Buffer Overflow

Remote code execution with root privileges or denial of service in Juniper Networks Junos OS on SRX Series devices is possible through a stack-based buffer overflow in the iked IKE key-management daemon. An authenticated remote-access VPN client on an SRX running affected Junos OS releases can exploit the remote-access VPN authentication and JIMS identity-publishing path; deployments not using remote-access VPN or JIMS identity publishing are not exposed. No public exploit code has been identified at time of analysis, but a vendor patch is available and the vendor CVSS score is 8.7 with high confidentiality, integrity, and availability impact.

Adjacent, unauthenticated code execution as root affects Juniper Junos OS and Junos OS Evolved devices that support Secure-ZTP when their phone-home daemon (phcd) processes a crafted DHCP SZTP bootstrap message. The flaw is a stack-based buffer overflow (CWE-121) that can be triggered by a network-adjacent attacker (CVSS 4.0 AV:A/AC:L/PR:N/UI:N, vendor score 8.7 High); no credentials or user interaction are required, but the target must be a Secure-ZTP-capable platform actively in the DHCP SZTP bootstrap/provisioning state and the attacker must be on the same Layer-2/logical segment. Vendor patches are available; no public exploit code or KEV-listed active exploitation was identified in the provided data.

Stack-based buffer overflow in Juniper Networks Junos OS jdhcpd lets an unauthenticated adjacent attacker crash the DHCP client process with a crafted DHCP response, causing denial of service for DHCP, relay, and zero-touch-provisioning services on devices configured as DHCP clients. Exploitation requires L2 adjacency to the victim and no authentication or user interaction; devices not operating as DHCP clients are not exposed, and service recovers once malicious traffic stops. Vendor patches are available per Juniper advisory JSA112188, and no public exploit code has been identified at time of analysis.

An out-of-bounds read in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker on the adjacent network crash the daemon and disclose limited process memory by sending a crafted Connectivity Fault Management (CFM) message to an interface with CFM configured. Affected releases span Junos OS 23.x through 26.2 and corresponding Junos OS Evolved branches, with fixes available per Juniper advisory JSA112187. Exploitation is bounded by the non-default requirement that CFM be configured on a reachable Layer 2 interface; no public exploit identified at time of analysis.

Stack-based buffer overflow in the cfmd process of Juniper Junos OS and Junos OS Evolved on MX Series and PTX Series platforms enables unauthenticated adjacent-network attackers to execute arbitrary code as root or cause denial of service when enhanced CFM mode and a configured down-MEP are present. The CVSS 8.7 score reflects high confidentiality, integrity, and availability impact, but real-world exposure is constrained by the non-default CFM/802.1ag configuration and the need for Layer 2 adjacency; no public exploit identified at time of analysis.

A stack-based buffer overflow in Juniper's jdhcpd process lets an adjacent, unauthenticated attacker crash or potentially achieve root-level code execution on Junos OS and Junos OS Evolved devices that are configured to use the DHCPv4 local-client feature. Exploitation requires the device to act as a DHCPv4 client and an attacker to sit on the same Layer 2 segment able to deliver a malformed DHCPv4 server response (for example via a rogue or spoofed DHCP server); there is no public exploit identified at time of analysis, but a vendor patch is available. Because jdhcpd runs with root privileges, a successful overflow could yield high confidentiality, integrity and availability impact, making this a mid-to-high priority issue for exposed deployments rather than a universal emergency.

A stack-based buffer overflow in the l2cpd (Layer 2 Control Protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker who is Layer 2 adjacent - on the same broadcast domain or directly cabled to the target interface - crash Layer 2 control-plane processing by sending crafted LLDP packets to an interface with LLDP enabled. The primary outcome is denial of service: repeated triggering can destabilize LLDP and other Layer 2 control protocols on the device, though the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, ~6.5) rates this as availability-only impact with no confidentiality or integrity loss. Exploitation is gated by two prerequisites - the attacker must already have local Layer 2 presence and the targeted interface must explicitly have LLDP configured - so remote Internet-based attacks are not possible; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and vendor patches are available.

Adjacent unauthenticated attackers can trigger a stack-based buffer overflow in the l2cpd process on Juniper Junos OS and Junos OS Evolved by sending crafted LLDP traffic to an interface configured with Unified Access Policy, potentially causing a denial of service or root-level code execution. Exploitation requires Layer-2 adjacency and the non-default UAP configuration, so this is a high-priority networking vulnerability rather than a universal emergency. No public exploit identified at time of analysis, and a vendor patch is available.

