbitrary code in the context of the victim user by supplying a malformed RAW image file. Exploitation requires user interaction (CVSS UI:R) - the victim must open, preview, or let Explorer generate a thumbnail for the crafted file, which can be delivered via email, web download, or a network share - and requires the optional codec to be installed, since it is not present on default Windows installations (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); vendor patch data indicates a fix is available. Overall this is a credible, patch-worthy priority but not a drop-everything emergency, given the dependency on the optional codec and on victim interaction with the malicious file.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged access on a target host trigger a heap-based buffer overflow and execute code at a higher integrity level, up to full system rights (CVSS 7.8, AV:L/PR:L/UI:N). Unpatched Windows 10 builds from 1607 through 22H2, Windows 11 builds from 23H2 through 26H2, and Windows Server 2012 through 2025 are affected below the fixed revisions tracked in EUVD-2026-100258. No public exploit code has been identified at time of analysis, but vendor-released patches are available, making this a genuine patching priority for any endpoint or server where an attacker could obtain a local foothold.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.
A heap-based buffer overflow in the Windows PCI Bus Driver lets an authenticated local attacker with only low privileges escalate to kernel-level code execution on affected Windows hosts, giving total loss of confidentiality, integrity, and availability (CVSS 8.8, scope-changed). Exploitation requires an existing low-privilege local session (AV:L/PR:L, UI:N) and the ability to invoke the driver with malformed input - there is no remote or network path, and CISA's SSVC assessment rates the issue as not automatable with exploitation: none. No public exploit code has been identified at time of analysis and there are no reports of active exploitation, but the driver is a default, always-present kernel component on every supported Windows client and server build, so the vulnerable surface is ubiquitous and the payload is high-impact once a foothold exists - making this a credible but non-urgent prioritization.
Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.
Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker who already holds low-privileged code execution on a VBS-enabled host to cross the enclave trust boundary and gain high-integrity code execution, carrying a CVSS 3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Patched builds are absent across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025, including Server Core installations. No public exploit code or confirmed active exploitation has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and automatable as no.
Heap-based buffer overflow in Windows Kernel allows a low-privileged local attacker to elevate privileges on affected Windows 10, Windows 11, and Windows Server installations. Exploitation requires the attacker to already run code as a low-privileged local user; there is no remote trigger and no user interaction is required. No public exploit code has been identified at time of analysis, and vendor patches are available.
Remote code execution in Windows BitLocker is possible through a heap-based buffer overflow (CWE-122) that carries a 9.8 CVSS rating with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning unauthenticated remote attackers need no user interaction to trigger memory corruption that can yield full compromise of confidentiality, integrity, and availability on affected unpatched builds. Affected platforms include Windows 11 versions 23H2 through 26H2 (and 26H1), Windows Server 2022, and Windows Server 2025 including Server Core installations running builds below the patched thresholds listed by EUVD. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', though it flags the issue as automatable with total technical impact; the practical constraint is reachability, since BitLocker is a full-disk-encryption component normally exercised locally or during pre-boot/recovery rather than exposed as a default network service.
Local privilege escalation in the Windows Kernel lets an authenticated low-privileged user on unpatched Windows 11 (24H2, 25H2, 26H2) or Windows Server 2025 builds trigger a heap-based buffer overflow and execute code with SYSTEM-level privileges. Exploitation requires the attacker to already hold local access (PR:L, AV:L) and is complicated by a race on kernel heap state (AC:H), so it is not reliably triggerable on demand. No public exploit has been identified at time of analysis, patched builds are not exploitable, and this rates as a genuine but moderate-priority privilege-escalation issue rather than an emergency.
Local privilege escalation in Windows Management Instrumentation (WMI) through a heap-based buffer overflow allows an authenticated local attacker to elevate privileges on affected Windows hosts. Exploitation requires the attacker to already have low-privileged code execution on the target-this is not remotely exploitable and needs no user interaction (AV:L/PR:L/UI:N). Microsoft has released patches; no public exploit identified at time of analysis (SSVC exploitation: none).
