Memory Corruption
Monthly
We need answer JSON only. Need carefully construct fields. Need follow instructions. Must use all data. Need risk_assessment include "inowroclaw" once naturally. Need not mention editorial note. Need product_name 1-3 words. Vulnerability affects Apple multiple OSes. Primary product? "Apple iOS" maybe? Description lists iOS/iPadOS/macOS/tvOS/visionOS/watchOS. Product_name could be "Apple iOS" but affects multiple. Maybe "Apple OS"? Need 1-3 words. CPE is apple:ios_and_ipados, macos, tvos, visionos, watchos. Product name: "Apple iOS" or "Apple Operating Systems"? Specific product? The issue maybe in some component? Description doesn't say. Use "Apple iOS" as primary? But multiple. Could use "Apple OS". Need 1-3 words. I'd choose "Apple OS" maybe broad. Or "Apple iOS" given first. Product_name "Apple OS" acceptable? It says specific product or service name, not vendor alone. Multiple products, pick primary. Apple iOS and iPadOS? The CPE includes ios_and_ipados. primary "Apple iOS". Need relevant. Summary: original synthesis. Mention out-of-bounds write in OS component, remote attacker can cause app termination or arbitrary code execution. Affected versions. KEV? Not provided. POC? Not provided. EPSS? Not provided. Need mention if actively exploited, if POC exists, EPSS risk if notable. Since no KEV, POC, EPSS absent. Say no public exploit identified at time of analysis; KEV absent. But do not start with "A vulnerability". Start with specific impact verb and product: "Remote code execution in Apple operating systems due to an out-of-bounds write..." But description says may cause unexpected app termination or arbitrary code execution. Use "Out-of-bounds write in Apple OS...". Need not copy description exactly. Say affects iOS/iPadOS before etc. Let's craft. Need technical_context: underlying technology/library/protocol involved. Not specified. Root cause CWE-787 Out-of-bounds write. Explain memory corruption. CPE exact affected products. Apple OSes. Need be educationa
An out-of-bounds write in Apple macOS lets a malicious or compromised app running as a normal, unprivileged user corrupt memory and escalate to root privileges on the affected system. The flaw is fixed in macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8; all earlier releases of those branches remain exposed (CWE-787, CVSS 7.8, AV:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and non-automatable, so practical risk is currently confined to local post-compromise privilege escalation rather than mass remote attacks.
Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk.
Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.
An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Out-of-bounds write in snappy-java through 1.1.10.8 allows unauthenticated remote attackers to crash the JVM by supplying valid compressed data whose decompressed size exceeds the caller-provided destination ByteBuffer capacity. The `Snappy.uncompress(ByteBuffer, ByteBuffer)` method passes the destination buffer directly to the native Snappy decompressor via JNI without first asserting that its capacity can accommodate the full decompressed output, causing native-layer writes past the buffer boundary and abrupt JVM process termination. No public exploit code or active exploitation has been identified at time of analysis, but the attack is trivially constructible by any attacker familiar with the Snappy wire format against applications that process untrusted compressed input through this specific API overload.
Heap buffer overflow in stb_vorbis through 1.22 allows remote attackers to crash or corrupt the heap of any application that parses attacker-supplied Ogg Vorbis audio. The root cause is an integer truncation bug in start_decoder() where the codebook multiplicands allocation size is computed as a size_t but narrowed to int before being passed to the allocator, enabling a heap undersizing condition triggerable by crafting codebook entries and dimensions values that overflow the int range. No public exploit code or active exploitation is confirmed, but the no-interaction network vector makes this impactful for any service that accepts Ogg Vorbis input from untrusted sources.
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; the fix ships in 7.0.16 and 8.0.5.
Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who supplies a crafted .traineddata language file to corrupt heap memory during legacy OCR classifier initialization, with potential for controlled code execution. The flaw is in ReadIntTemplates in src/classify/intproto.cpp, which reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP file component and uses them directly as loop bounds - storing heap pointers into fixed-capacity struct arrays without validating against compile-time maximums. No patched release exists as of this review, though a fix commit is present in the repository; no public exploit has been identified.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls the loaded .traineddata model file to corrupt heap memory, crash the process, or potentially achieve code execution. The root cause is in GenericVector::read (src/ccutil/genericvector.h): the serialized `reserved` field allocates the backing buffer while the independent `size_used_` field drives the callback write loop, with no invariant check enforcing size_used_ ≤ reserved. A crafted TESSDATA_INTTEMP component with version_id ≥ 4 exploits this by setting reserved small and size_used_ large, triggering the write overrun through fontinfo_table_.read during legacy classifier initialization. No public exploit and no CISA KEV entry exist at time of analysis; an upstream commit fix exists but no patched release has been published.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, leading to a crash or potentially controlled code execution. The root cause is an inconsistency between `source_` (sized from deserialized `na_`) and the write count used by `WriteTimeStepPart` and `AddTimeStepPart` (driven by `ns_` from the CI gate WeightMatrix dim1), leaving two functions unbounded after prior hardening patched sibling routines. No fixed release is available at time of analysis; an upstream fix exists only as a commit. No public exploit identified at time of analysis.
Buffer overflow in the XML processing stack of Palo Alto Networks PAN-OS enables unauthenticated remote attackers to cause denial of service on VM-Series virtual firewalls or execute arbitrary code with root privileges on PA-Series physical appliances. The vulnerability is reachable via the management web interface or dataplane interface, and Panorama management platforms are also confirmed in scope. No public exploit has been identified at time of analysis; the CVSS 4.0 supplemental metric E:U corroborates no known active exploitation.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. Exploitation can corrupt unrelated heap objects or terminate the JVM process entirely. No public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to execute arbitrary code with system server privilege. The flaw resides in Samsung's proprietary Mobile Display Image Enhancement (mdnie) library, which is accessible from low-privilege application contexts with no special Android permissions required. No public exploit has been identified at time of analysis, and Samsung addressed this in the September 2026 Monthly Security Release (SMR Sep-2026 Release 1).
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM TrustZone that handles cryptographic key operations - allows local attackers with high privileges to corrupt memory within the secure world, potentially compromising key material or TEE integrity. Affected devices run Android 14 through 17, with a fix delivered in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome's DevTools component (versions prior to 153.0.8010.36) enables arbitrary code execution within the renderer sandbox when a victim is socially engineered into visiting a crafted HTML page. The CVSS score of 8.8 reflects full C/I/A impact, but Chromium's own internal severity classification of 'Low' signals that exploitation is sandboxed - OS-level compromise requires an additional chained sandbox escape. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Remote code execution in Google Chrome's DevTools component before 153.0.8010.36 stems from a use-after-free (CWE-416) that, per the advisory, allows a crafted HTML page to execute arbitrary code outside the browser sandbox. All desktop Chrome builds prior to the fixed stable release are affected; the flaw was reported internally by the Chrome team, is fixed in the stable channel, and has no public exploit identified at time of analysis. Notably, the assigned CVSS is 9.6 (Critical) while Chromium itself rated the security severity only 'Low', a significant conflict discussed below.
