Information Disclosure
Monthly
CSV formula injection in Velociraptor's export pipeline allows attacker-controlled endpoint artifacts to execute as formulas when a forensic analyst opens the exported CSV in Microsoft Excel. Affected export paths include the GUI, offline collector, and data export features - any of which may produce unsanitized CSV output when collected data contains leading formula-trigger characters (=, +, -, @, tab). No public exploit code has been identified and no CISA KEV listing exists; however, the CVSS scope-change metric (S:C) and high confidentiality rating (C:H) correctly reflect that successful exploitation results in formula execution within the analyst's own workstation environment rather than the Velociraptor server itself.
Unauthenticated information disclosure in the Order Sync with Zendesk for WooCommerce WordPress plugin (all versions before 2.2.3) exposes full customer order history and cumulative purchase totals to any remote attacker who supplies a target's email address. The plugin's REST API endpoint omits both a WordPress capability check and any ownership verification, meaning the access control layer is entirely absent - not misconfigured but simply missing. A publicly available proof-of-concept exists (reported by WPScan), and SSVC assesses the vulnerability as automatable, making bulk enumeration of customer purchase data a realistic threat; however, no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
WPC Admin Columns WordPress plugin exposes arbitrary metadata to subscriber-level authenticated users through an AJAX endpoint that lacks any authorization check. Any account with the lowest default WordPress role - subscriber - can query user, post, and term metadata site-wide, including sensitive data belonging to administrator accounts. Publicly available exploit code documented by WPScan lowers the practical barrier to exploitation; patch version 2.3.4 is available and should be applied immediately.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. The vendor-released patch (version 4.1.20) resolves the access control gap; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authenticated user - including low-privilege subscribers - to retrieve lesson material from courses they have not purchased or enrolled in. The flaw resides in the plugin's AI-assistant feature, which processes lesson content requests without first verifying the requesting user's enrollment status, exposing an authorization bypass at the content-serving layer. With a publicly available proof-of-concept from WPScan and a 15% EPSS score, this is a realistic and low-barrier threat to any WordPress e-learning deployment running an affected version.
Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.
Stored XSS in tablib's HTML export path before version 3.10.0 allows an authenticated attacker to inject arbitrary JavaScript via maliciously named worksheet titles sourced from imported XLSX, ODS, XLS, or YAML files. The export_book method in _html.py previously interpolated dataset titles directly into HTML h3 tags using an f-string, bypassing all escaping; script payloads assigned to the Dataset title attribute execute in a victim's browser when the exported HTML is rendered. No active exploitation confirmed in CISA KEV; vendor-released patch is available as v3.10.0.
In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds. This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done.
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse: arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user * Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.
Integrity-check bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets an attacker defeat the product's file-integrity verification: when a LUKS-encrypted volume is present, the software fails to validate that encryption correctly and then silently skips ALL CryptoPro integrity checks, so tampered files pass as trusted. This undermines the pre-boot/endpoint trust guarantees the product exists to provide, enabling evil-maid-style tampering. There is no public exploit identified at time of analysis, though the flaw is the subject of a Black Hat USA 2026 disclosure ('The Cost of Obscurity'); EPSS is very low (0.11%, 1st percentile) and it is not on CISA KEV.
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
CryptoPro Secure Disk for BitLocker versions before v7.7.4 leaks TPM2.0 unsealing secrets by persisting them in a serialized binary format within unused disk sectors - raw storage areas that survive reboots and are accessible without operating system authentication. An unauthenticated attacker with physical access to the drive can image these sectors, extract the serialized secrets, and reconstruct a compatible TPM environment to unseal the BitLocker volume, effectively defeating the hardware-backed disk encryption the product is designed to enforce. No public exploit code has been identified at time of analysis; CISA SSVC rates exploitation as 'none', but the attack's low complexity once physical access is obtained was detailed publicly in a Black Hat USA 2026 research presentation, materially lowering the skill barrier for motivated actors.
Full-disk-encryption bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 stems from a default TPM PCR sealing policy that ignores the system boot state, letting an attacker with physical access unseal the TPM through an unintended execution path or by relocating the drive/TPM to another hardware platform and recover the BitLocker keys. The flaw was documented in the Black Hat USA 2026 research 'The Cost of Obscurity' by Burch; there is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is low at 0.18% (8th percentile), consistent with a physical-access rather than mass-exploitable weakness.
CryptoPro Secure Disk for BitLocker before v7.7.4 silently falls back to plaintext volume mounting when a decryption error occurs, negating the entire confidentiality guarantee that BitLocker is meant to enforce. Disclosed publicly at Black Hat USA 2026 in research titled 'The Cost of Obscurity' (Burch), the flaw demonstrates how improper error handling in encryption middleware can fully undermine the security layer it wraps. No public exploit code has been identified at time of analysis, though the Black Hat presentation and accompanying whitepaper are publicly available, substantially lowering the knowledge barrier for exploitation; EPSS stands at a low 0.17% but may shift as presentation details circulate.
CryptoPro Secure Disk for BitLocker before v7.7.4 stores initramfs contents in plaintext on disk, allowing a physical attacker to recover cryptographic keys and other secrets without defeating the encryption layer. The vulnerability was publicly disclosed at Black Hat USA 2026 by researcher Burch in a presentation titled 'The Cost of Obscurity,' suggesting the vendor's security model relied on implementation obscurity rather than cryptographic assurance. No public exploit identified at time of analysis; EPSS at 0.17% reflects the physical-access prerequisite that limits widespread automated exploitation.
Protection-mechanism bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets unsigned code run from temporary filesystems because the product fails to enforce its Integrity Measurement Architecture (IMA) policy across those locations. An attacker able to stage a binary in a tmpfs-style path can execute code that the integrity policy was meant to block, undermining the pre-boot/disk-encryption trust model. The flaw was disclosed in Black Hat USA 2026 research ('The Cost of Obscurity', Burch); no public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not in CISA KEV.
Brute-force credential attacks against Mira's cloud authentication endpoints are unrestricted due to the complete absence of per-account rate limiting, per-IP throttling, and account lockout controls, as disclosed in CISA ICS Medical Advisory ICSMA-26-223-01. Affected products include Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 from Quanovate Tech Inc. (operating as Mira / Mira Care), a healthcare-focused IoT platform. An unauthenticated remote attacker can systematically enumerate credentials at arbitrary scale to gain unauthorized access to user accounts, with no public exploit code or CISA KEV listing identified at time of analysis.
Firmware version spoofing in the Mira cloud API allows authenticated users to submit arbitrary firmware version strings for their own registered devices, bypassing server-side validation entirely. Affected products are Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 by Quanovate Tech Inc., operating in a medical IoT context and reported under CISA ICS-CERT advisory ICSMA-26-223-01. An attacker exploiting this flaw can cause the vendor backend to misrecord their device's patch state, suppressing security update prompts and distorting fleet-wide vulnerability analytics - with no public exploit identified at time of analysis.
Session token exposure in the Mira Android app (Quanovate Tech Inc.) leaks live authentication credentials to third-party web properties and referrer logs whenever users trigger in-app WebView flows such as shop redirects. The app appends the active session token as a URL query string parameter and embeds a persistent user identifier in the WebView User-Agent header, both of which are transmitted to any destination or JavaScript context receiving that traffic. Reported by ICS-CERT under medical advisory ICSMA-26-223-01, this vulnerability affects a healthcare-adjacent platform, amplifying the sensitivity of exposed credentials; no public exploit code or CISA KEV listing has been identified at time of analysis.
OpenSSH sshd before version 10.5 fails to enforce the `restrict` keyword in `authorized_keys` against tunnel forwarding, allowing a constrained SSH key holder to establish tun-device tunnels that the administrator explicitly intended to block. The flaw affects all OpenSSH releases prior to 10.5 and is classified as a policy-enforcement bypass with low integrity impact. No active exploitation is confirmed per SSVC (exploitation: none) and the vulnerability is absent from the CISA KEV catalog, placing this firmly in the low-urgency tier despite OpenSSH's near-ubiquitous deployment footprint.
