Heap Overflow
Monthly
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enables network-adjacent attackers to execute arbitrary code on the device. The flaw in `l2_reassemble_sdu` stems from missing length validation before copying attacker-controlled data to a heap buffer, granting full code execution in the device context once a malicious Bluetooth device has been paired by the victim. No public exploit or CISA KEV listing has been identified at time of analysis, but the ZDI advisory (ZDI-26-474) and a Sony firmware update advisory are both publicly available.
Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Heap buffer overflow in FreeRDP's Opus audio codec path allows a malicious RDP server to corrupt client heap memory and potentially execute arbitrary code on any connecting client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled. The flaw in freerdp_dsp_decode_opus (versions prior to 3.28.0) stems from a capacity check applied to the wrong buffer, leaving the actual PCM output buffer unguarded against oversized libopus decoded frames that can overrun the fixed 4096-byte StreamPool_Take destination in the rdpsnd channel. No public exploit has been identified at time of analysis, but the confirmed heap write primitive and RCE classification make this a credible code execution risk for susceptible client builds connecting to untrusted servers.
Heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) enables memory corruption via crafted Dirac data units across all versions prior to fix commit 1cdeb3c. The packetizer accepts an attacker-controlled data unit or fragment size and copies it into a fixed-size heap buffer without an upper-bound check, a classic CWE-122 condition with High confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; an upstream fix commit is available from the FFmpeg repository.
Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Heap buffer overflow in FFmpeg's hvcC box writer exposes any version prior to commit acf5d7c to memory corruption during HEVC muxing. When a crafted HEVC file presents more NAL units of a single type than the count field can encode, integer overflow corrupts heap memory, potentially enabling arbitrary code execution in the FFmpeg process context. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but server-side transcoding pipelines ingesting untrusted HEVC content effectively elevate the local-vector risk to a network-reachable attack surface.
Heap buffer overflows in FreeBSD's iconv(3) character-conversion library allow attackers who control input processed through the HZ, UTF-7, VIQR, or ZW encoding modules to corrupt heap memory, potentially leading to remote code execution. Applications on FreeBSD 14.3/14.4/15.0/15.1 that pass untrusted data through iconv using any of these encodings are exposed. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.21%, 12th percentile) despite the 9.8 CVSS.
Kernel memory corruption in FreeBSD's ZFS subsystem allows a local user with the delegated 'receive' ZFS permission to trigger a heap-based buffer overflow via the ZFS_IOC_RECV_NEW ioctl. The flaw stems from an integer truncation: a 64-bit payload size is silently narrowed to 32 bits for heap allocation, but the original 64-bit value is then used as the length for a subsequent byteswap operation - writing beyond the allocated buffer into kernel memory. Exploitation is limited to the heal receive path and requires the ZFS 'receive' delegation, but no patch has been publicly released yet for all affected branches. No public exploit code or CISA KEV listing has been identified at time of analysis.
Kernel heap overflow in FreeBSD's ZFS subsystem via the ZFS_IOC_USERSPACE_MANY ioctl enables local privilege escalation across multiple supported FreeBSD release branches. The flaw stems from an integer width mismatch: the kernel allocates a heap buffer sized by a 32-bit truncation of the caller-supplied 64-bit length, then copies records up to the original 64-bit limit - writing past the end of the allocation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and high impact across confidentiality, integrity, and availability make patching a priority for any FreeBSD deployment that uses ZFS delegated permissions.
Sandbox escape via heap-based buffer overflow in ANGLE's graphics engine on Chrome for Android allows a threat actor who has already achieved renderer process compromise to execute arbitrary code entirely outside the Chrome sandbox. All Chrome for Android versions prior to 151.0.7922.169 are affected; the vulnerability requires a two-stage exploit chain combining a separate renderer compromise with this ANGLE flaw. Google has released a patched build (151.0.7922.169); no public exploit code or CISA KEV listing has been identified at time of analysis, though the two-stage nature indicates likely use in sophisticated targeted attack chains.
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Google Chrome's WebGL implementation (all versions prior to 151.0.7922.169) enables a remote attacker to execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The sandbox escape elevates the impact from renderer-level code execution to potential full OS-level compromise. No public exploit code or active exploitation has been identified at the time of analysis, but the SSVC technical impact rating is 'total,' reflecting the severity of successful exploitation.
Heap-based buffer overflow in Open5GS v.2.7.0 allows remote unauthenticated attackers to crash the NAS 5GS decoder chain by sending a NAS PDU with a mutated message type byte, resulting in denial of service to the AMF component and all connected UEs. The vulnerability is network-accessible with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making it trivially reachable from any host with access to the AMF N1 interface. A public proof-of-concept exploit exists, no public exploit identified as confirmed active exploitation (no CISA KEV listing), and no vendor patch has been confirmed at time of analysis.
Remote code execution in Systerel S2OPC 1.7.3 arises from a heap out-of-bounds write in the server-side EventFilter handling path exercised during CreateMonitoredItems processing. A remote attacker who can reach the OPC UA server endpoint and open a session on an events-enabled server can corrupt heap memory to achieve arbitrary code execution with the privileges of the server process. No public exploit identified at time of analysis, and EPSS is low (0.27%, 20th percentile), indicating the CVSS 9.8 rating reflects potential impact rather than observed mass exploitation.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a heap-based buffer overflow (CWE-122) that network-accessible, unauthenticated attackers can trigger when a victim interacts with attacker-controlled content. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) reflects high confidentiality and integrity impact with low attack complexity, requiring only that the user visit or open a crafted resource. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.
Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows any authenticated database user to execute arbitrary code as the operating system account running the database process by supplying an excessively long POSIX timezone abbreviation. Affected versions span the actively maintained major release lines: PostgreSQL 14 through 18, with fixes available in 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit code has been identified at time of analysis, but the low attack complexity and broad deployment surface of PostgreSQL make this a high-priority patching target for any environment where untrusted or semi-trusted database users exist.
