Memory Corruption
Monthly
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Heap out-of-bounds write in FreeRDP before 3.32.0 allows a malicious RDP server to corrupt a connecting client's memory by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially enabling code execution through heap corruption. The flaw is in general_LumaToYUV444 and general_ChromaV2ToYUV444 and triggers when an odd-height region rectangle ends exactly at the surface height, causing writes past the U/V planes. Exploitation requires the victim's client to initiate or accept an RDP session with an attacker-controlled or compromised server and negotiate the affected H.264 YUV444 codec; no public exploit identified at time of analysis, and clients limited to trusted RDP hosts face substantially lower realistic risk.
Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.
Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.
Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).
Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.
Memory corruption in the snap7 S7 communication library (through version 1.4.3) allows a rogue or impersonated PLC to overflow client-side buffers while handling ReadVar responses, crashing SCADA, HMI, gateway, and custom S7 client processes and corrupting their memory. The flaw is unauthenticated from the protocol perspective (PR:N) and needs no user interaction, but per the authoritative assessment it is only reachable when the attacker already occupies a trusted position in the S7 path of the victim client - an attacker-controlled, spoofed, or MITM'd PLC endpoint (the condition encoded by CVSS 4.0 AT:P); clients that communicate only with legitimate PLCs cannot be triggered. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; CVSS 4.0 base 8.3 (High), with the independent assessment scoring CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
Out-of-bounds write in the Eclipse NetX Duo TLS 1.3 client lets a malicious or compromised server corrupt memory past the caller-supplied TLS packet buffer by returning a HelloRetryRequest containing an oversized cookie; the copy happens before certificate authentication completes, so no valid certificate is required. It is remotely triggerable without authentication (CVSS:4.0 base 9.3; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects only devices acting as TLS 1.3 clients that initiate an outbound handshake to an attacker-controlled or MITM-positioned server. No public exploit code or CISA KEV entry was identified at time of analysis.
Heap out-of-bounds write in Eclipse ThreadX GUIX's binary theme resource loader (gx_binres_theme_load) lets a crafted binary resource (theme) file overwrite memory past the end of the loader's own arena with bytes taken verbatim from the file, producing high confidentiality, integrity, and availability impact on the affected process. The vector is local rather than network-reachable: an attacker must get the malformed theme file onto the device and the target application must actively load it (CVSS 4.0 AV:L/UI:A; assessed CVSS 3.1 AV:L/UI:R, PR:N, so no privileges are needed once the file is loaded), and deployments that only load theme resources compiled into firmware, or that never accept externally sourced theme files, are not exposed. GX_BINARY_RESOURCE_SUPPORT is enabled in the shipped default configuration, so no special build option is required for the flaw to be reachable; no public exploit code was identified at time of analysis, and no caller-side workaround is possible because the public API takes no buffer-size parameter.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).
A denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent, unauthenticated attacker who sends crafted IS-IS traffic to a device where both IS-IS link protection and backup-selection are configured, causing an out-of-bounds write in the routing protocol daemon (rpd) that crashes or destabilizes the device. Only routers running these non-default IS-IS feature combinations are exposed, and the attacker must already hold a Layer 2 segment or IS-IS adjacency position (adjacent network, AV:A) rather than reaching the device over the internet. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed Junos OS and Junos OS Evolved builds.
An out-of-bounds write (CWE-787) in the lacpd daemon of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to crash the device - a denial of service - by sending a crafted frame to an aggregated-Ethernet member port that has LACP enabled. The attacker needs no authentication or user interaction (PR:N/UI:N) and must be positioned on the same local broadcast domain or directly attached to the member port (AV:A), so this is not an internet-reachable flaw; impact is availability-only (VC:N/VI:N/VA:H, with low subsequent-system availability impact SA:L in the CVSS 4.0 vector, assessed as CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The independent assessment rates this as a genuine but bounded operational risk rather than an emergency: exposure depends entirely on LACP being configured on an AE member port, and no public exploit has been identified at time of analysis (the CVE is not listed in CISA KEV, and no POC is referenced in the available intelligence).
Denial of service in the Juniper Junos OS rpd routing process is possible when the non-default Auto-RP mapping feature is enabled, allowing an unauthenticated attacker on an adjacent network segment to send crafted Auto-RP mapping announcements that trigger an out-of-bounds write (CWE-787) and crash the routing plane. Juniper rates this CVSS 4.0 7.1, and our independent assessment concurs it is a moderate-priority availability issue rather than a critical emergency; no public exploit code or CISA KEV entry was identified at time of analysis. The attacker must be within the PIM multicast domain and cannot reach the device from the general internet.
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241, and QFX5250 switches configured for BGP global-load-balancing with more than 128 ECMP next-hops allows unauthenticated adjacent-network attackers to crash rpd, causing a denial of service. This moderate-severity (CVSS 6.5) flaw is availability-only; exploitation requires the specific hardware and non-default routing configuration, and no public exploit code has been identified at time of analysis. Devices not configured for BGP global-load-balancing or with 128 or fewer ECMP next-hops are not affected.