Use-after-free (CWE-416) in OpenSSH's ssh client component affects all releases before version 10.5, triggered when a specific pair of remote-forwarding operations occur concurrently, causing access to freed realloc'd memory. A malicious or compromised SSH server could exploit this race condition against a connecting client to achieve partial information disclosure or limited memory corruption. No public exploit has been identified and CISA SSVC rates exploitation as none with partial technical impact, consistent with the moderate CVSS score of 4.8.
OpenSSH ssh-agent before version 10.5 permits remote execution of agent operations - including adding authentication tokens and using SSH keys - that were architecturally intended to be restricted to local access only. The trust boundary failure stems from a misinteraction between the agent locking mechanism and the session-bind@openssh.com extension, allowing an authenticated remote actor to cross the local/remote privilege boundary. No public exploit has been identified at time of analysis, and SSVC assessment confirms no current exploitation activity; however, the network-accessible vector and ubiquitous deployment footprint of OpenSSH make patching to 10.5 the appropriate response for any environment using agent forwarding.
Ente 2of3's version 1 card format undermines the information-theoretic guarantee of Shamir secret sharing by storing the secret's byte length and a 32-bit FNV-1a checksum in cleartext on every card, enabling single-card offline attacks. Any party who obtains or photographs one of the three recovery cards - a scenario the scheme was explicitly designed to render harmless - can enumerate low-entropy or predictable candidate secrets against the exposed checksum without needing a second card. The vulnerability affects all 2of3 cards generated before version 2026.07.28; no public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
AdminRenderer in Django REST Framework prior to 3.17.2 discloses unauthorized GET resource data to authenticated users who hold write-but-not-read permissions on a DRF view. When a POST request fails validation and returns a 400 Bad Request, the renderer internally calls view.get() without first invoking view.check_permissions(), embedding the full GET representation in the HTML error response visible to the requester. No public exploit is confirmed in CISA KEV, but SSVC rates exploitation as POC-level; risk is targeted rather than widespread.
Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences into the Insights API URL path by manipulating the ClusterID value it controls, redirecting authenticated hub-side requests to unintended API endpoints. Affected deployments include any multi-cluster Red Hat Insights configuration where a spoke cluster could be under adversary control. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Bearer token reuse in the acm-search-v2-api-rhel9 component of Red Hat Advanced Cluster Management exposes federated hub search results to unauthorized authenticated users. The `getFederationConfig` cache refresh incorrectly retains one user's token and applies it to all subsequent federated queries until TTL expiry, enabling cross-tenant information disclosure across remote managed hubs. No public exploit has been identified at time of analysis, and the CVSS High Confidentiality rating is tempered by the AC:H timing dependency required for successful exploitation.
Temporal UI Server versions 2.7.0 through 2.53.1 incorrectly derive the Secure attribute for OAuth authentication cookies from the proxy-to-server connection rather than the browser-facing connection, causing access-token and refresh-token cookies to be issued without Secure when TLS terminates at a reverse proxy forwarding over HTTP. An attacker who can additionally redirect browser traffic for the UI hostname away from HTTPS - beyond merely serving attacker-controlled content - can potentially intercept a live credential transmitted in a plaintext HTTP request. No public exploit code exists and CISA KEV does not list this vulnerability; the SSVC assessment confirms exploitation is currently none and the attack is not automatable, consistent with the very low CVSS 4.0 score of 2.3.
Authenticated annotation slot hijacking in CVAT versions 2.17.0 through 2.71.x enables any user with write access to a single job to deny automatic annotation service to arbitrary other tasks by submitting batch annotation requests with deliberately mismatched task and job IDs. The `RequestViewSet.create` endpoint reserved the single active annotation slot by task ID without validating that the submitted job belonged to that task or that the requester had any access to it, allowing cross-task resource monopolization. No public exploit code exists and the vulnerability is absent from CISA KEV; vendor-confirmed fix is available in v2.72.0.
Privilege escalation in Microsoft OneDrive for macOS exploits improper symbolic link resolution (CWE-59), enabling a locally authorized high-privileged attacker to redirect OneDrive file operations to unintended filesystem locations and gain elevated access beyond their sanctioned scope. Affected versions span 26.0.0.0 up to but not including 26.095.0519.0003 on macOS exclusively. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog, though the full high-high-high CIA impact within the unchanged scope warrants prompt patching for any enterprise deploying OneDrive on macOS endpoints.
Transient execution information disclosure in Intel processors allows a Ring 0 (kernel or hypervisor level) adversary to leak sensitive data across security boundaries into a subsequent system context. The flaw stems from incorrect data forwarding during speculative execution, a class of hardware-level side-channel vulnerability similar to Spectre-class attacks, requiring local access with high privileges and high attack complexity. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation enables high-confidentiality-impact cross-boundary data exposure, threatening hypervisor isolation guarantees critical in virtualized and cloud environments.
Incomplete cleanup (CWE-459) in UEFI firmware for select Intel reference platforms allows a high-privileged local system software adversary to read sensitive residual data that was not properly purged from firmware memory or registers, resulting in high confidentiality impact on the subsequent system layer. The vulnerability requires specific attack conditions (AT:P) and is scoped to Intel reference platforms identified in advisory INTEL-SA-01437. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Use-After-Free in the AMD Ryzen Master Utility Driver exposes kernel memory to a locally authenticated, high-privileged attacker, with the primary confirmed impact being system availability loss. The vulnerability (CWE-416) resides within the driver component bundled with both the Ryzen Master application and its Monitoring SDK, affecting all versions prior to the patched releases. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 5.6 reflects the restricted local, high-privilege attack surface despite the kernel-level nature of the flaw.
Symlink-following in the Windows Container Isolation FS Filter Driver (unionfs.sys) enables a locally authenticated attacker with low privileges to tamper with files outside the expected isolation boundary. Affected systems run Windows 11 version 26H1 builds prior to 10.0.28000.2704. A vendor patch is available; no public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Windows Management Services on Windows 11 contains an improper link resolution flaw (CWE-59) that allows an authenticated local attacker to crash or disable the service by planting a malicious symbolic link or directory junction at a file path the service accesses. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, with patched builds confirmed by Microsoft via MSRC. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel enables remote information disclosure when a user opens a specially crafted spreadsheet. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms that an unauthenticated network-based attacker can trigger the flaw, but only after social engineering a victim into opening a malicious file. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected Office product lines.
Out-of-bounds read in Microsoft Excel exposes sensitive memory contents over a network to unauthenticated remote attackers, resulting in high-confidence information disclosure (C:H). Exploitation requires user interaction - specifically, opening a crafted Excel document - placing this firmly in the phishing/malicious-attachment delivery class. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis, though the patch is available and should be applied promptly given the ubiquity of the affected product across enterprise environments.
Information disclosure in Microsoft Office PowerPoint enables a local attacker to obtain sensitive data from a victim's system by exploiting improper input validation (CWE-20) when processing a malicious file. Affected products span Windows and Mac editions including Office 2019, Microsoft 365 Apps for Enterprise, LTSC 2021/2024, and Office 365 for Mac - all requiring the victim to open a crafted PowerPoint file (UI:R). No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, a vendor patch is available.
Information disclosure in Microsoft Office (spanning 365 Apps for Enterprise, LTSC 2021/2024, Office 2019, and macOS variants) is triggered locally when a user opens a specially crafted document, exploiting improper input validation (CWE-20) to expose sensitive information with high confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) confirms local-only exploitation requiring user interaction, substantially limiting opportunistic mass exploitation. No public exploit has been identified at time of analysis, and Microsoft has released a patch across all affected product lines.
Local information disclosure in Microsoft PowerPoint stems from improper input validation (CWE-20) when processing specially crafted presentation files, affecting a broad range of Office product lines on both Windows and macOS. The CVSS vector (AV:L/UI:R/C:H) confirms that while no special system privileges are required, a victim must open a malicious file, making social engineering the primary delivery mechanism. No public exploit has been identified and no active exploitation is confirmed, but the high confidentiality impact (C:H) warrants prompt patching given the ubiquitous deployment of Microsoft Office.
Information disclosure in Microsoft Office PowerPoint stems from improper input validation (CWE-20) that allows a locally-present attacker to read sensitive data from the vulnerable system when a user opens a crafted file. Affected products span PowerPoint across Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code or active exploitation has been identified at the time of analysis; a vendor patch is available via standard Office update channels.
