Microsoft
Monthly
Path traversal in VictoriaMetrics vmrestore (prior to versions 1.122.25, 1.136.12, and 1.146.0) allows an attacker who controls or can modify a remote backup source - S3, GCS, Azure Blob Storage, or equivalent - to plant dot-dot sequences in object names, causing vmrestore to write restored files outside the configured -storageDataPath directory when an operator executes a restore operation. The CVSS Scope Changed metric (S:C) reflects that successful exploitation reaches beyond the vmrestore process boundary to the broader host filesystem, enabling potential overwrite of binaries, configuration, or credentials within the OS permissions of the process. Vendor-released patches are available across three maintained branches; no active exploitation has been identified at time of analysis.
Heap buffer overflow in SumatraPDF 3.6.1 and earlier enables an attacker who delivers a crafted CHM file to corrupt parser heap memory via malformed LZX Huffman code lengths. The PRETREE path in make_decode_table writes internal Huffman tree nodes beyond the 104-entry PRETREE_table boundary into adjacent struct LZXstate heap memory, reachable through the chm_open → chm_retrieve_object → LZXdecompress → BUILD_TABLE call chain. No public exploit or active exploitation is confirmed; arbitrary code execution has not been demonstrated, though the upstream fix commit validates that reliable heap corruption is achievable.
SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). While n8n applies SSRF guards to OAuth2 discovery and dynamic-client-registration requests, the access-token exchange step uses a separate, unguarded HTTP client, meaning a malicious credential configuration bypasses those controls entirely and reflects internal service responses back to the attacker. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 2.3 reflects the constrained impact and privilege requirement.
Cleartext exposure of temporary passwords in the Azure AD Graph app for Splunk SOAR (versions below 2.5.3) allows authenticated action-runners to read Azure AD reset credentials directly from the SOAR interface. The app's reset password action fails to classify the temp_password parameter as a sensitive field, so Splunk SOAR renders it unmasked in the UI rather than applying its standard password-masking behavior. Vendor patch 2.5.3 is available per Splunk advisory SVD-2026-0806; no public exploit code and no CISA KEV listing identified at time of analysis.
Broken access control across all four first-party TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, next-tinacms-cloudinary) allows any authenticated CMS editor to write or delete storage objects outside the operator-configured mediaRoot boundary. The handlers pass attacker-controlled query parameters (req.query.key for presigned S3 PUTs, req.query.media for DELETEs) directly to storage SDK operations without validating that the resulting key falls within the permitted path prefix, giving editors write and delete authority over the entire storage bucket or container reachable by the deployment's IAM or service credential. Vendor-released patches exist in all four packages; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft Windows App for Mac (versions 11.0.0 through 11.3.8) enables a remote unauthenticated attacker to disclose sensitive memory contents over the network when a victim connects to a malicious Remote Desktop server. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability without attacker authentication, though successful exploitation requires the victim to initiate or be lured into an RDP session. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor patch to version 11.3.9 is available from Microsoft.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
SQL injection in Wazuh's File Integrity Monitoring subsystem allows a local low-privileged user on non-Windows systems to manipulate the FIM SQLite database by creating a specially crafted filename in any monitored directory. The `wazuh-syscheckd` daemon in versions 4.6.0 through 4.14.5 concatenates unsanitized file paths directly into SQLite row filter predicates in `DB::getFile()` and `DB::searchFile()`, enabling UNION SELECT injection when the path is processed. No public exploit or KEV listing exists; however, the vendor-merged PR test suite contains a working injection payload, and the impact - falsification or suppression of FIM integrity alerts - directly undermines the product's core security monitoring function.
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when processing archive members whose names temporarily escape and re-enter it, such as '../evil/../dest/sub/file'. The extraction filters ('tar' and 'data') validate the resolved path - which correctly resolves to inside the destination - but create intermediate directories from the raw member name as given, allowing filesystem pollution beyond the extraction boundary. File contents are never placed outside the destination, and no public exploit has been identified at time of analysis; the PSF advisory confirms the limited scope.
Cross-site scripting via deliberate CSP header removal in Streambert's Electron API key redemption window affects versions 2.5.0 through 2.5.x, allowing attacker-controlled script content on sub.wyzie.io or any navigated resource to execute without Content-Security-Policy constraints and interact with other windows and persistent session storage. The wyzie-open-redeem IPC handler in index.js unconditionally strips all CSP response headers from a dedicated Electron session partition, and the redemption BrowserWindow omits a setWindowOpenHandler, compounding the attack surface. No public exploit has been identified at time of analysis; the vulnerability is fixed in version 2.6.0 by complete removal of the vulnerable feature.
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. No public exploit has been identified at time of analysis, and the vendor has already shipped a hardened installer that warns users before proceeding with potentially unsafe target directories.
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas_ctl leak on spi_async failure ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) and relies entirely on the SPI completion callback ca8210_spi_transfer_complete() to free it. The spi_async() API only invokes the completion callback on successful submission. On failure it returns a negative error code without ever queuing the callback, which leaves cas_ctl and its embedded spi_message and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is inside the completion callback, so there is no other reclamation path. ca8210_spi_transfer() is called from ca8210_spi_exchange(), the interrupt handler ca8210_interrupt_handler(), and from the retry path inside the completion callback itself. The exchange and interrupt handler paths loop on -EBUSY, so under sustained SPI bus contention every retry iteration leaks a fresh cas_ctl (~600 bytes per occurrence). Fix it by freeing cas_ctl on the spi_async() error path. While here, correct the misleading error string: the function calls spi_async(), not spi_sync().
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfifo_in()/kfifo_out(). This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the low 4 bytes of the 8-byte pointer are written into the FIFO. The reader then reads back 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes uninitialized stack data. The first dereference of the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel address and generally results in an oops. Use sizeof(fifo_buffer) so the byte count matches pointer width on every architecture. The driver has no architecture restriction in Kconfig, so any 64-bit build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has been latent since the driver was added in 2017 because it is most commonly deployed on 32-bit MCUs. Found via a custom Coccinelle semantic patch hunting for short-byte kfifo I/O on byte-mode kfifos used to shuttle pointers.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit") moved the binding-path session key out of the session-wide sess->sess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and sized both that buffer and the on-stack copy used during binding with SMB2_NTLMV2_SESSKEY_SIZE (16): struct channel { char sess_key[SMB2_NTLMV2_SESSKEY_SIZE]; /* 16 */ ... }; ntlm_authenticate() / krb5_authenticate(): char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; /* 16 */ char *auth_key = conn->binding ? channel_key : sess->sess_key; The two writers that fill this destination still bound the copy length against CIFS_KEY_SIZE (40), not against the 16-byte buffer: ksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange): if (sess_key_len > CIFS_KEY_SIZE) /* 40 */ return -EINVAL; arc4_crypt(ctx_arc4, sess_key, (char *)authblob + sess_key_off, sess_key_len); ksmbd_krb5_authenticate(): if (resp->session_key_len > sizeof(sess->sess_key)) /* 40 */ ... memcpy(sess_key, resp->payload, resp->session_key_len); On a binding SESSION_SETUP, auth_key points at the 16-byte channel_key, so a client that supplies an NTLM EncryptedRandomSessionKey of up to 40 bytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose session key is longer than 16 bytes (a normal AES256 key is 32), writes past the 16-byte stack buffer -- up to a 24-byte kernel stack overflow. KASAN reports it as a stack-out-of-bounds write in arc4_crypt() called from ksmbd_decode_ntlmssp_auth_blob(). The destinations must be able to hold the full session key the length checks already permit. Size the per-channel key buffer and the two on-stack channel_key buffers with CIFS_KEY_SIZE, matching sess->sess_key.
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpf_lru_pop_free()/push_free() already hold on the same CPU, AA-deadlocking. Lockdep reports "inconsistent {INITIAL USE} -> {IN-NMI}" on &l->lock (syzbot c69a0a2c816716f1e0d5) and "possible recursive locking detected" on &loc_l->lock (syzbot 18b26edb69b2e19f3b33). Prior trylock and rqspinlock based fixes (see links) were nacked because compromised on reliability. This patch converts every LRU lock site to rqspinlock_t and adds a recovery path for some failure windows to avoid node leaks. Failure recovery: - *_pop_free top-level: return NULL; prealloc_lru_pop() already treats that as no-free-element (-ENOMEM). - Cross-CPU steal: skip the victim's locked loc_l, try next CPU. - Post-steal local lock fail: publish stolen node to lockless per-CPU free_llist; next pop on this CPU picks it up. - push_free fail: mark node pending_free=1. __local_list_flush(), __local_list_pop_pending() reclaim the node from pending_list. __bpf_lru_list_shrink_inactive() reclaims the node from inactive list. Nodes from active list are reclaimed by __bpf_lru_list_shrink() or after __bpf_lru_list_rotate_active() demotes it to the inactive.