Heap buffer overflow in PostgreSQL's regexp engine allows any authenticated database user to execute arbitrary code as the operating system user running the database process. The flaw is triggered by specially crafted text that survives input validation but undergoes unanticipated data growth during internal round-trip conversion through the pg_wchar encoding layer, overflowing a heap-allocated buffer during regular expression evaluation. All active PostgreSQL branches are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - with no public exploit or CISA KEV listing confirmed at time of analysis.
Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. MongoDB has released a patched version (v1.4.9) that adds buffer-clamping logic to prevent the overflow; no public exploit has been identified at time of analysis.
Heap out-of-bounds read and write in FreeRDP's Kerberos SSPI layer (all versions prior to 3.30.0) allows a malicious RDP peer to corrupt memory during CredSSP/NLA Kerberos decryption by supplying a crafted GSS Wrap-token with an unbounded EC or EC+RRC field value. The flaw sits in the pre-session authentication path, meaning exploitation does not require an established authenticated session from the attacker's side. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the network-reachable attack surface during a common enterprise authentication flow warrants prompt patching.
Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office (365 Apps for Enterprise, Office 2019, Office 2021 LTSC, and Office 2024 LTSC) enables a local attacker with low-privilege credentials to execute arbitrary code with the full confidentiality, integrity, and availability impact of the Office process. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 and requires only local access and a standard user account - no user interaction is needed once the attacker can trigger the vulnerable allocation path. No public exploit code has been identified at time of analysis, and SSVC assessment confirms current exploitation status as none.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system-level impact when a victim opens a specially crafted Excel file. The flaw (CWE-122) resides in Excel's file parsing logic, where malformed input causes a heap memory region to be overwritten, redirecting execution flow. No public exploit has been identified at time of analysis, and the vulnerability has not appeared in CISA's Known Exploited Vulnerabilities catalog, though the Microsoft Security Response Center has issued an advisory.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The vulnerability triggers during file parsing, allowing an attacker who can deliver a malicious document to execute arbitrary code with the privileges of the logged-in user. No KEV listing or public exploit code has been identified at time of analysis, but the local-execution-via-document vector makes this a meaningful phishing and spear-phishing enabler.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted file, granting full confidentiality, integrity, and availability compromise of the affected system. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a document-triggered exploit requiring no attacker privileges but demanding victim interaction - a profile consistent with malicious email attachment or drive-by download campaigns. No public exploit code or CISA KEV listing has been identified at time of analysis, though Excel's ubiquity makes this a high-value target class.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The CVSS vector (AV:L/PR:N/UI:R) confirms the attack requires no system privileges but does require user interaction - the classic malicious-document delivery pattern. Full confidentiality, integrity, and availability compromise results, making this a high-severity threat against any organization reliant on Excel for document workflows. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system impact when a victim opens a maliciously crafted workbook. The root cause is a numeric truncation error (CWE-122) in Excel's file parsing logic, where an integer value is truncated before being used to size a heap allocation, resulting in an undersized buffer that can be overflowed. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, but the high CVSS score of 7.8 and full confidentiality, integrity, and availability impact make this a meaningful risk for organizations relying on Excel file workflows.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted workbook, resulting in full compromise of confidentiality, integrity, and availability on the local system. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no attacker privileges are required, though user interaction - opening the malicious file - is a hard prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue is confirmed by Microsoft's Security Response Center via secure@microsoft.com.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. The attack requires no privileges from the attacker but does require user interaction - consistent with a malicious document delivery vector - and carries high impact across confidentiality, integrity, and availability. No active exploitation (KEV) or public exploit code has been identified in the provided intelligence at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/PR:N/UI:R) confirms exploitation requires no prior privileges but depends on user interaction - consistent with a malicious document delivery scenario. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a high-severity concern for any environment running unpatched Excel installations.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. An unauthenticated attacker (per CVSS PR:N) delivers a malicious document that triggers the overflow upon interaction (UI:R), achieving full confidentiality, integrity, and availability compromise on the victim system. No public exploit or KEV listing has been identified at time of analysis, though the attack pattern is well-understood and document-based Excel exploits have a long operational history.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a maliciously crafted file. The vulnerability (CWE-122) corrupts heap memory in Excel's parsing logic, allowing an attacker to achieve full control over confidentiality, integrity, and availability of the affected system. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 7.8 with high impact across all three CIA triad pillars makes this a meaningful priority for organizations running affected Excel versions.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Heap-based buffer overflow in the Windows iSCSI Target Service enables an unauthenticated remote attacker to trigger denial of service across a wide range of Windows Server versions from 2012 through 2025. The vendor-assigned CVSS vector of C:H/I:H/A:H suggests potential impact beyond the description's stated denial-of-service scope, warranting attention to whether memory corruption could extend to confidentiality or integrity compromise. No public exploit or active exploitation has been identified at time of analysis; however, SSVC designates the attack as automatable, elevating the urgency for organizations running exposed iSCSI targets to apply available patches.
Remote code execution in the Windows iSCSI Target Service allows an unauthenticated network attacker to run arbitrary code by exploiting a heap-based buffer overflow (CWE-122) in the service's network-facing request handling. The flaw carries a critical 9.8 CVSS rating and is remotely reachable with no privileges or user interaction, meaning any exposed iSCSI Target endpoint can be compromised end-to-end. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Local privilege escalation in Windows Installer (msiexec) enables an authenticated low-privileged user to trigger a heap-based buffer overflow, potentially achieving SYSTEM-level code execution across a broad range of Windows client and server platforms spanning over a decade of releases. Affected systems include Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the exposure surface extensive across enterprise and consumer deployments. No public exploit identified at time of analysis and no active exploitation confirmed via CISA KEV; vendor-released patches are available through the Microsoft Security Response Center.