Microsoft Office Word's document parsing logic fails to properly validate input (CWE-20), enabling a local attacker to read sensitive information from a target system when a victim opens a specially crafted Word document. The flaw affects a broad range of Microsoft Office releases on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, and all LTSC variants through 2024. SSVC assessment confirms no current exploitation activity and the attack is not automatable due to required user interaction, though the CVSS confidentiality impact is rated High.
Improper input validation in Microsoft Office Excel enables a local attacker to disclose sensitive information when a target user opens a specially crafted file. The vulnerability affects a broad swath of Microsoft Office product lines - including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, Office 365 for Mac, and Word 2016 - across both Windows and macOS platforms. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches are available across all affected product lines.
Uninitialized memory disclosure in Microsoft Office exposes sensitive process memory to local attackers who can deliver a crafted document. Affecting a broad range of Office versions across Windows and macOS - including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office 365 for Mac - the flaw yields high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via the August 2026 update cycle.
Improper input validation in Microsoft Office PowerPoint enables local information disclosure when a victim opens a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and their macOS counterparts across both subscription and perpetual-license release tracks. Microsoft has released patches via the standard Office update channel; no public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (Windows and macOS editions, including LTSC 2024, LTSC 2021, 2019, and 365 Apps) enables local information disclosure when a user opens a maliciously crafted document. The CVSS vector (AV:L/UI:R) confirms exploitation is constrained to local, user-triggered scenarios with no code execution or data modification capability. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing exists at time of analysis.
Local information disclosure in Microsoft Office stems from improper input validation (CWE-20), allowing a local attacker who can induce user interaction to read sensitive data from the affected system. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Office 365/LTSC for Mac, with Mac builds patched at 16.112.26081010 and Windows builds addressed via the Microsoft Office Security Releases channel. No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable attack path.
Local information disclosure in Microsoft Office PowerPoint exposes sensitive data when a user opens a crafted file. The flaw, rooted in improper input validation (CWE-20), affects a broad range of Office versions across Windows and macOS including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches via its August 2026 update cycle.
Out-of-bounds read in Microsoft Office Word exposes sensitive memory contents to local attackers via crafted document files. Affected products span Word 2016 through Microsoft 365 Apps for Enterprise on both Windows and Mac platforms, covering a broad enterprise install base. Exploitation requires user interaction - a victim must open a malicious document - but yields high confidentiality impact with no integrity or availability loss. No public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a victim to open a crafted spreadsheet file. The flaw affects a wide range of Office versions across both Windows and macOS platforms, including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. No public exploit or active exploitation has been identified at time of analysis; SSVC assessment rates exploitation as none and the attack as non-automatable, indicating moderate real-world urgency despite the High confidentiality impact rating.
Incomplete resource cleanup in Microsoft Office PowerPoint exposes sensitive document data to local attackers across multiple supported product lines, including Microsoft 365 Apps for Enterprise, Office LTSC 2024, LTSC 2021, Office 2019, and PowerPoint 2016. Exploitation requires a victim to open or interact with a PowerPoint file (UI:R), after which residual data - likely temporary files, memory buffers, or cached presentation content - persists in a locally accessible state without requiring attacker privileges. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, keeping real-world risk moderate despite the high confidentiality impact rating.
Out-of-bounds read in Microsoft Excel exposes process memory to local information disclosure across a wide range of Office versions, from Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC releases on both Windows and macOS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms exploitation requires the victim to open a specially crafted spreadsheet file, making phishing-delivered documents the realistic delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Excel triggers information disclosure when a victim opens a specially crafted spreadsheet file, exposing potentially sensitive memory contents to a local attacker. The flaw spans multiple Office product lines - Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and corresponding Mac variants - with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified and SSVC confirms no known exploitation; a vendor patch is available via the Microsoft Security Response Center.
Information disclosure in Microsoft Excel arises from use of uninitialized memory (CWE-908), exposing potentially sensitive heap or stack contents to an attacker when a victim opens a maliciously crafted Excel file. Affected products span the full Microsoft Office portfolio on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, Excel 2016, and their Mac counterparts. No public exploit identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Out-of-bounds read in Microsoft Excel enables local information disclosure when a user opens a specially crafted spreadsheet. Multiple product lines are affected across Windows and macOS, spanning Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise. Microsoft has released patches; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in Microsoft Office exposes memory contents to local information disclosure across a wide range of affected products including Word 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office 365/LTSC for Mac. The CVSS vector (AV:L/UI:R/C:H) indicates exploitation requires a victim to open a specially crafted Office document, after which sensitive in-process memory can be disclosed to the attacker. No public exploit has been identified at time of analysis, no KEV listing exists, and Microsoft has released patches across all affected product lines.
Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality data to a local attacker when a user opens a crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the high confidentiality impact and wide deployment footprint make patching a clear priority.
Microsoft Dynamics 365 on-premises version 9.1 exposes sensitive information to authenticated network attackers via an improper access control flaw (CWE-200), allowing disclosure of data beyond a user's authorization level. The CVSS vector (PR:L) confirms exploitation requires a valid low-privilege account, limiting exposure to insider threats or compromised credentials rather than unauthenticated external actors. No public exploit code and no active exploitation have been identified; SSVC rates this as non-automatable with partial technical impact, consistent with a medium-priority finding.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Local privilege escalation in Windows DNS affects a broad range of Windows client and server operating systems, enabling an already-authenticated local attacker to gain elevated privileges on the target system. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the attacker requires high existing privileges - consistent with the description's reference to an 'authorized attacker' - yet can achieve full confidentiality, integrity, and availability impact post-exploitation. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; a vendor-released patch is available via Microsoft's Update Guide.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Out-of-bounds read in Microsoft Word's document parsing engine exposes sensitive in-process memory to a local attacker across Office 2016 through LTSC 2024 and macOS variants. Exploitation requires a victim to open a specially crafted document, making social engineering or phishing the primary delivery mechanism. No public exploit code exists and no active exploitation has been identified (not in CISA KEV); SSVC assessment rates exploitation status as none and technical impact as only partial.
Out-of-bounds memory read in Microsoft Office exposes potentially sensitive process memory contents when a victim opens a specially crafted document locally. The vulnerability affects the full Office suite across Windows and macOS - spanning Office 2016 through LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - with High confidentiality impact per CVSS but no integrity or availability consequence. No public exploit has been identified at time of analysis; CISA SSVC classifies exploitation status as none and the attack is not automatable, significantly reducing real-world prioritization urgency despite the High C rating.
Out-of-bounds read in Microsoft Office Word exposes potentially sensitive memory contents to local attackers when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021 and 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise across both Windows and macOS platforms, with vendor-confirmed patches available. No public exploit code exists and CISA SSVC rates exploitation likelihood as none with only partial technical impact, making this a medium-priority patching item despite the High confidentiality score assigned by CVSS.
Out-of-bounds read in Microsoft Office Word's document parser enables local information disclosure across Windows and Mac product lines, including Office 2016, 2019, 2021, 2024 LTSC, and Microsoft 365 Apps. An attacker who supplies a crafted Word document can cause the application to read beyond allocated memory boundaries, leaking high-confidence memory contents to the attacker. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, though the broad affected product surface and low attack complexity make it a credible phishing delivery vehicle.
Out-of-bounds read (CWE-125) in Microsoft Office enables a local, unauthenticated attacker to disclose sensitive memory contents by convincing a user to open a specially crafted Office document. Affected products span the full modern Office portfolio - Office 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable delivery, placing this in a lower operational urgency tier despite the High confidentiality impact rating.
Out-of-bounds read (CWE-125) in Microsoft Office Word exposes memory contents to a local, unauthenticated attacker who can trick a user into opening a crafted document, resulting in high-confidence information disclosure with no integrity or availability impact. The vulnerability spans eight distinct Office product lines across Windows and Mac, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, broadening the exposure surface considerably. No public exploit code or active exploitation has been identified per SSVC (Exploitation: none); Microsoft has released patches via the standard Office update channel.
Out-of-bounds read (CWE-125) in Microsoft Office exposes sensitive memory contents to local attackers who can persuade a user to open a specially crafted document. Affected products span multiple Office generations including Office 2016, 2019, 2021, 2024, LTSC variants, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable delivery, aligning with the local, user-interaction-dependent CVSS vector.