Sandbox-escaping remote code execution in Google Chrome's WebPackaging component affects all desktop versions prior to 153.0.8010.36. A use-after-free (CWE-416) reachable from a crafted HTML page can let a remote attacker potentially execute arbitrary code outside the renderer sandbox with no authentication, requiring only that the victim visit a malicious page. No public exploit has been identified at time of analysis; Chromium's own internal triage rated the security severity 'Low', which sits in notable tension with the 9.6 CVSS assigned to the record.
Remote code execution in Google Chrome on iOS before 153.0.8010.36 stems from a use-after-free in the Sharing component (CWE-416), letting a remote attacker who lures a victim to crafted network content execute arbitrary code outside the browser sandbox. Google has shipped a patched Chrome build; no public exploit is identified at time of analysis, and Google/Chromium rated the underlying bug 'Medium' severity even though the assigned CVSS base score is 9.6.
Remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the Passwords component that, when triggered via crafted UI interaction and social engineering, can let a remote attacker escape the renderer sandbox and run arbitrary code. All Chrome desktop builds before the 153.0.8010.36 stable release are affected. No public exploit identified at time of analysis, and no EPSS or KEV data was provided; note that Google's Chromium team rated the underlying bug only 'Medium' severity, which sits in tension with the supplied CVSS 9.6.
Sandbox-escaping remote code execution in Google Chrome's Aura windowing layer affects all desktop builds prior to 153.0.8010.36. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and potentially execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the fix ships in the stable-channel desktop update.
Out-of-bounds write in the Media component of Google Chrome before 153.0.8010.36 allows a remote attacker to potentially execute arbitrary code outside the browser's renderer sandbox by luring a victim to a crafted HTML page. The scope-changing memory-corruption bug carries a CVSS of 9.6 despite Chromium's own 'Medium' severity rating, and a vendor patch is available. There is no public exploit identified at time of analysis.
Remote code execution in Google Chrome on Windows prior to 153.0.8010.36 arises from a type-confusion bug in the browser's Rust code, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Google shipped a fixed build via the Stable channel, and the flaw was reported internally by the Chrome team. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though sandbox-escape memory-corruption bugs in Chrome are historically high-value exploitation targets.
Remote code execution in Google Chrome for macOS prior to 153.0.8010.36 stems from a use-after-free in the Extensions component, letting a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw carries a CVSS 9.6 (scope-changed, network vector with user interaction), though Chromium's own security team rated it 'Medium'. No public exploit has been identified at time of analysis, and the fix is available in the stable channel.
Use-after-free in Chrome's V8 JavaScript engine allows a remote attacker who can socially engineer a victim into installing a crafted Chrome extension to execute arbitrary code within the browser's renderer sandbox, affecting all Chrome versions prior to 153.0.8010.36. The vulnerability is constrained to in-sandbox execution - it does not constitute a standalone sandbox escape - which aligns with the S:U CVSS metric and Chromium's internal 'Medium' severity rating despite the 8.8 base score. No public exploit code or active exploitation has been identified at time of analysis, and Google has shipped a patch in the stable channel.
Use-after-free in Google Chrome's DevTools component prior to 153.0.8010.36 enables a local attacker to escape the browser sandbox and execute arbitrary code at the host OS level via a crafted local program. Chromium's own severity rating is 'Medium', reflecting the local access prerequisite, while the CVSS 8.1 score captures the high-impact sandbox-escape outcome once exploitation succeeds. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score (0.12%, 2nd percentile) confirms low observed exploitation probability.
Sandbox-escaping remote code execution in Google Chrome's Browser process on Windows (all versions prior to 153.0.8010.36) stems from a use-after-free flaw. A remote attacker who lures a victim into opening a crafted HTML page can corrupt reclaimed heap memory in the privileged browser process and execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the vendor has shipped a fixed stable build.
Use-after-free in Chrome's ANGLE graphics layer on Windows enables sandbox escape and arbitrary code execution when a renderer process has already been compromised. Affected versions are all Chrome releases prior to 153.0.8010.36 on Windows; exploitation requires an attacker to first compromise the renderer and then deliver a crafted HTML page triggering the ANGLE memory corruption. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.28% (20th percentile) reflects low observed exploitation probability.
Type confusion (CWE-843) in Chrome's XML processing component allows remote attackers to execute arbitrary code within the Chrome renderer sandbox by enticing a target to visit a crafted HTML page. All Chrome desktop versions prior to 153.0.8010.36 are affected across Windows, macOS, and Linux. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the impact is further bounded by Chrome's sandbox architecture, which prevents direct OS-level code execution without a secondary sandbox-escape primitive.
Use-after-free in Chrome's Chromecast component allows remote attackers to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Affected are all Google Chrome releases prior to 153.0.8010.36 across desktop platforms. Exploitation is sandboxed - code execution is confined to the renderer process - but the C:H/I:H/A:H impact rating reflects full compromise of data accessible within that context. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.
Out-of-bounds write in Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the renderer sandbox by directing a user to a crafted HTML page. All Google Chrome versions prior to 153.0.8010.36 are affected across desktop platforms. Impact is bounded by Chrome's renderer sandbox - an attacker achieves control over the renderer process and can access browser-stored data such as session cookies and saved credentials, but reaching the host OS would require a separately chained sandbox escape exploit. No public exploit identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the browser's Core component that a remote attacker can trigger through a maliciously crafted Chrome extension. Successful exploitation lets attacker-controlled code run outside the renderer sandbox with the browser process's privileges, but it requires convincing the victim to install or interact with the malicious extension (social engineering). There is no public exploit identified at time of analysis, EPSS is low (0.24%, 15th percentile), and CISA SSVC records exploitation as none, so the risk is high-impact but currently unproven in the wild.
Remote code execution in Google Chrome before 153.0.8010.36 stems from a use-after-free in the browser's Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Chromium rates the severity High, and the supplied CVSS is 9.6 reflecting the sandbox-escape scope change. EPSS is low (0.35%, 29th percentile) and no public exploit is identified at time of analysis.
Remote code execution inside the Chrome sandbox is possible in Google Chrome versions prior to 153.0.8010.36 via a use-after-free vulnerability in the V8 JavaScript engine, triggered by a specially crafted HTML page. An unauthenticated remote attacker who can lure a user to a malicious page can execute arbitrary code within the Chrome renderer process sandbox - a significant foothold even without a sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% reflects low observed exploitation activity, though V8 UAF primitives are historically attractive to threat actors.
Type confusion in V8 (CWE-843) in Google Chrome prior to 153.0.8010.36 allows a remote attacker to achieve arbitrary code execution within the Chrome renderer sandbox by delivering a crafted HTML page. All desktop Chrome installations on unpatched versions are affected, exploitable via drive-by browsing without any authentication or special privileges beyond convincing the victim to visit a malicious page. No public exploit or CISA KEV listing has been confirmed at time of analysis; SSVC rates technical impact as total but exploitation as none, consistent with a low EPSS of 0.23%.
