Buffer Overflow

Stack-based buffer overflow in the Native IBM i JSSE (Java Secure Socket Extension) provider enables local authenticated attackers with low privileges to execute arbitrary code or crash the JVM process on IBM i versions 7.3 through 7.6. The flaw is triggered during TLS session establishment via improper bounds checking against a fixed-length stack buffer. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.22% (12th percentile) and SSVC exploitation status is 'none' - but a vendor patch is available and should be applied given the high-impact code execution potential.

Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.

Out-of-bounds write (CWE-787) in IBM i versions 7.3 through 7.6 enables remote unauthenticated attackers to crash affected systems and cause denial of service. The CVSS 3.1 base score of 8.6 is backed by a network-reachable, zero-prerequisite attack vector spanning all four currently supported IBM i release lines, making the exposed attack surface broad. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available and should be applied promptly given the unauthenticated network vector.

Denial of service via buffer overflow in IBM i 7.3 through 7.6 exposes all supported release lines of IBM's midrange operating system to remote disruption. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that an unauthenticated remote attacker can trigger the flaw with low complexity and no user interaction, resulting in high availability impact and limited integrity impact - consistent with an out-of-bounds write that can crash or destabilize a targeted component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Out-of-bounds write in IBM i 7.3 through 7.6 enables a local low-privileged attacker to execute arbitrary code, with scope change (S:C) indicating the exploit crosses a security boundary into a higher-privileged component - achieving full confidentiality, integrity, and availability impact. The CVSS score of 8.8 reflects the severity of privilege escalation potential despite requiring local access. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.

Heap-based buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to execute arbitrary code with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 3.1 base score of 8.8 and is network-accessible with low attack complexity, making it a high-priority remediation target for IBM Power Systems environments. No public exploit code or active CISA KEV-listed exploitation has been identified at time of analysis; a vendor patch is available via IBM's support portal.

IBM i 7.6 exposes a remotely exploitable denial-of-service condition via an out-of-bounds write (CWE-787) that can be triggered by an unauthenticated remote attacker over the network without user interaction. The vulnerability produces high availability impact with no confidentiality or integrity consequence, consistent with a crash or resource exhaustion outcome rather than code execution. No public exploit or active exploitation has been identified at time of analysis; a vendor patch has been released.

Out-of-bounds read in IBM i 7.3 through 7.6 exposes sensitive memory contents to unauthenticated remote attackers over the network, with additional limited availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms exploitation requires no authentication and no user interaction, lowering the barrier for opportunistic targeting. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.

Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.

Remote denial-of-service in IBM i 7.3 through 7.6 allows unauthenticated network attackers to crash a host server by submitting malformed requests that trigger an out-of-bounds write (CWE-787) in the server's client data validation logic. The CVSS vector confirms no credentials or user interaction are required, making the attack straightforward to attempt against any network-reachable IBM i host server. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support portal.

Remote code execution in IBM i 7.3 through 7.6 is achievable by any authenticated network attacker via an out-of-bounds write (buffer overflow) triggered over the network. The vulnerability requires only low-level credentials, making it accessible to any valid user account on an internet- or network-exposed IBM i system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor has confirmed the flaw and released a patch via IBM Support.

Remote code execution in IBM i (formerly OS/400) releases 7.3 through 7.6 stems from a buffer overflow (out-of-bounds write) that a remote, unauthenticated attacker can trigger to run arbitrary code on the host. IBM has published a fix, and while the CVSS base score is 9.8, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.37% (30th percentile). CISA's SSVC framing rates exploitation as none and the vulnerability as not automatable, tempering the raw-score urgency.

Heap buffer overflow in IBM i 7.3 through 7.6 enables remote, unauthenticated attackers to crash affected systems via a network-reachable code path, resulting in a complete denial of availability. The vulnerability is rooted in CWE-787 (out-of-bounds write) and carries a CVSS 3.1 base score of 7.5 (High) with a fully unauthenticated network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch through its support portal.