Buffer overflow in the DPDK vhost-user backend's split-ring inflight descriptor table handling allows a guest VM with code execution to corrupt host memory, potentially leading to code execution on the host. This high-severity flaw (CVSS 8.8) is the most critical issue in a bundled DPDK security advisory and affects multi-tenant deployments where the split-ring inflight feature-used for vhost-user reconnection and live migration-is enabled. No public exploit code has been identified at the time of analysis.
Heap out-of-bounds read and write in the DPDK Generic Segmentation Offload (rte_gso) library can be triggered when an application enables GSO on its packet path and is configured with small or undersized mbuf pools relative to the segmentation workload, letting network-delivered traffic corrupt memory in the data plane. The vendor-published CVSS 3.1 base score is 8.6 (High) on a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating a network-reachable, unauthenticated, low-complexity heap out-of-bounds read/write; our independent assessment keeps the network-reachable, unauthenticated profile but assesses higher attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) because exploitation is gated on the non-default-looking small-mbuf-pool configuration together with GSO actually being enabled. Impact is dominated by availability (A:H), so the realistic outcome is a data-plane crash rather than full host compromise, with only partial confidentiality and integrity effects; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in GStreamer's gst-plugins-base plugin library lets a local attacker who controls the sending side of a GStreamer inter-process IPC pipeline corrupt memory in the receiving process, yielding a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. The victim process maps a crafted video buffer whose GstVideoMeta declares plane strides and offsets larger than the actual backing allocation, causing out-of-bounds reads and writes that can crash the process or potentially permit code execution in its context. Exploitation is strictly local and requires a deployment where GStreamer buffers cross a trust boundary between a less-trusted producer and a more-trusted consumer; no user interaction or authentication to the victim is needed, and no public exploit has been identified at time of analysis.
Use-after-free in curl's HTTP/2 client code (curl 8.12.0 through 8.22.0) can corrupt memory when a server answers an in-progress upload with an HTTP/2 RST_STREAM frame carrying the HTTP_1_1_REQUIRED or REFUSED_STREAM reason code, freeing the internal struct Curl_easy object while it is still referenced by the transfer state machine. The flaw is remote and requires no authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but exploitation is conditional: the victim must be uploading over a negotiated HTTP/2 connection to an endpoint the attacker controls or influences, and the RST_STREAM must land at the right point in the transfer lifecycle, which is why the assessed complexity is High. Publicly available exploit code exists (SSVC Exploitation: poc) and CISA's framework rates technical impact as total, yet there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.23% (12th percentile); a vendor patch is available. The same flaw affects libcurl and therefore every downstream application and distribution shipping an affected build.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.
Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.
In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
Use-after-free in Google Chrome's DOM implementation before 155.0.8059.79 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. The flaw affects desktop stable and extended-stable channels and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with exploitation limited by the requirement for user interaction and by the renderer sandbox preventing direct host compromise without a separate sandbox escape. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.
Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.
Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.
Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.
Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Use-after-free in Google Chrome's Media component before version 155.0.8059.79 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a user to open a crafted HTML page that drives the vulnerable media-parsing code path. Exploitation requires user interaction (the victim must navigate to or be redirected to attacker-controlled content), and the resulting code execution is confined to the sandbox, meaning host compromise would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, EPSS is low (0.21%, 11th percentile), and Google has released a fixed build, so risk is serious but not emergency-level; priority should follow normal rapid-patching timelines.
Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.
Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Out-of-bounds write in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) allows an attacker to execute arbitrary code in the context of the current user when the victim opens a malicious file. The flaw is a local, client-side memory corruption issue (AV:L, UI:R) that requires user interaction but no privileges; no public exploit has been identified at time of analysis. This is a high-severity flaw but not an emergency-tier internet-facing threat due to the human-in-the-loop prerequisite and user-level impact.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.
Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).
Out-of-bounds write in Adobe Photoshop Desktop running builds at or below 26.11.7 (and at or below 27.10 per ENISA EUVD data) allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. Because exploitation requires the victim to manually open a malicious file on their own system, the attack vector is local-only and depends on user interaction, and any code that runs inherits only the opening user's privileges (no privilege escalation). This is a genuine but operationally moderate-priority issue: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local plus user-interaction prerequisites materially reduce real-world risk.
Out-of-bounds write in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) allows an attacker to execute arbitrary code in the context of the current user when a victim opens a malicious file. The vulnerability requires user interaction (opening the file) and has a local attack vector, with a CVSS 3.1 base score of 7.8 High. No public exploit code has been identified at time of analysis.
Local privilege escalation in Microsoft SQL Server allows an authorized, low-privileged principal with existing access to the database host to exploit a use-after-free memory condition (CWE-416) and run code in a more privileged security context. Affected builds span SQL Server 2019, 2022, and 2025 on versions below the fixed GDR and CU releases published with Microsoft's January 2026 update. Exploitation is constrained by the local attack vector (AV:L) and high attack complexity (AC:H), since the attacker must already be authenticated on the host and win a memory-reuse/timing race; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available.