Out-of-bounds read in Microsoft Office Word exposes high-confidentiality memory contents when a user opens a specially crafted document locally. Affected products span Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise, confirmed via EUVD-2026-56423. No public exploit identified at time of analysis and no CISA KEV listing; vendor patch is available, placing this in the routine-patch-cycle priority tier rather than emergency response.
Out-of-bounds read in Microsoft Office exposes sensitive in-process memory contents to local attackers who socially engineer a victim into opening a crafted document. The flaw spans the full Microsoft Office portfolio across Windows and macOS - from Office 2016 through Microsoft 365 Apps for Enterprise - making it broadly relevant for enterprise patch management. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Spoofing in Microsoft SharePoint Server allows an authenticated low-privilege network attacker to manipulate content presentation or deceive users through improper input validation, achieving limited confidentiality and integrity impact. Affected deployments span SharePoint Server 2016 Enterprise, 2019, and Subscription Edition across a wide range of versions prior to their respective Microsoft-patched builds. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires both a low-privilege authenticated session and victim user interaction, constraining realistic threat scope.
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated network attacker to exfiltrate sensitive data when a target user opens a specially crafted document. The WPF document parser resolves external references from attacker-controlled URIs - an SSRF-adjacent primitive (CWE-829, CWE-918) - causing outbound network requests that can expose authentication tokens or internal metadata to the attacker's infrastructure. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected .NET and Visual Studio versions.
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to local attackers who can socially engineer a victim into opening a malicious document. Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise across both Windows and macOS. No public exploit code is identified and SSVC rates exploitation as none, but the high confidentiality impact warrants timely patching for organizations whose users regularly handle documents from untrusted sources.
Credential exposure in Microsoft SharePoint Server (CWE-522) enables an authenticated network attacker to intercept insufficiently protected credentials and perform identity spoofing against the affected deployment. All three active on-premises SharePoint release lines are confirmed affected - 2016 Enterprise, 2019, and Subscription Edition - with patched thresholds provided by EUVD. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard SharePoint user account, with high confidentiality impact; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
Integer underflow in the Windows DHCP Server service exposes adjacent-network unauthenticated attackers to high-confidentiality memory disclosure across a broad range of Windows Server releases from 2012 through 2025, plus Windows 10 1607 and 1809. The root cause (CWE-125 out-of-bounds read triggered by arithmetic underflow) allows a crafted DHCP packet to cause the server to read and return memory beyond the intended buffer boundary. No active exploitation is confirmed (not in CISA KEV) and SSVC rates exploitation status as none; a vendor patch is available via the Microsoft Security Response Center.
Windows Win32K contains an untrusted pointer dereference (CWE-822) that allows a locally authenticated attacker to disclose sensitive kernel or process memory contents. Affected systems include multiple Windows 11 release branches (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, both full and Server Core installations. No public exploit has been identified at time of analysis and exploitation has not been confirmed by CISA KEV; Microsoft has released patches addressing all affected build ranges.
Out-of-bounds read in the Windows NTFS driver exposes sensitive memory contents to locally authenticated attackers across a wide range of Microsoft Windows and Windows Server releases. The flaw (CWE-125) allows a low-privileged local user to read kernel or process memory beyond intended boundaries, resulting in information disclosure with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem allows any locally authenticated low-privilege user to disclose sensitive kernel memory contents without user interaction. The flaw spans an exceptionally broad range of affected Windows versions, from Server 2012 through Windows 11 25H2, significantly widening enterprise exposure. No active exploitation has been confirmed in CISA KEV and no public exploit has been identified at time of analysis, though kernel memory disclosure from Win32K is strategically valuable as a KASLR-bypass primitive in chained privilege escalation attacks.
Integer underflow (CWE-125) in the Windows DHCP Server service exposes server memory contents to unauthenticated attackers positioned on the same adjacent network segment. Affecting Windows Server versions from 2012 through 2025 (confirmed by ENISA EUVD-2026-56370), the flaw allows crafted DHCP packets to trigger an out-of-bounds read, resulting in high-confidence confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact - a vendor patch is available via Microsoft MSRC.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory contents to a locally authenticated low-privilege attacker across a wide swath of Windows desktop and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. The impact is strictly information disclosure - high confidentiality loss with no integrity or availability effect - making this most practically useful as a KASLR-bypass building block in a multi-stage local privilege escalation chain. No public exploit or active exploitation has been identified; SSVC classifies exploitation status as none and technical impact as partial.
Integer underflow in the Windows DHCP Server service exposes out-of-bounds memory to unauthenticated attackers on the adjacent network, enabling high-impact information disclosure across multiple Windows Server generations from 2012 through 2025. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, only Layer 2 or broadcast-domain adjacency to a host running the DHCP Server role. Microsoft has released patches for all affected builds; no public exploit code has been identified and the vulnerability does not appear in CISA KEV at time of analysis.
Windows Imaging Component (WIC) across a broad span of Windows 10, Windows 11, and Windows Server releases contains an uninitialized memory read flaw (CWE-908) that an authorized local user with low privileges can exploit to disclose sensitive information from process memory. The CVSS vector (AV:L/PR:L/C:H/I:N/A:N) confirms this is strictly a local, low-privilege information disclosure with no network attack surface and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; a vendor-released patch is confirmed via the Microsoft MSRC advisory.
Out-of-bounds read in Windows Management Instrumentation (WMI) enables a locally authenticated, low-privileged attacker to disclose potentially sensitive information from process memory. Affecting a broad sweep of Windows client and server releases from Windows Server 2012 through Windows 11 26H1, the flaw is rooted in a memory safety defect in the WMI subsystem (CWE-125). No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected product lines.
Information disclosure in Windows DHCP Server across six major Windows Server generations exposes heap or stack memory contents to unauthenticated adjacent-network attackers via an integer underflow defect. The vulnerability affects all Windows Server editions from 2012 through 2025 that have the DHCP Server role installed and running, with exploitation constrained to Layer 2 adjacency rather than the open internet. A vendor-released patch is available from Microsoft MSRC; no public exploit code has been identified at time of analysis.
Information disclosure via integer underflow in the Windows DHCP Server service exposes server process memory to unauthenticated attackers on the same network segment, affecting Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the DHCP Server role is installed. The root cause is a CWE-125 out-of-bounds read triggered when an integer underflows and wraps around, causing DHCP packet-processing code to read memory outside intended bounds and potentially return it in a server response. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with partial technical impact, indicating contained but real risk requiring timely patching.
Integer underflow (CWE-125, out-of-bounds read) in the Windows DHCP Server service allows an unauthenticated attacker on an adjacent network segment to disclose sensitive memory contents. Affected systems span Windows Server 2012 through 2025 and certain Windows 10 builds running the DHCP Server role. No public exploit has been identified at time of analysis, and a vendor patch is available via Microsoft's July 2026 update cycle.
Out-of-bounds memory read in the Windows DHCP Server service exposes sensitive server memory to unauthenticated attackers on the adjacent network. The root cause is an integer underflow (CWE-125) in DHCP packet processing, where a miscalculated length or index wraps around, causing the service to read and potentially return memory beyond intended buffer boundaries. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected Windows Server versions via the August 2026 Patch Tuesday cycle.
Information disclosure in the Windows DHCP Server service allows unauthenticated attackers on adjacent network segments to read out-of-bounds server memory via a malformed DHCP request that triggers an integer underflow. Affected builds span Windows Server 2012 through Windows Server 2025, as well as Windows 10 versions 1607 and 1809, making the version footprint unusually wide for a single service-role flaw. No public exploit has been identified at time of analysis and CISA's SSVC framework rates exploitation as none with non-automatable characteristics, though the high confidentiality impact and the breadth of affected builds warrant prompt patching.
CSV formula injection in Velociraptor's export pipeline allows attacker-controlled endpoint artifacts to execute as formulas when a forensic analyst opens the exported CSV in Microsoft Excel. Affected export paths include the GUI, offline collector, and data export features - any of which may produce unsanitized CSV output when collected data contains leading formula-trigger characters (=, +, -, @, tab). No public exploit code has been identified and no CISA KEV listing exists; however, the CVSS scope-change metric (S:C) and high confidentiality rating (C:H) correctly reflect that successful exploitation results in formula execution within the analyst's own workstation environment rather than the Velociraptor server itself.