An out-of-bounds write (CWE-787) in the lacpd daemon of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to crash the device - a denial of service - by sending a crafted frame to an aggregated-Ethernet member port that has LACP enabled. The attacker needs no authentication or user interaction (PR:N/UI:N) and must be positioned on the same local broadcast domain or directly attached to the member port (AV:A), so this is not an internet-reachable flaw; impact is availability-only (VC:N/VI:N/VA:H, with low subsequent-system availability impact SA:L in the CVSS 4.0 vector, assessed as CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The independent assessment rates this as a genuine but bounded operational risk rather than an emergency: exposure depends entirely on LACP being configured on an AE member port, and no public exploit has been identified at time of analysis (the CVE is not listed in CISA KEV, and no POC is referenced in the available intelligence).

Malformed 802.1Q Ethernet frames can panic or corrupt the network receive path in Zephyr RTOS builds that have CONFIG_NET_VLAN=y and a VLAN enabled on the receiving Ethernet interface. ethernet_recv() checks only that the first buffer holds a 14-byte plain Ethernet header, then reinterprets that same buffer as an 18-byte VLAN header when the ethertype is 0x8100, reading the TCI and inner ethertype from offsets 14-17 beyond the buffer's length and raising hdr_len to 18 so net_buf_pull() removes more bytes than exist. A single unauthenticated 14-17 byte broadcast frame with ethertype 0x8100 and TCI 0x0000 suffices, reachable by an adjacent/link-local attacker or a malicious USB host through the CDC ECM/NCM gadget classes; assertion-enabled builds panic (denial of service), while production builds with assertions and CONFIG_NET_BUF_HARDENING disabled suffer a uint16_t length underflow to 65534 that leaves later parsers reading far outside the fragment, giving out-of-bounds access with information-disclosure and corruption potential. No public exploit identified at time of analysis; exploitation is gated by the non-default VLAN configuration and hardware VLAN tag stripping absent.

Denial of service in the Juniper Junos OS rpd routing process is possible when the non-default Auto-RP mapping feature is enabled, allowing an unauthenticated attacker on an adjacent network segment to send crafted Auto-RP mapping announcements that trigger an out-of-bounds write (CWE-787) and crash the routing plane. Juniper rates this CVSS 4.0 7.1, and our independent assessment concurs it is a moderate-priority availability issue rather than a critical emergency; no public exploit code or CISA KEV entry was identified at time of analysis. The attacker must be within the PIM multicast domain and cannot reach the device from the general internet.

Heap-based buffer overflow in the secure-dot1xd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service by sending a crafted EAPOL frame to an 802.1X-authenticated interface. Exploitation requires the targeted interface to be configured for 802.1X port-based authentication and Layer 2 adjacency, and no public exploit has been identified at time of analysis. With a CVSS 4.0 score of 8.7, this is a high-priority flaw for affected deployments using 802.1X.

Stack-based buffer overflow in the authd process of Juniper Networks Junos OS allows an attacker who can influence a configured RADIUS server to crash the device or execute arbitrary code with root privileges. This unauthenticated, adjacent-network attack (CVSS 8.7) is limited to devices that have RADIUS authentication enabled and where the attacker either controls the RADIUS server or can inject or modify RADIUS responses on the adjacent network. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed (not in CISA KEV).

Juniper Junos OS and Junos OS Evolved devices that run OSPFv3 on a broadcast interface can be crashed by an unauthenticated adjacent attacker who sends specially crafted OSPFv3 protocol messages to the rpd routing daemon, producing a denial of service and heap memory corruption. Exploitation requires only Layer-2 adjacency to the affected broadcast segment and no credentials or user interaction, but devices that do not run OSPFv3, or that use point-to-point interface types, are not exposed; no public exploit code has been identified at time of analysis. Vendor severity is moderate (CVSS 4.0 7.1) with an availability-only impact, aligning with our independent CVSS 3.1 assessment of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.

Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.

Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.

A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Remote code execution in Juniper Networks Junos OS on SRX Series devices configured for AutoDiscovery VPN (ADVPN) can let an attacker who already is a trusted ADVPN peer take complete control of the device via malformed ADVPN attributes that trigger a buffer overflow. Exploitation requires the attacker either to possess the ADVPN pre-shared secret to impersonate a peer or to have compromised a legitimate peer, and the independent assessment rates this as high severity but not an emergency despite the 9.2 CVSS 4.0 score. No public exploit code or confirmed active exploitation was identified at time of analysis.

A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.

A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.

A stack-based buffer overflow in the kernel of Juniper Networks Junos OS Evolved can be triggered by a crafted TCP packet when key-chain authentication is configured for BGP or LDP sessions, leading to a kernel panic and denial of service. This remotely exploitable, unauthenticated vulnerability requires network reachability to BGP (TCP/179) or LDP (TCP/646) and the operator-side configuration of key-chain authentication for those protocols. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is limited to denial of service with no confidentiality or integrity impact, and it is not a code-execution threat.

An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241, and QFX5250 switches configured for BGP global-load-balancing with more than 128 ECMP next-hops allows unauthenticated adjacent-network attackers to crash rpd, causing a denial of service. This moderate-severity (CVSS 6.5) flaw is availability-only; exploitation requires the specific hardware and non-default routing configuration, and no public exploit code has been identified at time of analysis. Devices not configured for BGP global-load-balancing or with 128 or fewer ECMP next-hops are not affected.

Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.

Buffer overflow in the DPDK vhost-user backend's split-ring inflight descriptor table handling allows a guest VM with code execution to corrupt host memory, potentially leading to code execution on the host. This high-severity flaw (CVSS 8.8) is the most critical issue in a bundled DPDK security advisory and affects multi-tenant deployments where the split-ring inflight feature-used for vhost-user reconnection and live migration-is enabled. No public exploit code has been identified at the time of analysis.

Heap out-of-bounds read and write in the DPDK Generic Segmentation Offload (rte_gso) library can be triggered when an application enables GSO on its packet path and is configured with small or undersized mbuf pools relative to the segmentation workload, letting network-delivered traffic corrupt memory in the data plane. The vendor-published CVSS 3.1 base score is 8.6 (High) on a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating a network-reachable, unauthenticated, low-complexity heap out-of-bounds read/write; our independent assessment keeps the network-reachable, unauthenticated profile but assesses higher attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) because exploitation is gated on the non-default-looking small-mbuf-pool configuration together with GSO actually being enabled. Impact is dominated by availability (A:H), so the realistic outcome is a data-plane crash rather than full host compromise, with only partial confidentiality and integrity effects; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.

Heap out-of-bounds read in libsmb2 through 6.2 allows a malicious or man-in-the-middle SMB server to crash the client by returning crafted QUERY_INFO replies for FileFsVolumeInformation or FileFsAttributeInformation with missing or oversized name-length fields. Affected clients must issue a filesystem-information query against an attacker-controlled endpoint, or an attacker must hold a man-in-the-middle position on an unsigned SMB session, so exploitation is remote and unauthenticated but requires the victim to initiate the connection (user interaction). Publicly available exploit code exists, but there is no confirmed active exploitation and the impact is confined to a client crash, with no demonstrated confidentiality or integrity effect. The vendor has published an upstream fix.

A heap out-of-bounds read in libsmb2 through 6.2 lets a malicious SMB server (or a man-in-the-middle on an unsigned SMB session) crash a connecting client by returning a crafted FileAllInformation reply with an unchecked FileNameLength field. The bug is reached when the client library parses the server's reply inside smb2_decode_file_all_info, which is triggered by calls such as smb2_stat or smb2_fstat on the client side; publicly available exploit code exists, and a vendor fix is available upstream. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), impact is limited to client process availability - there is no code execution or data exposure, and unauthenticated remote attackers need the victim to initiate a connection to the attacker-controlled server.

Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default map directive with regex matching is configured so that the root directive or access log format references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under specific conditions. The flaw is remotely reachable without authentication (CVSS PR:N) but has high attack complexity (AC:H) because exploitation depends on conditions beyond the attacker's control and on a non-default configuration; the realistic outcome on systems with ASLR enabled is worker-process restart/DoS, while code execution is limited to systems with ASLR disabled or bypassed. F5 rates this CVSS 4.0 9.2 (Critical), and no public exploit identified at time of analysis.

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through crafted HTTP requests, but only when a non-default configuration uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log format directive. Successful exploitation causes a heap buffer overflow in the NGINX worker process, leading to a restart (denial of service) and potentially allowing code execution on systems with ASLR disabled or bypassable. No public exploit code or active exploitation has been identified at time of analysis.

Remote, unauthenticated code execution is possible in the HPE NonStop SNMP Trap Multiplexer, which processes inbound SNMP trap messages on the HPE NonStop platform. An attacker who can reach the trap-receiving interface can deliver a crafted trap that overflows a stack buffer (CWE-121); our independent assessment rates the full impact as high for confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas the vendor-published 7.5 vector reflects only an availability impact (C:N/I:N/A:H) - a conflict that must be reconciled with HPE before prioritization. Exploitation requires network reachability to the trap listener and no credentials, privileges, or user interaction (PR:N/UI:N); no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV. Exposure is confined to the specialized population running HPE NonStop with this multiplexer deployed - typically banking, telecom and transaction-processing environments - which limits the scale but not the severity of a successful attack.

Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a crafted primary zone file to perform out-of-bounds stack writes, including overwriting a callback function pointer that is invoked immediately after parsing, which can lead to arbitrary code execution. The vulnerable path requires direct ingestion of a specially formatted zone file; NSD-generated zone files, including those for secondary zones received by transfer, are not formatted in the triggering way and will not exploit the flaw. No public exploit code or confirmed active exploitation is identified in the available intelligence, and the assessed vector requires low privileges (PR:L) through local or zone-supply access rather than ordinary remote DNS queries.

Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-controlled data, which can corrupt control flow in the name server process and lead to code execution or a crash. The trigger is a HIP resource record whose RDATA is filled to (or near) its size limit and which also carries a second dname RDATA field, the HIP Rendezvous server; the bug lives in zone-file parsing, so it is not reachable through ordinary DNS query traffic, and zones NSD writes out itself - including secondary zones learned via zone transfer - are not formatted in the vulnerable way. Exploitation therefore requires the attacker to control zone-file content fed directly to NSD, for example through an operator-controlled provisioning or automation pipeline; no public exploit code was identified at time of analysis, and the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, score 8.7) overstates practical remote risk relative to the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). Authentication is required per the supplied vectors (PR:L), which corresponds in practice to a low-privileged position able to supply zone-file content to the daemon.

A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supply a crafted zone file to corrupt memory and potentially achieve arbitrary code execution. The flaw is triggered when the RDATA is filled to the wire-format limit and an ECH parameter overflows the stack, after which the base64 decoder can write attacker-controlled data of unlimited size. Exploitation requires that the crafted zone file be fed directly to NSD; zone files written by NSD itself (e.g., secondary zones) are not affected. The attacker must control or inject into the zone-provisioning path, such as a multi-tenant zone-submission pipeline, and authentication requirements are low-privileged per the CVSS vector (PR:L). No public exploit or in-the-wild exploitation has been identified at time of analysis.

Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data split into chunks of three characters or fewer, causing the token length calculation to yield zero bytes and letting an attacker overwrite up to 64K of stack memory with attacker-controlled data, with likely code-execution impact. Our independent assessment rates this CVSS 3.1 AV:L/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact, reflecting that the attacker must control zone-file content fed directly to NSD (PR:L, i.e., write/submit access to the zone input path) - it is not reachable through normal DNS queries and does not affect zone files NSD generates itself, such as zones for which the instance is secondary. The vendor rates it CVSS 4.0 8.7 (High) with AV:N/PR:L; patch availability is not confirmed in the provided data, and no public exploit code or CISA KEV activity was identified at time of analysis.

Heap-based buffer overflow in GStreamer's gst-plugins-base plugin library lets a local attacker who controls the sending side of a GStreamer inter-process IPC pipeline corrupt memory in the receiving process, yielding a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. The victim process maps a crafted video buffer whose GstVideoMeta declares plane strides and offsets larger than the actual backing allocation, causing out-of-bounds reads and writes that can crash the process or potentially permit code execution in its context. Exploitation is strictly local and requires a deployment where GStreamer buffers cross a trust boundary between a less-trusted producer and a more-trusted consumer; no user interaction or authentication to the victim is needed, and no public exploit has been identified at time of analysis.

Remote, unauthenticated requests to HPE NonStop iTP WebServer can trigger memory corruption severe enough to shut the service and system down, giving network-positioned attackers a reliable denial-of-service with a secondary integrity impact. The assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, CVSS 8.2) shows no authentication, user interaction, or non-default feature is required - the only real barrier is that the target web server must be network-reachable, and it runs solely on the niche HPE NonStop platform rather than commodity servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied; combined with the narrow platform footprint, this is a genuine but bounded priority rather than a mass-exploitation threat.

An integer overflow in list allocation inside the Nix expression evaluator - and in the Lix fork - can drive an out-of-bounds write when an attacker-supplied Nix expression is evaluated, allowing memory corruption in the evaluating process. Only Nix before 2.35.3 and Lix before 2.95.4 are affected, and the flaw is remotely reachable and requires no authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L, base 7.5), though the high attack complexity means allocation sizes must be crafted precisely. Our assessment is consistent with a memory-corruption primitive rather than a trivial crash - high integrity impact, low availability impact, no confidentiality impact; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).

Heap-based buffer overflow in Google Chrome's Animation component allows a remote attacker to execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page in any build prior to 155.0.8059.79. The bug carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication or special configuration is required, but exploitation depends on the user rendering attacker-controlled content, and because the scope is unchanged the resulting code execution is confined to the sandboxed renderer process rather than the host OS. No public exploit code and no confirmed active exploitation have been identified at time of analysis - CISA's SSVC evaluation rates Exploitation as 'none' - so this is a patch-promptly item rather than an emergency, with Google rating the issue High severity.

A heap-based buffer overflow in PDFium, the PDF rendering engine embedded in Google Chrome, allows a remote attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to open a crafted HTML page. All desktop Chrome builds prior to 155.0.8059.79 (stable and extended-stable channels) are affected, and exploitation requires user interaction (UI:R), which limits mass or automated abuse. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none; however, CISA assigns a total technical impact once the bug is triggered, and Google rates the Chromium security severity as High. The primary constraint on real-world impact is that code execution is confined to the renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape vulnerability.

Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).

Out-of-bounds write in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) allows an attacker to execute arbitrary code in the context of the current user when the victim opens a malicious file. The flaw is a local, client-side memory corruption issue (AV:L, UI:R) that requires user interaction but no privileges; no public exploit has been identified at time of analysis. This is a high-severity flaw but not an emergency-tier internet-facing threat due to the human-in-the-loop prerequisite and user-level impact.