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
A heap-based buffer overflow in the optional Microsoft Windows Raw Image Extension allows remote code execution in the context of the invoking process when a user opens or previews a crafted RAW image file. Affected versions are 2.1.0.0 up to but not including 2.4.36.0; because exploitation requires user interaction (UI:R) with a malicious file and is not automatable, systems that do not have the extension installed are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Heap buffer overflow in FreeRDP before 3.32.0 can let a local attacker corrupt heap memory and potentially execute code when the victim loads a crafted persistent bitmap cache v2 file, because persistent_cache_read_entry_v2 miscalculates bitmap sizes via integer wraparound and then performs fixed 16 KiB reads against mismatched entry-size accounting. Exploitation requires the local attacker to place a malicious cache file in the client's load path and relies on low-level local privileges plus user interaction (PR:L/UI:P), so there is no remote unauthenticated path; no public exploit identified at time of analysis. No CISA KEV entry was provided, making this a moderate-priority local risk rather than a mass-exploitation threat.
Heap buffer overflow in FreeRDP before 3.32.0 allows a local attacker with low privileges to corrupt memory and potentially execute code by supplying a crafted v3 persistent bitmap cache file. The vulnerability is triggered when the FreeRDP client processes a malicious cache file with crafted width and height values, causing an integer overflow in size calculation and a subsequent heap overflow via fread. Exploitation requires the victim to load the poisoned cache during a session (passive user interaction); no public exploit code has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Outlook is possible through a heap-based buffer overflow that an unauthenticated, network-based attacker can trigger by convincing a victim to open or preview a crafted email message or Office document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365 for Mac, but a vendor patch is available. Exploitation carries a high attack complexity due to required heap grooming and memory-layout control, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word allows unauthenticated remote attackers to execute code on vulnerable systems when a user opens a crafted document, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The attack requires user interaction (opening a malicious file) and executes code in the context of the opening user without privilege escalation, resulting in a CVSS score of 8.8. No public exploit code or active exploitation has been identified, and a vendor patch is available; this is a high-priority vulnerability but not an emergency based on current signals.
Heap-based buffer overflow in Microsoft Word allows remote, unauthenticated attackers to execute arbitrary code when a user opens a maliciously crafted document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS editions, with a CVSS score of 8.8; no public exploit identified at time of analysis, and CISA KEV does not list active exploitation, though high impact and low attack complexity make this a genuine high-priority issue. The primary limiting factor is the required user interaction to open the weaponized file, and code runs with the victim's privileges rather than SYSTEM.
Heap-based buffer overflow in Microsoft Word (CWE-122) allows an unauthorized attacker to execute code in the context of the victim when a specially crafted Word document is opened, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw affects Word as shipped in Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and macOS. Exploitation is unauthenticated from the attacker's side but requires the victim to open an attacker-supplied file, so success depends on social engineering and on getting past Protected View or Mark-of-the-Web warnings for documents downloaded from the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); patch data indicates a vendor fix is available via the Microsoft Security Response Center advisory.
Heap-based buffer overflow in Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024) allows a remote, unauthenticated attacker to execute code in the context of the victim when a crafted document is opened, matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Exploitation is not interaction-free: the vector's UI:R component and the assessed conditions require file delivery plus a user open action, so Protected View and Mark-of-the-Web prompts materially limit real-world success. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available from Microsoft and this remains a genuine priority for patching.
Heap-based buffer overflow in Microsoft Word allows remote unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted document. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. No public exploit identified at time of analysis, but this is a genuine high-priority issue given the potential for code execution and widespread product deployment; exploitation requires user interaction (opening or previewing the malicious file).