Sandbox-escape code execution in Google Chrome's Printing subsystem (all versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a crafted HTML page, leveraging a use-after-free in the print handling path. This is a secondary exploit in a multi-stage chain: renderer compromise is a hard prerequisite, not something this bug alone provides. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
Sandbox-escaping remote code execution in Google Chrome's Payments component (versions prior to 153.0.8010.36) lets a remote attacker who successfully social-engineers a victim into visiting a crafted HTML page trigger a use-after-free and potentially run arbitrary code outside the renderer sandbox. Chromium rates the security severity 'High'; the supplied CVSS is 9.6 reflecting scope change and full CIA impact. No public exploit is identified at time of analysis and EPSS is low (0.26%, 17th percentile), and CISA SSVC records exploitation status as none.
Remote code execution in Google Chrome on macOS prior to 153.0.8010.36 stems from a use-after-free in the Payments component, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the browser sandbox. The provided CVSS vector (9.6) reflects a scope-changing sandbox escape requiring user interaction (a page visit), while Chromium rated the underlying bug 'High' rather than 'Critical'. A vendor patch is available; EPSS is low (0.30%, 22th percentile) and no public exploit is identified.
Sandbox-escape remote code execution in Google Chrome's Device component on macOS (versions prior to 153.0.8010.36) allows a remote attacker to potentially run arbitrary code outside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; Chromium assigned it 'High' severity while the CVSS base score is 9.6. No public exploit identified at time of analysis, and EPSS is low (0.26%).
Use-after-free in V8, Chrome's JavaScript engine, enables remote code execution within the browser's renderer sandbox when a victim visits a crafted HTML page. All Chrome releases prior to 153.0.8010.36 are affected across desktop platforms. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), but SSVC rates the technical impact as total, and the Chromium security team classified this as High severity.
Use-after-free in Chrome's WebPackaging component enables full sandbox escape to arbitrary code execution for attackers who have already established a foothold in the renderer process. All Chrome desktop releases prior to 153.0.8010.36 are affected. No public exploit code has been identified and EPSS is low (0.34%), but the scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms that successful exploitation fully escapes Chrome's multi-process sandbox, translating a renderer compromise into OS-level code execution.
Use-after-free in Chrome's Input component enables in-sandbox remote code execution against all Chrome versions prior to 153.0.8010.36. The vulnerability is triggered when a victim visits a crafted HTML page, requiring no authentication and no special configuration - only a single browse action. Google has rated this High severity, the patch is available in 153.0.8010.36, and no public exploit has been identified at time of analysis, with EPSS at 0.21%.
Use-after-free in Chrome's Platform component (all versions prior to 153.0.8010.36) enables remote code execution confined within the browser sandbox when a user visits a crafted HTML page. The Chromium team rated this 'High' severity - consistent with the CVSS 8.8 score and distinguishing it from Critical-rated full sandbox-escape vulnerabilities addressed in the same release cycle. No public exploit code has been identified, and the EPSS score of 0.21% (12th percentile) reflects limited observed exploitation activity at this time; no CISA KEV listing exists.
Remote code execution outside the browser sandbox affects Google Chrome versions prior to 153.0.8010.36 through a use-after-free flaw in the Web Authentication (WebAuthn) component. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code with the privileges of the browser process, escaping the renderer sandbox (scope change). No public exploit has been identified at time of analysis and EPSS is low (0.34%), but the sandbox-escape RCE nature and Chrome's enormous install base make prompt patching important.
Remote code execution in Google Chrome's ANGLE graphics component on Windows (versions prior to 153.0.8010.36) allows a remote attacker to trigger an out-of-bounds write and potentially execute arbitrary code outside the browser sandbox via a crafted HTML page. Rated Chromium 'High' with a CVSS of 9.6 reflecting a scope-changing sandbox escape, though exploitation requires the victim to load malicious web content. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with CISA SSVC scoring exploitation as 'none'.
Use-after-free in Chrome's Views UI framework enables local attackers to escape the browser sandbox and execute arbitrary code at browser-process privilege level. The vulnerability affects all Google Chrome desktop versions prior to 153.0.8010.36. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects low near-term exploitation probability.
Sandbox-escape remote code execution in Google Chrome on Android (versions prior to 153.0.8010.36) stems from a use-after-free in Dawn, Chromium's WebGPU implementation. A remote attacker who lures a victim to a crafted HTML page can trigger the freed-object reuse to execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; there is no public exploit or CISA KEV listing, and EPSS is low (0.30%), indicating no evidence of active or widespread exploitation at time of analysis.
Use-after-free in Google Chrome's Core component on Windows prior to 153.0.8010.36 enables a renderer-compromised attacker to escape the browser sandbox and execute arbitrary code on the host OS. The vulnerability is platform-specific to Windows and functions as the second stage of a chained exploit: an attacker must first achieve renderer-level compromise before triggering this UAF to pivot into the privileged browser process. No public exploit code or active exploitation has been identified at time of analysis; vendor patch 153.0.8010.36 is available.
Use-after-free in Chrome's Receiver component allows an adjacent, unauthenticated attacker to execute arbitrary code outside the renderer sandbox via crafted network traffic, affecting all Chrome versions prior to 153.0.8010.36. The scope change in the CVSS vector confirms this is a full sandbox escape - successful exploitation yields OS-level code execution on the victim machine without requiring any user interaction. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) indicates low observed exploitation activity.
Sandbox-escape remote code execution in Google Chrome's Views UI framework prior to 153.0.8010.36 allows a local attacker to execute arbitrary code outside the browser sandbox by inducing a specific UI interaction that triggers a use-after-free condition. The CVSS scope change (S:C) confirms the vulnerability crosses the renderer sandbox boundary into the broader OS context, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.20% (10th percentile) reflects low automated exploitation probability, though sandbox escapes are high-value for privilege escalation chains.
Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a use-after-free in ANGLE, Chrome's graphics abstraction layer that translates OpenGL ES calls to Direct3D. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code outside the browser sandbox, giving full compromise of the renderer host process. No public exploit identified at time of analysis, and EPSS is modest (0.35%), but the sandbox-escape impact and one-click delivery make this a high-priority browser patch.
Use-after-free in Chrome's Cast (Chromecast streaming) component allows an adjacent unauthenticated attacker to potentially escape the browser sandbox and execute arbitrary code by delivering crafted network traffic over a local or Wi-Fi network. All Chrome desktop versions prior to 153.0.8010.36 are affected, with Chromium rating this Critical due to the full-CIA, scope-changed impact. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal observed exploitation activity despite the high severity classification.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 arises from an out-of-bounds write in the WebGL graphics subsystem, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the renderer sandbox. Rated Critical by Chromium and CVSS 9.6, the scope-changed vector reflects a full sandbox escape. No public exploit is identified at time of analysis and EPSS is low (0.39%), but WebGL memory-corruption bugs are historically high-value targets.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 stems from a use-after-free in the WebGL implementation that a remote attacker can trigger with a crafted HTML page to execute arbitrary code outside the browser sandbox. Chromium rates this Critical and the CVSS is 9.6, reflecting a full renderer-to-sandbox-escape chain requiring only that a victim visit a malicious page. No public exploit is identified at time of analysis and EPSS is low (0.36%), but the sandbox-escape impact makes it a priority patch.