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regions_lock", to disable region deletion in the critical period between construct_region() and attach_target(), as well as the period between device_add() and registering the remove actions. Otherwise, userspace can confuse the kernel. It can violate the assumption the region stays registered through the completion of cxl_add_to_region(). It can violate the assumption that devm_add_action_or_reset() is working with a live 'struct cxl_region'. It is ok for the region to disappear outside of those windows as that mirrors device hotplug flows where the proper locks are held.
Resource exhaustion in Elastic Kibana allows an authenticated user who holds maintenance window management privileges to crash the Kibana process for all users by submitting a specially crafted malformed payload. The Kibana process consumes unbounded resources and becomes fully unresponsive, requiring manual operator intervention to restore service - there is no automatic recovery. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low access complexity and broad multi-tenant availability impact make it a meaningful operational risk for shared Kibana deployments.
Cross-site request forgery in Zimbra Collaboration's Exchange Web Services (EWS) endpoint (versions before 10.1.17) allows a network-based attacker to perform unauthorized actions on behalf of an authenticated victim by exploiting insufficient content-type validation. Exploitation requires tricking a logged-in Zimbra user into interacting with attacker-controlled content, after which the browser automatically submits a crafted EWS request within the victim's session context. No public exploit has been identified and this CVE is absent from the CISA KEV catalog; the CVSS score of 3.1 accurately reflects the high attack complexity and integrity-only impact bounded to the victim's account.
PostgreSQL's GSSAPI authentication enforcement can be bypassed in versions 17.x and 18.x, allowing an authenticated database user to establish a connection protected only by TLS despite pg_hba.conf explicitly requiring GSSAPI. The bypass is achieved by initiating a direct TLS connection rather than a GSSAPI handshake, causing the server to accept the weaker protection profile when TLS settings are more permissive than GSS settings. No public exploit code and no CISA KEV listing have been identified at time of analysis; the EPSS score was not provided in source data.
Wireshark 4.6.0 through 4.6.7 on Windows crashes when parsing malformed Ixia IxVeriWave capture files or Vector Informatik BLF files, resulting in denial of service via an out-of-bounds write (CWE-787). The vulnerability requires a user to open a crafted file, making it a user-assisted local attack. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary code execution at SYSTEM or root privilege levels when clients connect to an attacker-controlled rogue gateway or are subjected to a man-in-the-middle attack. The vulnerability resides in the client-side VPN agent's processing of gateway-supplied data, where a crafted response can corrupt memory and hijack execution. No public exploit has been identified at time of analysis, and CISA has not confirmed active exploitation, but full confidentiality, integrity, and availability compromise is possible on any affected endpoint that connects through a manipulated gateway.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain unauthorized access to the agent's protected processes and files, effectively disabling endpoint security enforcement. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly not impacted. No public exploit code has been identified and no active exploitation has been confirmed (CVSS E:U), keeping real-world risk constrained to insider threat and post-compromise scenarios.
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrator to circumvent the agent's security inspection enforcement, subsequently enabling injection and interception of arbitrary network traffic. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected by the vendor. No public exploit has been identified at time of analysis, and exploitation requires pre-existing local administrator access, significantly narrowing the realistic threat population.
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to delete a limited set of system files and disable the agent entirely. Only Linux deployments are affected - macOS, Windows, iOS, Android, and Chrome OS are explicitly confirmed safe by the vendor. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 4.0 supplemental vector classifies exploitation as unlikely (E:U) with Amber urgency, making this a low-priority but genuine patch target for Linux endpoint fleets.
Privilege escalation in LuminalShine prior to version 26.05.0-rc4 stems from a latent file permission gap where `apps.json`, written by the SYSTEM service to `C:\ProgramData\LuminalShine\config\`, could be overwritten by local users if directory ACLs deviate from Windows defaults. On a default Windows installation this EoP path does not trigger because `BUILTIN\Users` inherits only Read+Execute rights from `C:\ProgramData`; the vulnerability is only exploitable when an administrator has loosened those inherited permissions. No public exploit code has been identified and no active exploitation is confirmed.
Integer underflow in open-iscsi's iscsiuio daemon crashes the process when parsing malformed DHCPv6 Advertise packets with a truncated UDP length field, disrupting iSCSI storage connectivity. Systems running Red Hat Enterprise Linux 9 and 10 with iscsiuio actively engaged in a DHCPv6 exchange are exploitable by any unauthenticated attacker on the same adjacent network segment. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; real-world impact is highest in shared or multi-tenant storage network environments where adjacency cannot be guaranteed.
Unauthenticated remote denial of service in the Russh SSH library (versions ≤ 0.62.3) allows any network attacker to crash individual server key-exchange sessions by sending a single SSH_MSG_KEX_ECDH_INIT packet containing a 32-byte all-zero Curve25519 public key. The defect triggers under the default server configuration - no special deployment required - causing a Rust bounds-check panic in encode_mpint before host-key signature verification ever occurs. A public proof-of-concept is documented in GHSA-5xvq-cp9x-6p6r; no active exploitation is confirmed in CISA KEV.
Denial-of-service in russh's Curve25519 key exchange client path allows any malicious SSH server to crash a connecting russh client session deterministically and pre-authentication, before host key verification occurs. Affected are all russh client deployments running versions prior to 0.62.4. An attacker operating or controlling an SSH server can terminate the client's spawned session task with a single malformed KEX_ECDH_REPLY packet; a working proof-of-concept is included in the GHSA advisory. No public exploit identified at time of analysis for active exploitation, and CISA KEV listing is absent, but the attack is reliable, requires no authentication, and a POC is publicly available.
IBM Db2 on Linux, UNIX, and Windows exposes cleartext database passwords by writing them into diagnostic trace files, affecting versions 11.5.0-11.5.9 and 12.1.0-12.1.5, including DB2 Connect Server. Any low-privilege local OS user with read access to the Db2 trace directory can harvest plaintext credentials without requiring database-level authentication or elevated system rights. IBM has released a patch; no active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Memory leak denial of service in IBM Db2 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) enables a local attacker with low-privilege credentials to exhaust system resources and degrade database availability. Rooted in CWE-770 (uncontrolled resource allocation), the flaw requires no user interaction beyond an authenticated local session. No public exploit code or active exploitation is identified; IBM has released a patch via its support portal.
Server-side request forgery in Microsoft UFO's URL validation layer allows unauthenticated remote attackers to bypass the SSRF guard by supplying IPv6 transition addresses - NAT64 (64:ff9b::/96, 64:ff9b:1::/48), 6to4 (2002::/16), or Teredo (2001::/32) - that embed private or link-local IPv4 destinations the guard would otherwise reject. The bypass grants access to cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, or localhost in any deployment where UFO processes externally-influenced URLs. No active exploitation is confirmed (not in CISA KEV), but the technique is well-documented in SSRF research and the fix is available in version 3.0.8.
CSV formula injection in Velociraptor's export pipeline allows attacker-controlled endpoint artifacts to execute as formulas when a forensic analyst opens the exported CSV in Microsoft Excel. Affected export paths include the GUI, offline collector, and data export features - any of which may produce unsanitized CSV output when collected data contains leading formula-trigger characters (=, +, -, @, tab). No public exploit code has been identified and no CISA KEV listing exists; however, the CVSS scope-change metric (S:C) and high confidentiality rating (C:H) correctly reflect that successful exploitation results in formula execution within the analyst's own workstation environment rather than the Velociraptor server itself.
Command injection in the Notepad++ Windows 11 x64 and ARM64 installer prior to version 8.9.7 allows an attacker who can influence the installation directory path to execute arbitrary PowerShell commands in the installer's security context. The vulnerable `RegisterMSIX` function in the NSIS installer script (`nppSetup.nsi`) unsafely interpolates the `$INSTDIR` variable into a PowerShell `-Command` string, enabling subexpression syntax such as `$()` embedded in a crafted directory name to be evaluated as live commands. Exploitation additionally requires that the user selects the optional Explorer context menu shell extension component during installation. The vendor has confirmed the fix in version 8.9.7; no public exploit or active exploitation has been identified at time of analysis.
Server-Side Request Forgery in kkFileView before 5.0.1 allows unauthenticated remote attackers to make the application server issue HTTP requests to arbitrary internal or external URLs via the unprotected /addTask endpoint. The vulnerability arises because /addTask was excluded from both TrustHostFilter and TrustDirFilter in WebConfig.java, and the fullfilename parameter can be manipulated to coerce file type classification as OFFICE, COMPRESS, or CAD, triggering FileConvertQueueTask to fetch attacker-chosen URLs. No public exploit identified at time of analysis per CISA KEV; however, SSVC flags a publicly available POC and marks the vulnerability as automatable.