Unauthenticated remote exploitation of a buffer overflow in IBM i 7.3 through 7.6 allows attackers to cause denial of service and modify authentication metadata without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially reachable exploitation over the network against default-accessible services. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.

Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.

Out-of-bounds read in PostGIS before 3.7.0beta2 enables low-privileged database users to disclose server process memory or crash the PostgreSQL backend by passing malformed FlatGeobuf geometry data to the extension's property metadata decoder. The decoder validates that a string length prefix is present but omits a bounds check confirming the string body falls within the supplied buffer before materializing it as a SQL-visible value, creating both a memory disclosure and denial-of-service path. A publicly available exploit demonstrates successful memory disclosure against managed PostgreSQL platforms including NeonDB and Supabase; exploitation is not confirmed in CISA KEV but the public proof-of-concept and multi-tenant exposure substantially elevate real-world risk.

Out-of-bounds write in the PostGIS address_standardizer extension through 3.7.0 allows a low-privileged database user to trigger memory corruption in the PostgreSQL server process by supplying a malicious rules table to the standardize_address() function. Missing bounds validation on the classification Type field in gamma.c permits values outside the valid range to be used as raw array indices into an internal output-link table, writing attacker-influenced data to adjacent memory. Publicly available exploit code demonstrates successful exploitation against managed cloud PostgreSQL environments including NeonDB and Supabase; no CISA KEV listing is present at time of analysis.

Out-of-bounds heap write in rsync 3.0.1 through 3.4.x allows a malicious sender to corrupt adjacent heap memory by crafting an argument list that exactly fills the argv allocation in read_args(), causing the trailing NULL terminator to land one slot beyond the allocation boundary. Any rsync client performing a pull operation against an attacker-controlled or compromised server is exposed; heap corruption at this boundary can produce a crash (high availability impact) or potentially a write-what-where condition depending on heap layout. No public exploit code and no CISA KEV listing have been identified at time of analysis; rsync maintainers designated v3.5.0 a major security release, confirming patch availability.

Out-of-bounds write in rsync 3.2.3 through 3.4.x corrupts .bss-segment memory via misuse of snprintf() return semantics in parse_size_arg(), enabling remote denial-of-service and potential memory corruption with high availability impact. The CVSS 4.0 score of 8.3 with AV:N/PR:N reflects that an unauthenticated remote attacker can reach the vulnerable code path, though AC:H indicates the truncation condition requires a specifically crafted size argument. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The fix is confirmed in v3.5.0, designated a major security release by the maintainers.

Out-of-bounds write in rsync 3.0.0 through 3.4.x enables remote memory corruption when a peer sends file entries with the FLAG_HLINKED flag set against a receiver with hard-link preservation disabled. The missing F_SUM field in the file_struct layout permits writes beyond the allocated structure boundary, corrupting adjacent heap or stack data and likely causing denial-of-service or potentially enabling code execution. Vendor-released patch v3.5.0 is available; no public exploit or CISA KEV listing has been confirmed at time of analysis.

Heap out-of-bounds write in rsync 3.2.5 through 3.4.x allows remote unauthenticated attackers to corrupt heap memory by supplying a crafted files-from entry to any exposed rsync daemon module. Critically, the flaw is exploitable against read-only daemon modules - a configuration commonly treated as a safe exposure boundary - by providing a path containing both an interior and trailing backslash, causing add_implied_include() to under-size its destination buffer and write one attacker-controlled byte past the allocation end. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.8 reflects the unauthenticated network attack vector and high availability impact.

Out-of-bounds read in rsync's sender-side block matching logic exposes systems running rsync before 3.5.0 to a denial-of-service condition when syncing with a malicious or compromised receiver. The vulnerability stems from missing validation of zero-length checksum blocks: when a receiver sends such a block, the sender performs a negative offset calculation during delta computation, reading memory before the start of an allocated file data buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the CVSS 4.0 score of 7.1 (VA:H) reflects the practical crash risk for any rsync client connecting to an untrusted server.