Remote code execution in Google Chrome desktop prior to 153.0.8010.36 arises from a use-after-free in the WebGL implementation, allowing a remote attacker to run arbitrary code outside the browser sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as Critical and the CVSS is 9.6, reflecting a full renderer-to-host sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.28% (20th percentile).
Use-After-Free in Adobe Acrobat Reader and Adobe Acrobat allows arbitrary code execution in the security context of the current user upon opening a specially crafted PDF file. Affected versions span Acrobat Reader up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit identified at time of analysis, but the file-delivery attack vector makes this a realistic phishing and drive-by-download threat given Acrobat Reader's ubiquity as an enterprise PDF handler.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious document. Affected across both the continuous track (≤26.002.21900) and the classic 2024 track (≤24.001.30383), this is a memory corruption vulnerability rooted in improper object lifecycle management within Acrobat's rendering engine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open attack surface and high impact make this a credible phishing or watering-hole delivery risk.
Use-after-free (UAF) in Adobe Acrobat Reader allows arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious PDF or document file. Affected versions span Acrobat 2024 (≤24.001.30383) and both Acrobat and Acrobat Reader (≤26.002.21900), making the exposure broad across the current release track. No public exploit or active exploitation has been confirmed at time of analysis, but the file-based delivery vector makes this class of vulnerability routinely weaponized via phishing campaigns.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted PDF file. Affected versions include Acrobat Reader and Adobe Acrobat up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis, but the ubiquity of Acrobat Reader across enterprise environments and the reliable code-execution impact make patching a high priority.
Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat allows arbitrary code execution in the context of the opening user when a victim opens a specially crafted malicious file. All versions of Acrobat Reader and Adobe Acrobat through 26.002.21900, and Acrobat 2024 through 24.001.30383, are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-based delivery mechanism and full C:H/I:H/A:H impact make this a material risk for organizations with unpatched deployments.
Out-of-bounds write in Adobe Acrobat and Acrobat Reader allows arbitrary code execution in the current user's context when a victim opens a specially crafted file. Affected are Acrobat 2024 versions through 24.001.30383 and Adobe Acrobat/Acrobat Reader through 26.002.21900, per Adobe APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the ubiquity of Acrobat as an attack surface and the RCE-grade impact make this a priority patch.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat (Continuous track through 26.002.21900; Classic 2024 track through 24.001.30383) enables arbitrary code execution in the context of the victim user. The CWE-787 memory corruption flaw is triggered when a specially crafted document is opened, placing this squarely in the document-weaponization threat category common to PDF toolchains. Adobe PSIRT has issued advisory APSB26-141; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write (CWE-787) in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a crafted malicious PDF or document file. Affected versions span Acrobat 2024 up to 24.001.30383 and both Acrobat and Acrobat Reader through 26.002.21900, per Adobe PSIRT advisory APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the C:H/I:H/A:H CVSS impact and prevalence of Adobe Reader in enterprise environments make this a meaningful patching priority.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.
Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.
Type confusion (CWE-843) in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Multiple product lines are affected, including Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383. No public exploit or CISA KEV listing has been identified at time of analysis, but the ubiquity of Acrobat Reader and routine delivery of PDFs via phishing make this a realistic and high-priority patching target.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Out-of-bounds write (CWE-787) in Adobe Acrobat and Acrobat Reader enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. All continuous-track versions through 26.002.21900 and Acrobat 2024 versions through 24.001.30383 are affected, per Adobe PSIRT and EUVD-2026-74193. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction to deliver and open a malicious document.
Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap memory during RTP encoding, with potential for arbitrary code execution. The root cause is in nal_send() within libavformat/rtpenc_h264_hevc.c, where a negative size value (-3) is passed directly to memcpy, producing an out-of-bounds write. A public proof-of-concept exploit is available, though EPSS probability remains low at 0.17% and no active exploitation has been confirmed by CISA.
Out-of-bounds write in Adobe Photoshop Desktop allows arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted malicious file. Affected versions span both the Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6) release lines. Adobe's PSIRT has released advisory APSB26-130 addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write (CWE-787) in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) enables arbitrary code execution in the context of the logged-in user. The attack is triggered by opening a specially crafted document, making phishing attachments and compromised file-sharing platforms viable delivery mechanisms against creative and design professionals. No public exploit identified at time of analysis, but the low attack complexity and full CIA impact across affected versions represent a meaningful and realistic risk.
Out-of-bounds write in Adobe Photoshop Desktop enables arbitrary code execution in the context of the victim's user account when a malicious file is opened. Both the 2025 branch (through version 26.11.6) and the 2026 branch (through version 27.6) are confirmed affected per Adobe's EUVD entry and APSB26-130 advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open trigger and high CVSS C/I/A ratings make this a credible phishing-delivery vector in creative and design environments.
Out-of-bounds write vulnerabilities in multiple Android system functions allow a local, low-privileged attacker to escalate to root on Android 16-QPR2 and Android 17 without requiring any user interaction. The root cause is integer overflow (CWE-787) that underestimates buffer allocation size, enabling memory writes beyond allocated regions and corruption of privilege-sensitive data structures. The September 2026 Android Security Bulletin addresses these issues, and no public exploit has been identified at time of analysis.
Remote code execution is possible in Android's NFC Type 3 Tag processing layer (rw_t3t.cc within libnfc-nci) across Android 14 through 17 via an integer overflow that triggers a heap out-of-bounds write. No user interaction or additional privileges are required per the description, making this exploitable by any attacker within NFC proximity of an unpatched device. Google addressed this in the September 2026 Android Security Bulletin; no public exploit or active exploitation has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation status as 'none'.
Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Use-after-free code execution in Microsoft Excel allows a local unauthenticated attacker to execute arbitrary code at the privilege level of the victim user by enticing them to open a specially crafted workbook file. Affected products span the full current Office portfolio: Excel 2016, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is identified at time of analysis, but Microsoft has released patches addressing all affected version lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
We need answer JSON only. Need carefully construct fields. Need follow instructions. Must use all data. Need risk_assessment include "inowroclaw" once naturally. Need not mention editorial note. Need product_name 1-3 words. Vulnerability affects Apple multiple OSes. Primary product? "Apple iOS" maybe? Description lists iOS/iPadOS/macOS/tvOS/visionOS/watchOS. Product_name could be "Apple iOS" but affects multiple. Maybe "Apple OS"? Need 1-3 words. CPE is apple:ios_and_ipados, macos, tvos, visionos, watchos. Product name: "Apple iOS" or "Apple Operating Systems"? Specific product? The issue maybe in some component? Description doesn't say. Use "Apple iOS" as primary? But multiple. Could use "Apple OS". Need 1-3 words. I'd choose "Apple OS" maybe broad. Or "Apple iOS" given first. Product_name "Apple OS" acceptable? It says specific product or service name, not vendor alone. Multiple products, pick primary. Apple iOS and iPadOS? The CPE includes ios_and_ipados. primary "Apple iOS". Need relevant. Summary: original synthesis. Mention out-of-bounds write in OS component, remote attacker can cause app termination or arbitrary code execution. Affected versions. KEV? Not provided. POC? Not provided. EPSS? Not provided. Need mention if actively exploited, if POC exists, EPSS risk if notable. Since no KEV, POC, EPSS absent. Say no public exploit identified at time of analysis; KEV absent. But do not start with "A vulnerability". Start with specific impact verb and product: "Remote code execution in Apple operating systems due to an out-of-bounds write..." But description says may cause unexpected app termination or arbitrary code execution. Use "Out-of-bounds write in Apple OS...". Need not copy description exactly. Say affects iOS/iPadOS before etc. Let's craft. Need technical_context: underlying technology/library/protocol involved. Not specified. Root cause CWE-787 Out-of-bounds write. Explain memory corruption. CPE exact affected products. Apple OSes. Need be educationa
An out-of-bounds write in Apple macOS lets a malicious or compromised app running as a normal, unprivileged user corrupt memory and escalate to root privileges on the affected system. The flaw is fixed in macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8; all earlier releases of those branches remain exposed (CWE-787, CVSS 7.8, AV:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and non-automatable, so practical risk is currently confined to local post-compromise privilege escalation rather than mass remote attacks.
Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. No public exploit identified at time of analysis; the flaw is reached through the normal CompressedSection.process() parsing path, so any tool or service that ingests untrusted firmware with this library is at risk.
Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. No public exploit identified at time of analysis; the issue was fixed in 1.14 by porting the upstream EDK2 hardening.
An out-of-bounds write in GIMP's Lighting Effects filter allows memory corruption when a victim opens a specially crafted lighting preset file, resulting in a crash or potentially arbitrary code execution in the context of the GIMP process. The CVSS vector (AV:L/UI:R) confirms the attack is file-driven and requires a user to open the malicious preset, so no remote unauthenticated path exists; exploitation depends on social engineering. Red Hat is the reporting party and its CPE data lists RHEL 6 through 9, but no public exploit code, EPSS score, or CISA KEV entry was supplied, so status is no public exploit identified at time of analysis.
Heap-based buffer overflow in GIMP's Paint Shop Pro (PSP) file format loader allows arbitrary code execution when a victim opens a crafted PSP image file. The flaw stems from a size mismatch between the buffer allocated for a compressed selection channel and the actual decompressed output, triggering an out-of-bounds write on the heap. No public exploit has been identified at time of analysis, but the file-open trigger makes this a realistic phishing or drive-by vector against GIMP users on Red Hat Enterprise Linux 6-9.
Heap-based buffer overflow in GIMP's ICO file loader allows arbitrary code execution or application crash when a user opens a specially crafted ICO file containing an embedded PNG image. The root cause is an integer overflow during buffer size calculation (CWE-787, with CWE-190 as the precipitating cause), causing an undersized heap allocation that overflows when decoded pixel data is written. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Out-of-bounds write in snappy-java through 1.1.10.8 allows unauthenticated remote attackers to crash the JVM by supplying valid compressed data whose decompressed size exceeds the caller-provided destination ByteBuffer capacity. The `Snappy.uncompress(ByteBuffer, ByteBuffer)` method passes the destination buffer directly to the native Snappy decompressor via JNI without first asserting that its capacity can accommodate the full decompressed output, causing native-layer writes past the buffer boundary and abrupt JVM process termination. No public exploit code or active exploitation has been identified at time of analysis, but the attack is trivially constructible by any attacker familiar with the Snappy wire format against applications that process untrusted compressed input through this specific API overload.
Heap buffer overflow in stb_vorbis through 1.22 allows remote attackers to crash or corrupt the heap of any application that parses attacker-supplied Ogg Vorbis audio. The root cause is an integer truncation bug in start_decoder() where the codebook multiplicands allocation size is computed as a size_t but narrowed to int before being passed to the allocator, enabling a heap undersizing condition triggerable by crafting codebook entries and dimensions values that overflow the int range. No public exploit code or active exploitation is confirmed, but the no-interaction network vector makes this impactful for any service that accepts Ogg Vorbis input from untrusted sources.
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; the fix ships in 7.0.16 and 8.0.5.
Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who supplies a crafted .traineddata language file to corrupt heap memory during legacy OCR classifier initialization, with potential for controlled code execution. The flaw is in ReadIntTemplates in src/classify/intproto.cpp, which reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP file component and uses them directly as loop bounds - storing heap pointers into fixed-capacity struct arrays without validating against compile-time maximums. No patched release exists as of this review, though a fix commit is present in the repository; no public exploit has been identified.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls the loaded .traineddata model file to corrupt heap memory, crash the process, or potentially achieve code execution. The root cause is in GenericVector::read (src/ccutil/genericvector.h): the serialized `reserved` field allocates the backing buffer while the independent `size_used_` field drives the callback write loop, with no invariant check enforcing size_used_ ≤ reserved. A crafted TESSDATA_INTTEMP component with version_id ≥ 4 exploits this by setting reserved small and size_used_ large, triggering the write overrun through fontinfo_table_.read during legacy classifier initialization. No public exploit and no CISA KEV entry exist at time of analysis; an upstream commit fix exists but no patched release has been published.
Heap out-of-bounds write in Tesseract OCR 5.5.3 and earlier allows an attacker who controls a crafted `.traineddata` model file to corrupt heap memory during LSTM inference, leading to a crash or potentially controlled code execution. The root cause is an inconsistency between `source_` (sized from deserialized `na_`) and the write count used by `WriteTimeStepPart` and `AddTimeStepPart` (driven by `ns_` from the CI gate WeightMatrix dim1), leaving two functions unbounded after prior hardening patched sibling routines. No fixed release is available at time of analysis; an upstream fix exists only as a commit. No public exploit identified at time of analysis.
Buffer overflow in the XML processing stack of Palo Alto Networks PAN-OS enables unauthenticated remote attackers to cause denial of service on VM-Series virtual firewalls or execute arbitrary code with root privileges on PA-Series physical appliances. The vulnerability is reachable via the management web interface or dataplane interface, and Panorama management platforms are also confirmed in scope. No public exploit has been identified at time of analysis; the CVSS 4.0 supplemental metric E:U corroborates no known active exploitation.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. Exploitation can corrupt unrelated heap objects or terminate the JVM process entirely. No public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to execute arbitrary code with system server privilege. The flaw resides in Samsung's proprietary Mobile Display Image Enhancement (mdnie) library, which is accessible from low-privilege application contexts with no special Android permissions required. No public exploit has been identified at time of analysis, and Samsung addressed this in the September 2026 Monthly Security Release (SMR Sep-2026 Release 1).