Unauthenticated information disclosure in the Order Sync with Zendesk for WooCommerce WordPress plugin (all versions before 2.2.3) exposes full customer order history and cumulative purchase totals to any remote attacker who supplies a target's email address. The plugin's REST API endpoint omits both a WordPress capability check and any ownership verification, meaning the access control layer is entirely absent - not misconfigured but simply missing. A publicly available proof-of-concept exists (reported by WPScan), and SSVC assesses the vulnerability as automatable, making bulk enumeration of customer purchase data a realistic threat; however, no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
WPC Admin Columns WordPress plugin exposes arbitrary metadata to subscriber-level authenticated users through an AJAX endpoint that lacks any authorization check. Any account with the lowest default WordPress role - subscriber - can query user, post, and term metadata site-wide, including sensitive data belonging to administrator accounts. Publicly available exploit code documented by WPScan lowers the practical barrier to exploitation; patch version 2.3.4 is available and should be applied immediately.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. The vendor-released patch (version 4.1.20) resolves the access control gap; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authenticated user - including low-privilege subscribers - to retrieve lesson material from courses they have not purchased or enrolled in. The flaw resides in the plugin's AI-assistant feature, which processes lesson content requests without first verifying the requesting user's enrollment status, exposing an authorization bypass at the content-serving layer. With a publicly available proof-of-concept from WPScan and a 15% EPSS score, this is a realistic and low-barrier threat to any WordPress e-learning deployment running an affected version.
Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.
Stored XSS in tablib's HTML export path before version 3.10.0 allows an authenticated attacker to inject arbitrary JavaScript via maliciously named worksheet titles sourced from imported XLSX, ODS, XLS, or YAML files. The export_book method in _html.py previously interpolated dataset titles directly into HTML h3 tags using an f-string, bypassing all escaping; script payloads assigned to the Dataset title attribute execute in a victim's browser when the exported HTML is rendered. No active exploitation confirmed in CISA KEV; vendor-released patch is available as v3.10.0.
In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds. This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done.
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the user-space segment buffer straight to strncmp() through a bogus (char __user *) cast. This dereferences a user pointer in kernel context, which is wrong and is flagged by sparse: arch/loongarch/kernel/machine_kexec.c:84:51: sparse: incorrect type in argument 2 (different address spaces) @@ expected char const * @@ got char [noderef] __user * Here copy the marker-sized prefix of each segment into a small on-stack buffer with copy_from_user() before comparing, and skip segments that fault. The subsequent copy_from_user() that stages the full command line into the safe area is left unchanged.
Integrity-check bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets an attacker defeat the product's file-integrity verification: when a LUKS-encrypted volume is present, the software fails to validate that encryption correctly and then silently skips ALL CryptoPro integrity checks, so tampered files pass as trusted. This undermines the pre-boot/endpoint trust guarantees the product exists to provide, enabling evil-maid-style tampering. There is no public exploit identified at time of analysis, though the flaw is the subject of a Black Hat USA 2026 disclosure ('The Cost of Obscurity'); EPSS is very low (0.11%, 1st percentile) and it is not on CISA KEV.
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
CryptoPro Secure Disk for BitLocker versions before v7.7.4 leaks TPM2.0 unsealing secrets by persisting them in a serialized binary format within unused disk sectors - raw storage areas that survive reboots and are accessible without operating system authentication. An unauthenticated attacker with physical access to the drive can image these sectors, extract the serialized secrets, and reconstruct a compatible TPM environment to unseal the BitLocker volume, effectively defeating the hardware-backed disk encryption the product is designed to enforce. No public exploit code has been identified at time of analysis; CISA SSVC rates exploitation as 'none', but the attack's low complexity once physical access is obtained was detailed publicly in a Black Hat USA 2026 research presentation, materially lowering the skill barrier for motivated actors.
Full-disk-encryption bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 stems from a default TPM PCR sealing policy that ignores the system boot state, letting an attacker with physical access unseal the TPM through an unintended execution path or by relocating the drive/TPM to another hardware platform and recover the BitLocker keys. The flaw was documented in the Black Hat USA 2026 research 'The Cost of Obscurity' by Burch; there is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is low at 0.18% (8th percentile), consistent with a physical-access rather than mass-exploitable weakness.
CryptoPro Secure Disk for BitLocker before v7.7.4 silently falls back to plaintext volume mounting when a decryption error occurs, negating the entire confidentiality guarantee that BitLocker is meant to enforce. Disclosed publicly at Black Hat USA 2026 in research titled 'The Cost of Obscurity' (Burch), the flaw demonstrates how improper error handling in encryption middleware can fully undermine the security layer it wraps. No public exploit code has been identified at time of analysis, though the Black Hat presentation and accompanying whitepaper are publicly available, substantially lowering the knowledge barrier for exploitation; EPSS stands at a low 0.17% but may shift as presentation details circulate.
CryptoPro Secure Disk for BitLocker before v7.7.4 stores initramfs contents in plaintext on disk, allowing a physical attacker to recover cryptographic keys and other secrets without defeating the encryption layer. The vulnerability was publicly disclosed at Black Hat USA 2026 by researcher Burch in a presentation titled 'The Cost of Obscurity,' suggesting the vendor's security model relied on implementation obscurity rather than cryptographic assurance. No public exploit identified at time of analysis; EPSS at 0.17% reflects the physical-access prerequisite that limits widespread automated exploitation.
Protection-mechanism bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets unsigned code run from temporary filesystems because the product fails to enforce its Integrity Measurement Architecture (IMA) policy across those locations. An attacker able to stage a binary in a tmpfs-style path can execute code that the integrity policy was meant to block, undermining the pre-boot/disk-encryption trust model. The flaw was disclosed in Black Hat USA 2026 research ('The Cost of Obscurity', Burch); no public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not in CISA KEV.
Brute-force credential attacks against Mira's cloud authentication endpoints are unrestricted due to the complete absence of per-account rate limiting, per-IP throttling, and account lockout controls, as disclosed in CISA ICS Medical Advisory ICSMA-26-223-01. Affected products include Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 from Quanovate Tech Inc. (operating as Mira / Mira Care), a healthcare-focused IoT platform. An unauthenticated remote attacker can systematically enumerate credentials at arbitrary scale to gain unauthorized access to user accounts, with no public exploit code or CISA KEV listing identified at time of analysis.
Firmware version spoofing in the Mira cloud API allows authenticated users to submit arbitrary firmware version strings for their own registered devices, bypassing server-side validation entirely. Affected products are Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4 by Quanovate Tech Inc., operating in a medical IoT context and reported under CISA ICS-CERT advisory ICSMA-26-223-01. An attacker exploiting this flaw can cause the vendor backend to misrecord their device's patch state, suppressing security update prompts and distorting fleet-wide vulnerability analytics - with no public exploit identified at time of analysis.
Session token exposure in the Mira Android app (Quanovate Tech Inc.) leaks live authentication credentials to third-party web properties and referrer logs whenever users trigger in-app WebView flows such as shop redirects. The app appends the active session token as a URL query string parameter and embeds a persistent user identifier in the WebView User-Agent header, both of which are transmitted to any destination or JavaScript context receiving that traffic. Reported by ICS-CERT under medical advisory ICSMA-26-223-01, this vulnerability affects a healthcare-adjacent platform, amplifying the sensitivity of exposed credentials; no public exploit code or CISA KEV listing has been identified at time of analysis.
OpenSSH sshd before version 10.5 fails to enforce the `restrict` keyword in `authorized_keys` against tunnel forwarding, allowing a constrained SSH key holder to establish tun-device tunnels that the administrator explicitly intended to block. The flaw affects all OpenSSH releases prior to 10.5 and is classified as a policy-enforcement bypass with low integrity impact. No active exploitation is confirmed per SSVC (exploitation: none) and the vulnerability is absent from the CISA KEV catalog, placing this firmly in the low-urgency tier despite OpenSSH's near-ubiquitous deployment footprint.
Use-after-free (CWE-416) in OpenSSH's ssh client component affects all releases before version 10.5, triggered when a specific pair of remote-forwarding operations occur concurrently, causing access to freed realloc'd memory. A malicious or compromised SSH server could exploit this race condition against a connecting client to achieve partial information disclosure or limited memory corruption. No public exploit has been identified and CISA SSVC rates exploitation as none with partial technical impact, consistent with the moderate CVSS score of 4.8.