Heap buffer overflow in PostgreSQL's pg_dump backup utility across all active major versions enables an authenticated database user with object creation privileges to execute arbitrary code as the operating system account running pg_dump. The attacker plants a crafted database object containing an excessively long function transform list, then waits for pg_dump to process that object during a backup operation, triggering CWE-122 heap corruption. No public exploit has been identified at time of analysis, but the clear trigger path and widely deployed target surface make this a meaningful operational risk for organizations relying on pg_dump for backup automation.

Stack buffer overflow in PostgreSQL's argument name matching logic allows a database object creator to crash backend processes and achieve low integrity impact by supplying a crafted OUT parameter count. Affected are all active major branches: versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. No public exploit or CISA KEV listing has been identified at time of analysis; however, the constrained-write nature of the overflow (limited to 0x0 and 0x1 bytes) caps realistic impact at availability loss rather than arbitrary code execution, making this a high-priority patch rather than an emergency incident response trigger.

Heap buffer overflow in PostgreSQL's pg_stat_statements extension (major version 18, minor versions 18.0 through 18.4) allows any authenticated database user to execute arbitrary code as the operating system account running the PostgreSQL service by submitting crafted SQL queries containing array constants. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a valid database credential, with full confidentiality, integrity, and availability impact on the database host. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.

Heap buffer overflow in PostgreSQL's plperl extension allows a database function owner to execute arbitrary code as the OS-level user running the database server by crafting a function body that returns a tied hash. Affected versions span the four active PostgreSQL major release lines prior to 18.5, 17.11, 16.15, 15.19, and 14.24. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows any authenticated database user to execute arbitrary code as the operating system account running the database process by supplying an excessively long POSIX timezone abbreviation. Affected versions span the actively maintained major release lines: PostgreSQL 14 through 18, with fixes available in 14.24, 15.19, 16.15, 17.11, and 18.5. No public exploit code has been identified at time of analysis, but the low attack complexity and broad deployment surface of PostgreSQL make this a high-priority patching target for any environment where untrusted or semi-trusted database users exist.

Heap buffer overflow in PostgreSQL's regexp engine allows any authenticated database user to execute arbitrary code as the operating system user running the database process. The flaw is triggered by specially crafted text that survives input validation but undergoes unanticipated data growth during internal round-trip conversion through the pg_wchar encoding layer, overflowing a heap-allocated buffer during regular expression evaluation. All active PostgreSQL branches are affected - versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 - with no public exploit or CISA KEV listing confirmed at time of analysis.

CVE-2026-62292 has been reported by Ubuntu as a security update, but no technical description, CVSS score, CWE, affected product versions, or references are available at time of analysis. No meaningful synthesis is possible without fabricating data.

Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a stack buffer (CWE-121), affecting Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on all listed platforms. Successful exploitation can crash the database engine or lead to code execution in the Db2 server process, yielding total loss of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as 'none'.

Remote unauthenticated denial of service and sensitive information disclosure in IBM i 7.3 through 7.6 stems from an integer underflow (CWE-125 out-of-bounds read) reachable over the network without authentication. An attacker sending a crafted request can crash an affected service and read portions of process memory, yielding both high availability impact and limited confidentiality exposure. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated attack vector makes it a meaningful risk for internet-exposed IBM i systems.

Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the context of the user who opens the dialog. The flaw is triggered when a DSN configuration containing an over-length file path is loaded into the setup dialog and a file or folder selection is initiated, due to an incorrect buffer capacity calculation in that handler. No public exploit exists and no CISA KEV listing is present; however, a confirmed vendor-released patch is available in v1.4.9, which clamps DSN path field sizes.

Unauthenticated remote crash of rsyslogd is possible through a flaw in the optional imptcp input module, where a crafted input sequence during oversize-frame recovery produces an invalid internal message length and terminates the logging daemon. Systems running Red Hat Enterprise Linux 6 through 10 are affected only when imptcp is explicitly loaded with a non-default frame delimiting mode; the default imptcp framing and the separate imtcp module are explicitly confirmed unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS scores this at 7.5 High solely on the basis of network-accessible, unauthenticated availability impact.

Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. MongoDB has released a patched version (v1.4.9) that adds buffer-clamping logic to prevent the overflow; no public exploit has been identified at time of analysis.

Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the client application performing data reads through the connector. The driver fails to validate destination buffer size when converting floating-point column values to their string representations, enabling memory corruption when sufficiently large float values are encountered. No public exploit code has been identified at time of analysis, and a vendor-confirmed fix is available in version 1.4.9.

Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or object name is passed to a metadata retrieval/catalog function, overflowing a fixed-size buffer. This can crash the calling application and, under certain heap/stack conditions, lead to arbitrary code execution within that process. The flaw is rooted in an integer overflow (CWE-190) in the driver's catalog-name handling; MongoDB itself reported it and shipped a clamp fix, and no public exploit has been identified at time of analysis (not listed in CISA KEV).

Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potential code execution when the driver processes malformed stored procedure parameter metadata returned by a malicious or compromised server. The root cause is a missing bounds check (CWE-120) on the parameter size field in the metadata parsing routine, affecting all versions prior to v1.4.9. No public exploit code or active exploitation has been identified at time of analysis, and MongoDB has released a fix in v1.4.9.

Remote code execution in IBM Informix Dynamic Server 14.10, 12.10.x, and 15.0 is possible through a stack-based buffer overflow (CWE-121) in the oninit daemon's sq_sgkprepare function, triggered when processing a SQL interface request containing an unchecked length field. An authenticated, network-adjacent attacker with low-privilege SQL credentials can exploit this to achieve full compromise of the database server, resulting in complete confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; IBM has released a patch via Security Advisory 7283143.

Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 arises from a stack-based buffer overflow that lets a remote attacker run arbitrary code on the host operating system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high impact to confidentiality, integrity, and availability, scoring 9.8 (Critical). IBM has published a fix, but there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Remote code execution in IBM i 7.3 through 7.6 is exploitable by a remote authenticated attacker via improper bounds checking (CWE-787: Out-of-bounds Write). The high integrity impact (I:H) in the CVSS vector confirms that successful exploitation allows an attacker to overwrite memory and achieve arbitrary code execution on the affected IBM Power Systems platform. No public exploit identified at time of analysis, and IBM has released a vendor patch; however, the low-privilege authentication requirement (PR:L) broadens the attacker pool to any valid system user.

Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to run arbitrary code via an out-of-bounds write (CWE-787) memory-corruption flaw. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), indicating unauthenticated network exploitation with no user interaction against affected releases. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so the 9.8 rating reflects potential impact rather than confirmed exploitation.

Out-of-bounds read in IBM i 7.3 through 7.6 enables remote authenticated attackers with low-privilege credentials to obtain sensitive information across a security scope boundary, yielding a high confidentiality impact. The CVSS vector (S:C/C:H) indicates the leaked data can originate from components outside the attacker's immediate security context - a notable escalation beyond typical information disclosure. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7283280.

Remote code execution in Fortinet FortiClientWindows affects versions 7.2.0-7.2.11 and 7.4.0-7.4.3, exploitable by any attacker capable of intercepting or forging DNS responses destined for the target host. Maliciously crafted DNS response packets trigger a classic buffer overflow (CWE-120) in the client's DNS parsing logic, allowing arbitrary code execution without requiring any credentials or user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity requirement (DNS MITM/poisoning position) meaningfully limits opportunistic exploitation.

Stack-based buffer overflow in Fortinet FortiOS, FortiProxy, and FortiPAM allows unauthenticated remote attackers to execute arbitrary code or commands within the WAD (Web Application Daemon) process via crafted sockets - but only on devices where the explicit proxy is simultaneously configured with Kerberos authentication and SOCKS enabled. Exploitation further requires defeating stack canary protection and ASLR, elevating real-world attack complexity well above the raw CVSS base score implies. No public exploit or active exploitation has been confirmed; Fortinet PSIRT published advisory FG-IR-26-161 disclosing the issue.