Remote code execution in Microsoft Edge (Chromium-based) below version 151.0.4129.78 stems from a type confusion flaw (CWE-843) in the browser engine, exploitable over the network when a user visits or interacts with attacker-controlled content. The vendor has confirmed patch availability and the flaw is tagged as causing memory corruption, which aligns with the typical consequence of type confusion in browser engines. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the unauthenticated network vector with low attack complexity warrants prioritized patching in enterprise environments.
Privilege escalation in Microsoft OneDrive for macOS exploits improper symbolic link resolution (CWE-59), enabling a locally authorized high-privileged attacker to redirect OneDrive file operations to unintended filesystem locations and gain elevated access beyond their sanctioned scope. Affected versions span 26.0.0.0 up to but not including 26.095.0519.0003 on macOS exclusively. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog, though the full high-high-high CIA impact within the unchanged scope warrants prompt patching for any enterprise deploying OneDrive on macOS endpoints.
Symlink-following in the Windows Container Isolation FS Filter Driver (unionfs.sys) enables a locally authenticated attacker with low privileges to tamper with files outside the expected isolation boundary. Affected systems run Windows 11 version 26H1 builds prior to 10.0.28000.2704. A vendor patch is available; no public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Windows Management Services on Windows 11 contains an improper link resolution flaw (CWE-59) that allows an authenticated local attacker to crash or disable the service by planting a malicious symbolic link or directory junction at a file path the service accesses. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, with patched builds confirmed by Microsoft via MSRC. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel enables remote information disclosure when a user opens a specially crafted spreadsheet. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms that an unauthenticated network-based attacker can trigger the flaw, but only after social engineering a victim into opening a malicious file. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected Office product lines.
Out-of-bounds read in Microsoft Excel exposes sensitive memory contents over a network to unauthenticated remote attackers, resulting in high-confidence information disclosure (C:H). Exploitation requires user interaction - specifically, opening a crafted Excel document - placing this firmly in the phishing/malicious-attachment delivery class. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis, though the patch is available and should be applied promptly given the ubiquity of the affected product across enterprise environments.
Information disclosure in Microsoft Office PowerPoint enables a local attacker to obtain sensitive data from a victim's system by exploiting improper input validation (CWE-20) when processing a malicious file. Affected products span Windows and Mac editions including Office 2019, Microsoft 365 Apps for Enterprise, LTSC 2021/2024, and Office 365 for Mac - all requiring the victim to open a crafted PowerPoint file (UI:R). No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, a vendor patch is available.
Information disclosure in Microsoft Office (spanning 365 Apps for Enterprise, LTSC 2021/2024, Office 2019, and macOS variants) is triggered locally when a user opens a specially crafted document, exploiting improper input validation (CWE-20) to expose sensitive information with high confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) confirms local-only exploitation requiring user interaction, substantially limiting opportunistic mass exploitation. No public exploit has been identified at time of analysis, and Microsoft has released a patch across all affected product lines.
Local information disclosure in Microsoft PowerPoint stems from improper input validation (CWE-20) when processing specially crafted presentation files, affecting a broad range of Office product lines on both Windows and macOS. The CVSS vector (AV:L/UI:R/C:H) confirms that while no special system privileges are required, a victim must open a malicious file, making social engineering the primary delivery mechanism. No public exploit has been identified and no active exploitation is confirmed, but the high confidentiality impact (C:H) warrants prompt patching given the ubiquitous deployment of Microsoft Office.
Information disclosure in Microsoft Office PowerPoint stems from improper input validation (CWE-20) that allows a locally-present attacker to read sensitive data from the vulnerable system when a user opens a crafted file. Affected products span PowerPoint across Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code or active exploitation has been identified at the time of analysis; a vendor patch is available via standard Office update channels.
Microsoft Office Word's document parsing logic fails to properly validate input (CWE-20), enabling a local attacker to read sensitive information from a target system when a victim opens a specially crafted Word document. The flaw affects a broad range of Microsoft Office releases on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, and all LTSC variants through 2024. SSVC assessment confirms no current exploitation activity and the attack is not automatable due to required user interaction, though the CVSS confidentiality impact is rated High.
Improper input validation in Microsoft Office Excel enables a local attacker to disclose sensitive information when a target user opens a specially crafted file. The vulnerability affects a broad swath of Microsoft Office product lines - including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, Office 365 for Mac, and Word 2016 - across both Windows and macOS platforms. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches are available across all affected product lines.
Uninitialized memory disclosure in Microsoft Office exposes sensitive process memory to local attackers who can deliver a crafted document. Affecting a broad range of Office versions across Windows and macOS - including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office 365 for Mac - the flaw yields high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via the August 2026 update cycle.
Improper input validation in Microsoft Office PowerPoint enables local information disclosure when a victim opens a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and their macOS counterparts across both subscription and perpetual-license release tracks. Microsoft has released patches via the standard Office update channel; no public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (Windows and macOS editions, including LTSC 2024, LTSC 2021, 2019, and 365 Apps) enables local information disclosure when a user opens a maliciously crafted document. The CVSS vector (AV:L/UI:R) confirms exploitation is constrained to local, user-triggered scenarios with no code execution or data modification capability. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing exists at time of analysis.
Local information disclosure in Microsoft Office stems from improper input validation (CWE-20), allowing a local attacker who can induce user interaction to read sensitive data from the affected system. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Office 365/LTSC for Mac, with Mac builds patched at 16.112.26081010 and Windows builds addressed via the Microsoft Office Security Releases channel. No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable attack path.
Local information disclosure in Microsoft Office PowerPoint exposes sensitive data when a user opens a crafted file. The flaw, rooted in improper input validation (CWE-20), affects a broad range of Office versions across Windows and macOS including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches via its August 2026 update cycle.
Out-of-bounds read in Microsoft Office Word exposes sensitive memory contents to local attackers via crafted document files. Affected products span Word 2016 through Microsoft 365 Apps for Enterprise on both Windows and Mac platforms, covering a broad enterprise install base. Exploitation requires user interaction - a victim must open a malicious document - but yields high confidentiality impact with no integrity or availability loss. No public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a victim to open a crafted spreadsheet file. The flaw affects a wide range of Office versions across both Windows and macOS platforms, including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. No public exploit or active exploitation has been identified at time of analysis; SSVC assessment rates exploitation as none and the attack as non-automatable, indicating moderate real-world urgency despite the High confidentiality impact rating.
Incomplete resource cleanup in Microsoft Office PowerPoint exposes sensitive document data to local attackers across multiple supported product lines, including Microsoft 365 Apps for Enterprise, Office LTSC 2024, LTSC 2021, Office 2019, and PowerPoint 2016. Exploitation requires a victim to open or interact with a PowerPoint file (UI:R), after which residual data - likely temporary files, memory buffers, or cached presentation content - persists in a locally accessible state without requiring attacker privileges. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, keeping real-world risk moderate despite the high confidentiality impact rating.
Out-of-bounds read in Microsoft Excel exposes process memory to local information disclosure across a wide range of Office versions, from Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC releases on both Windows and macOS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms exploitation requires the victim to open a specially crafted spreadsheet file, making phishing-delivered documents the realistic delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Excel triggers information disclosure when a victim opens a specially crafted spreadsheet file, exposing potentially sensitive memory contents to a local attacker. The flaw spans multiple Office product lines - Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and corresponding Mac variants - with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified and SSVC confirms no known exploitation; a vendor patch is available via the Microsoft Security Response Center.
Information disclosure in Microsoft Excel arises from use of uninitialized memory (CWE-908), exposing potentially sensitive heap or stack contents to an attacker when a victim opens a maliciously crafted Excel file. Affected products span the full Microsoft Office portfolio on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, Excel 2016, and their Mac counterparts. No public exploit identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Out-of-bounds read in Microsoft Excel enables local information disclosure when a user opens a specially crafted spreadsheet. Multiple product lines are affected across Windows and macOS, spanning Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise. Microsoft has released patches; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Microsoft Office Word enables a local, unauthenticated attacker to disclose sensitive memory contents by enticing a user to open a maliciously crafted document. Affected products span Microsoft Word 2016, Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, and Office LTSC/365 on macOS. No public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and Microsoft has released patches via the standard Office update channel.
Out-of-bounds read in Microsoft Office exposes memory contents to local information disclosure across a wide range of affected products including Word 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office 365/LTSC for Mac. The CVSS vector (AV:L/UI:R/C:H) indicates exploitation requires a victim to open a specially crafted Office document, after which sensitive in-process memory can be disclosed to the attacker. No public exploit has been identified at time of analysis, no KEV listing exists, and Microsoft has released patches across all affected product lines.
Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality data to a local attacker when a user opens a crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the high confidentiality impact and wide deployment footprint make patching a clear priority.
Microsoft Dynamics 365 on-premises version 9.1 exposes sensitive information to authenticated network attackers via an improper access control flaw (CWE-200), allowing disclosure of data beyond a user's authorization level. The CVSS vector (PR:L) confirms exploitation requires a valid low-privilege account, limiting exposure to insider threats or compromised credentials rather than unauthenticated external actors. No public exploit code and no active exploitation have been identified; SSVC rates this as non-automatable with partial technical impact, consistent with a medium-priority finding.
Information disclosure in Azure CycleCloud allows an authenticated network attacker to bypass authorization checks and read sensitive data. Rooted in CWE-862 (Missing Authorization), the flaw affects versions up to 8.9.2 and is exploitable by any authorized user who can reach the service over a network without elevated privileges. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released a patch.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.
Local privilege escalation in Windows DNS affects a broad range of Windows client and server operating systems, enabling an already-authenticated local attacker to gain elevated privileges on the target system. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the attacker requires high existing privileges - consistent with the description's reference to an 'authorized attacker' - yet can achieve full confidentiality, integrity, and availability impact post-exploitation. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; a vendor-released patch is available via Microsoft's Update Guide.
Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.
Uncontrolled resource consumption in the Windows DHCP Client enables an unauthenticated attacker on the same network segment to crash or deny service to affected hosts without any user interaction. Affected platforms span Windows 11 (versions 24H2, 25H2, and 26H1) and Windows Server 2025, all in unpatched builds. No public exploit code or active exploitation (KEV) has been identified at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Inadequate encryption strength in Windows Active Directory enables a low-privileged authenticated network attacker to bypass a security feature, resulting in a high-integrity impact. Affected platforms span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit identified at time of analysis; SSVC assessment confirms no observed exploitation and the attack is not automatable, placing this in a lower operational urgency tier despite the high integrity impact rating.
Security feature bypass in Microsoft Visual Studio Code Copilot Chat Extension (versions 0.27.0 through pre-1.132.1) enables network-based attackers to circumvent a protective control without authentication, resulting in high integrity impact and low availability impact. The attack requires user interaction - consistent with a scenario where a victim must engage with crafted content delivered over the network. No public exploit code has been identified at time of analysis, and a vendor patch (1.132.1) is available via the Microsoft Security Response Center.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated, low-privileged attacker to inject malicious script content that renders in a victim's browser upon interaction with a crafted page, enabling spoofing and potential session compromise. All three actively-supported on-premises SharePoint product lines are affected, with patched builds available via Microsoft's Security Response Center advisory. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the routine patching tier rather than an emergency-response scenario.
Out-of-bounds read in Microsoft Word's document parsing engine exposes sensitive in-process memory to a local attacker across Office 2016 through LTSC 2024 and macOS variants. Exploitation requires a victim to open a specially crafted document, making social engineering or phishing the primary delivery mechanism. No public exploit code exists and no active exploitation has been identified (not in CISA KEV); SSVC assessment rates exploitation status as none and technical impact as only partial.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to inject malicious script that, when rendered by a victim's browser, performs network-based spoofing within the SharePoint web application. All three current on-premises SharePoint product lines are affected across the 16.0.x branch, with specific fixed builds identified by EUVD-2026-56718. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released patches for all affected versions.
Cross-site scripting in Microsoft SharePoint Server allows an authenticated attacker to inject malicious script content that executes within other users' browser sessions, enabling spoofing and potential session compromise. Affected are SharePoint Server Subscription Edition, 2019, and 2016 Enterprise editions running builds below the July 2026 cumulative update thresholds. Exploitation requires contributor-level authenticated access and victim interaction; no active exploitation is confirmed and no public exploit code has been identified at time of analysis, though the CVSS scope change confirms that successful injection reaches beyond the SharePoint application boundary into victims' browser contexts.
Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated, low-privilege attacker to inject malicious scripts that execute in other users' browsers upon interaction, enabling session hijacking and spoofing attacks within the SharePoint context. The CVSS 7.3 score reflects high confidentiality and integrity impact bounded to the SharePoint application scope, gated by both valid credentials and victim interaction. Microsoft has released patches for all three affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in Microsoft Office exposes potentially sensitive process memory contents when a victim opens a specially crafted document locally. The vulnerability affects the full Office suite across Windows and macOS - spanning Office 2016 through LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - with High confidentiality impact per CVSS but no integrity or availability consequence. No public exploit has been identified at time of analysis; CISA SSVC classifies exploitation status as none and the attack is not automatable, significantly reducing real-world prioritization urgency despite the High C rating.
Cross-site scripting in Microsoft SharePoint Server enables an authenticated attacker with low privileges to inject malicious scripts into web-rendered content, executing arbitrary JavaScript in victims' browsers and enabling spoofing attacks over the network. All three actively-supported SharePoint Server product lines are affected: Enterprise 2016, 2019, and Subscription Edition - making this a broad enterprise exposure. SSVC rates exploitation as none and not automatable, and no public exploit has been identified at time of analysis, though the scope change (S:C) and low attack complexity elevate theoretical impact beyond the 5.4 CVSS score suggests.
Out-of-bounds read in Microsoft Office Word exposes potentially sensitive memory contents to local attackers when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021 and 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise across both Windows and macOS platforms, with vendor-confirmed patches available. No public exploit code exists and CISA SSVC rates exploitation likelihood as none with only partial technical impact, making this a medium-priority patching item despite the High confidentiality score assigned by CVSS.
Out-of-bounds read in Microsoft Office Word's document parser enables local information disclosure across Windows and Mac product lines, including Office 2016, 2019, 2021, 2024 LTSC, and Microsoft 365 Apps. An attacker who supplies a crafted Word document can cause the application to read beyond allocated memory boundaries, leaking high-confidence memory contents to the attacker. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, though the broad affected product surface and low attack complexity make it a credible phishing delivery vehicle.
Out-of-bounds read (CWE-125) in Microsoft Office enables a local, unauthenticated attacker to disclose sensitive memory contents by convincing a user to open a specially crafted Office document. Affected products span the full modern Office portfolio - Office 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable delivery, placing this in a lower operational urgency tier despite the High confidentiality impact rating.
Out-of-bounds read (CWE-125) in Microsoft Office Word exposes memory contents to a local, unauthenticated attacker who can trick a user into opening a crafted document, resulting in high-confidence information disclosure with no integrity or availability impact. The vulnerability spans eight distinct Office product lines across Windows and Mac, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, broadening the exposure surface considerably. No public exploit code or active exploitation has been identified per SSVC (Exploitation: none); Microsoft has released patches via the standard Office update channel.
Out-of-bounds read (CWE-125) in Microsoft Office exposes sensitive memory contents to local attackers who can persuade a user to open a specially crafted document. Affected products span multiple Office generations including Office 2016, 2019, 2021, 2024, LTSC variants, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable delivery, aligning with the local, user-interaction-dependent CVSS vector.
Out-of-bounds read in Microsoft Office Word exposes high-confidentiality memory contents when a user opens a specially crafted document locally. Affected products span Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise, confirmed via EUVD-2026-56423. No public exploit identified at time of analysis and no CISA KEV listing; vendor patch is available, placing this in the routine-patch-cycle priority tier rather than emergency response.
Out-of-bounds read in Microsoft Office exposes sensitive in-process memory contents to local attackers who socially engineer a victim into opening a crafted document. The flaw spans the full Microsoft Office portfolio across Windows and macOS - from Office 2016 through Microsoft 365 Apps for Enterprise - making it broadly relevant for enterprise patch management. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Path traversal in VictoriaMetrics vmrestore (prior to versions 1.122.25, 1.136.12, and 1.146.0) allows an attacker who controls or can modify a remote backup source - S3, GCS, Azure Blob Storage, or equivalent - to plant dot-dot sequences in object names, causing vmrestore to write restored files outside the configured -storageDataPath directory when an operator executes a restore operation. The CVSS Scope Changed metric (S:C) reflects that successful exploitation reaches beyond the vmrestore process boundary to the broader host filesystem, enabling potential overwrite of binaries, configuration, or credentials within the OS permissions of the process. Vendor-released patches are available across three maintained branches; no active exploitation has been identified at time of analysis.
Heap buffer overflow in SumatraPDF 3.6.1 and earlier enables an attacker who delivers a crafted CHM file to corrupt parser heap memory via malformed LZX Huffman code lengths. The PRETREE path in make_decode_table writes internal Huffman tree nodes beyond the 104-entry PRETREE_table boundary into adjacent struct LZXstate heap memory, reachable through the chm_open → chm_retrieve_object → LZXdecompress → BUILD_TABLE call chain. No public exploit or active exploitation is confirmed; arbitrary code execution has not been demonstrated, though the upstream fix commit validates that reliable heap corruption is achievable.
SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). While n8n applies SSRF guards to OAuth2 discovery and dynamic-client-registration requests, the access-token exchange step uses a separate, unguarded HTTP client, meaning a malicious credential configuration bypasses those controls entirely and reflects internal service responses back to the attacker. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 2.3 reflects the constrained impact and privilege requirement.
Cleartext exposure of temporary passwords in the Azure AD Graph app for Splunk SOAR (versions below 2.5.3) allows authenticated action-runners to read Azure AD reset credentials directly from the SOAR interface. The app's reset password action fails to classify the temp_password parameter as a sensitive field, so Splunk SOAR renders it unmasked in the UI rather than applying its standard password-masking behavior. Vendor patch 2.5.3 is available per Splunk advisory SVD-2026-0806; no public exploit code and no CISA KEV listing identified at time of analysis.
Broken access control across all four first-party TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, next-tinacms-cloudinary) allows any authenticated CMS editor to write or delete storage objects outside the operator-configured mediaRoot boundary. The handlers pass attacker-controlled query parameters (req.query.key for presigned S3 PUTs, req.query.media for DELETEs) directly to storage SDK operations without validating that the resulting key falls within the permitted path prefix, giving editors write and delete authority over the entire storage bucket or container reachable by the deployment's IAM or service credential. Vendor-released patches exist in all four packages; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft Windows App for Mac (versions 11.0.0 through 11.3.8) enables a remote unauthenticated attacker to disclose sensitive memory contents over the network when a victim connects to a malicious Remote Desktop server. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability without attacker authentication, though successful exploitation requires the victim to initiate or be lured into an RDP session. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor patch to version 11.3.9 is available from Microsoft.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
SQL injection in Wazuh's File Integrity Monitoring subsystem allows a local low-privileged user on non-Windows systems to manipulate the FIM SQLite database by creating a specially crafted filename in any monitored directory. The `wazuh-syscheckd` daemon in versions 4.6.0 through 4.14.5 concatenates unsanitized file paths directly into SQLite row filter predicates in `DB::getFile()` and `DB::searchFile()`, enabling UNION SELECT injection when the path is processed. No public exploit or KEV listing exists; however, the vendor-merged PR test suite contains a working injection payload, and the impact - falsification or suppression of FIM integrity alerts - directly undermines the product's core security monitoring function.
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when processing archive members whose names temporarily escape and re-enter it, such as '../evil/../dest/sub/file'. The extraction filters ('tar' and 'data') validate the resolved path - which correctly resolves to inside the destination - but create intermediate directories from the raw member name as given, allowing filesystem pollution beyond the extraction boundary. File contents are never placed outside the destination, and no public exploit has been identified at time of analysis; the PSF advisory confirms the limited scope.
Cross-site scripting via deliberate CSP header removal in Streambert's Electron API key redemption window affects versions 2.5.0 through 2.5.x, allowing attacker-controlled script content on sub.wyzie.io or any navigated resource to execute without Content-Security-Policy constraints and interact with other windows and persistent session storage. The wyzie-open-redeem IPC handler in index.js unconditionally strips all CSP response headers from a dedicated Electron session partition, and the redemption BrowserWindow omits a setWindowOpenHandler, compounding the attack surface. No public exploit has been identified at time of analysis; the vulnerability is fixed in version 2.6.0 by complete removal of the vulnerable feature.
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. No public exploit has been identified at time of analysis, and the vendor has already shipped a hardened installer that warns users before proceeding with potentially unsafe target directories.
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas_ctl leak on spi_async failure ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) and relies entirely on the SPI completion callback ca8210_spi_transfer_complete() to free it. The spi_async() API only invokes the completion callback on successful submission. On failure it returns a negative error code without ever queuing the callback, which leaves cas_ctl and its embedded spi_message and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is inside the completion callback, so there is no other reclamation path. ca8210_spi_transfer() is called from ca8210_spi_exchange(), the interrupt handler ca8210_interrupt_handler(), and from the retry path inside the completion callback itself. The exchange and interrupt handler paths loop on -EBUSY, so under sustained SPI bus contention every retry iteration leaks a fresh cas_ctl (~600 bytes per occurrence). Fix it by freeing cas_ctl on the spi_async() error path. While here, correct the misleading error string: the function calls spi_async(), not spi_sync().
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfifo_in()/kfifo_out(). This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the low 4 bytes of the 8-byte pointer are written into the FIFO. The reader then reads back 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes uninitialized stack data. The first dereference of the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel address and generally results in an oops. Use sizeof(fifo_buffer) so the byte count matches pointer width on every architecture. The driver has no architecture restriction in Kconfig, so any 64-bit build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has been latent since the driver was added in 2017 because it is most commonly deployed on 32-bit MCUs. Found via a custom Coccinelle semantic patch hunting for short-byte kfifo I/O on byte-mode kfifos used to shuttle pointers.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 ("ksmbd: fix multichannel binding and enforce channel limit") moved the binding-path session key out of the session-wide sess->sess_key (CIFS_KEY_SIZE = 40) into a new per-channel buffer, and sized both that buffer and the on-stack copy used during binding with SMB2_NTLMV2_SESSKEY_SIZE (16): struct channel { char sess_key[SMB2_NTLMV2_SESSKEY_SIZE]; /* 16 */ ... }; ntlm_authenticate() / krb5_authenticate(): char channel_key[SMB2_NTLMV2_SESSKEY_SIZE] = {}; /* 16 */ char *auth_key = conn->binding ? channel_key : sess->sess_key; The two writers that fill this destination still bound the copy length against CIFS_KEY_SIZE (40), not against the 16-byte buffer: ksmbd_decode_ntlmssp_auth_blob() (NTLM key exchange): if (sess_key_len > CIFS_KEY_SIZE) /* 40 */ return -EINVAL; arc4_crypt(ctx_arc4, sess_key, (char *)authblob + sess_key_off, sess_key_len); ksmbd_krb5_authenticate(): if (resp->session_key_len > sizeof(sess->sess_key)) /* 40 */ ... memcpy(sess_key, resp->payload, resp->session_key_len); On a binding SESSION_SETUP, auth_key points at the 16-byte channel_key, so a client that supplies an NTLM EncryptedRandomSessionKey of up to 40 bytes (with NTLMSSP_NEGOTIATE_KEY_EXCH), or a Kerberos ticket whose session key is longer than 16 bytes (a normal AES256 key is 32), writes past the 16-byte stack buffer -- up to a 24-byte kernel stack overflow. KASAN reports it as a stack-out-of-bounds write in arc4_crypt() called from ksmbd_decode_ntlmssp_auth_blob(). The destinations must be able to hold the full session key the length checks already permit. Size the per-channel key buffer and the two on-stack channel_key buffers with CIFS_KEY_SIZE, matching sess->sess_key.
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpf_lru_pop_free()/push_free() already hold on the same CPU, AA-deadlocking. Lockdep reports "inconsistent {INITIAL USE} -> {IN-NMI}" on &l->lock (syzbot c69a0a2c816716f1e0d5) and "possible recursive locking detected" on &loc_l->lock (syzbot 18b26edb69b2e19f3b33). Prior trylock and rqspinlock based fixes (see links) were nacked because compromised on reliability. This patch converts every LRU lock site to rqspinlock_t and adds a recovery path for some failure windows to avoid node leaks. Failure recovery: - *_pop_free top-level: return NULL; prealloc_lru_pop() already treats that as no-free-element (-ENOMEM). - Cross-CPU steal: skip the victim's locked loc_l, try next CPU. - Post-steal local lock fail: publish stolen node to lockless per-CPU free_llist; next pop on this CPU picks it up. - push_free fail: mark node pending_free=1. __local_list_flush(), __local_list_pop_pending() reclaim the node from pending_list. __bpf_lru_list_shrink_inactive() reclaims the node from inactive list. Nodes from active list are reclaimed by __bpf_lru_list_shrink() or after __bpf_lru_list_rotate_active() demotes it to the inactive.
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regions_lock", to disable region deletion in the critical period between construct_region() and attach_target(), as well as the period between device_add() and registering the remove actions. Otherwise, userspace can confuse the kernel. It can violate the assumption the region stays registered through the completion of cxl_add_to_region(). It can violate the assumption that devm_add_action_or_reset() is working with a live 'struct cxl_region'. It is ok for the region to disappear outside of those windows as that mirrors device hotplug flows where the proper locks are held.
Resource exhaustion in Elastic Kibana allows an authenticated user who holds maintenance window management privileges to crash the Kibana process for all users by submitting a specially crafted malformed payload. The Kibana process consumes unbounded resources and becomes fully unresponsive, requiring manual operator intervention to restore service - there is no automatic recovery. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low access complexity and broad multi-tenant availability impact make it a meaningful operational risk for shared Kibana deployments.