OpenSSH ssh-agent before version 10.5 permits remote execution of agent operations - including adding authentication tokens and using SSH keys - that were architecturally intended to be restricted to local access only. The trust boundary failure stems from a misinteraction between the agent locking mechanism and the session-bind@openssh.com extension, allowing an authenticated remote actor to cross the local/remote privilege boundary. No public exploit has been identified at time of analysis, and SSVC assessment confirms no current exploitation activity; however, the network-accessible vector and ubiquitous deployment footprint of OpenSSH make patching to 10.5 the appropriate response for any environment using agent forwarding.
Ente 2of3's version 1 card format undermines the information-theoretic guarantee of Shamir secret sharing by storing the secret's byte length and a 32-bit FNV-1a checksum in cleartext on every card, enabling single-card offline attacks. Any party who obtains or photographs one of the three recovery cards - a scenario the scheme was explicitly designed to render harmless - can enumerate low-entropy or predictable candidate secrets against the exposed checksum without needing a second card. The vulnerability affects all 2of3 cards generated before version 2026.07.28; no public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
AdminRenderer in Django REST Framework prior to 3.17.2 discloses unauthorized GET resource data to authenticated users who hold write-but-not-read permissions on a DRF view. When a POST request fails validation and returns a 400 Bad Request, the renderer internally calls view.get() without first invoking view.check_permissions(), embedding the full GET representation in the HTML error response visible to the requester. No public exploit is confirmed in CISA KEV, but SSVC rates exploitation as POC-level; risk is targeted rather than widespread.
Path traversal in Red Hat insights-client allows a compromised spoke (managed cluster) to inject unencoded sequences into the Insights API URL path by manipulating the ClusterID value it controls, redirecting authenticated hub-side requests to unintended API endpoints. Affected deployments include any multi-cluster Red Hat Insights configuration where a spoke cluster could be under adversary control. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Bearer token reuse in the acm-search-v2-api-rhel9 component of Red Hat Advanced Cluster Management exposes federated hub search results to unauthorized authenticated users. The `getFederationConfig` cache refresh incorrectly retains one user's token and applies it to all subsequent federated queries until TTL expiry, enabling cross-tenant information disclosure across remote managed hubs. No public exploit has been identified at time of analysis, and the CVSS High Confidentiality rating is tempered by the AC:H timing dependency required for successful exploitation.
Temporal UI Server versions 2.7.0 through 2.53.1 incorrectly derive the Secure attribute for OAuth authentication cookies from the proxy-to-server connection rather than the browser-facing connection, causing access-token and refresh-token cookies to be issued without Secure when TLS terminates at a reverse proxy forwarding over HTTP. An attacker who can additionally redirect browser traffic for the UI hostname away from HTTPS - beyond merely serving attacker-controlled content - can potentially intercept a live credential transmitted in a plaintext HTTP request. No public exploit code exists and CISA KEV does not list this vulnerability; the SSVC assessment confirms exploitation is currently none and the attack is not automatable, consistent with the very low CVSS 4.0 score of 2.3.
Authenticated annotation slot hijacking in CVAT versions 2.17.0 through 2.71.x enables any user with write access to a single job to deny automatic annotation service to arbitrary other tasks by submitting batch annotation requests with deliberately mismatched task and job IDs. The `RequestViewSet.create` endpoint reserved the single active annotation slot by task ID without validating that the submitted job belonged to that task or that the requester had any access to it, allowing cross-task resource monopolization. No public exploit code exists and the vulnerability is absent from CISA KEV; vendor-confirmed fix is available in v2.72.0.
Privilege escalation in Microsoft OneDrive for macOS exploits improper symbolic link resolution (CWE-59), enabling a locally authorized high-privileged attacker to redirect OneDrive file operations to unintended filesystem locations and gain elevated access beyond their sanctioned scope. Affected versions span 26.0.0.0 up to but not including 26.095.0519.0003 on macOS exclusively. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog, though the full high-high-high CIA impact within the unchanged scope warrants prompt patching for any enterprise deploying OneDrive on macOS endpoints.
Transient execution information disclosure in Intel processors allows a Ring 0 (kernel or hypervisor level) adversary to leak sensitive data across security boundaries into a subsequent system context. The flaw stems from incorrect data forwarding during speculative execution, a class of hardware-level side-channel vulnerability similar to Spectre-class attacks, requiring local access with high privileges and high attack complexity. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation enables high-confidentiality-impact cross-boundary data exposure, threatening hypervisor isolation guarantees critical in virtualized and cloud environments.
Incomplete cleanup (CWE-459) in UEFI firmware for select Intel reference platforms allows a high-privileged local system software adversary to read sensitive residual data that was not properly purged from firmware memory or registers, resulting in high confidentiality impact on the subsequent system layer. The vulnerability requires specific attack conditions (AT:P) and is scoped to Intel reference platforms identified in advisory INTEL-SA-01437. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Use-After-Free in the AMD Ryzen Master Utility Driver exposes kernel memory to a locally authenticated, high-privileged attacker, with the primary confirmed impact being system availability loss. The vulnerability (CWE-416) resides within the driver component bundled with both the Ryzen Master application and its Monitoring SDK, affecting all versions prior to the patched releases. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 5.6 reflects the restricted local, high-privilege attack surface despite the kernel-level nature of the flaw.
Symlink-following in the Windows Container Isolation FS Filter Driver (unionfs.sys) enables a locally authenticated attacker with low privileges to tamper with files outside the expected isolation boundary. Affected systems run Windows 11 version 26H1 builds prior to 10.0.28000.2704. A vendor patch is available; no public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Windows Management Services on Windows 11 contains an improper link resolution flaw (CWE-59) that allows an authenticated local attacker to crash or disable the service by planting a malicious symbolic link or directory junction at a file path the service accesses. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, with patched builds confirmed by Microsoft via MSRC. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel enables remote information disclosure when a user opens a specially crafted spreadsheet. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms that an unauthenticated network-based attacker can trigger the flaw, but only after social engineering a victim into opening a malicious file. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected Office product lines.
Out-of-bounds read in Microsoft Excel exposes sensitive memory contents over a network to unauthenticated remote attackers, resulting in high-confidence information disclosure (C:H). Exploitation requires user interaction - specifically, opening a crafted Excel document - placing this firmly in the phishing/malicious-attachment delivery class. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis, though the patch is available and should be applied promptly given the ubiquity of the affected product across enterprise environments.
Information disclosure in Microsoft Office PowerPoint enables a local attacker to obtain sensitive data from a victim's system by exploiting improper input validation (CWE-20) when processing a malicious file. Affected products span Windows and Mac editions including Office 2019, Microsoft 365 Apps for Enterprise, LTSC 2021/2024, and Office 365 for Mac - all requiring the victim to open a crafted PowerPoint file (UI:R). No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, a vendor patch is available.
Information disclosure in Microsoft Office (spanning 365 Apps for Enterprise, LTSC 2021/2024, Office 2019, and macOS variants) is triggered locally when a user opens a specially crafted document, exploiting improper input validation (CWE-20) to expose sensitive information with high confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) confirms local-only exploitation requiring user interaction, substantially limiting opportunistic mass exploitation. No public exploit has been identified at time of analysis, and Microsoft has released a patch across all affected product lines.
Local information disclosure in Microsoft PowerPoint stems from improper input validation (CWE-20) when processing specially crafted presentation files, affecting a broad range of Office product lines on both Windows and macOS. The CVSS vector (AV:L/UI:R/C:H) confirms that while no special system privileges are required, a victim must open a malicious file, making social engineering the primary delivery mechanism. No public exploit has been identified and no active exploitation is confirmed, but the high confidentiality impact (C:H) warrants prompt patching given the ubiquitous deployment of Microsoft Office.
Information disclosure in Microsoft Office PowerPoint stems from improper input validation (CWE-20) that allows a locally-present attacker to read sensitive data from the vulnerable system when a user opens a crafted file. Affected products span PowerPoint across Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code or active exploitation has been identified at the time of analysis; a vendor patch is available via standard Office update channels.