Privilege elevation in Microsoft SQL Server lets an attacker who already holds high-privilege credentials on the instance trigger a stack-based buffer overflow over a network connection and break out of their authorization boundary. Exploitation is constrained: the CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C) and the vendor description both indicate an authorized, highly privileged principal is required, and the AC:H rating means the overflow depends on specific server state, data, or timing rather than trivial input, so it is not reliably repeatable on a first attempt. All affected GDR and CU builds are pre-patch, Microsoft has published a fix via the MSRC update guide, and no public exploit or confirmed active exploitation was identified at time of analysis, so risk is real but conditional rather than a drop-everything emergency.

An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.

An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.

Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).

Out-of-bounds write in Adobe Photoshop Desktop running builds at or below 26.11.7 (and at or below 27.10 per ENISA EUVD data) allows an attacker to execute arbitrary code in the context of the user who opens a crafted file. Because exploitation requires the victim to manually open a malicious file on their own system, the attack vector is local-only and depends on user interaction, and any code that runs inherits only the opening user's privileges (no privilege escalation). This is a genuine but operationally moderate-priority issue: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local plus user-interaction prerequisites materially reduce real-world risk.

Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.

Out-of-bounds write in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) allows an attacker to execute arbitrary code in the context of the current user when a victim opens a malicious file. The vulnerability requires user interaction (opening the file) and has a local attack vector, with a CVSS 3.1 base score of 7.8 High. No public exploit code has been identified at time of analysis.

Heap-based buffer overflow in Microsoft SQL Server lets an authenticated attacker who holds any valid, low-privileged database login - and can reach the instance's listening port over the network - execute code in the context of the SQL Server service process, with high confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no user interaction). The vendor has released patched builds for SQL Server 2017, 2019, 2022 and 2025, and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible priority rather than an emergency. Because exploitation needs only ordinary credentials rather than sysadmin rights, the practical exposure is concentrated on instances reachable from untrusted networks and on estates where database logins are shared or weakly managed.

Local privilege escalation in Microsoft SQL Server allows an authenticated attacker holding low-privilege access to the instance or its host to potentially elevate privileges on the underlying system by triggering an integer overflow (CWE-190). The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0 High) confirms the attack is local rather than network-based, requires a pre-existing authenticated foothold (PR:L), and carries high attack complexity (AC:H), meaning precise conditions such as specific input sizes or memory state are needed; no public exploit identified at time of analysis, and the issue is not in CISA KEV. This is a credible but not emergency-tier privilege-escalation issue whose practical risk concentrates on multi-tenant SQL Server instances or hosts shared with low-trust principals, and vendor patches are available per the Microsoft advisory.

Remote code execution in Microsoft SQL Server 2022 and 2025 arises from a stack-based buffer overflow (CWE-121) that is triggered when a client connects to an attacker-controlled SQL Server endpoint and the malicious response overflows a fixed-size stack buffer. The vulnerability is unauthenticated from the attacker's side (PR:N) but requires victim-side interaction (UI:R) and high attack complexity (AC:H), so it is a moderate-priority issue rather than a mass-exploitation emergency; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation. Affected builds are SQL Server 2022 GDR below 16.0.1210.3 and CU27 below 16.0.4305.5, plus SQL Server 2025 GDR below 17.0.1145.4 and CU9 below 17.0.5015.4, with vendor-released patches available from Microsoft.

Local privilege elevation in Microsoft SQL Server 2019, 2022, and 2025 stems from a heap-based buffer overflow that a low-privileged authenticated user with local access can trigger to gain elevated rights on the database host. Exploitation is not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:N) demands an existing authorized database session plus successful heap manipulation, and no public exploit has been identified at time of analysis, with no CISA KEV listing. Vendor patches are available, so this is a moderate-priority hardening item rather than a drop-everything emergency.

An out-of-bounds read in Microsoft SQL Server allows an authenticated, low-privileged database user to make the engine read past the bounds of an allocated buffer and disclose information over the network, affecting unpatched builds in the 2017, 2019, 2022 and 2025 release trains across both GDR and cumulative-update branches. The vector (AV:N, PR:L, UI:N, S:C, C:H, I:N, A:N) means the flaw needs only a valid login reachable on the TDS endpoint - no user interaction and no special configuration - but cannot be triggered by an unauthenticated remote attacker, and integrity and availability are unaffected. Vendor patches are available per the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible but second-tier disclosure risk rather than an emergency zero-interaction issue.

Privilege elevation on Microsoft SQL Server 2019, 2022, and 2025 instances can be achieved by an authenticated, low-privileged user who already has local access to the host or instance and can drive crafted input into a vulnerable heap-allocation code path. Successful exploitation corrupts heap memory and, because the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0), yields high confidentiality, integrity, and availability impact within the database engine's security context; the High attack complexity reflects the non-deterministic heap-grooming required for reliable code execution, and no end-user interaction is needed. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available per the Microsoft advisory, and unaffected instances are those already running the corrected cumulative-update or GDR builds.