Cross-site request forgery in Zimbra Collaboration's Exchange Web Services (EWS) endpoint (versions before 10.1.17) allows a network-based attacker to perform unauthorized actions on behalf of an authenticated victim by exploiting insufficient content-type validation. Exploitation requires tricking a logged-in Zimbra user into interacting with attacker-controlled content, after which the browser automatically submits a crafted EWS request within the victim's session context. No public exploit has been identified and this CVE is absent from the CISA KEV catalog; the CVSS score of 3.1 accurately reflects the high attack complexity and integrity-only impact bounded to the victim's account.
PostgreSQL's GSSAPI authentication enforcement can be bypassed in versions 17.x and 18.x, allowing an authenticated database user to establish a connection protected only by TLS despite pg_hba.conf explicitly requiring GSSAPI. The bypass is achieved by initiating a direct TLS connection rather than a GSSAPI handshake, causing the server to accept the weaker protection profile when TLS settings are more permissive than GSS settings. No public exploit code and no CISA KEV listing have been identified at time of analysis; the EPSS score was not provided in source data.
Wireshark 4.6.0 through 4.6.7 on Windows crashes when parsing malformed Ixia IxVeriWave capture files or Vector Informatik BLF files, resulting in denial of service via an out-of-bounds write (CWE-787). The vulnerability requires a user to open a crafted file, making it a user-assisted local attack. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary code execution at SYSTEM or root privilege levels when clients connect to an attacker-controlled rogue gateway or are subjected to a man-in-the-middle attack. The vulnerability resides in the client-side VPN agent's processing of gateway-supplied data, where a crafted response can corrupt memory and hijack execution. No public exploit has been identified at time of analysis, and CISA has not confirmed active exploitation, but full confidentiality, integrity, and availability compromise is possible on any affected endpoint that connects through a manipulated gateway.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain unauthorized access to the agent's protected processes and files, effectively disabling endpoint security enforcement. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly not impacted. No public exploit code has been identified and no active exploitation has been confirmed (CVSS E:U), keeping real-world risk constrained to insider threat and post-compromise scenarios.
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrator to circumvent the agent's security inspection enforcement, subsequently enabling injection and interception of arbitrary network traffic. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected by the vendor. No public exploit has been identified at time of analysis, and exploitation requires pre-existing local administrator access, significantly narrowing the realistic threat population.
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to delete a limited set of system files and disable the agent entirely. Only Linux deployments are affected - macOS, Windows, iOS, Android, and Chrome OS are explicitly confirmed safe by the vendor. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 4.0 supplemental vector classifies exploitation as unlikely (E:U) with Amber urgency, making this a low-priority but genuine patch target for Linux endpoint fleets.
Privilege escalation in LuminalShine prior to version 26.05.0-rc4 stems from a latent file permission gap where `apps.json`, written by the SYSTEM service to `C:\ProgramData\LuminalShine\config\`, could be overwritten by local users if directory ACLs deviate from Windows defaults. On a default Windows installation this EoP path does not trigger because `BUILTIN\Users` inherits only Read+Execute rights from `C:\ProgramData`; the vulnerability is only exploitable when an administrator has loosened those inherited permissions. No public exploit code has been identified and no active exploitation is confirmed.
Integer underflow in open-iscsi's iscsiuio daemon crashes the process when parsing malformed DHCPv6 Advertise packets with a truncated UDP length field, disrupting iSCSI storage connectivity. Systems running Red Hat Enterprise Linux 9 and 10 with iscsiuio actively engaged in a DHCPv6 exchange are exploitable by any unauthenticated attacker on the same adjacent network segment. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; real-world impact is highest in shared or multi-tenant storage network environments where adjacency cannot be guaranteed.
Unauthenticated remote denial of service in the Russh SSH library (versions ≤ 0.62.3) allows any network attacker to crash individual server key-exchange sessions by sending a single SSH_MSG_KEX_ECDH_INIT packet containing a 32-byte all-zero Curve25519 public key. The defect triggers under the default server configuration - no special deployment required - causing a Rust bounds-check panic in encode_mpint before host-key signature verification ever occurs. A public proof-of-concept is documented in GHSA-5xvq-cp9x-6p6r; no active exploitation is confirmed in CISA KEV.
Denial-of-service in russh's Curve25519 key exchange client path allows any malicious SSH server to crash a connecting russh client session deterministically and pre-authentication, before host key verification occurs. Affected are all russh client deployments running versions prior to 0.62.4. An attacker operating or controlling an SSH server can terminate the client's spawned session task with a single malformed KEX_ECDH_REPLY packet; a working proof-of-concept is included in the GHSA advisory. No public exploit identified at time of analysis for active exploitation, and CISA KEV listing is absent, but the attack is reliable, requires no authentication, and a POC is publicly available.
IBM Db2 on Linux, UNIX, and Windows exposes cleartext database passwords by writing them into diagnostic trace files, affecting versions 11.5.0-11.5.9 and 12.1.0-12.1.5, including DB2 Connect Server. Any low-privilege local OS user with read access to the Db2 trace directory can harvest plaintext credentials without requiring database-level authentication or elevated system rights. IBM has released a patch; no active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Memory leak denial of service in IBM Db2 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) enables a local attacker with low-privilege credentials to exhaust system resources and degrade database availability. Rooted in CWE-770 (uncontrolled resource allocation), the flaw requires no user interaction beyond an authenticated local session. No public exploit code or active exploitation is identified; IBM has released a patch via its support portal.
Server-side request forgery in Microsoft UFO's URL validation layer allows unauthenticated remote attackers to bypass the SSRF guard by supplying IPv6 transition addresses - NAT64 (64:ff9b::/96, 64:ff9b:1::/48), 6to4 (2002::/16), or Teredo (2001::/32) - that embed private or link-local IPv4 destinations the guard would otherwise reject. The bypass grants access to cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, or localhost in any deployment where UFO processes externally-influenced URLs. No active exploitation is confirmed (not in CISA KEV), but the technique is well-documented in SSRF research and the fix is available in version 3.0.8.
CSV formula injection in Velociraptor's export pipeline allows attacker-controlled endpoint artifacts to execute as formulas when a forensic analyst opens the exported CSV in Microsoft Excel. Affected export paths include the GUI, offline collector, and data export features - any of which may produce unsanitized CSV output when collected data contains leading formula-trigger characters (=, +, -, @, tab). No public exploit code has been identified and no CISA KEV listing exists; however, the CVSS scope-change metric (S:C) and high confidentiality rating (C:H) correctly reflect that successful exploitation results in formula execution within the analyst's own workstation environment rather than the Velociraptor server itself.
Command injection in the Notepad++ Windows 11 x64 and ARM64 installer prior to version 8.9.7 allows an attacker who can influence the installation directory path to execute arbitrary PowerShell commands in the installer's security context. The vulnerable `RegisterMSIX` function in the NSIS installer script (`nppSetup.nsi`) unsafely interpolates the `$INSTDIR` variable into a PowerShell `-Command` string, enabling subexpression syntax such as `$()` embedded in a crafted directory name to be evaluated as live commands. Exploitation additionally requires that the user selects the optional Explorer context menu shell extension component during installation. The vendor has confirmed the fix in version 8.9.7; no public exploit or active exploitation has been identified at time of analysis.
Server-Side Request Forgery in kkFileView before 5.0.1 allows unauthenticated remote attackers to make the application server issue HTTP requests to arbitrary internal or external URLs via the unprotected /addTask endpoint. The vulnerability arises because /addTask was excluded from both TrustHostFilter and TrustDirFilter in WebConfig.java, and the fullfilename parameter can be manipulated to coerce file type classification as OFFICE, COMPRESS, or CAD, triggering FileConvertQueueTask to fetch attacker-chosen URLs. No public exploit identified at time of analysis per CISA KEV; however, SSVC flags a publicly available POC and marks the vulnerability as automatable.
Remote code execution in Microsoft Edge (Chromium-based) below version 151.0.4129.78 stems from a type confusion flaw (CWE-843) in the browser engine, exploitable over the network when a user visits or interacts with attacker-controlled content. The vendor has confirmed patch availability and the flaw is tagged as causing memory corruption, which aligns with the typical consequence of type confusion in browser engines. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the unauthenticated network vector with low attack complexity warrants prioritized patching in enterprise environments.
Privilege escalation in Microsoft OneDrive for macOS exploits improper symbolic link resolution (CWE-59), enabling a locally authorized high-privileged attacker to redirect OneDrive file operations to unintended filesystem locations and gain elevated access beyond their sanctioned scope. Affected versions span 26.0.0.0 up to but not including 26.095.0519.0003 on macOS exclusively. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog, though the full high-high-high CIA impact within the unchanged scope warrants prompt patching for any enterprise deploying OneDrive on macOS endpoints.