Remote code execution via heap-based buffer overflow in the Windows iSCSI Target Service affects a broad range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). An unauthenticated network attacker can send a malformed iSCSI protocol request to trigger CWE-122 heap corruption and achieve arbitrary code execution on the target host. No public exploit identified at time of analysis and no CISA KEV listing, though the CVSS score of 8.1 (AC:H) reflects real exploitation complexity; the full C:H/I:H/A:H impact triad makes this a credible priority for environments running the iSCSI Target role.
Privilege escalation in the Windows Remote Access API via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker with low privileges to gain full SYSTEM-level control over affected Windows 11 and Windows Server 2022/2025 hosts. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a valid local account and no user interaction, making it a reliable post-compromise escalation path. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all enumerated affected versions.
Privilege escalation via heap buffer overflow in the Windows Remote Access (RAS) API affects every major in-support Windows desktop and server release, from Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low-privileged access can trigger a CWE-122 heap overflow to achieve full SYSTEM-level compromise with High confidentiality, integrity, and availability impact and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a patch across all affected build lines.
Heap-based buffer overflow in Microsoft Office enables arbitrary local code execution when a user opens a specially crafted document. Affected products span seven product lines across Windows and macOS, including Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and their Mac counterparts, all prior to the vendor-released patch. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of the affected install base and the low-complexity exploitation path make this a high-priority patching item.
Heap-based buffer overflow in Microsoft Office enables local code execution when a user opens a specially crafted document, affecting multiple product lines including Office 2016 through Microsoft 365 Apps for Enterprise. The vulnerability carries a CVSS 7.8 (High) score and achieves full confidentiality, integrity, and availability compromise on the victim system. No public exploit code has been identified at time of analysis, and Microsoft has released patches via the standard Office Security Releases channel.
Heap-based buffer overflow in Microsoft Office Access enables local code execution across Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise when a victim opens a specially crafted database file. The flaw, rooted in CWE-122, yields full High/High/High impact on confidentiality, integrity, and availability (CVSS 7.8), making successful exploitation equivalent to arbitrary code execution in the user's security context. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches via the Office Security Releases channel.
Heap-based buffer overflow in Microsoft Office Word enables local code execution with High confidentiality, integrity, and availability impact when a user opens a specially crafted document. Affects Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Word 2016, and corresponding Mac editions. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad product footprint and low attack complexity make patch application a near-term priority for enterprise defenders.
Heap-based buffer overflow (CWE-122) in Microsoft Office Access enables local code execution when a user opens a specially crafted database file, with full high-impact compromise of confidentiality, integrity, and availability (CVSS 7.8). Affected products span Microsoft Access 2016 through Microsoft 365 Apps for Enterprise and Office LTSC 2024. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Local code execution via heap-based buffer overflow in Microsoft Office affects multiple product lines including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. An integer overflow or wraparound during document parsing leads to an undersized heap allocation (CWE-122), enabling arbitrary code execution at the privilege level of the opening user when a victim opens a maliciously crafted Office file. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, though the full-triad high-impact CVSS score of 7.8 reflects the severity of successful exploitation.
Heap-based buffer overflow in Microsoft Office, rooted in an integer underflow during document parsing, enables local code execution with high confidentiality, integrity, and availability impact when a user opens a specially crafted file. All major Office release channels on both Windows and Mac are affected, including Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021/2019/2016, and their Mac equivalents. No public exploit has been identified at time of analysis, but a vendor-released patch is available via the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office Access enables local arbitrary code execution with full confidentiality, integrity, and availability impact across several Office product families. The vulnerability, rooted in CWE-122, affects Microsoft Access 2016 (both 32- and 64-bit editions), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Exploitation requires local access and user interaction - consistent with a malicious database file delivery scenario - and a vendor patch is available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution when a user opens a specially crafted Access database file. Affected products span Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad corporate user base. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Local code execution in Microsoft Office stems from an integer overflow that cascades into a heap-based buffer overflow (CWE-122), affecting Office 2016 through LTSC 2024 on both Windows and macOS. An unauthenticated attacker who can convince a target user to open a crafted Office document gains full code execution with the victim's privilege level - achieving high confidentiality, integrity, and availability impact per the CVSS:3.1 AV:L/C:H/I:H/A:H rating. No public exploit code or CISA KEV listing was identified at time of analysis, but the patch is vendor-confirmed and available via Microsoft's Security Update Guide.
Local code execution in Microsoft Office affects all major editions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and their Mac counterparts. The vulnerability is a heap-based buffer overflow (CWE-122) triggered when a user opens a specially crafted document, granting the attacker arbitrary code execution at the victim's privilege level. No public exploit has been identified at time of analysis, and a vendor-released patch is available, making this a high-priority patching target across enterprise Office deployments.
Heap-based buffer overflow in Microsoft Office allows local code execution across a wide range of Office versions on both Windows and macOS when a victim opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms that no privileges are required - only that a user interacts with malicious content - making this practically reachable via phishing or drive-by document delivery despite the local attack vector. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; a vendor-released patch is available.
Local code execution in Microsoft Office results from an integer overflow that leads to a heap-based buffer overflow (CWE-122), enabling an attacker to run arbitrary code at the privilege level of the logged-in user. Affected products span multiple Windows and Mac release tracks including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is present in the available data; however, the complete high CIA triad and wide deployment footprint make this a priority patching target.
Local code execution in Microsoft Office is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122), granting the attacker full control over the victim's user session. The vulnerability spans the entire modern Office portfolio - Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, LTSC 2024, and macOS equivalents - making the attack surface exceptionally broad. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches for all affected product lines.