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM TrustZone that handles cryptographic key operations - allows local attackers with high privileges to corrupt memory within the secure world, potentially compromising key material or TEE integrity. Affected devices run Android 14 through 17, with a fix delivered in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome's DevTools component (versions prior to 153.0.8010.36) enables arbitrary code execution within the renderer sandbox when a victim is socially engineered into visiting a crafted HTML page. The CVSS score of 8.8 reflects full C/I/A impact, but Chromium's own internal severity classification of 'Low' signals that exploitation is sandboxed - OS-level compromise requires an additional chained sandbox escape. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Remote code execution in Google Chrome's DevTools component before 153.0.8010.36 stems from a use-after-free (CWE-416) that, per the advisory, allows a crafted HTML page to execute arbitrary code outside the browser sandbox. All desktop Chrome builds prior to the fixed stable release are affected; the flaw was reported internally by the Chrome team, is fixed in the stable channel, and has no public exploit identified at time of analysis. Notably, the assigned CVSS is 9.6 (Critical) while Chromium itself rated the security severity only 'Low', a significant conflict discussed below.
Sandbox-escaping remote code execution in Google Chrome's WebPackaging component affects all desktop versions prior to 153.0.8010.36. A use-after-free (CWE-416) reachable from a crafted HTML page can let a remote attacker potentially execute arbitrary code outside the renderer sandbox with no authentication, requiring only that the victim visit a malicious page. No public exploit has been identified at time of analysis; Chromium's own internal triage rated the security severity 'Low', which sits in notable tension with the 9.6 CVSS assigned to the record.
Remote code execution in Google Chrome on iOS before 153.0.8010.36 stems from a use-after-free in the Sharing component (CWE-416), letting a remote attacker who lures a victim to crafted network content execute arbitrary code outside the browser sandbox. Google has shipped a patched Chrome build; no public exploit is identified at time of analysis, and Google/Chromium rated the underlying bug 'Medium' severity even though the assigned CVSS base score is 9.6.
Remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the Passwords component that, when triggered via crafted UI interaction and social engineering, can let a remote attacker escape the renderer sandbox and run arbitrary code. All Chrome desktop builds before the 153.0.8010.36 stable release are affected. No public exploit identified at time of analysis, and no EPSS or KEV data was provided; note that Google's Chromium team rated the underlying bug only 'Medium' severity, which sits in tension with the supplied CVSS 9.6.
Sandbox-escaping remote code execution in Google Chrome's Aura windowing layer affects all desktop builds prior to 153.0.8010.36. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and potentially execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the fix ships in the stable-channel desktop update.
Out-of-bounds write in the Media component of Google Chrome before 153.0.8010.36 allows a remote attacker to potentially execute arbitrary code outside the browser's renderer sandbox by luring a victim to a crafted HTML page. The scope-changing memory-corruption bug carries a CVSS of 9.6 despite Chromium's own 'Medium' severity rating, and a vendor patch is available. There is no public exploit identified at time of analysis.
Remote code execution in Google Chrome on Windows prior to 153.0.8010.36 arises from a type-confusion bug in the browser's Rust code, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Google shipped a fixed build via the Stable channel, and the flaw was reported internally by the Chrome team. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though sandbox-escape memory-corruption bugs in Chrome are historically high-value exploitation targets.
Remote code execution in Google Chrome for macOS prior to 153.0.8010.36 stems from a use-after-free in the Extensions component, letting a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw carries a CVSS 9.6 (scope-changed, network vector with user interaction), though Chromium's own security team rated it 'Medium'. No public exploit has been identified at time of analysis, and the fix is available in the stable channel.
Use-after-free in Chrome's V8 JavaScript engine allows a remote attacker who can socially engineer a victim into installing a crafted Chrome extension to execute arbitrary code within the browser's renderer sandbox, affecting all Chrome versions prior to 153.0.8010.36. The vulnerability is constrained to in-sandbox execution - it does not constitute a standalone sandbox escape - which aligns with the S:U CVSS metric and Chromium's internal 'Medium' severity rating despite the 8.8 base score. No public exploit code or active exploitation has been identified at time of analysis, and Google has shipped a patch in the stable channel.
Use-after-free in Google Chrome's DevTools component prior to 153.0.8010.36 enables a local attacker to escape the browser sandbox and execute arbitrary code at the host OS level via a crafted local program. Chromium's own severity rating is 'Medium', reflecting the local access prerequisite, while the CVSS 8.1 score captures the high-impact sandbox-escape outcome once exploitation succeeds. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score (0.12%, 2nd percentile) confirms low observed exploitation probability.
Sandbox-escaping remote code execution in Google Chrome's Browser process on Windows (all versions prior to 153.0.8010.36) stems from a use-after-free flaw. A remote attacker who lures a victim into opening a crafted HTML page can corrupt reclaimed heap memory in the privileged browser process and execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the vendor has shipped a fixed stable build.
Use-after-free in Chrome's ANGLE graphics layer on Windows enables sandbox escape and arbitrary code execution when a renderer process has already been compromised. Affected versions are all Chrome releases prior to 153.0.8010.36 on Windows; exploitation requires an attacker to first compromise the renderer and then deliver a crafted HTML page triggering the ANGLE memory corruption. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.28% (20th percentile) reflects low observed exploitation probability.
Type confusion (CWE-843) in Chrome's XML processing component allows remote attackers to execute arbitrary code within the Chrome renderer sandbox by enticing a target to visit a crafted HTML page. All Chrome desktop versions prior to 153.0.8010.36 are affected across Windows, macOS, and Linux. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the impact is further bounded by Chrome's sandbox architecture, which prevents direct OS-level code execution without a secondary sandbox-escape primitive.
Use-after-free in Chrome's Chromecast component allows remote attackers to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Affected are all Google Chrome releases prior to 153.0.8010.36 across desktop platforms. Exploitation is sandboxed - code execution is confined to the renderer process - but the C:H/I:H/A:H impact rating reflects full compromise of data accessible within that context. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.
Out-of-bounds write in Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the renderer sandbox by directing a user to a crafted HTML page. All Google Chrome versions prior to 153.0.8010.36 are affected across desktop platforms. Impact is bounded by Chrome's renderer sandbox - an attacker achieves control over the renderer process and can access browser-stored data such as session cookies and saved credentials, but reaching the host OS would require a separately chained sandbox escape exploit. No public exploit identified at time of analysis.
Sandbox-escaping remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the browser's Core component that a remote attacker can trigger through a maliciously crafted Chrome extension. Successful exploitation lets attacker-controlled code run outside the renderer sandbox with the browser process's privileges, but it requires convincing the victim to install or interact with the malicious extension (social engineering). There is no public exploit identified at time of analysis, EPSS is low (0.24%, 15th percentile), and CISA SSVC records exploitation as none, so the risk is high-impact but currently unproven in the wild.
Remote code execution in Google Chrome before 153.0.8010.36 stems from a use-after-free in the browser's Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Chromium rates the severity High, and the supplied CVSS is 9.6 reflecting the sandbox-escape scope change. EPSS is low (0.35%, 29th percentile) and no public exploit is identified at time of analysis.