Heap overflow in the Linux kernel's txgbe network driver enables a local attacker to write beyond an allocated heap buffer during ethtool EEPROM reads, potentially escalating to full kernel compromise on systems with Wangxun txgbe 10GbE hardware. The flaw exists because txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into a buffer ethtool allocates to exactly length bytes, causing a 1-3 byte out-of-bounds write whenever the requested length is not 4-byte aligned. Vendor patches are available in Linux 6.19 and stable releases 7.1.6 and 7.2-rc5; no public exploit code or active exploitation has been identified at time of analysis, though the 16% EPSS score is notably elevated for a kernel driver defect.

Heap out-of-bounds read and write in FreeRDP's Kerberos SSPI layer (all versions prior to 3.30.0) allows a malicious RDP peer to corrupt memory during CredSSP/NLA Kerberos decryption by supplying a crafted GSS Wrap-token with an unbounded EC or EC+RRC field value. The flaw sits in the pre-session authentication path, meaning exploitation does not require an established authenticated session from the attacker's side. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the network-reachable attack surface during a common enterprise authentication flow warrants prompt patching.

Heap and stack buffer overflow in CivetWeb's read_websocket() function (through commit 4a4f0c95) allows unauthenticated remote attackers to corrupt memory by sending crafted compressed WebSocket frames, but only against instances compiled with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES build flags. Attackers negotiate permessage-deflate during the WebSocket handshake and send an RSV1-flagged frame that triggers a 4-byte zlib sync trailer write past the allocated buffer boundary, corrupting heap metadata and enabling denial of service or potential code execution (per VulnCheck tagging). No public exploit code is confirmed and this CVE does not appear in CISA KEV at time of analysis, but the deterministic 4-byte overwrite primitive is a credible research target; the non-default build configuration substantially limits the real-world exploitable population.

Out-of-bounds read in MongoDB Server's geospatial query processing permits an authenticated user with write privileges to store malformed geometry documents that bypass validation at ingestion time, with the memory access violation occurring later during query execution. Affected deployments span all tracked versions per NVD CPE data (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*), and the dual impact - server crash and limited process memory disclosure - makes this a moderate-to-high priority for any MongoDB deployment where untrusted authenticated users have write access. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.

Out-of-bounds memory read in MongoDB Server's aggregation framework allows an authenticated attacker to crash the database server or expose limited memory contents by submitting a specially crafted numeric parameter within a specific aggregation pipeline stage. The CVSS 4.0 score of 7.1 reflects dual impact: high availability loss from server crash (VA:H) and low-level confidentiality exposure from adjacent memory leakage (VC:L). Self-reported by MongoDB (responsible disclosure), with no public exploit code or CISA KEV listing identified at time of analysis.

Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in the context of the logged-in user when a crafted malicious file is opened. Tagged as Memory Corruption, RCE, and Buffer Overflow by Adobe PSIRT, this is a file-parsing flaw rooted in CWE-787. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, Adobe has released patch version 15.5 via advisory APSB26-94.

Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens a specially crafted malicious file, exploiting an out-of-bounds write flaw in the application's file parsing logic. The vulnerability executes at the privilege level of the current user, meaning full compromise of user-accessible data and processes without requiring elevation. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, file-based delivery against creative professionals - a population that routinely opens files from clients, stock libraries, and external collaborators - represents a realistic social-engineering attack surface.

Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user when a victim opens a specially crafted file. All releases from 15.2 through 15.4.1 are confirmed affected; Adobe has released version 15.5 as the fix per advisory APSB26-94. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of a concrete patch release and high CVSS impact warrants prompt remediation for any organization with creative or photography workflows.

Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security context of the current user through a maliciously crafted file. The flaw, classified under CWE-787 (Memory Corruption / Buffer Overflow), resides in file-parsing logic and requires no elevated privileges on the attacker's side - only that a victim opens the weaponized file. No public exploit code or active exploitation has been confirmed at time of analysis; vendor-released patch 15.5 is available.

Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted file. Tagged as Memory Corruption, RCE, and Buffer Overflow by Adobe PSIRT, the vulnerability carries a CVSS 7.8 (High) rating. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-based attack vector makes it suitable for phishing and malicious download campaigns targeting creative professionals.

Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a crafted malicious file is opened. The vulnerability is rooted in improper memory boundary validation during file parsing (CWE-787), yielding full confidentiality, integrity, and availability impact per CVSS. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE-class severity and file-delivery vector make this a meaningful phishing or watering-hole risk for creative professionals.

Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in the context of the logged-in user when a specially crafted file is opened. Adobe's PSIRT reported the issue under advisory APSB26-94, and the ENISA EUVD tracks it as EUVD-2026-56829. No public exploit or CISA KEV listing has been identified at time of analysis, though the CWE-787 memory corruption class combined with a confirmed high C/I/A impact triad warrants prompt patching across all affected release branches.

Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full code execution upon successful exploitation, with high impact across confidentiality, integrity, and availability. The vulnerability requires user interaction - such as opening a malicious file or running a crafted application - making social engineering a likely delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Microsoft Security Response Center has acknowledged the issue.

Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.

Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.

Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.

Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.

Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.

Remote code execution in Microsoft Office Outlook stems from an integer overflow or wraparound condition (CWE-190) that allows an unauthenticated network attacker to execute arbitrary code on a victim's system, achieving full confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R reflects low attack complexity and no authentication requirement, though exploitation is gated by a user interaction step. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the attack profile is consistent with phishing-delivered malicious email or attachment campaigns targeting Outlook users.

Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.

Heap-based buffer overflow in Microsoft Office (365 Apps for Enterprise, Office 2019, Office 2021 LTSC, and Office 2024 LTSC) enables a local attacker with low-privilege credentials to execute arbitrary code with the full confidentiality, integrity, and availability impact of the Office process. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 and requires only local access and a standard user account - no user interaction is needed once the attacker can trigger the vulnerable allocation path. No public exploit code has been identified at time of analysis, and SSVC assessment confirms current exploitation status as none.

Remote unauthenticated denial of service in Windows Network File System (NFS) allows a network attacker to crash the NFS service by sending a malformed packet that triggers a buffer over-read (CWE-126). Affected systems span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog; Microsoft has released patches across all affected build lines.

Stack-based buffer overflow in Microsoft Office Excel enables local arbitrary code execution when a user opens a specially crafted file. The vulnerability (CWE-121) carries a CVSS 7.8 High score, with high confidentiality, integrity, and availability impact upon successful exploitation. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis.

Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a crafted file. The vulnerability (CWE-121) is triggered through user interaction with malicious content, requiring no privileges on the target system beyond access to run Excel. No public exploit code or CISA KEV listing is identified at time of analysis, though the high-impact CVSS 7.8 score reflects full compromise of confidentiality, integrity, and availability upon successful exploitation.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system-level impact when a victim opens a specially crafted Excel file. The flaw (CWE-122) resides in Excel's file parsing logic, where malformed input causes a heap memory region to be overwritten, redirecting execution flow. No public exploit has been identified at time of analysis, and the vulnerability has not appeared in CISA's Known Exploited Vulnerabilities catalog, though the Microsoft Security Response Center has issued an advisory.

Out-of-bounds read in Microsoft Office Excel enables local code execution when a user opens a specially crafted spreadsheet file. The vulnerability (CWE-125) carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability, and is reported directly by Microsoft via the MSRC update guide. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) indicates reliable exploitability once a working exploit is developed.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The vulnerability triggers during file parsing, allowing an attacker who can deliver a malicious document to execute arbitrary code with the privileges of the logged-in user. No KEV listing or public exploit code has been identified at time of analysis, but the local-execution-via-document vector makes this a meaningful phishing and spear-phishing enabler.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted file, granting full confidentiality, integrity, and availability compromise of the affected system. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a document-triggered exploit requiring no attacker privileges but demanding victim interaction - a profile consistent with malicious email attachment or drive-by download campaigns. No public exploit code or CISA KEV listing has been identified at time of analysis, though Excel's ubiquity makes this a high-value target class.