Heap-based memory corruption in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 - lets a remote, unauthenticated attacker execute arbitrary code in the context of the victim, but only when that victim opens or previews a specially crafted Word document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms the trigger is entirely dependent on user interaction, so there is no zero-click or server-side path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available. That combination - high technical severity but a required user action and an available fix - makes this a high-priority vulnerability rather than an emergency.
A heap-based buffer overflow in Microsoft Word's document-parsing code lets an unauthenticated remote attacker execute arbitrary code when a victim opens a maliciously crafted Word file, affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. The attack is network-deliverable (typically a phishing attachment or downloaded document) but cannot trigger without user interaction, since the victim must open or preview the file; successful exploitation runs code in that user's security context rather than SYSTEM. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patching item - rated 8.8 with the vendor patch already available - rather than an emergency zero-day response.
Heap-based out-of-bounds reads and writes in bincookie prior to 0.1.9 occur when an application calls bincookie_init_file() on an attacker-supplied .binarycookies file, allowing the crafted input to drive byte-swap and iteration loops past a heap buffer sized only to the real file length. The vulnerable parser trusts file-controlled num_pages, page_sizes, and cookie_offsets as loop bounds, so malformed files can crash the host application or corrupt heap metadata in ways that could potentially lead to code execution. Exploitation requires local delivery of the crafted file and user interaction to make the target application parse it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8); no authentication to the parsing application is needed, and there is no public exploit identified at time of analysis. Version 0.1.9 fixes the issue by rejecting malformed files.
A heap-based buffer overflow in the api.cgi management handler of Wavlink WN530HG4B routers (firmware M30HG4B_V260724) allows unauthenticated remote attackers to corrupt heap memory by sending a crafted request to the api=info&client=app endpoint. The vulnerability is rated 9.3 under CVSS 4.0 (assessed 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting no authentication requirement, no user interaction, and full loss of confidentiality, integrity, and availability on the affected device. Publicly available exploit code exists, and while the issue is not confirmed as actively exploited (not in CISA KEV), the weaponizable nature of an unbounded parameter flowing into a shell-invoked handler makes patching exposed devices a priority; the vendor has released firmware 2026-09-24-841a51c6d5_tclinux.bin that resolves the flaw.
An authenticated local user on an HPE NonStop system can trigger a heap buffer overflow in the HPE NonStop Debug Utilities to corrupt a saved resume-execution address, potentially redirecting the flow of the debugged process. The flaw is rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) - the attacker needs an existing local foothold with only low privileges, but cannot reach the component remotely, no user interaction is required, and confidentiality is not impacted while integrity and availability are rated High. A vendor security bulletin is published, but no exact fixed version is given in the supplied data, and no public exploit code or CISA KEV entry has been identified at time of analysis; the practical risk is moderate and bounded by the requirement for local access and the platform-specific, diagnostic nature of the utility.
Heap-based buffer overflow in HPE NonStop Inspect Subsystem allows an authenticated local attacker with low privileges to corrupt a saved resume-execution address and potentially redirect control flow. The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects no confidentiality impact but high integrity and availability impact. No public exploit code or active exploitation is identified at time of analysis, and exploitation requires prior authenticated local access plus interaction with the Inspect debugging subsystem.
A heap buffer overflow in HPE NonStop OCAX lets an authenticated local actor corrupt the component's address space and potentially redirect execution flow, producing high integrity and availability impact with no confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Because the vector is AV:L with PR:L, exploitation requires pre-existing local access and at least low-privilege credentials on the NonStop system plus the ability to feed input to OCAX; it is not remotely reachable, so realistic exposure is limited to insiders or attackers who have already compromised a low-privilege account. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a medium-severity authenticated local issue rather than a top-tier emergency. HPE is the reporting vendor and the linked HPE Security Bulletin (hpesbns05148en_us) is the authoritative source for fixed versions.