Symlink-following in the Windows Container Isolation FS Filter Driver (unionfs.sys) enables a locally authenticated attacker with low privileges to tamper with files outside the expected isolation boundary. Affected systems run Windows 11 version 26H1 builds prior to 10.0.28000.2704. A vendor patch is available; no public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Windows Management Services on Windows 11 contains an improper link resolution flaw (CWE-59) that allows an authenticated local attacker to crash or disable the service by planting a malicious symbolic link or directory junction at a file path the service accesses. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, with patched builds confirmed by Microsoft via MSRC. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel enables remote information disclosure when a user opens a specially crafted spreadsheet. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms that an unauthenticated network-based attacker can trigger the flaw, but only after social engineering a victim into opening a malicious file. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected Office product lines.
Out-of-bounds read in Microsoft Excel exposes sensitive memory contents over a network to unauthenticated remote attackers, resulting in high-confidence information disclosure (C:H). Exploitation requires user interaction - specifically, opening a crafted Excel document - placing this firmly in the phishing/malicious-attachment delivery class. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at the time of analysis, though the patch is available and should be applied promptly given the ubiquity of the affected product across enterprise environments.
Information disclosure in Microsoft Office PowerPoint enables a local attacker to obtain sensitive data from a victim's system by exploiting improper input validation (CWE-20) when processing a malicious file. Affected products span Windows and Mac editions including Office 2019, Microsoft 365 Apps for Enterprise, LTSC 2021/2024, and Office 365 for Mac - all requiring the victim to open a crafted PowerPoint file (UI:R). No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, a vendor patch is available.
Information disclosure in Microsoft Office (spanning 365 Apps for Enterprise, LTSC 2021/2024, Office 2019, and macOS variants) is triggered locally when a user opens a specially crafted document, exploiting improper input validation (CWE-20) to expose sensitive information with high confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) confirms local-only exploitation requiring user interaction, substantially limiting opportunistic mass exploitation. No public exploit has been identified at time of analysis, and Microsoft has released a patch across all affected product lines.
Local information disclosure in Microsoft PowerPoint stems from improper input validation (CWE-20) when processing specially crafted presentation files, affecting a broad range of Office product lines on both Windows and macOS. The CVSS vector (AV:L/UI:R/C:H) confirms that while no special system privileges are required, a victim must open a malicious file, making social engineering the primary delivery mechanism. No public exploit has been identified and no active exploitation is confirmed, but the high confidentiality impact (C:H) warrants prompt patching given the ubiquitous deployment of Microsoft Office.
Information disclosure in Microsoft Office PowerPoint stems from improper input validation (CWE-20) that allows a locally-present attacker to read sensitive data from the vulnerable system when a user opens a crafted file. Affected products span PowerPoint across Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code or active exploitation has been identified at the time of analysis; a vendor patch is available via standard Office update channels.
Microsoft Office Word's document parsing logic fails to properly validate input (CWE-20), enabling a local attacker to read sensitive information from a target system when a victim opens a specially crafted Word document. The flaw affects a broad range of Microsoft Office releases on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, and all LTSC variants through 2024. SSVC assessment confirms no current exploitation activity and the attack is not automatable due to required user interaction, though the CVSS confidentiality impact is rated High.
Improper input validation in Microsoft Office Excel enables a local attacker to disclose sensitive information when a target user opens a specially crafted file. The vulnerability affects a broad swath of Microsoft Office product lines - including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, Office 365 for Mac, and Word 2016 - across both Windows and macOS platforms. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches are available across all affected product lines.
Uninitialized memory disclosure in Microsoft Office exposes sensitive process memory to local attackers who can deliver a crafted document. Affecting a broad range of Office versions across Windows and macOS - including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office 365 for Mac - the flaw yields high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via the August 2026 update cycle.
Improper input validation in Microsoft Office PowerPoint enables local information disclosure when a victim opens a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and their macOS counterparts across both subscription and perpetual-license release tracks. Microsoft has released patches via the standard Office update channel; no public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (Windows and macOS editions, including LTSC 2024, LTSC 2021, 2019, and 365 Apps) enables local information disclosure when a user opens a maliciously crafted document. The CVSS vector (AV:L/UI:R) confirms exploitation is constrained to local, user-triggered scenarios with no code execution or data modification capability. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing exists at time of analysis.
Local information disclosure in Microsoft Office stems from improper input validation (CWE-20), allowing a local attacker who can induce user interaction to read sensitive data from the affected system. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Office 365/LTSC for Mac, with Mac builds patched at 16.112.26081010 and Windows builds addressed via the Microsoft Office Security Releases channel. No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable attack path.
Local information disclosure in Microsoft Office PowerPoint exposes sensitive data when a user opens a crafted file. The flaw, rooted in improper input validation (CWE-20), affects a broad range of Office versions across Windows and macOS including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches via its August 2026 update cycle.
Out-of-bounds read in Microsoft Office Word exposes sensitive memory contents to local attackers via crafted document files. Affected products span Word 2016 through Microsoft 365 Apps for Enterprise on both Windows and Mac platforms, covering a broad enterprise install base. Exploitation requires user interaction - a victim must open a malicious document - but yields high confidentiality impact with no integrity or availability loss. No public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a victim to open a crafted spreadsheet file. The flaw affects a wide range of Office versions across both Windows and macOS platforms, including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. No public exploit or active exploitation has been identified at time of analysis; SSVC assessment rates exploitation as none and the attack as non-automatable, indicating moderate real-world urgency despite the High confidentiality impact rating.
Incomplete resource cleanup in Microsoft Office PowerPoint exposes sensitive document data to local attackers across multiple supported product lines, including Microsoft 365 Apps for Enterprise, Office LTSC 2024, LTSC 2021, Office 2019, and PowerPoint 2016. Exploitation requires a victim to open or interact with a PowerPoint file (UI:R), after which residual data - likely temporary files, memory buffers, or cached presentation content - persists in a locally accessible state without requiring attacker privileges. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, keeping real-world risk moderate despite the high confidentiality impact rating.
Out-of-bounds read in Microsoft Excel exposes process memory to local information disclosure across a wide range of Office versions, from Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC releases on both Windows and macOS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms exploitation requires the victim to open a specially crafted spreadsheet file, making phishing-delivered documents the realistic delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Excel triggers information disclosure when a victim opens a specially crafted spreadsheet file, exposing potentially sensitive memory contents to a local attacker. The flaw spans multiple Office product lines - Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and corresponding Mac variants - with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified and SSVC confirms no known exploitation; a vendor patch is available via the Microsoft Security Response Center.
Information disclosure in Microsoft Excel arises from use of uninitialized memory (CWE-908), exposing potentially sensitive heap or stack contents to an attacker when a victim opens a maliciously crafted Excel file. Affected products span the full Microsoft Office portfolio on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, Excel 2016, and their Mac counterparts. No public exploit identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Out-of-bounds read in Microsoft Excel enables local information disclosure when a user opens a specially crafted spreadsheet. Multiple product lines are affected across Windows and macOS, spanning Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise. Microsoft has released patches; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Microsoft Office Word enables a local, unauthenticated attacker to disclose sensitive memory contents by enticing a user to open a maliciously crafted document. Affected products span Microsoft Word 2016, Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, and Office LTSC/365 on macOS. No public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and Microsoft has released patches via the standard Office update channel.
Out-of-bounds read in Microsoft Office exposes memory contents to local information disclosure across a wide range of affected products including Word 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office 365/LTSC for Mac. The CVSS vector (AV:L/UI:R/C:H) indicates exploitation requires a victim to open a specially crafted Office document, after which sensitive in-process memory can be disclosed to the attacker. No public exploit has been identified at time of analysis, no KEV listing exists, and Microsoft has released patches across all affected product lines.
Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality data to a local attacker when a user opens a crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the high confidentiality impact and wide deployment footprint make patching a clear priority.
Microsoft Dynamics 365 on-premises version 9.1 exposes sensitive information to authenticated network attackers via an improper access control flaw (CWE-200), allowing disclosure of data beyond a user's authorization level. The CVSS vector (PR:L) confirms exploitation requires a valid low-privilege account, limiting exposure to insider threats or compromised credentials rather than unauthenticated external actors. No public exploit code and no active exploitation have been identified; SSVC rates this as non-automatable with partial technical impact, consistent with a medium-priority finding.
Information disclosure in Azure CycleCloud allows an authenticated network attacker to bypass authorization checks and read sensitive data. Rooted in CWE-862 (Missing Authorization), the flaw affects versions up to 8.9.2 and is exploitable by any authorized user who can reach the service over a network without elevated privileges. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released a patch.