Out-of-bounds write (CWE-787) in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file, yielding full confidentiality, integrity, and availability impact at CVSS 7.8. The attack is file-delivery based - typical phishing or drive-by download - requiring no system privileges from the attacker but requiring the victim to open the malicious document. No public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The CVSS vector (AV:L/PR:N/UI:R) confirms the attack requires no system privileges but does require user interaction - the classic malicious-document delivery pattern. Full confidentiality, integrity, and availability compromise results, making this a high-severity threat against any organization reliant on Excel for document workflows. No public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system impact when a victim opens a maliciously crafted workbook. The root cause is a numeric truncation error (CWE-122) in Excel's file parsing logic, where an integer value is truncated before being used to size a heap allocation, resulting in an undersized buffer that can be overflowed. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, but the high CVSS score of 7.8 and full confidentiality, integrity, and availability impact make this a meaningful risk for organizations relying on Excel file workflows.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted workbook, resulting in full compromise of confidentiality, integrity, and availability on the local system. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no attacker privileges are required, though user interaction - opening the malicious file - is a hard prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue is confirmed by Microsoft's Security Response Center via secure@microsoft.com.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. The attack requires no privileges from the attacker but does require user interaction - consistent with a malicious document delivery vector - and carries high impact across confidentiality, integrity, and availability. No active exploitation (KEV) or public exploit code has been identified in the provided intelligence at time of analysis.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/PR:N/UI:R) confirms exploitation requires no prior privileges but depends on user interaction - consistent with a malicious document delivery scenario. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a high-severity concern for any environment running unpatched Excel installations.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. An unauthenticated attacker (per CVSS PR:N) delivers a malicious document that triggers the overflow upon interaction (UI:R), achieving full confidentiality, integrity, and availability compromise on the victim system. No public exploit or KEV listing has been identified at time of analysis, though the attack pattern is well-understood and document-based Excel exploits have a long operational history.

Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution on the victim's local machine when a specially crafted Excel file is opened. The vulnerability carries a CVSS base score of 7.8 with high confidentiality, integrity, and availability impact, affecting the victim's user-level security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, reducing immediacy compared to actively exploited file-format parsing flaws.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a maliciously crafted file. The vulnerability (CWE-122) corrupts heap memory in Excel's parsing logic, allowing an attacker to achieve full control over confidentiality, integrity, and availability of the affected system. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 7.8 with high impact across all three CIA triad pillars makes this a meaningful priority for organizations running affected Excel versions.

Out-of-bounds read in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook file. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms file-based delivery requiring victim interaction, achieving full confidentiality, integrity, and availability impact on the compromised host. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Stack-based buffer overflow in Microsoft Office enables local arbitrary code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation is local and requires user interaction - most likely triggered by opening a maliciously crafted Office file delivered via phishing or other social engineering. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the high-impact triad (C:H/I:H/A:H) and Microsoft Office's ubiquitous deployment footprint make this a notable patching priority.

Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.

Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.

Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.

Heap-based buffer overflow in the Windows iSCSI Target Service enables an unauthenticated remote attacker to trigger denial of service across a wide range of Windows Server versions from 2012 through 2025. The vendor-assigned CVSS vector of C:H/I:H/A:H suggests potential impact beyond the description's stated denial-of-service scope, warranting attention to whether memory corruption could extend to confidentiality or integrity compromise. No public exploit or active exploitation has been identified at time of analysis; however, SSVC designates the attack as automatable, elevating the urgency for organizations running exposed iSCSI targets to apply available patches.

Remote code execution in the Windows iSCSI Target Service allows an unauthenticated network attacker to run arbitrary code by exploiting a heap-based buffer overflow (CWE-122) in the service's network-facing request handling. The flaw carries a critical 9.8 CVSS rating and is remotely reachable with no privileges or user interaction, meaning any exposed iSCSI Target endpoint can be compromised end-to-end. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.