Information disclosure in Microsoft SQL Server 2017, 2019, 2022, and 2025 allows an authenticated low-privilege attacker with network access to trigger an out-of-bounds read and potentially disclose sensitive memory contents. The affected builds are those in the EUVD-listed GDR and cumulative-update ranges, and the assessed vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, so valid database credentials and network reachability are required but no user interaction is needed. No public exploit has been identified at time of analysis, no CISA KEV listing is present, and the risk is best treated as a credible mid-tier patch priority rather than a drop-everything emergency; vendor patches are available via the Microsoft Security Response Center advisory.

Heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds a valid low-privilege database login execute arbitrary code on the database engine over the network, with impact crossing a security scope boundary (CVSS 8.5; AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected builds span SQL Server 2017, 2019, 2022, and 2025 across both the GDR (security-only) and cumulative-update branches, so most unpatched enterprise estates that still run older builds are in scope. Exploitation is not trivial - the high attack complexity implies reliable heap layout/grooming or a timing-sensitive corruption window must be achieved - and there is no public exploit identified at time of analysis, but a vendor patch is available and the flaw should be prioritized on internet-exposed or broadly accessible database listeners.

Opening an attacker-supplied file in Adobe Substance 3D Sampler 6.0.3 and earlier can trigger an out-of-bounds write that leads to arbitrary code execution in the context of the current user. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is strictly local and client-side: there is no network-facing service to hit, and the victim must be socially engineered into opening a malicious asset in their own session. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the practical risk is bounded by the required user interaction and the specialized deployment of this creative tooling, which favors targeted delivery over opportunistic mass exploitation.

Arbitrary code execution in Adobe Substance 3D Sampler 6.0.3 and earlier is possible because a stack-based buffer overflow (CWE-121) is triggered when the application parses a specially crafted file, with any code executed inheriting the privileges of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) shows no privileges are required, but the attack is not network-reachable: the attacker must first deliver the malicious file and rely on the victim opening it in the application. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuinely moderate-risk desktop issue rather than a top-priority emergency, though the high confidentiality, integrity, and availability impact on the user's session justifies prompt patching.

Privilege elevation in Microsoft SQL Server (2017, 2019, 2022 and 2025 builds below their patched levels) allows an authenticated, low-privileged database principal to trigger a heap-based buffer overflow in the database engine over a network connection and gain higher privileges, with impact crossing a security boundary (CVSS 8.5, S:C). Exploitation is not anonymous: the attacker must already hold a valid SQL Server login (PR:L) and satisfy a hard-to-control heap-state or race condition (AC:H), so the flaw is not automatable or scalable (SSVC Automatable: no, Exploitation: none), and no public exploit code has been identified at time of analysis. Microsoft has published fixed builds via its update guide, so this is a legitimate but not top-tier emergency priority - patch promptly, with urgency driven by the total technical impact and the broad installed base.

Authenticated code execution in Microsoft SQL Server 2017 through 2025 arises from a heap-based buffer overflow (CWE-122) that allows a low-privileged database login to execute code on the database server over the network. Exploitation is not available to unauthenticated attackers: valid credentials for a SQL Server login are mandatory (CVSS PR:L) and the high attack complexity (AC:H) reflects the heap-layout grooming normally required for a reliable overflow, so the practical bar is considerably higher than the 8.5 base score alone suggests. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds across every affected servicing branch.

Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).

Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.

An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.

Out-of-bounds write in Adobe Substance 3D Designer 16.0.4 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, meaning an attacker must first deliver a malicious asset and persuade the victim to open it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8). The high confidentiality, integrity and availability impacts are tempered by the local attack vector, the unchanged scope (no privilege escalation beyond the current user) and the mandatory user-interaction step, so this is not a wormable or remotely reachable flaw. No public exploit identified at time of analysis; CISA KEV status is not indicated and the flaw is tracked by Adobe as APSB26-169 / ENISA EUVD-2026-100699.

Out-of-bounds write in Adobe Bridge (versions up to and including 15.1.8 and 16.0.7) can let an attacker execute arbitrary code in the context of the current user when a crafted file is opened. The attack is local and requires the victim to open a malicious file (UI:R), so delivery of the file to the target and a user action are both prerequisites; no authentication is required of the attacker and complexity is low once the file is opened. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the vendor advisory (APSB26-167) is the authoritative fix reference. Given the mandatory user interaction and local delivery requirement, this is a credible but second-tier priority rather than an urgent remotely exploitable issue.

Out-of-bounds write in Adobe Bridge allows a local attacker to achieve arbitrary code execution in the context of the current user when a victim opens a malicious file. Affected versions are Adobe Bridge 15.1.8 and earlier, and 16.0.7 and earlier. Exploitation requires user interaction (opening a crafted file) and no elevated privileges, but the attack is local. No public exploit code has been identified at time of analysis, and the flaw is rated CVSS 7.8, making it a legitimately actionable local code-execution flaw but not a drop-everything emergency.