Heap-based buffer overflow in Microsoft Office Word enables arbitrary local code execution when a user opens a specially crafted document. The vulnerability spans a broad set of affected products across both Windows and macOS platforms, including Office LTSC 2021/2024, Office 2019, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Outlook 2016. No public exploit code has been identified at time of analysis, though Microsoft has released a patch and the document-based delivery model is a proven and widely abused attack vector in enterprise phishing campaigns.
Heap-based buffer overflow in Microsoft Office enables local code execution with high impact across confidentiality, integrity, and availability. Affecting Office 2016 through 2024, including LTSC and Microsoft 365 variants on both Windows and macOS, the vulnerability is triggered when a user opens a specially crafted document - requiring no privileges but mandatory user interaction (CVSS AV:L/UI:R). Patch is available from Microsoft; no public exploit identified at time of analysis.
Remote code execution in Microsoft Exchange Server stems from a heap-based buffer overflow (CWE-122) exploitable by any network-accessible authenticated user with low privileges. Affected versions span Exchange Server 2016 CU23, 2019 CU14 and CU15, and the Subscription Edition - all major currently-supported release lines. Vendor patches are available, and no public exploit identified at time of analysis, though the low attack complexity and full CIA impact make this a critical patching priority for enterprise Exchange deployments.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Unauthenticated code execution in Windows DHCP Server allows an attacker positioned on an adjacent network segment to trigger a heap-based buffer overflow and achieve full system compromise. The vulnerability spans a wide range of Microsoft server and desktop platforms, from Windows Server 2012 through Windows Server 2025 and select Windows 10 builds, making it broadly relevant in Windows-centric enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-interaction exploitation profile and vendor-confirmed patch availability make this a high-priority patching candidate for any organization running Windows DHCP Server.
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.
Privilege escalation via heap-based buffer overflow in the Windows HTTP.sys kernel-mode driver affects Windows 11 (23H2 through 26H1) and Windows Server 2022/2025. An authenticated low-privileged local attacker can exploit this flaw to gain SYSTEM-level privileges on the target machine. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected Windows builds make this a significant patching priority for organizations running vulnerable versions.
Remote code execution in Windows SMB Server is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that low-privileged, network-accessible credentials are sufficient - no user interaction or elevated rights are required. The vulnerability affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, with vendor patches now available. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows SMB Client on Windows 11 version 26H1 enables a low-privileged authorized attacker to gain SYSTEM-level control via a heap-based buffer overflow (CWE-122). The CVSS 7.8 (High) score reflects low attack complexity and no user interaction required once local access is established, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch raising build to 10.0.28000.2704 is available from Microsoft.
Privilege escalation via heap-based buffer overflow in the Windows NTFS driver enables a local authenticated attacker with standard user rights to gain SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans a wide swath of the Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making the aggregate exposure significant. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) mean that a working exploit would be highly reliable once developed.
Remote code execution is achievable in Windows SMB Server via a heap-based buffer overflow exploitable by a low-privileged, authenticated network attacker. The vulnerability (CWE-122) spans a wide range of Microsoft Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released patches via the MSRC update guide; no KEV listing or public exploit code is present in the available intelligence at time of analysis.
Heap-based buffer overflow in the Windows LDAP client implementation enables remote code execution against any Windows system that initiates an LDAP connection to an attacker-controlled server. The vulnerability spans an exceptionally wide set of affected Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the potential attack surface very large. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/UI:R vector and high CIAlll impact make this a credible priority for patching.
Remote code execution in Microsoft's Local Security Authority Server (lsasrv) affects virtually every supported Windows client and server release, from Windows Server 2012 through Server 2025 and Windows 10 through Windows 11 26H1. The heap-based buffer overflow (CWE-122) is reachable over the network by any low-privileged authenticated attacker - aligning with the CVSS PR:L designation and the description's 'authorized attacker' language - enabling full system compromise. No public exploit identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation in the Windows Remote Access Connection Manager (RASMAN) service enables a low-privileged local attacker to achieve SYSTEM-level access through a heap-based buffer overflow. Affecting Windows 10 (from version 1809), Windows 11 (through version 26H1), Windows Server 2019 through Server 2025, this vulnerability requires only a valid local user account and no user interaction. Microsoft has released patches via MSRC; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution via heap-based buffer overflow in the Windows RPC Runtime affects every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated remote attacker who can reach an exposed RPC endpoint can corrupt heap memory and achieve arbitrary code execution, yielding full confidentiality, integrity, and availability compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions, combined with network accessibility and no authentication requirement, elevates operational priority for internet-facing and laterally-reachable Windows infrastructure.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated local attacker to gain SYSTEM-level privileges on affected Windows 11 26H1 systems. The vulnerability is a heap-based buffer overflow in the kernel driver, exploitable by a low-privileged user without any user interaction. No public exploit has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
Heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (CldFlt.sys) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard user account with no user interaction and no special configuration - a reliable post-access escalation primitive. Microsoft has released patches; no public exploit code or CISA KEV listing is present in the provided data.
Privilege escalation via heap-based buffer overflow in Windows Shell affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. A locally authenticated, low-privileged attacker can trigger heap corruption within the Windows Shell component to achieve full SYSTEM-level code execution with no user interaction required and low attack complexity. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service affects virtually every current and legacy Windows release from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can overwrite heap memory to gain SYSTEM-level code execution on the target host without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; however, Microsoft has confirmed and patched the vulnerability through the MSRC update guide.
Heap-based buffer overflow in the Sony XAV-9500ES car multimedia receiver's Bluetooth L2CAP SDU reassembly function enables network-adjacent attackers to execute arbitrary code on the device. The flaw in `l2_reassemble_sdu` stems from missing length validation before copying attacker-controlled data to a heap buffer, granting full code execution in the device context once a malicious Bluetooth device has been paired by the victim. No public exploit or CISA KEV listing has been identified at time of analysis, but the ZDI advisory (ZDI-26-474) and a Sony firmware update advisory are both publicly available.
Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Heap-based buffer overflow in Wireshark's RDP protocol dissector (CWE-122) crashes the application when processing malformed RDP traffic, causing denial of service across two active release branches. Affected versions span 4.4.0-4.4.17 and 4.6.0-4.6.7 of the Wireshark Foundation's Wireshark (CPE: cpe:2.3:a:wireshark_foundation:wireshark). A proof-of-concept exists per SSVC data, though EPSS (0.17%, 7th percentile) and SSVC's 'Automatable: no' assessment indicate real-world mass exploitation is not occurring; no public exploit identified at time of analysis beyond the poc designation, and the flaw is absent from CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Heap buffer overflow in FreeRDP's Opus audio codec path allows a malicious RDP server to corrupt client heap memory and potentially execute arbitrary code on any connecting client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled. The flaw in freerdp_dsp_decode_opus (versions prior to 3.28.0) stems from a capacity check applied to the wrong buffer, leaving the actual PCM output buffer unguarded against oversized libopus decoded frames that can overrun the fixed 4096-byte StreamPool_Take destination in the rdpsnd channel. No public exploit has been identified at time of analysis, but the confirmed heap write primitive and RCE classification make this a credible code execution risk for susceptible client builds connecting to untrusted servers.
Heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) enables memory corruption via crafted Dirac data units across all versions prior to fix commit 1cdeb3c. The packetizer accepts an attacker-controlled data unit or fragment size and copies it into a fixed-size heap buffer without an upper-bound check, a classic CWE-122 condition with High confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; an upstream fix commit is available from the FFmpeg repository.
Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Heap buffer overflow in FFmpeg's hvcC box writer exposes any version prior to commit acf5d7c to memory corruption during HEVC muxing. When a crafted HEVC file presents more NAL units of a single type than the count field can encode, integer overflow corrupts heap memory, potentially enabling arbitrary code execution in the FFmpeg process context. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but server-side transcoding pipelines ingesting untrusted HEVC content effectively elevate the local-vector risk to a network-reachable attack surface.
Heap buffer overflows in FreeBSD's iconv(3) character-conversion library allow attackers who control input processed through the HZ, UTF-7, VIQR, or ZW encoding modules to corrupt heap memory, potentially leading to remote code execution. Applications on FreeBSD 14.3/14.4/15.0/15.1 that pass untrusted data through iconv using any of these encodings are exposed. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.21%, 12th percentile) despite the 9.8 CVSS.
Kernel memory corruption in FreeBSD's ZFS subsystem allows a local user with the delegated 'receive' ZFS permission to trigger a heap-based buffer overflow via the ZFS_IOC_RECV_NEW ioctl. The flaw stems from an integer truncation: a 64-bit payload size is silently narrowed to 32 bits for heap allocation, but the original 64-bit value is then used as the length for a subsequent byteswap operation - writing beyond the allocated buffer into kernel memory. Exploitation is limited to the heal receive path and requires the ZFS 'receive' delegation, but no patch has been publicly released yet for all affected branches. No public exploit code or CISA KEV listing has been identified at time of analysis.
Kernel heap overflow in FreeBSD's ZFS subsystem via the ZFS_IOC_USERSPACE_MANY ioctl enables local privilege escalation across multiple supported FreeBSD release branches. The flaw stems from an integer width mismatch: the kernel allocates a heap buffer sized by a 32-bit truncation of the caller-supplied 64-bit length, then copies records up to the original 64-bit limit - writing past the end of the allocation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and high impact across confidentiality, integrity, and availability make patching a priority for any FreeBSD deployment that uses ZFS delegated permissions.
Sandbox escape via heap-based buffer overflow in ANGLE's graphics engine on Chrome for Android allows a threat actor who has already achieved renderer process compromise to execute arbitrary code entirely outside the Chrome sandbox. All Chrome for Android versions prior to 151.0.7922.169 are affected; the vulnerability requires a two-stage exploit chain combining a separate renderer compromise with this ANGLE flaw. Google has released a patched build (151.0.7922.169); no public exploit code or CISA KEV listing has been identified at time of analysis, though the two-stage nature indicates likely use in sophisticated targeted attack chains.
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Google Chrome's WebGL implementation (all versions prior to 151.0.7922.169) enables a remote attacker to execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The sandbox escape elevates the impact from renderer-level code execution to potential full OS-level compromise. No public exploit code or active exploitation has been identified at the time of analysis, but the SSVC technical impact rating is 'total,' reflecting the severity of successful exploitation.
Heap-based buffer overflow in Open5GS v.2.7.0 allows remote unauthenticated attackers to crash the NAS 5GS decoder chain by sending a NAS PDU with a mutated message type byte, resulting in denial of service to the AMF component and all connected UEs. The vulnerability is network-accessible with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), making it trivially reachable from any host with access to the AMF N1 interface. A public proof-of-concept exploit exists, no public exploit identified as confirmed active exploitation (no CISA KEV listing), and no vendor patch has been confirmed at time of analysis.
Remote code execution in Systerel S2OPC 1.7.3 arises from a heap out-of-bounds write in the server-side EventFilter handling path exercised during CreateMonitoredItems processing. A remote attacker who can reach the OPC UA server endpoint and open a session on an events-enabled server can corrupt heap memory to achieve arbitrary code execution with the privileges of the server process. No public exploit identified at time of analysis, and EPSS is low (0.27%, 20th percentile), indicating the CVSS 9.8 rating reflects potential impact rather than observed mass exploitation.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a heap-based buffer overflow (CWE-122) that network-accessible, unauthenticated attackers can trigger when a victim interacts with attacker-controlled content. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) reflects high confidentiality and integrity impact with low attack complexity, requiring only that the user visit or open a crafted resource. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.
Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows any authenticated database user to execute arbitrary code as the operating system account running the database process by supplying an excessively long POSIX timezone abbreviation. Affected versions span the actively maintained major release lines: PostgreSQL 14 through 18, with fixes available in 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit code has been identified at time of analysis, but the low attack complexity and broad deployment surface of PostgreSQL make this a high-priority patching target for any environment where untrusted or semi-trusted database users exist.
Heap buffer overflow in PostgreSQL's regexp engine allows any authenticated database user to execute arbitrary code as the operating system user running the database process. The flaw is triggered by specially crafted text that survives input validation but undergoes unanticipated data growth during internal round-trip conversion through the pg_wchar encoding layer, overflowing a heap-allocated buffer during regular expression evaluation. All active PostgreSQL branches are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - with no public exploit or CISA KEV listing confirmed at time of analysis.
Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. MongoDB has released a patched version (v1.4.9) that adds buffer-clamping logic to prevent the overflow; no public exploit has been identified at time of analysis.
Heap out-of-bounds read and write in FreeRDP's Kerberos SSPI layer (all versions prior to 3.30.0) allows a malicious RDP peer to corrupt memory during CredSSP/NLA Kerberos decryption by supplying a crafted GSS Wrap-token with an unbounded EC or EC+RRC field value. The flaw sits in the pre-session authentication path, meaning exploitation does not require an established authenticated session from the attacker's side. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the network-reachable attack surface during a common enterprise authentication flow warrants prompt patching.
Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office (365 Apps for Enterprise, Office 2019, Office 2021 LTSC, and Office 2024 LTSC) enables a local attacker with low-privilege credentials to execute arbitrary code with the full confidentiality, integrity, and availability impact of the Office process. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 and requires only local access and a standard user account - no user interaction is needed once the attacker can trigger the vulnerable allocation path. No public exploit code has been identified at time of analysis, and SSVC assessment confirms current exploitation status as none.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system-level impact when a victim opens a specially crafted Excel file. The flaw (CWE-122) resides in Excel's file parsing logic, where malformed input causes a heap memory region to be overwritten, redirecting execution flow. No public exploit has been identified at time of analysis, and the vulnerability has not appeared in CISA's Known Exploited Vulnerabilities catalog, though the Microsoft Security Response Center has issued an advisory.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The vulnerability triggers during file parsing, allowing an attacker who can deliver a malicious document to execute arbitrary code with the privileges of the logged-in user. No KEV listing or public exploit code has been identified at time of analysis, but the local-execution-via-document vector makes this a meaningful phishing and spear-phishing enabler.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted file, granting full confidentiality, integrity, and availability compromise of the affected system. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a document-triggered exploit requiring no attacker privileges but demanding victim interaction - a profile consistent with malicious email attachment or drive-by download campaigns. No public exploit code or CISA KEV listing has been identified at time of analysis, though Excel's ubiquity makes this a high-value target class.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The CVSS vector (AV:L/PR:N/UI:R) confirms the attack requires no system privileges but does require user interaction - the classic malicious-document delivery pattern. Full confidentiality, integrity, and availability compromise results, making this a high-severity threat against any organization reliant on Excel for document workflows. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system impact when a victim opens a maliciously crafted workbook. The root cause is a numeric truncation error (CWE-122) in Excel's file parsing logic, where an integer value is truncated before being used to size a heap allocation, resulting in an undersized buffer that can be overflowed. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, but the high CVSS score of 7.8 and full confidentiality, integrity, and availability impact make this a meaningful risk for organizations relying on Excel file workflows.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted workbook, resulting in full compromise of confidentiality, integrity, and availability on the local system. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no attacker privileges are required, though user interaction - opening the malicious file - is a hard prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue is confirmed by Microsoft's Security Response Center via secure@microsoft.com.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. The attack requires no privileges from the attacker but does require user interaction - consistent with a malicious document delivery vector - and carries high impact across confidentiality, integrity, and availability. No active exploitation (KEV) or public exploit code has been identified in the provided intelligence at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/PR:N/UI:R) confirms exploitation requires no prior privileges but depends on user interaction - consistent with a malicious document delivery scenario. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a high-severity concern for any environment running unpatched Excel installations.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. An unauthenticated attacker (per CVSS PR:N) delivers a malicious document that triggers the overflow upon interaction (UI:R), achieving full confidentiality, integrity, and availability compromise on the victim system. No public exploit or KEV listing has been identified at time of analysis, though the attack pattern is well-understood and document-based Excel exploits have a long operational history.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a maliciously crafted file. The vulnerability (CWE-122) corrupts heap memory in Excel's parsing logic, allowing an attacker to achieve full control over confidentiality, integrity, and availability of the affected system. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 7.8 with high impact across all three CIA triad pillars makes this a meaningful priority for organizations running affected Excel versions.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Heap-based buffer overflow in the Windows iSCSI Target Service enables an unauthenticated remote attacker to trigger denial of service across a wide range of Windows Server versions from 2012 through 2025. The vendor-assigned CVSS vector of C:H/I:H/A:H suggests potential impact beyond the description's stated denial-of-service scope, warranting attention to whether memory corruption could extend to confidentiality or integrity compromise. No public exploit or active exploitation has been identified at time of analysis; however, SSVC designates the attack as automatable, elevating the urgency for organizations running exposed iSCSI targets to apply available patches.