Heap buffer overflow in HPE NonStop NDSREST (CVSS 7.1) can corrupt a resume-execution address and potentially redirect execution flow, producing high integrity and availability impact without confidentiality impact. Exploitation requires authenticated low-privilege local access (AV:L, PR:L), no user interaction, and low attack complexity; if NDSREST is network-exposed in a given deployment, effective reachability may be broader than the local vector suggests. No public exploit identified at time of analysis, and CISA KEV does not confirm active exploitation.
Heap out-of-bounds write in the FreeBSD RACK TCP stack (CVE-2026-101307) lets a remote, unauthenticated attacker who completes a TCP handshake and sends a sufficient number of ACKs cause a 16-bit PCM sample-array growth counter to wrap to zero, producing a near-zero-length kernel heap allocation that is then overwritten with roughly 512 KB of existing sample data. The result is a kernel panic - availability impact only, with no confidentiality or integrity loss - and only FreeBSD 15.1-RELEASE before p5 hosts that have explicitly enabled the non-default RACK stack are exposed; stock FreeBSD hosts using the default stack are unaffected. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none', and EPSS is 0.17% (6th percentile), so the practical near-term risk is moderate and conditional on RACK being enabled.
Local attackers with low-privilege access can exploit a heap-based buffer overflow in HPE NonStop TNS/X Native Inspect to corrupt memory and potentially redirect execution flow, leading to code execution or denial of service. The vulnerability requires local, authenticated access (CVSS vector: AV:L/PR:L) and the ability to invoke the Native Inspect debugger utility. No public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause a denial of service via a crafted TCP frame. Exploitation requires the optional SDX/SRC service-deployment feature to be configured and the attacker to hold a man-in-the-middle position on that path (or control/spoof the SDX/SRC server), conditions that significantly limit real-world exposure; no public exploit has been identified at time of analysis. Juniper has issued patches in advisory JSA112187, and the vendor's CVSS 4.0 score of 9.3 is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1).
Heap-based buffer overflow in the secure-dot1xd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service by sending a crafted EAPOL frame to an 802.1X-authenticated interface. Exploitation requires the targeted interface to be configured for 802.1X port-based authentication and Layer 2 adjacency, and no public exploit has been identified at time of analysis. With a CVSS 4.0 score of 8.7, this is a high-priority flaw for affected deployments using 802.1X.
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default map directive with regex matching is configured so that the root directive or access log format references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under specific conditions. The flaw is remotely reachable without authentication (CVSS PR:N) but has high attack complexity (AC:H) because exploitation depends on conditions beyond the attacker's control and on a non-default configuration; the realistic outcome on systems with ASLR enabled is worker-process restart/DoS, while code execution is limited to systems with ASLR disabled or bypassed. F5 rates this CVSS 4.0 9.2 (Critical), and no public exploit identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through crafted HTTP requests, but only when a non-default configuration uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log format directive. Successful exploitation causes a heap buffer overflow in the NGINX worker process, leading to a restart (denial of service) and potentially allowing code execution on systems with ASLR disabled or bypassable. No public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Google Chrome's Animation component allows a remote attacker to execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page in any build prior to 155.0.8059.79. The bug carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication or special configuration is required, but exploitation depends on the user rendering attacker-controlled content, and because the scope is unchanged the resulting code execution is confined to the sandboxed renderer process rather than the host OS. No public exploit code and no confirmed active exploitation have been identified at time of analysis - CISA's SSVC evaluation rates Exploitation as 'none' - so this is a patch-promptly item rather than an emergency, with Google rating the issue High severity.
A heap-based buffer overflow in PDFium, the PDF rendering engine embedded in Google Chrome, allows a remote attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to open a crafted HTML page. All desktop Chrome builds prior to 155.0.8059.79 (stable and extended-stable channels) are affected, and exploitation requires user interaction (UI:R), which limits mass or automated abuse. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none; however, CISA assigns a total technical impact once the bug is triggered, and Google rates the Chromium security severity as High. The primary constraint on real-world impact is that code execution is confined to the renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape vulnerability.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.