Out-of-bounds write in Adobe Bridge - versions 15.x through 15.1.8 and 16.x through 16.0.7 - can result in arbitrary code execution in the context of the current user when a victim opens or previews a crafted file. The issue is local in reach (AV:L) and requires attacker-induced user interaction (UI:R), with no authentication or elevated privileges needed (PR:N) and low attack complexity (AC:L) once the file is opened, yielding a CVSS 3.1 base score of 7.8. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical barrier for an attacker remains the social engineering needed to convince a target on an unpatched version to open the malicious file.

An out-of-bounds write in Adobe Photoshop Desktop (builds up to and including 27.10, and the 26.x line up to and including 26.11.7) lets an attacker corrupt process memory and achieve arbitrary code execution with the privileges of the user who opened the file. Exploitation is not remote: it requires a victim to open a crafted image or project file (CVSS 3.1 base 7.8, AV:L/PR:N/UI:R), so a successful attack depends on social engineering to deliver and convince the user to open the document. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Arbitrary code execution in Adobe Photoshop Desktop (versions 27.10 and earlier, and 26.11.7 and earlier) is possible via an out-of-bounds write when a victim opens a crafted file. Exploitation requires user interaction and is limited to the context of the current user; no public exploit identified at time of analysis. The CVSS score is 7.8, and the vulnerability is not known to be actively exploited.

Opening an attacker-supplied crafted file in Adobe Dimension 4.1.8 or earlier can trigger a stack-based buffer overflow that allows arbitrary code execution in the context of the victim's user account. Scoring 7.8 under CVSS 3.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the issue is delivered purely through social engineering - a target must open a malicious file - and requires no network reachability, credentials, or elevated privileges, though any resulting code runs only at the victim's privilege level with no scope change. No public exploit code or confirmed active exploitation has been identified at time of analysis, making this a credible but moderate-priority patching item rather than an emergency.

Arbitrary code execution in Adobe Substance 3D Stager (versions 3.1.8 and earlier) is possible when a victim opens a maliciously crafted file, which overflows a stack buffer during parsing and lets the malformed input corrupt memory in the context of the current user. The attack cannot be triggered remotely or without the target's cooperation - it is a local vector (AV:L) that requires user interaction (UI:R), so delivery depends on social engineering that convinces the victim to open the file - and code executes with the privileges of that user only (S:U), meaning a non-administrative victim limits the blast radius to that account. Adobe's PSIRT assigned a 7.8 base score (CWE-121), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).

An out-of-bounds write (CWE-787) in Adobe Dimension 4.1.8 and earlier allows arbitrary code execution at the privilege level of the user who opens a specially crafted file, such as a malicious Dimension project or imported 3D asset. Exploitation is local and depends entirely on victim interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) - the attacker must deliver a file the user then opens, so this is not a remotely triggerable, wormable flaw; no public exploit code identified at time of analysis and the CVE is not in CISA KEV. The practical risk is genuine but operationally constrained by the mandatory user action, the local delivery requirement, and the shrinking installed base of what our assessment describes as a discontinued product.

An out-of-bounds read when parsing a crafted file in Adobe Substance 3D Stager 3.1.8 and earlier can be leveraged to execute code in the context of the current user, though exploitation is constrained by mandatory user interaction - a victim must open a maliciously crafted file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is triggered locally through file loading rather than over the network, requires no attacker-held privileges, and yields only the privileges of the user who opens the document. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a genuine but not emergency-grade priority requiring timely patching rather than urgent incident response.

Parsing a maliciously crafted 3D asset or project file in Adobe Substance 3D Stager 3.1.8 and earlier can drive an out-of-bounds read that leads to code execution in the context of the user running the application. Exploitation is local and socially engineered - the victim must open the attacker-supplied file (AV:L, UI:R, PR:N) - and impact is confined to that user's privileges (S:U), so a non-administrative account limits the blast radius. No public exploit code and no CISA KEV entry were identified at time of analysis, making this a targeted, per-user risk rather than a mass-exploitation threat.

An out-of-bounds read (CWE-125) in Adobe Substance 3D Stager 3.1.8 and earlier can lead to arbitrary code execution in the context of the current user when a victim opens a crafted file with the application. Exploitation is local in vector terms (AV:L) and requires user interaction (UI:R), so an attacker must first deliver a malicious asset and persuade the target to open it; code execution is confined to the victim's privileges because the scope is unchanged (S:U). Rated CVSS 7.8 (High), with no public exploit identified at time of analysis and no CISA KEV listing, making this a genuine but not top-tier priority that should be handled through routine patch cycles rather than emergency response.