Remote code execution inside the Chrome sandbox is possible in Google Chrome versions prior to 153.0.8010.36 via a use-after-free vulnerability in the V8 JavaScript engine, triggered by a specially crafted HTML page. An unauthenticated remote attacker who can lure a user to a malicious page can execute arbitrary code within the Chrome renderer process sandbox - a significant foothold even without a sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% reflects low observed exploitation activity, though V8 UAF primitives are historically attractive to threat actors.
Type confusion in V8 (CWE-843) in Google Chrome prior to 153.0.8010.36 allows a remote attacker to achieve arbitrary code execution within the Chrome renderer sandbox by delivering a crafted HTML page. All desktop Chrome installations on unpatched versions are affected, exploitable via drive-by browsing without any authentication or special privileges beyond convincing the victim to visit a malicious page. No public exploit or CISA KEV listing has been confirmed at time of analysis; SSVC rates technical impact as total but exploitation as none, consistent with a low EPSS of 0.23%.
Sandbox-escape code execution in Google Chrome's Printing subsystem (all versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a crafted HTML page, leveraging a use-after-free in the print handling path. This is a secondary exploit in a multi-stage chain: renderer compromise is a hard prerequisite, not something this bug alone provides. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
Sandbox-escaping remote code execution in Google Chrome's Payments component (versions prior to 153.0.8010.36) lets a remote attacker who successfully social-engineers a victim into visiting a crafted HTML page trigger a use-after-free and potentially run arbitrary code outside the renderer sandbox. Chromium rates the security severity 'High'; the supplied CVSS is 9.6 reflecting scope change and full CIA impact. No public exploit is identified at time of analysis and EPSS is low (0.26%, 17th percentile), and CISA SSVC records exploitation status as none.
Remote code execution in Google Chrome on macOS prior to 153.0.8010.36 stems from a use-after-free in the Payments component, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the browser sandbox. The provided CVSS vector (9.6) reflects a scope-changing sandbox escape requiring user interaction (a page visit), while Chromium rated the underlying bug 'High' rather than 'Critical'. A vendor patch is available; EPSS is low (0.30%, 22th percentile) and no public exploit is identified.
Sandbox-escape remote code execution in Google Chrome's Device component on macOS (versions prior to 153.0.8010.36) allows a remote attacker to potentially run arbitrary code outside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; Chromium assigned it 'High' severity while the CVSS base score is 9.6. No public exploit identified at time of analysis, and EPSS is low (0.26%).
Use-after-free in V8, Chrome's JavaScript engine, enables remote code execution within the browser's renderer sandbox when a victim visits a crafted HTML page. All Chrome releases prior to 153.0.8010.36 are affected across desktop platforms. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), but SSVC rates the technical impact as total, and the Chromium security team classified this as High severity.
Use-after-free in Chrome's WebPackaging component enables full sandbox escape to arbitrary code execution for attackers who have already established a foothold in the renderer process. All Chrome desktop releases prior to 153.0.8010.36 are affected. No public exploit code has been identified and EPSS is low (0.34%), but the scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms that successful exploitation fully escapes Chrome's multi-process sandbox, translating a renderer compromise into OS-level code execution.
Use-after-free in Chrome's Input component enables in-sandbox remote code execution against all Chrome versions prior to 153.0.8010.36. The vulnerability is triggered when a victim visits a crafted HTML page, requiring no authentication and no special configuration - only a single browse action. Google has rated this High severity, the patch is available in 153.0.8010.36, and no public exploit has been identified at time of analysis, with EPSS at 0.21%.
Use-after-free in Chrome's Platform component (all versions prior to 153.0.8010.36) enables remote code execution confined within the browser sandbox when a user visits a crafted HTML page. The Chromium team rated this 'High' severity - consistent with the CVSS 8.8 score and distinguishing it from Critical-rated full sandbox-escape vulnerabilities addressed in the same release cycle. No public exploit code has been identified, and the EPSS score of 0.21% (12th percentile) reflects limited observed exploitation activity at this time; no CISA KEV listing exists.
Remote code execution outside the browser sandbox affects Google Chrome versions prior to 153.0.8010.36 through a use-after-free flaw in the Web Authentication (WebAuthn) component. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code with the privileges of the browser process, escaping the renderer sandbox (scope change). No public exploit has been identified at time of analysis and EPSS is low (0.34%), but the sandbox-escape RCE nature and Chrome's enormous install base make prompt patching important.
Remote code execution in Google Chrome's ANGLE graphics component on Windows (versions prior to 153.0.8010.36) allows a remote attacker to trigger an out-of-bounds write and potentially execute arbitrary code outside the browser sandbox via a crafted HTML page. Rated Chromium 'High' with a CVSS of 9.6 reflecting a scope-changing sandbox escape, though exploitation requires the victim to load malicious web content. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with CISA SSVC scoring exploitation as 'none'.
Use-after-free in Chrome's Views UI framework enables local attackers to escape the browser sandbox and execute arbitrary code at browser-process privilege level. The vulnerability affects all Google Chrome desktop versions prior to 153.0.8010.36. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects low near-term exploitation probability.
Sandbox-escape remote code execution in Google Chrome on Android (versions prior to 153.0.8010.36) stems from a use-after-free in Dawn, Chromium's WebGPU implementation. A remote attacker who lures a victim to a crafted HTML page can trigger the freed-object reuse to execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; there is no public exploit or CISA KEV listing, and EPSS is low (0.30%), indicating no evidence of active or widespread exploitation at time of analysis.
Use-after-free in Google Chrome's Core component on Windows prior to 153.0.8010.36 enables a renderer-compromised attacker to escape the browser sandbox and execute arbitrary code on the host OS. The vulnerability is platform-specific to Windows and functions as the second stage of a chained exploit: an attacker must first achieve renderer-level compromise before triggering this UAF to pivot into the privileged browser process. No public exploit code or active exploitation has been identified at time of analysis; vendor patch 153.0.8010.36 is available.
Use-after-free in Chrome's Receiver component allows an adjacent, unauthenticated attacker to execute arbitrary code outside the renderer sandbox via crafted network traffic, affecting all Chrome versions prior to 153.0.8010.36. The scope change in the CVSS vector confirms this is a full sandbox escape - successful exploitation yields OS-level code execution on the victim machine without requiring any user interaction. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) indicates low observed exploitation activity.
Sandbox-escape remote code execution in Google Chrome's Views UI framework prior to 153.0.8010.36 allows a local attacker to execute arbitrary code outside the browser sandbox by inducing a specific UI interaction that triggers a use-after-free condition. The CVSS scope change (S:C) confirms the vulnerability crosses the renderer sandbox boundary into the broader OS context, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.20% (10th percentile) reflects low automated exploitation probability, though sandbox escapes are high-value for privilege escalation chains.
Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a use-after-free in ANGLE, Chrome's graphics abstraction layer that translates OpenGL ES calls to Direct3D. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code outside the browser sandbox, giving full compromise of the renderer host process. No public exploit identified at time of analysis, and EPSS is modest (0.35%), but the sandbox-escape impact and one-click delivery make this a high-priority browser patch.