Heap-based buffer overflow in Microsoft SQL Server lets an authenticated attacker who holds any valid, low-privileged database login - and can reach the instance's listening port over the network - execute code in the context of the SQL Server service process, with high confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no user interaction). The vendor has released patched builds for SQL Server 2017, 2019, 2022 and 2025, and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible priority rather than an emergency. Because exploitation needs only ordinary credentials rather than sysadmin rights, the practical exposure is concentrated on instances reachable from untrusted networks and on estates where database logins are shared or weakly managed.
Local privilege elevation in Microsoft SQL Server 2019, 2022, and 2025 stems from a heap-based buffer overflow that a low-privileged authenticated user with local access can trigger to gain elevated rights on the database host. Exploitation is not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:N) demands an existing authorized database session plus successful heap manipulation, and no public exploit has been identified at time of analysis, with no CISA KEV listing. Vendor patches are available, so this is a moderate-priority hardening item rather than a drop-everything emergency.
Privilege elevation on Microsoft SQL Server 2019, 2022, and 2025 instances can be achieved by an authenticated, low-privileged user who already has local access to the host or instance and can drive crafted input into a vulnerable heap-allocation code path. Successful exploitation corrupts heap memory and, because the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0), yields high confidentiality, integrity, and availability impact within the database engine's security context; the High attack complexity reflects the non-deterministic heap-grooming required for reliable code execution, and no end-user interaction is needed. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available per the Microsoft advisory, and unaffected instances are those already running the corrected cumulative-update or GDR builds.
Heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds a valid low-privilege database login execute arbitrary code on the database engine over the network, with impact crossing a security scope boundary (CVSS 8.5; AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected builds span SQL Server 2017, 2019, 2022, and 2025 across both the GDR (security-only) and cumulative-update branches, so most unpatched enterprise estates that still run older builds are in scope. Exploitation is not trivial - the high attack complexity implies reliable heap layout/grooming or a timing-sensitive corruption window must be achieved - and there is no public exploit identified at time of analysis, but a vendor patch is available and the flaw should be prioritized on internet-exposed or broadly accessible database listeners.
Privilege elevation in Microsoft SQL Server (2017, 2019, 2022 and 2025 builds below their patched levels) allows an authenticated, low-privileged database principal to trigger a heap-based buffer overflow in the database engine over a network connection and gain higher privileges, with impact crossing a security boundary (CVSS 8.5, S:C). Exploitation is not anonymous: the attacker must already hold a valid SQL Server login (PR:L) and satisfy a hard-to-control heap-state or race condition (AC:H), so the flaw is not automatable or scalable (SSVC Automatable: no, Exploitation: none), and no public exploit code has been identified at time of analysis. Microsoft has published fixed builds via its update guide, so this is a legitimate but not top-tier emergency priority - patch promptly, with urgency driven by the total technical impact and the broad installed base.
Authenticated code execution in Microsoft SQL Server 2017 through 2025 arises from a heap-based buffer overflow (CWE-122) that allows a low-privileged database login to execute code on the database server over the network. Exploitation is not available to unauthenticated attackers: valid credentials for a SQL Server login are mandatory (CVSS PR:L) and the high attack complexity (AC:H) reflects the heap-layout grooming normally required for a reliable overflow, so the practical bar is considerably higher than the 8.5 base score alone suggests. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds across every affected servicing branch.
Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).