Microsoft Office Word's document parsing logic fails to properly validate input (CWE-20), enabling a local attacker to read sensitive information from a target system when a victim opens a specially crafted Word document. The flaw affects a broad range of Microsoft Office releases on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, and all LTSC variants through 2024. SSVC assessment confirms no current exploitation activity and the attack is not automatable due to required user interaction, though the CVSS confidentiality impact is rated High.
Improper input validation in Microsoft Office Excel enables a local attacker to disclose sensitive information when a target user opens a specially crafted file. The vulnerability affects a broad swath of Microsoft Office product lines - including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, Office 365 for Mac, and Word 2016 - across both Windows and macOS platforms. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches are available across all affected product lines.
Uninitialized memory disclosure in Microsoft Office exposes sensitive process memory to local attackers who can deliver a crafted document. Affecting a broad range of Office versions across Windows and macOS - including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office 365 for Mac - the flaw yields high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via the August 2026 update cycle.
Improper input validation in Microsoft Office PowerPoint enables local information disclosure when a victim opens a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and their macOS counterparts across both subscription and perpetual-license release tracks. Microsoft has released patches via the standard Office update channel; no public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (Windows and macOS editions, including LTSC 2024, LTSC 2021, 2019, and 365 Apps) enables local information disclosure when a user opens a maliciously crafted document. The CVSS vector (AV:L/UI:R) confirms exploitation is constrained to local, user-triggered scenarios with no code execution or data modification capability. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing exists at time of analysis.
Local information disclosure in Microsoft Office stems from improper input validation (CWE-20), allowing a local attacker who can induce user interaction to read sensitive data from the affected system. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Office 365/LTSC for Mac, with Mac builds patched at 16.112.26081010 and Windows builds addressed via the Microsoft Office Security Releases channel. No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable attack path.
Local information disclosure in Microsoft Office PowerPoint exposes sensitive data when a user opens a crafted file. The flaw, rooted in improper input validation (CWE-20), affects a broad range of Office versions across Windows and macOS including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches via its August 2026 update cycle.
Out-of-bounds read in Microsoft Office Word exposes sensitive memory contents to local attackers via crafted document files. Affected products span Word 2016 through Microsoft 365 Apps for Enterprise on both Windows and Mac platforms, covering a broad enterprise install base. Exploitation requires user interaction - a victim must open a malicious document - but yields high confidentiality impact with no integrity or availability loss. No public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a victim to open a crafted spreadsheet file. The flaw affects a wide range of Office versions across both Windows and macOS platforms, including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. No public exploit or active exploitation has been identified at time of analysis; SSVC assessment rates exploitation as none and the attack as non-automatable, indicating moderate real-world urgency despite the High confidentiality impact rating.
Incomplete resource cleanup in Microsoft Office PowerPoint exposes sensitive document data to local attackers across multiple supported product lines, including Microsoft 365 Apps for Enterprise, Office LTSC 2024, LTSC 2021, Office 2019, and PowerPoint 2016. Exploitation requires a victim to open or interact with a PowerPoint file (UI:R), after which residual data - likely temporary files, memory buffers, or cached presentation content - persists in a locally accessible state without requiring attacker privileges. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, keeping real-world risk moderate despite the high confidentiality impact rating.
Out-of-bounds read in Microsoft Excel exposes process memory to local information disclosure across a wide range of Office versions, from Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC releases on both Windows and macOS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms exploitation requires the victim to open a specially crafted spreadsheet file, making phishing-delivered documents the realistic delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Excel triggers information disclosure when a victim opens a specially crafted spreadsheet file, exposing potentially sensitive memory contents to a local attacker. The flaw spans multiple Office product lines - Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and corresponding Mac variants - with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified and SSVC confirms no known exploitation; a vendor patch is available via the Microsoft Security Response Center.
Information disclosure in Microsoft Excel arises from use of uninitialized memory (CWE-908), exposing potentially sensitive heap or stack contents to an attacker when a victim opens a maliciously crafted Excel file. Affected products span the full Microsoft Office portfolio on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, Excel 2016, and their Mac counterparts. No public exploit identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Out-of-bounds read in Microsoft Excel enables local information disclosure when a user opens a specially crafted spreadsheet. Multiple product lines are affected across Windows and macOS, spanning Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise. Microsoft has released patches; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in Microsoft Office exposes memory contents to local information disclosure across a wide range of affected products including Word 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office 365/LTSC for Mac. The CVSS vector (AV:L/UI:R/C:H) indicates exploitation requires a victim to open a specially crafted Office document, after which sensitive in-process memory can be disclosed to the attacker. No public exploit has been identified at time of analysis, no KEV listing exists, and Microsoft has released patches across all affected product lines.
Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality data to a local attacker when a user opens a crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the high confidentiality impact and wide deployment footprint make patching a clear priority.
Microsoft Dynamics 365 on-premises version 9.1 exposes sensitive information to authenticated network attackers via an improper access control flaw (CWE-200), allowing disclosure of data beyond a user's authorization level. The CVSS vector (PR:L) confirms exploitation requires a valid low-privilege account, limiting exposure to insider threats or compromised credentials rather than unauthenticated external actors. No public exploit code and no active exploitation have been identified; SSVC rates this as non-automatable with partial technical impact, consistent with a medium-priority finding.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Local privilege escalation in Windows DNS affects a broad range of Windows client and server operating systems, enabling an already-authenticated local attacker to gain elevated privileges on the target system. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the attacker requires high existing privileges - consistent with the description's reference to an 'authorized attacker' - yet can achieve full confidentiality, integrity, and availability impact post-exploitation. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; a vendor-released patch is available via Microsoft's Update Guide.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Out-of-bounds read in Microsoft Word's document parsing engine exposes sensitive in-process memory to a local attacker across Office 2016 through LTSC 2024 and macOS variants. Exploitation requires a victim to open a specially crafted document, making social engineering or phishing the primary delivery mechanism. No public exploit code exists and no active exploitation has been identified (not in CISA KEV); SSVC assessment rates exploitation status as none and technical impact as only partial.
Out-of-bounds memory read in Microsoft Office exposes potentially sensitive process memory contents when a victim opens a specially crafted document locally. The vulnerability affects the full Office suite across Windows and macOS - spanning Office 2016 through LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - with High confidentiality impact per CVSS but no integrity or availability consequence. No public exploit has been identified at time of analysis; CISA SSVC classifies exploitation status as none and the attack is not automatable, significantly reducing real-world prioritization urgency despite the High C rating.
Out-of-bounds read in Microsoft Office Word exposes potentially sensitive memory contents to local attackers when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021 and 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise across both Windows and macOS platforms, with vendor-confirmed patches available. No public exploit code exists and CISA SSVC rates exploitation likelihood as none with only partial technical impact, making this a medium-priority patching item despite the High confidentiality score assigned by CVSS.
Out-of-bounds read in Microsoft Office Word's document parser enables local information disclosure across Windows and Mac product lines, including Office 2016, 2019, 2021, 2024 LTSC, and Microsoft 365 Apps. An attacker who supplies a crafted Word document can cause the application to read beyond allocated memory boundaries, leaking high-confidence memory contents to the attacker. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, though the broad affected product surface and low attack complexity make it a credible phishing delivery vehicle.
Out-of-bounds read (CWE-125) in Microsoft Office enables a local, unauthenticated attacker to disclose sensitive memory contents by convincing a user to open a specially crafted Office document. Affected products span the full modern Office portfolio - Office 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable delivery, placing this in a lower operational urgency tier despite the High confidentiality impact rating.
Out-of-bounds read (CWE-125) in Microsoft Office Word exposes memory contents to a local, unauthenticated attacker who can trick a user into opening a crafted document, resulting in high-confidence information disclosure with no integrity or availability impact. The vulnerability spans eight distinct Office product lines across Windows and Mac, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, broadening the exposure surface considerably. No public exploit code or active exploitation has been identified per SSVC (Exploitation: none); Microsoft has released patches via the standard Office update channel.
Out-of-bounds read (CWE-125) in Microsoft Office exposes sensitive memory contents to local attackers who can persuade a user to open a specially crafted document. Affected products span multiple Office generations including Office 2016, 2019, 2021, 2024, LTSC variants, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable delivery, aligning with the local, user-interaction-dependent CVSS vector.