Use-after-free in Chrome's Cast (Chromecast streaming) component allows an adjacent unauthenticated attacker to potentially escape the browser sandbox and execute arbitrary code by delivering crafted network traffic over a local or Wi-Fi network. All Chrome desktop versions prior to 153.0.8010.36 are affected, with Chromium rating this Critical due to the full-CIA, scope-changed impact. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal observed exploitation activity despite the high severity classification.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 arises from an out-of-bounds write in the WebGL graphics subsystem, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the renderer sandbox. Rated Critical by Chromium and CVSS 9.6, the scope-changed vector reflects a full sandbox escape. No public exploit is identified at time of analysis and EPSS is low (0.39%), but WebGL memory-corruption bugs are historically high-value targets.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 stems from a use-after-free in the WebGL implementation that a remote attacker can trigger with a crafted HTML page to execute arbitrary code outside the browser sandbox. Chromium rates this Critical and the CVSS is 9.6, reflecting a full renderer-to-sandbox-escape chain requiring only that a victim visit a malicious page. No public exploit is identified at time of analysis and EPSS is low (0.36%), but the sandbox-escape impact makes it a priority patch.
Remote code execution in Google Chrome desktop prior to 153.0.8010.36 arises from a use-after-free in the WebGL implementation, allowing a remote attacker to run arbitrary code outside the browser sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as Critical and the CVSS is 9.6, reflecting a full renderer-to-host sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.28% (20th percentile).
Use-After-Free in Adobe Acrobat Reader and Adobe Acrobat allows arbitrary code execution in the security context of the current user upon opening a specially crafted PDF file. Affected versions span Acrobat Reader up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit identified at time of analysis, but the file-delivery attack vector makes this a realistic phishing and drive-by-download threat given Acrobat Reader's ubiquity as an enterprise PDF handler.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious document. Affected across both the continuous track (≤26.002.21900) and the classic 2024 track (≤24.001.30383), this is a memory corruption vulnerability rooted in improper object lifecycle management within Acrobat's rendering engine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open attack surface and high impact make this a credible phishing or watering-hole delivery risk.
Use-after-free (UAF) in Adobe Acrobat Reader allows arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious PDF or document file. Affected versions span Acrobat 2024 (≤24.001.30383) and both Acrobat and Acrobat Reader (≤26.002.21900), making the exposure broad across the current release track. No public exploit or active exploitation has been confirmed at time of analysis, but the file-based delivery vector makes this class of vulnerability routinely weaponized via phishing campaigns.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted PDF file. Affected versions include Acrobat Reader and Adobe Acrobat up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis, but the ubiquity of Acrobat Reader across enterprise environments and the reliable code-execution impact make patching a high priority.
Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat allows arbitrary code execution in the context of the opening user when a victim opens a specially crafted malicious file. All versions of Acrobat Reader and Adobe Acrobat through 26.002.21900, and Acrobat 2024 through 24.001.30383, are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-based delivery mechanism and full C:H/I:H/A:H impact make this a material risk for organizations with unpatched deployments.
Out-of-bounds write in Adobe Acrobat and Acrobat Reader allows arbitrary code execution in the current user's context when a victim opens a specially crafted file. Affected are Acrobat 2024 versions through 24.001.30383 and Adobe Acrobat/Acrobat Reader through 26.002.21900, per Adobe APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the ubiquity of Acrobat as an attack surface and the RCE-grade impact make this a priority patch.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat (Continuous track through 26.002.21900; Classic 2024 track through 24.001.30383) enables arbitrary code execution in the context of the victim user. The CWE-787 memory corruption flaw is triggered when a specially crafted document is opened, placing this squarely in the document-weaponization threat category common to PDF toolchains. Adobe PSIRT has issued advisory APSB26-141; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write (CWE-787) in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a crafted malicious PDF or document file. Affected versions span Acrobat 2024 up to 24.001.30383 and both Acrobat and Acrobat Reader through 26.002.21900, per Adobe PSIRT advisory APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the C:H/I:H/A:H CVSS impact and prevalence of Adobe Reader in enterprise environments make this a meaningful patching priority.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.
Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.
Type confusion (CWE-843) in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Multiple product lines are affected, including Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383. No public exploit or CISA KEV listing has been identified at time of analysis, but the ubiquity of Acrobat Reader and routine delivery of PDFs via phishing make this a realistic and high-priority patching target.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Out-of-bounds write (CWE-787) in Adobe Acrobat and Acrobat Reader enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. All continuous-track versions through 26.002.21900 and Acrobat 2024 versions through 24.001.30383 are affected, per Adobe PSIRT and EUVD-2026-74193. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction to deliver and open a malicious document.
Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap memory during RTP encoding, with potential for arbitrary code execution. The root cause is in nal_send() within libavformat/rtpenc_h264_hevc.c, where a negative size value (-3) is passed directly to memcpy, producing an out-of-bounds write. A public proof-of-concept exploit is available, though EPSS probability remains low at 0.17% and no active exploitation has been confirmed by CISA.
Out-of-bounds write in Adobe Photoshop Desktop allows arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted malicious file. Affected versions span both the Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6) release lines. Adobe's PSIRT has released advisory APSB26-130 addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write (CWE-787) in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) enables arbitrary code execution in the context of the logged-in user. The attack is triggered by opening a specially crafted document, making phishing attachments and compromised file-sharing platforms viable delivery mechanisms against creative and design professionals. No public exploit identified at time of analysis, but the low attack complexity and full CIA impact across affected versions represent a meaningful and realistic risk.
Out-of-bounds write in Adobe Photoshop Desktop enables arbitrary code execution in the context of the victim's user account when a malicious file is opened. Both the 2025 branch (through version 26.11.6) and the 2026 branch (through version 27.6) are confirmed affected per Adobe's EUVD entry and APSB26-130 advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open trigger and high CVSS C/I/A ratings make this a credible phishing-delivery vector in creative and design environments.
Out-of-bounds write vulnerabilities in multiple Android system functions allow a local, low-privileged attacker to escalate to root on Android 16-QPR2 and Android 17 without requiring any user interaction. The root cause is integer overflow (CWE-787) that underestimates buffer allocation size, enabling memory writes beyond allocated regions and corruption of privilege-sensitive data structures. The September 2026 Android Security Bulletin addresses these issues, and no public exploit has been identified at time of analysis.
Remote code execution is possible in Android's NFC Type 3 Tag processing layer (rw_t3t.cc within libnfc-nci) across Android 14 through 17 via an integer overflow that triggers a heap out-of-bounds write. No user interaction or additional privileges are required per the description, making this exploitable by any attacker within NFC proximity of an unpatched device. Google addressed this in the September 2026 Android Security Bulletin; no public exploit or active exploitation has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation status as 'none'.
Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Use-after-free code execution in Microsoft Excel allows a local unauthenticated attacker to execute arbitrary code at the privilege level of the victim user by enticing them to open a specially crafted workbook file. Affected products span the full current Office portfolio: Excel 2016, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is identified at time of analysis, but Microsoft has released patches addressing all affected version lines.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.