Heap-based buffer overflow in Microsoft Office Visio allows unauthenticated remote attackers to execute arbitrary code in the context of the user who opens a specially crafted Visio document, with the only barrier being user interaction (UI:R) - the victim must be socially engineered into opening the file. Affected builds are Microsoft 365 Apps for Enterprise (16.0.1, patched via the current channel at https://aka.ms/OfficeSecurityReleases), Office LTSC 2021 below 16.0.14334.20974, and Office LTSC 2024 below 16.0.17932.21056. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the 8.8 CVSS score, network attack vector, and complete confidentiality/integrity/availability impact make prompt patching a high priority for any environment where Visio is installed.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
An authenticated, low-privileged local attacker can trigger a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) to corrupt kernel memory and elevate to SYSTEM on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 hosts. Exploitation is local-only and high-complexity (CVSS 7.0, AC:H), requiring precise kernel heap grooming or a race window, so this is a moderate-priority privilege-escalation issue rather than a remote or wormable emergency. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds that remove the vulnerable condition.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Local privilege escalation in the Windows 11 26H1 kernel allows a low-privileged local user to corrupt heap memory and escalate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so an attacker who already holds a foothold as any user or service account can reliably and non-interactively raise their privileges to the highest level on the host. Exploitation is post-compromise, not a remote entry point; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Microsoft has shipped a vendor patch addressing it.
Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.
Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.
Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.
Heap-based buffer overflow in Microsoft Excel enables remote code execution when a user opens or previews a specially crafted spreadsheet, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Any affected build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft Office 365 for Mac, or Office Online Server - that processes the malicious file is at risk; no authentication or non-default configuration is required, but the attacker must convince the victim to open the document. No public exploit identified at time of analysis, and the flaw is not confirmed as actively exploited, though the high confidentiality, integrity, and availability impact makes it a priority patch for Office endpoints.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute code by convincing a user to open a specially crafted Excel file. Exploitation requires user interaction and can be blocked by Protected View, but the high impact (CVSS 8.8) makes patching a high priority even though no public exploit has been identified at the time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code in the context of a victim user by convincing them to open a crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), confirming no attacker credentials are needed but requiring user interaction (opening the file, typically via phishing or a malicious download); the code executes with the victim's privileges, so a low-privileged account limits the immediate impact. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 and LTSC for Mac, Office 365 for Mac, and Office Online Server below patched versions like 16.0.14334.20974, 16.0.17932.21056, and 16.0.10417.20228, and no public exploit or KEV listing is confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code in the context of the user who opens a maliciously crafted workbook, with the file delivered over the network (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office Online Server, and Office LTSC for Mac; no public exploit identified at time of analysis, and vendor patches remove the condition.
Remote code execution in Microsoft Excel is possible when a user opens a specially crafted workbook, driven by a heap-based buffer overflow. Affected versions include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Office Online Server before 16.0.10417.20228, Microsoft 365 Apps for Enterprise, and the listed macOS Office builds; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit was identified at time of analysis and no CISA KEV entry is provided, but the mandatory user interaction makes social engineering the practical attack path, and vendor patches are available.
Heap-based buffer overflow in Microsoft Excel (CWE-122) lets an unauthenticated attacker execute arbitrary code in the context of the victim's user account when that user opens a specially crafted spreadsheet; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) reflects full confidentiality, integrity and availability impact but is gated by mandatory user interaction. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows and Mac, Office 365 for Mac, and Office Online Server, so both endpoint document handling and server-side file rendering are in scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but with a vendor patch already published it is a high-priority patching candidate for environments that routinely open externally sourced Office files rather than a drop-everything emergency.
Heap-based buffer overflow in Microsoft Excel enables remote attackers to execute code on a victim's machine with the privileges of the affected Office process by convincing a user to open or preview a specially crafted workbook (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Because the vector shows PR:N, no credentials or elevated privileges are needed, but the UI:R requirement means the bug cannot self-propagate and depends on social engineering to deliver and open the malicious file across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, Office LTSC for Mac 2021/2024, Office 365 for Mac, and Office Online Server, all of which have vendor-supplied fixes. Microsoft has published a security update (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97748), and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven by unpatched, high-exposure Office deployments and phishing-delivered workbooks rather than by an observed campaign.