Opening an attacker-supplied file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds write that leads to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is strictly local and client-side: there is no network-facing service to hit, and the victim must be socially engineered into opening a malicious asset in their own session. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the practical risk is bounded by the required user interaction and the specialized deployment of this creative tooling, which favors targeted delivery over opportunistic mass exploitation.
Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.
Out-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, meaning an attacker must first deliver a malicious asset and persuade the victim to open it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8). The high confidentiality, integrity and availability impacts are tempered by the local attack vector, the unchanged scope (no privilege escalation beyond the current user) and the mandatory user-interaction step, so this is not a wormable or remotely reachable flaw. No public exploit identified at time of analysis; CISA KEV status is not indicated and the flaw is tracked by Adobe as APSB26-169 / ENISA EUVD-2026-100699.
Out-of-bounds write in Adobe Bridge (versions up to and including 15.1.8 and 16.0.7) can let an attacker execute arbitrary code in the context of the current user when a crafted file is opened. The attack is local and requires the victim to open a malicious file (UI:R), so delivery of the file to the target and a user action are both prerequisites; no authentication is required of the attacker and complexity is low once the file is opened. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the vendor advisory (APSB26-167) is the authoritative fix reference. Given the mandatory user interaction and local delivery requirement, this is a credible but second-tier priority rather than an urgent remotely exploitable issue.
Out-of-bounds write in Adobe Bridge allows a local attacker to achieve arbitrary code execution in the context of the current user when a victim opens a malicious file. Affected versions are Adobe Bridge 15.1.8 and earlier, and 16.0.7 and earlier. Exploitation requires user interaction (opening a crafted file) and no elevated privileges, but the attack is local. No public exploit code has been identified at time of analysis, and the flaw is rated CVSS 7.8, making it a legitimately actionable local code-execution flaw but not a drop-everything emergency.
Out-of-bounds write in Adobe Bridge - versions 15.x through 15.1.8 and 16.x through 16.0.7 - can result in arbitrary code execution in the context of the current user when a victim opens or previews a crafted file. The issue is local in reach (AV:L) and requires attacker-induced user interaction (UI:R), with no authentication or elevated privileges needed (PR:N) and low attack complexity (AC:L) once the file is opened, yielding a CVSS 3.1 base score of 7.8. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical barrier for an attacker remains the social engineering needed to convince a target on an unpatched version to open the malicious file.
An out-of-bounds write in Adobe Photoshop Desktop (builds up to and including 27.10, and the 26.x line up to and including 26.11.7) lets an attacker corrupt process memory and achieve arbitrary code execution with the privileges of the user who opened the file. Exploitation is not remote: it requires a victim to open a crafted image or project file (CVSS 3.1 base 7.8, AV:L/PR:N/UI:R), so a successful attack depends on social engineering to deliver and convince the user to open the document. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) is possible via an out-of-bounds write when a victim opens a crafted file. Exploitation requires user interaction and is limited to the context of the current user; no public exploit identified at time of analysis. The CVSS score is 7.8, and the vulnerability is not known to be actively exploited.
An out-of-bounds write (CWE-787) in Adobe Dimension 4.1.8 and earlier allows arbitrary code execution at the privilege level of the user who opens a specially crafted file, such as a malicious Dimension project or imported 3D asset. Exploitation is local and depends entirely on victim interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) - the attacker must deliver a file the user then opens, so this is not a remotely triggerable, wormable flaw; no public exploit code identified at time of analysis and the CVE is not in CISA KEV. The practical risk is genuine but operationally constrained by the mandatory user action, the local delivery requirement, and the shrinking installed base of what our assessment describes as a discontinued product.
Arbitrary code execution is possible in Adobe Substance 3D Stager 3.1.8 and earlier, where a use-after-free (CWE-416) is triggered while the application processes a crafted file. The CVSS v3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) shows no authentication is required, but the attacker must deliver the malicious file locally and convince the victim to open it, after which code runs only with the privileges of the current user. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the practical risk is driven by social-engineering delivery and by the fact that a crash (denial of service) is also achievable from the same corrupting file.