Out-of-bounds read in Microsoft Office Word exposes high-confidentiality memory contents when a user opens a specially crafted document locally. Affected products span Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise, confirmed via EUVD-2026-56423. No public exploit identified at time of analysis and no CISA KEV listing; vendor patch is available, placing this in the routine-patch-cycle priority tier rather than emergency response.
Out-of-bounds read in Microsoft Office exposes sensitive in-process memory contents to local attackers who socially engineer a victim into opening a crafted document. The flaw spans the full Microsoft Office portfolio across Windows and macOS - from Office 2016 through Microsoft 365 Apps for Enterprise - making it broadly relevant for enterprise patch management. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Spoofing in Microsoft SharePoint Server allows an authenticated low-privilege network attacker to manipulate content presentation or deceive users through improper input validation, achieving limited confidentiality and integrity impact. Affected deployments span SharePoint Server 2016 Enterprise, 2019, and Subscription Edition across a wide range of versions prior to their respective Microsoft-patched builds. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires both a low-privilege authenticated session and victim user interaction, constraining realistic threat scope.
Information disclosure in Windows Presentation Foundation (WPF) within .NET 8, 9, and 10 allows an unauthenticated network attacker to exfiltrate sensitive data when a target user opens a specially crafted document. The WPF document parser resolves external references from attacker-controlled URIs - an SSRF-adjacent primitive (CWE-829, CWE-918) - causing outbound network requests that can expose authentication tokens or internal metadata to the attacker's infrastructure. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected .NET and Visual Studio versions.
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver exposes kernel memory contents to local authenticated attackers across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. Exploitation requires only a low-privileged local account (CVSS PR:L, AV:L), yielding high confidentiality impact with no integrity or availability consequence. No public exploit code exists and SSVC exploitation status is confirmed 'none', though the broad platform footprint and low-privilege bar make this a meaningful patch priority for multi-user and shared-access environments.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to local attackers who can socially engineer a victim into opening a malicious document. Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise across both Windows and macOS. No public exploit code is identified and SSVC rates exploitation as none, but the high confidentiality impact warrants timely patching for organizations whose users regularly handle documents from untrusted sources.
Credential exposure in Microsoft SharePoint Server (CWE-522) enables an authenticated network attacker to intercept insufficiently protected credentials and perform identity spoofing against the affected deployment. All three active on-premises SharePoint release lines are confirmed affected - 2016 Enterprise, 2019, and Subscription Edition - with patched thresholds provided by EUVD. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard SharePoint user account, with high confidentiality impact; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
Integer underflow in the Windows DHCP Server service exposes adjacent-network unauthenticated attackers to high-confidentiality memory disclosure across a broad range of Windows Server releases from 2012 through 2025, plus Windows 10 1607 and 1809. The root cause (CWE-125 out-of-bounds read triggered by arithmetic underflow) allows a crafted DHCP packet to cause the server to read and return memory beyond the intended buffer boundary. No active exploitation is confirmed (not in CISA KEV) and SSVC rates exploitation status as none; a vendor patch is available via the Microsoft Security Response Center.
Windows Win32K contains an untrusted pointer dereference (CWE-822) that allows a locally authenticated attacker to disclose sensitive kernel or process memory contents. Affected systems include multiple Windows 11 release branches (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, both full and Server Core installations. No public exploit has been identified at time of analysis and exploitation has not been confirmed by CISA KEV; Microsoft has released patches addressing all affected build ranges.
Out-of-bounds read in the Windows NTFS driver exposes sensitive memory contents to locally authenticated attackers across a wide range of Microsoft Windows and Windows Server releases. The flaw (CWE-125) allows a low-privileged local user to read kernel or process memory beyond intended boundaries, resulting in information disclosure with high confidentiality impact but no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem allows any locally authenticated low-privilege user to disclose sensitive kernel memory contents without user interaction. The flaw spans an exceptionally broad range of affected Windows versions, from Server 2012 through Windows 11 25H2, significantly widening enterprise exposure. No active exploitation has been confirmed in CISA KEV and no public exploit has been identified at time of analysis, though kernel memory disclosure from Win32K is strategically valuable as a KASLR-bypass primitive in chained privilege escalation attacks.
Integer underflow (CWE-125) in the Windows DHCP Server service exposes server memory contents to unauthenticated attackers positioned on the same adjacent network segment. Affecting Windows Server versions from 2012 through 2025 (confirmed by ENISA EUVD-2026-56370), the flaw allows crafted DHCP packets to trigger an out-of-bounds read, resulting in high-confidence confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact - a vendor patch is available via Microsoft MSRC.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory contents to a locally authenticated low-privilege attacker across a wide swath of Windows desktop and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. The impact is strictly information disclosure - high confidentiality loss with no integrity or availability effect - making this most practically useful as a KASLR-bypass building block in a multi-stage local privilege escalation chain. No public exploit or active exploitation has been identified; SSVC classifies exploitation status as none and technical impact as partial.
Integer underflow in the Windows DHCP Server service exposes out-of-bounds memory to unauthenticated attackers on the adjacent network, enabling high-impact information disclosure across multiple Windows Server generations from 2012 through 2025. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, only Layer 2 or broadcast-domain adjacency to a host running the DHCP Server role. Microsoft has released patches for all affected builds; no public exploit code has been identified and the vulnerability does not appear in CISA KEV at time of analysis.
Windows Imaging Component (WIC) across a broad span of Windows 10, Windows 11, and Windows Server releases contains an uninitialized memory read flaw (CWE-908) that an authorized local user with low privileges can exploit to disclose sensitive information from process memory. The CVSS vector (AV:L/PR:L/C:H/I:N/A:N) confirms this is strictly a local, low-privilege information disclosure with no network attack surface and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; a vendor-released patch is confirmed via the Microsoft MSRC advisory.
Out-of-bounds read in Windows Management Instrumentation (WMI) enables a locally authenticated, low-privileged attacker to disclose potentially sensitive information from process memory. Affecting a broad sweep of Windows client and server releases from Windows Server 2012 through Windows 11 26H1, the flaw is rooted in a memory safety defect in the WMI subsystem (CWE-125). No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected product lines.
Information disclosure in Windows DHCP Server across six major Windows Server generations exposes heap or stack memory contents to unauthenticated adjacent-network attackers via an integer underflow defect. The vulnerability affects all Windows Server editions from 2012 through 2025 that have the DHCP Server role installed and running, with exploitation constrained to Layer 2 adjacency rather than the open internet. A vendor-released patch is available from Microsoft MSRC; no public exploit code has been identified at time of analysis.
Information disclosure via integer underflow in the Windows DHCP Server service exposes server process memory to unauthenticated attackers on the same network segment, affecting Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 where the DHCP Server role is installed. The root cause is a CWE-125 out-of-bounds read triggered when an integer underflows and wraps around, causing DHCP packet-processing code to read memory outside intended bounds and potentially return it in a server response. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with partial technical impact, indicating contained but real risk requiring timely patching.
Integer underflow (CWE-125, out-of-bounds read) in the Windows DHCP Server service allows an unauthenticated attacker on an adjacent network segment to disclose sensitive memory contents. Affected systems span Windows Server 2012 through 2025 and certain Windows 10 builds running the DHCP Server role. No public exploit has been identified at time of analysis, and a vendor patch is available via Microsoft's July 2026 update cycle.
Out-of-bounds memory read in the Windows DHCP Server service exposes sensitive server memory to unauthenticated attackers on the adjacent network. The root cause is an integer underflow (CWE-125) in DHCP packet processing, where a miscalculated length or index wraps around, causing the service to read and potentially return memory beyond intended buffer boundaries. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected Windows Server versions via the August 2026 Patch Tuesday cycle.
Information disclosure in the Windows DHCP Server service allows unauthenticated attackers on adjacent network segments to read out-of-bounds server memory via a malformed DHCP request that triggers an integer underflow. Affected builds span Windows Server 2012 through Windows Server 2025, as well as Windows 10 versions 1607 and 1809, making the version footprint unusually wide for a single service-role flaw. No public exploit has been identified at time of analysis and CISA's SSVC framework rates exploitation as none with non-automatable characteristics, though the high confidentiality impact and the breadth of affected builds warrant prompt patching.