Opening an attacker-crafted Excel workbook in affected Microsoft 365 Apps for Enterprise, Office 365 for Mac, or Office LTSC for Mac builds can trigger a heap-based buffer overflow (CWE-122) that lets an unauthenticated remote attacker execute code in the context of the victim user, earning a CVSS 3.1 base score of 8.8 (High). Delivery is network-based and requires no credentials or special configuration, but the attacker must persuade the victim to open the malicious file (UI:R), so a successful email attachment or download plus user action is sufficient to reach the vulnerability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the mandatory user-interaction step means Protected View, Mark-of-the-Web blocking, and attachment filtering remain meaningful brakes despite the high base score.
Remote code execution in Microsoft Office Excel is possible when an unauthenticated attacker convinces a user to open a crafted spreadsheet in an unpatched build, with the underlying flaw being an integer underflow/wraparound in the document parser that corrupts memory. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, Office 365 for Mac, and Office Online Server below their fixed builds; exploitation requires the user to open and enable content in the malicious document (CVSS UI:R) but needs no credentials or pre-existing privileges on the target (PR:N). No public exploit was identified at time of analysis, and Microsoft has released fixed builds, so this is a genuine patching priority even though the attack hinges on user interaction and is substantially blunted by Protected View and Mark-of-the-Web sandboxing.
Remote code execution in Microsoft Outlook allows unauthenticated attackers to execute arbitrary code by sending a crafted email that triggers a heap-based buffer overflow when the message is parsed. Affected versions include Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. No public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 9.8) and requires no user interaction per the vendor vector, making it a serious risk for unpatched systems.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthenticated attacker to execute arbitrary code locally when a user opens a specially crafted workbook. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 before version 16.0.14334.20974, and Microsoft Office LTSC 2024 before version 16.0.17932.21056. Exploitation requires user interaction (UI:R) to open the malicious file; no public exploit identified at time of analysis, and the issue is considered a credible patch-priority item rather than an emergency. Code execution occurs in the context of the user opening the file, so a low-privilege user context limits downstream impact.
Heap-based buffer overflow in Microsoft Excel allows unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and Office for Mac. Exploitation requires user interaction (UI:R) and no public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code when a victim opens or previews a crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. No public exploit code has been identified at time of analysis, but the CVSS score of 8.8 and low attack complexity make this a credible, actionable priority; vendor patches are available. Code execution occurs in the context of the user who opens the file, and user interaction is required.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to execute arbitrary code in the context of the opening user when a crafted workbook is opened or previewed (user interaction required). Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 for Windows and Mac, Office 365 for Mac, and Office Online Server. No public exploit has been identified at time of analysis, and Microsoft has released patches; risk is high but not a top-tier emergency given the reliance on social engineering.
Heap-based buffer overflow in Microsoft Word allows an unauthenticated attacker to execute arbitrary code in the context of the victim when the victim opens a crafted Word document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office LTSC/365 for Mac 2021/2024. Microsoft has released vendor patches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. User interaction (opening the document) is the primary limiting factor, and code execution is confined to the user's security context (S:U).
Opening a specially crafted document in an affected Microsoft Word build triggers a heap-based buffer overflow that lets an attacker execute code in the context of the user who opened the file. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, and Microsoft 365 Apps for Enterprise installations older than the current fixed release. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attack requires the victim to open the malicious file, but no attacker credentials or prior privileges are needed; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated remote attackers to execute arbitrary code when a user opens a crafted media file (UI:R). Affected and unpatched builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution in the optional Microsoft Windows Raw Image Extension codec (versions 2.1.0.0 up to but not including 2.4.36.0) allows an unauthenticated, remote attacker to run arbitrary code in the context of the victim user by supplying a malformed RAW image file. Exploitation requires user interaction (CVSS UI:R) - the victim must open, preview, or let Explorer generate a thumbnail for the crafted file, which can be delivered via email, web download, or a network share - and requires the optional codec to be installed, since it is not present on default Windows installations (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); vendor patch data indicates a fix is available. Overall this is a credible, patch-worthy priority but not a drop-everything emergency, given the dependency on the optional codec and on victim interaction with the malicious file.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged access on a target host trigger a heap-based buffer overflow and execute code at a higher integrity level, up to full system rights (CVSS 7.8, AV:L/PR:L/UI:N). Unpatched Windows 10 builds from 1607 through 22H2, Windows 11 builds from 23H2 through 26H2, and Windows Server 2012 through 2025 are affected below the fixed revisions tracked in EUVD-2026-100258. No public exploit code has been identified at time of analysis, but vendor-released patches are available, making this a genuine patching priority for any endpoint or server where an attacker could obtain a local foothold.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.