Remote code execution in the Windows iSCSI Target Service allows an unauthenticated network attacker to run arbitrary code by exploiting a heap-based buffer overflow (CWE-122) in the service's network-facing request handling. The flaw carries a critical 9.8 CVSS rating and is remotely reachable with no privileges or user interaction, meaning any exposed iSCSI Target endpoint can be compromised end-to-end. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Local privilege escalation in Windows Installer (msiexec) enables an authenticated low-privileged user to trigger a heap-based buffer overflow, potentially achieving SYSTEM-level code execution across a broad range of Windows client and server platforms spanning over a decade of releases. Affected systems include Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the exposure surface extensive across enterprise and consumer deployments. No public exploit identified at time of analysis and no active exploitation confirmed via CISA KEV; vendor-released patches are available through the Microsoft Security Response Center.
Remote code execution via heap-based buffer overflow in the Windows iSCSI Target Service affects a broad range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). An unauthenticated network attacker can send a malformed iSCSI protocol request to trigger CWE-122 heap corruption and achieve arbitrary code execution on the target host. No public exploit identified at time of analysis and no CISA KEV listing, though the CVSS score of 8.1 (AC:H) reflects real exploitation complexity; the full C:H/I:H/A:H impact triad makes this a credible priority for environments running the iSCSI Target role.
Privilege escalation in the Windows Remote Access API via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker with low privileges to gain full SYSTEM-level control over affected Windows 11 and Windows Server 2022/2025 hosts. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a valid local account and no user interaction, making it a reliable post-compromise escalation path. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all enumerated affected versions.
Privilege escalation via heap buffer overflow in the Windows Remote Access (RAS) API affects every major in-support Windows desktop and server release, from Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low-privileged access can trigger a CWE-122 heap overflow to achieve full SYSTEM-level compromise with High confidentiality, integrity, and availability impact and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a patch across all affected build lines.
Heap-based buffer overflow in Microsoft Office enables arbitrary local code execution when a user opens a specially crafted document. Affected products span seven product lines across Windows and macOS, including Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and their Mac counterparts, all prior to the vendor-released patch. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of the affected install base and the low-complexity exploitation path make this a high-priority patching item.
Heap-based buffer overflow in Microsoft Office enables local code execution when a user opens a specially crafted document, affecting multiple product lines including Office 2016 through Microsoft 365 Apps for Enterprise. The vulnerability carries a CVSS 7.8 (High) score and achieves full confidentiality, integrity, and availability compromise on the victim system. No public exploit code has been identified at time of analysis, and Microsoft has released patches via the standard Office Security Releases channel.
Heap-based buffer overflow in Microsoft Office Access enables local code execution across Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise when a victim opens a specially crafted database file. The flaw, rooted in CWE-122, yields full High/High/High impact on confidentiality, integrity, and availability (CVSS 7.8), making successful exploitation equivalent to arbitrary code execution in the user's security context. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches via the Office Security Releases channel.
Heap-based buffer overflow in Microsoft Office Word enables local code execution with High confidentiality, integrity, and availability impact when a user opens a specially crafted document. Affects Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Word 2016, and corresponding Mac editions. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad product footprint and low attack complexity make patch application a near-term priority for enterprise defenders.
Heap-based buffer overflow (CWE-122) in Microsoft Office Access enables local code execution when a user opens a specially crafted database file, with full high-impact compromise of confidentiality, integrity, and availability (CVSS 7.8). Affected products span Microsoft Access 2016 through Microsoft 365 Apps for Enterprise and Office LTSC 2024. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Local code execution via heap-based buffer overflow in Microsoft Office affects multiple product lines including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. An integer overflow or wraparound during document parsing leads to an undersized heap allocation (CWE-122), enabling arbitrary code execution at the privilege level of the opening user when a victim opens a maliciously crafted Office file. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, though the full-triad high-impact CVSS score of 7.8 reflects the severity of successful exploitation.
Heap-based buffer overflow in Microsoft Office, rooted in an integer underflow during document parsing, enables local code execution with high confidentiality, integrity, and availability impact when a user opens a specially crafted file. All major Office release channels on both Windows and Mac are affected, including Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021/2019/2016, and their Mac equivalents. No public exploit has been identified at time of analysis, but a vendor-released patch is available via the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office Access enables local arbitrary code execution with full confidentiality, integrity, and availability impact across several Office product families. The vulnerability, rooted in CWE-122, affects Microsoft Access 2016 (both 32- and 64-bit editions), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Exploitation requires local access and user interaction - consistent with a malicious database file delivery scenario - and a vendor patch is available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution when a user opens a specially crafted Access database file. Affected products span Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad corporate user base. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Local code execution in Microsoft Office stems from an integer overflow that cascades into a heap-based buffer overflow (CWE-122), affecting Office 2016 through LTSC 2024 on both Windows and macOS. An unauthenticated attacker who can convince a target user to open a crafted Office document gains full code execution with the victim's privilege level - achieving high confidentiality, integrity, and availability impact per the CVSS:3.1 AV:L/C:H/I:H/A:H rating. No public exploit code or CISA KEV listing was identified at time of analysis, but the patch is vendor-confirmed and available via Microsoft's Security Update Guide.
Local code execution in Microsoft Office affects all major editions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and their Mac counterparts. The vulnerability is a heap-based buffer overflow (CWE-122) triggered when a user opens a specially crafted document, granting the attacker arbitrary code execution at the victim's privilege level. No public exploit has been identified at time of analysis, and a vendor-released patch is available, making this a high-priority patching target across enterprise Office deployments.
Heap-based buffer overflow in Microsoft Office allows local code execution across a wide range of Office versions on both Windows and macOS when a victim opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms that no privileges are required - only that a user interacts with malicious content - making this practically reachable via phishing or drive-by document delivery despite the local attack vector. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; a vendor-released patch is available.
Local code execution in Microsoft Office results from an integer overflow that leads to a heap-based buffer overflow (CWE-122), enabling an attacker to run arbitrary code at the privilege level of the logged-in user. Affected products span multiple Windows and Mac release tracks including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is present in the available data; however, the complete high CIA triad and wide deployment footprint make this a priority patching target.