Arbitrary code execution in Adobe Substance 3D Stager 3.1.8 and earlier is possible via an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, such as a 3D asset or project file, in the application. The flaw carries a CVSS 3.1 base score of 7.8 (HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attack is local-only with no network path, requires victim user interaction to open the file, and needs no prior privileges, but grants full confidentiality, integrity, and availability impact through code execution in the context of the current user. There is no public exploit identified at time of analysis (not in CISA KEV, no POC referenced), so the practical risk depends on an attacker's ability to socially engineer a designer or artist into opening a booby-trapped asset.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local, user-interaction-required flaw (CVSS 7.8) stems from improper memory handling (CWE-787) during file/asset parsing; no public exploit code has been identified at time of analysis, and exploitation requires the attacker to deliver a crafted file to the target workstation. Successful exploitation grants code execution with the privileges of the Stager user, with high impact to confidentiality, integrity, and availability.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier permits arbitrary code execution in the context of the current user when a victim opens a crafted file. The flaw is local (AV:L), requires user interaction (UI:R), and needs no privileges (PR:N), so exploitation depends on social engineering rather than remote autonomous triggering. No public exploit or confirmed active exploitation (CISA KEV) is identified at time of analysis, making this a high-priority patch item but not an emergency per the independent assessment.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, and Adobe's PSIRT has published advisory APSB26-170 covering the issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.8 High on the strength of full confidentiality, integrity and availability impact, but the attack is not remotely triggerable: the attacker must deliver a malicious file and convince a victim to open it, and any resulting code runs only with that user's privileges, with no privilege escalation beyond the current user. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); exploitation is neither automatable nor network-reachable, so risk concentrates on targeted file-delivery campaigns against individual Stager users.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when the victim opens a maliciously crafted 3D project or asset file. The attack path is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), with no network-facing trigger and no privilege escalation beyond the rights of the user who opens the file. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but not emergency-grade priority, where the practical risk is driven by social engineering that convinces a Stager user to open attacker-supplied content.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when a victim opens a crafted 3D asset or scene file. The flaw is a client-side file-parsing issue (CWE-787) with a local attack vector and required user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8); no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). Attackers must deliver a malicious file to the target and induce the user to open it, which limits exposure to systems where untrusted Stager files are processed.
An out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted 3D project or asset file. The attack is local in nature (AV:L) and depends entirely on user interaction (UI:R) - the victim must be socially engineered into opening the malicious file - and the resulting code runs with the victim's own privileges rather than elevated rights (no privileges are required per PR:N). At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, so this is assessed as a moderate-priority, not emergency, memory-corruption flaw whose primary risk is targeted, file-based social engineering against individual Substance 3D Stager workstations.
Arbitrary code execution in Adobe Substance 3D Stager 3.1.8 and earlier is achievable when a user is persuaded to open a maliciously crafted file, allowing an unauthenticated attacker to corrupt memory out of bounds and run code in the context of the current user. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local, file-based flaw with no network attack surface, where the mandatory user interaction of opening an untrusted file is the principal limiting factor; impact is confined to the victim user's privileges rather than the whole system. No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
A use-after-free in the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService) lets an attacker who already holds a low-privileged local session elevate privileges on the affected host, with high impact to confidentiality, integrity and availability. Microsoft scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the affected service ships enabled by default across the listed Windows 10, Windows 11 and Windows Server 2019 build ranges, so exposure depends almost entirely on whether untrusted users can obtain interactive or code-execution access to the machine. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a credible but not emergency-tier patch priority rather than an actively exploited emergency; the limiting factor is the local attack vector, since there is no network-reachable exploitation path.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.
Use-after-free in Microsoft's Remote Desktop Client (mstsc) allows an attacker who controls an RDP server to execute arbitrary code on the machine of any user who connects to it, with high confidentiality, integrity and availability impact (CVSS 7.5; AV:N/AC:H/PR:N/UI:R). Exploitation is not a passive drive-by: the victim must launch the client and initiate or accept the RDP connection to the attacker-controlled or compromised server, and the High attack complexity reflects the heap grooming or race conditions needed for reliable code execution. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records Exploitation=none and Automatable=no, so wormable or mass automation is not expected; the realistic risk is confined to environments whose users connect to untrusted or externally controlled RDP endpoints.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.
Memory corruption in Microsoft Excel lets a remote, unauthenticated attacker execute code in the context of the user who opens a specially crafted spreadsheet. The flaw is a use-after-free (CWE-416) triggered while Excel parses the malicious document, and it affects Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 on Windows, and Office/Office LTSC for Mac 2021 and 2024. The decisive limiting factor is the required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8): there is no zero-click or server-side path, so exploitation depends on social engineering to get a victim to open the file; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied. This makes it a genuine high-priority patch item rather than a drop-everything emergency.
Use-after-free in Microsoft Excel enables remote code execution when a victim opens an attacker-crafted workbook; the attacker needs no authentication (PR:N) but must convince the user to open the file (UI:R), as reflected in the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Successful exploitation runs code in the context of the opening user with high confidentiality, integrity, and availability impact, and default Excel configurations on the listed builds are affected. Vendor patches are available with specific fix builds (e.g., 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024, and 16.0.10417.20228 for Office Online Server), and no public exploit code was identified at time of analysis, making this a genuine high-priority patch-worthy issue but not an emergency at the time of analysis.
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Heap out-of-bounds write in FreeRDP before 3.32.0 allows a malicious RDP server to corrupt a connecting client's memory by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially enabling code execution through heap corruption. The flaw is in general_LumaToYUV444 and general_ChromaV2ToYUV444 and triggers when an odd-height region rectangle ends exactly at the surface height, causing writes past the U/V planes. Exploitation requires the victim's client to initiate or accept an RDP session with an attacker-controlled or compromised server and negotiate the affected H.264 YUV444 codec; no public exploit identified at time of analysis, and clients limited to trusted RDP hosts face substantially lower realistic risk.
Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.
Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.
Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).
Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.
Memory corruption in the snap7 S7 communication library (through version 1.4.3) allows a rogue or impersonated PLC to overflow client-side buffers while handling ReadVar responses, crashing SCADA, HMI, gateway, and custom S7 client processes and corrupting their memory. The flaw is unauthenticated from the protocol perspective (PR:N) and needs no user interaction, but per the authoritative assessment it is only reachable when the attacker already occupies a trusted position in the S7 path of the victim client - an attacker-controlled, spoofed, or MITM'd PLC endpoint (the condition encoded by CVSS 4.0 AT:P); clients that communicate only with legitimate PLCs cannot be triggered. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; CVSS 4.0 base 8.3 (High), with the independent assessment scoring CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
Out-of-bounds write in the Eclipse NetX Duo TLS 1.3 client lets a malicious or compromised server corrupt memory past the caller-supplied TLS packet buffer by returning a HelloRetryRequest containing an oversized cookie; the copy happens before certificate authentication completes, so no valid certificate is required. It is remotely triggerable without authentication (CVSS:4.0 base 9.3; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects only devices acting as TLS 1.3 clients that initiate an outbound handshake to an attacker-controlled or MITM-positioned server. No public exploit code or CISA KEV entry was identified at time of analysis.
Heap out-of-bounds write in Eclipse ThreadX GUIX's binary theme resource loader (gx_binres_theme_load) lets a crafted binary resource (theme) file overwrite memory past the end of the loader's own arena with bytes taken verbatim from the file, producing high confidentiality, integrity, and availability impact on the affected process. The vector is local rather than network-reachable: an attacker must get the malformed theme file onto the device and the target application must actively load it (CVSS 4.0 AV:L/UI:A; assessed CVSS 3.1 AV:L/UI:R, PR:N, so no privileges are needed once the file is loaded), and deployments that only load theme resources compiled into firmware, or that never accept externally sourced theme files, are not exposed. GX_BINARY_RESOURCE_SUPPORT is enabled in the shipped default configuration, so no special build option is required for the flaw to be reachable; no public exploit code was identified at time of analysis, and no caller-side workaround is possible because the public API takes no buffer-size parameter.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved, where a specifically malformed BGP UPDATE sent by an eBGP peer that did not negotiate the four-octet-AS (RFC 6793) capability triggers an out-of-bounds write in the routing protocol daemon (rpd), disrupting or crashing the routing control plane on affected devices. The CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N/VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) both characterize this as a pure availability-only flaw with no confidentiality or integrity impact. Although PR:N, exploitation is not reachable by an arbitrary off-path internet host: the attacker must hold (or be able to spoof/inject into) an established eBGP session with the target device, and the device must be running BGP with at least one such eBGP neighbor. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Juniper has released fixed builds.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP EVPN peer to crash the routing protocol daemon (rpd) via BGP EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribed. Exploitation requires two non-default preconditions: an established EVPN peering session and an active telemetry sensor subscription; the impact is availability-only (rpd crash) with automatic recovery after daemon restart and reconvergence. No public exploit identified at time of analysis; vendor patch available (see Juniper advisory JSA112187).
A denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent, unauthenticated attacker who sends crafted IS-IS traffic to a device where both IS-IS link protection and backup-selection are configured, causing an out-of-bounds write in the routing protocol daemon (rpd) that crashes or destabilizes the device. Only routers running these non-default IS-IS feature combinations are exposed, and the attacker must already hold a Layer 2 segment or IS-IS adjacency position (adjacent network, AV:A) rather than reaching the device over the internet. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed Junos OS and Junos OS Evolved builds.
An out-of-bounds write (CWE-787) in the lacpd daemon of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to crash the device - a denial of service - by sending a crafted frame to an aggregated-Ethernet member port that has LACP enabled. The attacker needs no authentication or user interaction (PR:N/UI:N) and must be positioned on the same local broadcast domain or directly attached to the member port (AV:A), so this is not an internet-reachable flaw; impact is availability-only (VC:N/VI:N/VA:H, with low subsequent-system availability impact SA:L in the CVSS 4.0 vector, assessed as CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The independent assessment rates this as a genuine but bounded operational risk rather than an emergency: exposure depends entirely on LACP being configured on an AE member port, and no public exploit has been identified at time of analysis (the CVE is not listed in CISA KEV, and no POC is referenced in the available intelligence).
Denial of service in the Juniper Junos OS rpd routing process is possible when the non-default Auto-RP mapping feature is enabled, allowing an unauthenticated attacker on an adjacent network segment to send crafted Auto-RP mapping announcements that trigger an out-of-bounds write (CWE-787) and crash the routing plane. Juniper rates this CVSS 4.0 7.1, and our independent assessment concurs it is a moderate-priority availability issue rather than a critical emergency; no public exploit code or CISA KEV entry was identified at time of analysis. The attacker must be within the PIM multicast domain and cannot reach the device from the general internet.