Privilege escalation in Windows DNS affects a broad range of Windows 10, Windows 11, and Windows Server releases through a numeric truncation error (CWE-197) in the DNS component. An authorized local attacker already holding high-privilege credentials can exploit this flaw to achieve full compromise of confidentiality, integrity, and availability on the affected host. Microsoft has released patched builds across all affected version lines; no public exploit code exists and no active exploitation has been identified at time of analysis.
Privilege escalation in the Windows DNS service affects a broad range of Windows client and server versions from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all major feature releases. The vulnerability stems from a numeric truncation error (CWE-122, heap-based buffer overflow) that an already-privileged local attacker can trigger to gain elevated access beyond their current privilege level. No public exploit code and no CISA KEV listing are present at time of analysis, but Microsoft has released patches across all affected product lines.
Local privilege escalation in Windows DNS affects a broad range of Windows client and server operating systems, enabling an already-authenticated local attacker to gain elevated privileges on the target system. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the attacker requires high existing privileges - consistent with the description's reference to an 'authorized attacker' - yet can achieve full confidentiality, integrity, and availability impact post-exploitation. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; a vendor-released patch is available via Microsoft's Update Guide.
Information disclosure via a buffer over-read in the Windows SMB Client component affects a broad spectrum of Microsoft Windows desktop and server editions, from Windows Server 2012 through Windows 11 25H2. An attacker who controls a malicious SMB server and induces a target Windows user to connect to it can trigger the client to read beyond allocated memory buffer boundaries, leaking potentially sensitive process memory contents across the network. SSVC rates exploitation status as none and no public exploit code has been identified at time of analysis, though the high confidentiality impact (C:H) and the near-universal deployment footprint of the Windows SMB Client make this a meaningful routine patch priority.
Uncontrolled resource consumption in the Windows DHCP Client enables an unauthenticated attacker on the same network segment to crash or deny service to affected hosts without any user interaction. Affected platforms span Windows 11 (versions 24H2, 25H2, and 26H1) and Windows Server 2025, all in unpatched builds. No public exploit code or active exploitation (KEV) has been identified at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in the Windows NTFS kernel driver (CWE-125) allows a low-privileged local attacker to disclose potentially sensitive kernel memory contents across a broad range of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. The CVSS vector confirms local-only exploitability with low privilege requirements and no user interaction needed, yielding high confidentiality impact but no integrity or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the breadth of affected versions across both consumer and enterprise Windows releases makes timely patching critical for any organization with a Windows estate.
Inadequate encryption strength in Windows Active Directory enables a low-privileged authenticated network attacker to bypass a security feature, resulting in a high-integrity impact. Affected platforms span Windows Server 2022, Windows Server 2025, and multiple Windows 11 release channels (23H2 through 26H1). No public exploit identified at time of analysis; SSVC assessment confirms no observed exploitation and the attack is not automatable, placing this in a lower operational urgency tier despite the high integrity impact rating.
Security feature bypass in Microsoft Visual Studio Code Copilot Chat Extension (versions 0.27.0 through pre-1.132.1) enables network-based attackers to circumvent a protective control without authentication, resulting in high integrity impact and low availability impact. The attack requires user interaction - consistent with a scenario where a victim must engage with crafted content delivered over the network. No public exploit code has been identified at time of analysis, and a vendor patch (1.132.1) is available via the Microsoft Security Response Center.
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated, low-privileged attacker to inject malicious script content that renders in a victim's browser upon interaction with a crafted page, enabling spoofing and potential session compromise. All three actively-supported on-premises SharePoint product lines are affected, with patched builds available via Microsoft's Security Response Center advisory. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the routine patching tier rather than an emergency-response scenario.
Out-of-bounds read in Microsoft Word's document parsing engine exposes sensitive in-process memory to a local attacker across Office 2016 through LTSC 2024 and macOS variants. Exploitation requires a victim to open a specially crafted document, making social engineering or phishing the primary delivery mechanism. No public exploit code exists and no active exploitation has been identified (not in CISA KEV); SSVC assessment rates exploitation status as none and technical impact as only partial.
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to inject malicious script that, when rendered by a victim's browser, performs network-based spoofing within the SharePoint web application. All three current on-premises SharePoint product lines are affected across the 16.0.x branch, with specific fixed builds identified by EUVD-2026-56718. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released patches for all affected versions.
Cross-site scripting in Microsoft SharePoint Server allows an authenticated attacker to inject malicious script content that executes within other users' browser sessions, enabling spoofing and potential session compromise. Affected are SharePoint Server Subscription Edition, 2019, and 2016 Enterprise editions running builds below the July 2026 cumulative update thresholds. Exploitation requires contributor-level authenticated access and victim interaction; no active exploitation is confirmed and no public exploit code has been identified at time of analysis, though the CVSS scope change confirms that successful injection reaches beyond the SharePoint application boundary into victims' browser contexts.
Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated, low-privilege attacker to inject malicious scripts that execute in other users' browsers upon interaction, enabling session hijacking and spoofing attacks within the SharePoint context. The CVSS 7.3 score reflects high confidentiality and integrity impact bounded to the SharePoint application scope, gated by both valid credentials and victim interaction. Microsoft has released patches for all three affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds memory read in Microsoft Office exposes potentially sensitive process memory contents when a victim opens a specially crafted document locally. The vulnerability affects the full Office suite across Windows and macOS - spanning Office 2016 through LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - with High confidentiality impact per CVSS but no integrity or availability consequence. No public exploit has been identified at time of analysis; CISA SSVC classifies exploitation status as none and the attack is not automatable, significantly reducing real-world prioritization urgency despite the High C rating.
Cross-site scripting in Microsoft SharePoint Server enables an authenticated attacker with low privileges to inject malicious scripts into web-rendered content, executing arbitrary JavaScript in victims' browsers and enabling spoofing attacks over the network. All three actively-supported SharePoint Server product lines are affected: Enterprise 2016, 2019, and Subscription Edition - making this a broad enterprise exposure. SSVC rates exploitation as none and not automatable, and no public exploit has been identified at time of analysis, though the scope change (S:C) and low attack complexity elevate theoretical impact beyond the 5.4 CVSS score suggests.
Out-of-bounds read in Microsoft Office Word exposes potentially sensitive memory contents to local attackers when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021 and 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise across both Windows and macOS platforms, with vendor-confirmed patches available. No public exploit code exists and CISA SSVC rates exploitation likelihood as none with only partial technical impact, making this a medium-priority patching item despite the High confidentiality score assigned by CVSS.
Out-of-bounds read in Microsoft Office Word's document parser enables local information disclosure across Windows and Mac product lines, including Office 2016, 2019, 2021, 2024 LTSC, and Microsoft 365 Apps. An attacker who supplies a crafted Word document can cause the application to read beyond allocated memory boundaries, leaking high-confidence memory contents to the attacker. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, though the broad affected product surface and low attack complexity make it a credible phishing delivery vehicle.
Out-of-bounds read (CWE-125) in Microsoft Office enables a local, unauthenticated attacker to disclose sensitive memory contents by convincing a user to open a specially crafted Office document. Affected products span the full modern Office portfolio - Office 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable delivery, placing this in a lower operational urgency tier despite the High confidentiality impact rating.
Out-of-bounds read (CWE-125) in Microsoft Office Word exposes memory contents to a local, unauthenticated attacker who can trick a user into opening a crafted document, resulting in high-confidence information disclosure with no integrity or availability impact. The vulnerability spans eight distinct Office product lines across Windows and Mac, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, broadening the exposure surface considerably. No public exploit code or active exploitation has been identified per SSVC (Exploitation: none); Microsoft has released patches via the standard Office update channel.
Out-of-bounds read (CWE-125) in Microsoft Office exposes sensitive memory contents to local attackers who can persuade a user to open a specially crafted document. Affected products span multiple Office generations including Office 2016, 2019, 2021, 2024, LTSC variants, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable delivery, aligning with the local, user-interaction-dependent CVSS vector.
Out-of-bounds read in Microsoft Office Word exposes high-confidentiality memory contents when a user opens a specially crafted document locally. Affected products span Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise, confirmed via EUVD-2026-56423. No public exploit identified at time of analysis and no CISA KEV listing; vendor patch is available, placing this in the routine-patch-cycle priority tier rather than emergency response.
Out-of-bounds read in Microsoft Office exposes sensitive in-process memory contents to local attackers who socially engineer a victim into opening a crafted document. The flaw spans the full Microsoft Office portfolio across Windows and macOS - from Office 2016 through Microsoft 365 Apps for Enterprise - making it broadly relevant for enterprise patch management. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.