Local code execution in Microsoft Office is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122), granting the attacker full control over the victim's user session. The vulnerability spans the entire modern Office portfolio - Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, LTSC 2024, and macOS equivalents - making the attack surface exceptionally broad. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches for all affected product lines.
Heap-based buffer overflow in Microsoft Office Word enables arbitrary local code execution when a user opens a specially crafted document. The vulnerability spans a broad set of affected products across both Windows and macOS platforms, including Office LTSC 2021/2024, Office 2019, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Outlook 2016. No public exploit code has been identified at time of analysis, though Microsoft has released a patch and the document-based delivery model is a proven and widely abused attack vector in enterprise phishing campaigns.
Heap-based buffer overflow in Microsoft Office enables local code execution with high impact across confidentiality, integrity, and availability. Affecting Office 2016 through 2024, including LTSC and Microsoft 365 variants on both Windows and macOS, the vulnerability is triggered when a user opens a specially crafted document - requiring no privileges but mandatory user interaction (CVSS AV:L/UI:R). Patch is available from Microsoft; no public exploit identified at time of analysis.
Remote code execution in Microsoft Exchange Server stems from a heap-based buffer overflow (CWE-122) exploitable by any network-accessible authenticated user with low privileges. Affected versions span Exchange Server 2016 CU23, 2019 CU14 and CU15, and the Subscription Edition - all major currently-supported release lines. Vendor patches are available, and no public exploit identified at time of analysis, though the low attack complexity and full CIA impact make this a critical patching priority for enterprise Exchange deployments.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Unauthenticated code execution in Windows DHCP Server allows an attacker positioned on an adjacent network segment to trigger a heap-based buffer overflow and achieve full system compromise. The vulnerability spans a wide range of Microsoft server and desktop platforms, from Windows Server 2012 through Windows Server 2025 and select Windows 10 builds, making it broadly relevant in Windows-centric enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-interaction exploitation profile and vendor-confirmed patch availability make this a high-priority patching candidate for any organization running Windows DHCP Server.
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.
Privilege escalation via heap-based buffer overflow in the Windows HTTP.sys kernel-mode driver affects Windows 11 (23H2 through 26H1) and Windows Server 2022/2025. An authenticated low-privileged local attacker can exploit this flaw to gain SYSTEM-level privileges on the target machine. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected Windows builds make this a significant patching priority for organizations running vulnerable versions.
Remote code execution in Windows SMB Server is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that low-privileged, network-accessible credentials are sufficient - no user interaction or elevated rights are required. The vulnerability affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, with vendor patches now available. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows SMB Client on Windows 11 version 26H1 enables a low-privileged authorized attacker to gain SYSTEM-level control via a heap-based buffer overflow (CWE-122). The CVSS 7.8 (High) score reflects low attack complexity and no user interaction required once local access is established, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch raising build to 10.0.28000.2704 is available from Microsoft.
Privilege escalation via heap-based buffer overflow in the Windows NTFS driver enables a local authenticated attacker with standard user rights to gain SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans a wide swath of the Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making the aggregate exposure significant. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) mean that a working exploit would be highly reliable once developed.
Remote code execution is achievable in Windows SMB Server via a heap-based buffer overflow exploitable by a low-privileged, authenticated network attacker. The vulnerability (CWE-122) spans a wide range of Microsoft Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released patches via the MSRC update guide; no KEV listing or public exploit code is present in the available intelligence at time of analysis.
Heap-based buffer overflow in the Windows LDAP client implementation enables remote code execution against any Windows system that initiates an LDAP connection to an attacker-controlled server. The vulnerability spans an exceptionally wide set of affected Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the potential attack surface very large. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/UI:R vector and high CIAlll impact make this a credible priority for patching.
Remote code execution in Microsoft's Local Security Authority Server (lsasrv) affects virtually every supported Windows client and server release, from Windows Server 2012 through Server 2025 and Windows 10 through Windows 11 26H1. The heap-based buffer overflow (CWE-122) is reachable over the network by any low-privileged authenticated attacker - aligning with the CVSS PR:L designation and the description's 'authorized attacker' language - enabling full system compromise. No public exploit identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation in the Windows Remote Access Connection Manager (RASMAN) service enables a low-privileged local attacker to achieve SYSTEM-level access through a heap-based buffer overflow. Affecting Windows 10 (from version 1809), Windows 11 (through version 26H1), Windows Server 2019 through Server 2025, this vulnerability requires only a valid local user account and no user interaction. Microsoft has released patches via MSRC; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution via heap-based buffer overflow in the Windows RPC Runtime affects every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated remote attacker who can reach an exposed RPC endpoint can corrupt heap memory and achieve arbitrary code execution, yielding full confidentiality, integrity, and availability compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions, combined with network accessibility and no authentication requirement, elevates operational priority for internet-facing and laterally-reachable Windows infrastructure.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated local attacker to gain SYSTEM-level privileges on affected Windows 11 26H1 systems. The vulnerability is a heap-based buffer overflow in the kernel driver, exploitable by a low-privileged user without any user interaction. No public exploit has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
Heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (CldFlt.sys) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard user account with no user interaction and no special configuration - a reliable post-access escalation primitive. Microsoft has released patches; no public exploit code or CISA KEV listing is present in the provided data.
Privilege escalation via heap-based buffer overflow in Windows Shell affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. A locally authenticated, low-privileged attacker can trigger heap corruption within the Windows Shell component to achieve full SYSTEM-level code execution with no user interaction required and low attack complexity. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service affects virtually every current and legacy Windows release from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can overwrite heap memory to gain SYSTEM-level code execution on the target host without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; however, Microsoft has confirmed and patched the vulnerability through the MSRC update guide.