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241, and QFX5250 switches configured for BGP global-load-balancing with more than 128 ECMP next-hops allows unauthenticated adjacent-network attackers to crash rpd, causing a denial of service. This moderate-severity (CVSS 6.5) flaw is availability-only; exploitation requires the specific hardware and non-default routing configuration, and no public exploit code has been identified at time of analysis. Devices not configured for BGP global-load-balancing or with 128 or fewer ECMP next-hops are not affected.
Buffer overflow in the DPDK vhost-user backend's split-ring inflight descriptor table handling allows a guest VM with code execution to corrupt host memory, potentially leading to code execution on the host. This high-severity flaw (CVSS 8.8) is the most critical issue in a bundled DPDK security advisory and affects multi-tenant deployments where the split-ring inflight feature-used for vhost-user reconnection and live migration-is enabled. No public exploit code has been identified at the time of analysis.
Heap out-of-bounds read and write in the DPDK Generic Segmentation Offload (rte_gso) library can be triggered when an application enables GSO on its packet path and is configured with small or undersized mbuf pools relative to the segmentation workload, letting network-delivered traffic corrupt memory in the data plane. The vendor-published CVSS 3.1 base score is 8.6 (High) on a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating a network-reachable, unauthenticated, low-complexity heap out-of-bounds read/write; our independent assessment keeps the network-reachable, unauthenticated profile but assesses higher attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) because exploitation is gated on the non-default-looking small-mbuf-pool configuration together with GSO actually being enabled. Impact is dominated by availability (A:H), so the realistic outcome is a data-plane crash rather than full host compromise, with only partial confidentiality and integrity effects; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in GStreamer's gst-plugins-base plugin library lets a local attacker who controls the sending side of a GStreamer inter-process IPC pipeline corrupt memory in the receiving process, yielding a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. The victim process maps a crafted video buffer whose GstVideoMeta declares plane strides and offsets larger than the actual backing allocation, causing out-of-bounds reads and writes that can crash the process or potentially permit code execution in its context. Exploitation is strictly local and requires a deployment where GStreamer buffers cross a trust boundary between a less-trusted producer and a more-trusted consumer; no user interaction or authentication to the victim is needed, and no public exploit has been identified at time of analysis.
Use-after-free in curl's HTTP/2 client code (curl 8.12.0 through 8.22.0) can corrupt memory when a server answers an in-progress upload with an HTTP/2 RST_STREAM frame carrying the HTTP_1_1_REQUIRED or REFUSED_STREAM reason code, freeing the internal struct Curl_easy object while it is still referenced by the transfer state machine. The flaw is remote and requires no authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but exploitation is conditional: the victim must be uploading over a negotiated HTTP/2 connection to an endpoint the attacker controls or influences, and the RST_STREAM must land at the right point in the transfer lifecycle, which is why the assessed complexity is High. Publicly available exploit code exists (SSVC Exploitation: poc) and CISA's framework rates technical impact as total, yet there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.23% (12th percentile); a vendor patch is available. The same flaw affects libcurl and therefore every downstream application and distribution shipping an affected build.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.
Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.
In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
Use-after-free in Google Chrome's DOM implementation before 155.0.8059.79 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. The flaw affects desktop stable and extended-stable channels and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with exploitation limited by the requirement for user interaction and by the renderer sandbox preventing direct host compromise without a separate sandbox escape. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.
Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.
Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.
Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.
Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Use-after-free in Google Chrome's Media component before version 155.0.8059.79 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a user to open a crafted HTML page that drives the vulnerable media-parsing code path. Exploitation requires user interaction (the victim must navigate to or be redirected to attacker-controlled content), and the resulting code execution is confined to the sandbox, meaning host compromise would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, EPSS is low (0.21%, 11th percentile), and Google has released a fixed build, so risk is serious but not emergency-level; priority should follow normal rapid-patching timelines.
Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.
Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Out-of-bounds write in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) allows an attacker to execute arbitrary code in the context of the current user when the victim opens a malicious file. The flaw is a local, client-side memory corruption issue (AV:L, UI:R) that requires user interaction but no privileges; no public exploit has been identified at time of analysis. This is a high-severity flaw but not an emergency-tier internet-facing threat due to the human-in-the-loop prerequisite and user-level impact.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.
Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).
Out-of-bounds write in Adobe Photoshop Desktop running builds at or below 26.11.7 (and at or below 27.10 per ENISA EUVD data) allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. Because exploitation requires the victim to manually open a malicious file on their own system, the attack vector is local-only and depends on user interaction, and any code that runs inherits only the opening user's privileges (no privilege escalation). This is a genuine but operationally moderate-priority issue: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local plus user-interaction prerequisites materially reduce real-world risk.
Out-of-bounds write in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) allows an attacker to execute arbitrary code in the context of the current user when a victim opens a malicious file. The vulnerability requires user interaction (opening the file) and has a local attack vector, with a CVSS 3.1 base score of 7.8 High. No public exploit code has been identified at time of analysis.