A heap-based buffer overflow in the Windows PCI Bus Driver lets an authenticated local attacker with only low privileges escalate to kernel-level code execution on affected Windows hosts, giving total loss of confidentiality, integrity, and availability (CVSS 8.8, scope-changed). Exploitation requires an existing low-privilege local session (AV:L/PR:L, UI:N) and the ability to invoke the driver with malformed input - there is no remote or network path, and CISA's SSVC assessment rates the issue as not automatable with exploitation: none. No public exploit code has been identified at time of analysis and there are no reports of active exploitation, but the driver is a default, always-present kernel component on every supported Windows client and server build, so the vulnerable surface is ubiquitous and the payload is high-impact once a foothold exists - making this a credible but non-urgent prioritization.
Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.
Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker who already holds low-privileged code execution on a VBS-enabled host to cross the enclave trust boundary and gain high-integrity code execution, carrying a CVSS 3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Patched builds are absent across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025, including Server Core installations. No public exploit code or confirmed active exploitation has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and automatable as no.
Heap-based buffer overflow in Windows Kernel allows a low-privileged local attacker to elevate privileges on affected Windows 10, Windows 11, and Windows Server installations. Exploitation requires the attacker to already run code as a low-privileged local user; there is no remote trigger and no user interaction is required. No public exploit code has been identified at time of analysis, and vendor patches are available.
Remote code execution in Windows BitLocker is possible through a heap-based buffer overflow (CWE-122) that carries a 9.8 CVSS rating with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning unauthenticated remote attackers need no user interaction to trigger memory corruption that can yield full compromise of confidentiality, integrity, and availability on affected unpatched builds. Affected platforms include Windows 11 versions 23H2 through 26H2 (and 26H1), Windows Server 2022, and Windows Server 2025 including Server Core installations running builds below the patched thresholds listed by EUVD. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', though it flags the issue as automatable with total technical impact; the practical constraint is reachability, since BitLocker is a full-disk-encryption component normally exercised locally or during pre-boot/recovery rather than exposed as a default network service.
Local privilege escalation in the Windows Kernel lets an authenticated low-privileged user on unpatched Windows 11 (24H2, 25H2, 26H2) or Windows Server 2025 builds trigger a heap-based buffer overflow and execute code with SYSTEM-level privileges. Exploitation requires the attacker to already hold local access (PR:L, AV:L) and is complicated by a race on kernel heap state (AC:H), so it is not reliably triggerable on demand. No public exploit has been identified at time of analysis, patched builds are not exploitable, and this rates as a genuine but moderate-priority privilege-escalation issue rather than an emergency.
Local privilege escalation in Windows Management Instrumentation (WMI) through a heap-based buffer overflow allows an authenticated local attacker to elevate privileges on affected Windows hosts. Exploitation requires the attacker to already have low-privileged code execution on the target-this is not remotely exploitable and needs no user interaction (AV:L/PR:L/UI:N). Microsoft has released patches; no public exploit identified at time of analysis (SSVC exploitation: none).
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
A heap-based buffer overflow in the optional Microsoft Windows Raw Image Extension allows remote code execution in the context of the invoking process when a user opens or previews a crafted RAW image file. Affected versions are 2.1.0.0 up to but not including 2.4.36.0; because exploitation requires user interaction (UI:R) with a malicious file and is not automatable, systems that do not have the extension installed are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.