Arbitrary code execution in Adobe Substance 3D Stager 3.1.8 and earlier is possible via an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, such as a 3D asset or project file, in the application. The flaw carries a CVSS 3.1 base score of 7.8 (HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attack is local-only with no network path, requires victim user interaction to open the file, and needs no prior privileges, but grants full confidentiality, integrity, and availability impact through code execution in the context of the current user. There is no public exploit identified at time of analysis (not in CISA KEV, no POC referenced), so the practical risk depends on an attacker's ability to socially engineer a designer or artist into opening a booby-trapped asset.

Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when a victim opens a malicious file. This local, user-interaction-required flaw (CVSS 7.8) stems from improper memory handling (CWE-787) during file/asset parsing; no public exploit code has been identified at time of analysis, and exploitation requires the attacker to deliver a crafted file to the target workstation. Successful exploitation grants code execution with the privileges of the Stager user, with high impact to confidentiality, integrity, and availability.

Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier permits arbitrary code execution in the context of the current user when a victim opens a crafted file. The flaw is local (AV:L), requires user interaction (UI:R), and needs no privileges (PR:N), so exploitation depends on social engineering rather than remote autonomous triggering. No public exploit or confirmed active exploitation (CISA KEV) is identified at time of analysis, making this a high-priority patch item but not an emergency per the independent assessment.

Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the user who opens a crafted file, and Adobe's PSIRT has published advisory APSB26-170 covering the issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.8 High on the strength of full confidentiality, integrity and availability impact, but the attack is not remotely triggerable: the attacker must deliver a malicious file and convince a victim to open it, and any resulting code runs only with that user's privileges, with no privilege escalation beyond the current user. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); exploitation is neither automatable nor network-reachable, so risk concentrates on targeted file-delivery campaigns against individual Stager users.

Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when the victim opens a maliciously crafted 3D project or asset file. The attack path is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), with no network-facing trigger and no privilege escalation beyond the rights of the user who opens the file. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but not emergency-grade priority, where the practical risk is driven by social engineering that convinces a Stager user to open attacker-supplied content.

Out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier allows arbitrary code execution in the context of the current user when a victim opens a crafted 3D asset or scene file. The flaw is a client-side file-parsing issue (CWE-787) with a local attack vector and required user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8); no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). Attackers must deliver a malicious file to the target and induce the user to open it, which limits exposure to systems where untrusted Stager files are processed.

An out-of-bounds write in Adobe Substance 3D Stager 3.1.8 and earlier lets an attacker achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted 3D project or asset file. The attack is local in nature (AV:L) and depends entirely on user interaction (UI:R) - the victim must be socially engineered into opening the malicious file - and the resulting code runs with the victim's own privileges rather than elevated rights (no privileges are required per PR:N). At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, so this is assessed as a moderate-priority, not emergency, memory-corruption flaw whose primary risk is targeted, file-based social engineering against individual Substance 3D Stager workstations.

Arbitrary code execution in Adobe Substance 3D Stager 3.1.8 and earlier is achievable when a user is persuaded to open a maliciously crafted file, allowing an unauthenticated attacker to corrupt memory out of bounds and run code in the context of the current user. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local, file-based flaw with no network attack surface, where the mandatory user interaction of opening an untrusted file is the principal limiting factor; impact is confined to the victim user's privileges rather than the whole system. No public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.

Opening a crafted file in Adobe Substance 3D Stager 3.1.8 or earlier can trigger a stack-based buffer overflow that leads to arbitrary code execution in the context of the current user. The attack is local in nature (AV:L) and requires the victim to open an attacker-supplied file (UI:R), while requiring no privileges on the target (PR:N), so practical exploitation depends on socially engineering a user into opening a malicious asset rather than on any remotely reachable network service. There is no public exploit identified at time of analysis and nothing in the supplied intelligence indicates confirmed active exploitation, so this is a genuine but not emergency-priority issue at a CVSS 3.1 base score of 7.8, with impact bounded by the privileges of the user who opens the file.

Heap-based buffer overflow in Microsoft Office Visio allows unauthenticated remote attackers to execute arbitrary code in the context of the user who opens a specially crafted Visio document, with the only barrier being user interaction (UI:R) - the victim must be socially engineered into opening the file. Affected builds are Microsoft 365 Apps for Enterprise (16.0.1, patched via the current channel at https://aka.ms/OfficeSecurityReleases), Office LTSC 2021 below 16.0.14334.20974, and Office LTSC 2024 below 16.0.17932.21056. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the 8.8 CVSS score, network attack vector, and complete confidentiality/integrity/availability impact make prompt patching a high priority for any environment where Visio is installed.

Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.

Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.

An authenticated, low-privileged local attacker can trigger a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) to corrupt kernel memory and elevate to SYSTEM on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 hosts. Exploitation is local-only and high-complexity (CVSS 7.0, AC:H), requiring precise kernel heap grooming or a race window, so this is a moderate-priority privilege-escalation issue rather than a remote or wormable emergency. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds that remove the vulnerable condition.