Local privilege escalation in Microsoft SQL Server allows an authorized, low-privileged principal with existing access to the database host to exploit a use-after-free memory condition (CWE-416) and run code in a more privileged security context. Affected builds span SQL Server 2019, 2022, and 2025 on versions below the fixed GDR and CU releases published with Microsoft's January 2026 update. Exploitation is constrained by the local attack vector (AV:L) and high attack complexity (AC:H), since the attacker must already be authenticated on the host and win a memory-reuse/timing race; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available.
Opening an attacker-supplied file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds write that leads to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is strictly local and client-side: there is no network-facing service to hit, and the victim must be socially engineered into opening a malicious asset in their own session. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the practical risk is bounded by the required user interaction and the specialized deployment of this creative tooling, which favors targeted delivery over opportunistic mass exploitation.
Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.
Out-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, meaning an attacker must first deliver a malicious asset and persuade the victim to open it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8). The high confidentiality, integrity and availability impacts are tempered by the local attack vector, the unchanged scope (no privilege escalation beyond the current user) and the mandatory user-interaction step, so this is not a wormable or remotely reachable flaw. No public exploit identified at time of analysis; CISA KEV status is not indicated and the flaw is tracked by Adobe as APSB26-169 / ENISA EUVD-2026-100699.
Out-of-bounds write in Adobe Bridge (versions up to and including 15.1.8 and 16.0.7) can let an attacker execute arbitrary code in the context of the current user when a crafted file is opened. The attack is local and requires the victim to open a malicious file (UI:R), so delivery of the file to the target and a user action are both prerequisites; no authentication is required of the attacker and complexity is low once the file is opened. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the vendor advisory (APSB26-167) is the authoritative fix reference. Given the mandatory user interaction and local delivery requirement, this is a credible but second-tier priority rather than an urgent remotely exploitable issue.
Out-of-bounds write in Adobe Bridge allows a local attacker to achieve arbitrary code execution in the context of the current user when a victim opens a malicious file. Affected versions are Adobe Bridge 15.1.8 and earlier, and 16.0.7 and earlier. Exploitation requires user interaction (opening a crafted file) and no elevated privileges, but the attack is local. No public exploit code has been identified at time of analysis, and the flaw is rated CVSS 7.8, making it a legitimately actionable local code-execution flaw but not a drop-everything emergency.
Out-of-bounds write in Adobe Bridge - versions 15.x through 15.1.8 and 16.x through 16.0.7 - can result in arbitrary code execution in the context of the current user when a victim opens or previews a crafted file. The issue is local in reach (AV:L) and requires attacker-induced user interaction (UI:R), with no authentication or elevated privileges needed (PR:N) and low attack complexity (AC:L) once the file is opened, yielding a CVSS 3.1 base score of 7.8. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical barrier for an attacker remains the social engineering needed to convince a target on an unpatched version to open the malicious file.
An out-of-bounds write in Adobe Photoshop Desktop (builds up to and including 27.10, and the 26.x line up to and including 26.11.7) lets an attacker corrupt process memory and achieve arbitrary code execution with the privileges of the user who opened the file. Exploitation is not remote: it requires a victim to open a crafted image or project file (CVSS 3.1 base 7.8, AV:L/PR:N/UI:R), so a successful attack depends on social engineering to deliver and convince the user to open the document. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Arbitrary code execution in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) is possible via an out-of-bounds write when a victim opens a crafted file. Exploitation requires user interaction and is limited to the context of the current user; no public exploit identified at time of analysis. The CVSS score is 7.8, and the vulnerability is not known to be actively exploited.
An out-of-bounds write (CWE-787) in Adobe Dimension 4.1.8 and earlier allows arbitrary code execution at the privilege level of the user who opens a specially crafted file, such as a malicious Dimension project or imported 3D asset. Exploitation is local and depends entirely on victim interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) - the attacker must deliver a file the user then opens, so this is not a remotely triggerable, wormable flaw; no public exploit code identified at time of analysis and the CVE is not in CISA KEV. The practical risk is genuine but operationally constrained by the mandatory user action, the local delivery requirement, and the shrinking installed base of what our assessment describes as a discontinued product.
Arbitrary code execution is possible in Adobe Substance 3D Stager 3.1.8 and earlier, where a use-after-free (CWE-416) is triggered while the application processes a crafted file. The CVSS v3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) shows no authentication is required, but the attacker must deliver the malicious file locally and convince the victim to open it, after which code runs only with the privileges of the current user. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the practical risk is driven by social-engineering delivery and by the fact that a crash (denial of service) is also achievable from the same corrupting file.
Arbitrary code execution in Adobe Substance 3D Stager 3.1.8 and earlier is possible via an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, such as a 3D asset or project file, in the application. The flaw carries a CVSS 3.1 base score of 7.8 (HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attack is local-only with no network path, requires victim user interaction to open the file, and needs no prior privileges, but grants full confidentiality, integrity, and availability impact through code execution in the context of the current user. There is no public exploit identified at time of analysis (not in CISA KEV, no POC referenced), so the practical risk depends on an attacker's ability to socially engineer a designer or artist into opening a booby-trapped asset.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local, user-interaction-required flaw (CVSS 7.8) stems from improper memory handling (CWE-787) during file/asset parsing; no public exploit code has been identified at time of analysis, and exploitation requires the attacker to deliver a crafted file to the target workstation. Successful exploitation grants code execution with the privileges of the Stager user, with high impact to confidentiality, integrity, and availability.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier permits arbitrary code execution in the context of the current user when a victim opens a crafted file. The flaw is local (AV:L), requires user interaction (UI:R), and needs no privileges (PR:N), so exploitation depends on social engineering rather than remote autonomous triggering. No public exploit or confirmed active exploitation (CISA KEV) is identified at time of analysis, making this a high-priority patch item but not an emergency per the independent assessment.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, and Adobe's PSIRT has published advisory APSB26-170 covering the issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.8 High on the strength of full confidentiality, integrity and availability impact, but the attack is not remotely triggerable: the attacker must deliver a malicious file and convince a victim to open it, and any resulting code runs only with that user's privileges, with no privilege escalation beyond the current user. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); exploitation is neither automatable nor network-reachable, so risk concentrates on targeted file-delivery campaigns against individual Stager users.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when the victim opens a maliciously crafted 3D project or asset file. The attack path is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), with no network-facing trigger and no privilege escalation beyond the rights of the user who opens the file. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but not emergency-grade priority, where the practical risk is driven by social engineering that convinces a Stager user to open attacker-supplied content.
Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when a victim opens a crafted 3D asset or scene file. The flaw is a client-side file-parsing issue (CWE-787) with a local attack vector and required user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8); no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). Attackers must deliver a malicious file to the target and induce the user to open it, which limits exposure to systems where untrusted Stager files are processed.
An out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted 3D project or asset file. The attack is local in nature (AV:L) and depends entirely on user interaction (UI:R) - the victim must be socially engineered into opening the malicious file - and the resulting code runs with the victim's own privileges rather than elevated rights (no privileges are required per PR:N). At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, so this is assessed as a moderate-priority, not emergency, memory-corruption flaw whose primary risk is targeted, file-based social engineering against individual Substance 3D Stager workstations.
Arbitrary code execution in Adobe Substance 3D Stager 3.1.8 and earlier is achievable when a user is persuaded to open a maliciously crafted file, allowing an unauthenticated attacker to corrupt memory out of bounds and run code in the context of the current user. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local, file-based flaw with no network attack surface, where the mandatory user interaction of opening an untrusted file is the principal limiting factor; impact is confined to the victim user's privileges rather than the whole system. No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
A use-after-free in the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService) lets an attacker who already holds a low-privileged local session elevate privileges on the affected host, with high impact to confidentiality, integrity and availability. Microsoft scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the affected service ships enabled by default across the listed Windows 10, Windows 11 and Windows Server 2019 build ranges, so exposure depends almost entirely on whether untrusted users can obtain interactive or code-execution access to the machine. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a credible but not emergency-tier patch priority rather than an actively exploited emergency; the limiting factor is the local attack vector, since there is no network-reachable exploitation path.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.
Use-after-free in Microsoft's Remote Desktop Client (mstsc) allows an attacker who controls an RDP server to execute arbitrary code on the machine of any user who connects to it, with high confidentiality, integrity and availability impact (CVSS 7.5; AV:N/AC:H/PR:N/UI:R). Exploitation is not a passive drive-by: the victim must launch the client and initiate or accept the RDP connection to the attacker-controlled or compromised server, and the High attack complexity reflects the heap grooming or race conditions needed for reliable code execution. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records Exploitation=none and Automatable=no, so wormable or mass automation is not expected; the realistic risk is confined to environments whose users connect to untrusted or externally controlled RDP endpoints.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.
Memory corruption in Microsoft Excel lets a remote, unauthenticated attacker execute code in the context of the user who opens a specially crafted spreadsheet. The flaw is a use-after-free (CWE-416) triggered while Excel parses the malicious document, and it affects Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 on Windows, and Office/Office LTSC for Mac 2021 and 2024. The decisive limiting factor is the required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8): there is no zero-click or server-side path, so exploitation depends on social engineering to get a victim to open the file; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied. This makes it a genuine high-priority patch item rather than a drop-everything emergency.
Use-after-free in Microsoft Excel enables remote code execution when a victim opens an attacker-crafted workbook; the attacker needs no authentication (PR:N) but must convince the user to open the file (UI:R), as reflected in the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Successful exploitation runs code in the context of the opening user with high confidentiality, integrity, and availability impact, and default Excel configurations on the listed builds are affected. Vendor patches are available with specific fix builds (e.g., 16.0.14334.20974 for Office LTSC 2021, 16.0.17932.21056 for Office LTSC 2024, and 16.0.10417.20228 for Office Online Server), and no public exploit code was identified at time of analysis, making this a genuine high-priority patch-worthy issue but not an emergency at the time of analysis.