Buffer Overflow

Remote kernel heap corruption in the illumos SCTP stack lets an unauthenticated attacker send a crafted INIT ACK packet with malformed address parameters to trigger an out-of-bounds access during packet classification, potentially leading to remote code execution or a kernel panic. The flaw affects illumos-gate and downstream distributions (OmniOS, SmartOS/Triton) built before commit 53a3efde, and has existed since 2010 (commit a5407c02). There is no public exploit identified at time of analysis and the CVSS 4.0 exploit-maturity metric is Unreported (E:U), but the attack requires no authentication or user interaction.

Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing process or disclose small amounts of adjacent process memory by feeding it a truncated or malformed XML document. The parserc_parse C routine performs multi-character lookahead (for tokens like '<![CDATA[' and element terminators) without verifying the offsets stay inside the input buffer, so inputs such as '<a/' read past the end. There is no public exploit identified at time of analysis and EPSS is low (0.19%), but SSVC rates the flaw automatable, reflecting how easily malformed XML can be delivered to any service that parses untrusted input with this module.

Out-of-bounds read in the HTML::Bare Perl parsing module (versions through 0.04) lets an attacker who supplies truncated or malformed HTML - such as the string "<a/" - force the C-based parserc_parse routine to read past the end of the input buffer. Because the parser performs multi-character lookahead for tokens like "<![CDATA" and element terminators ">" without bounds checks, adjacent heap memory can be disclosed or the process can crash. No public exploit was identified at time of analysis, but an upstream fix (GitHub PR #2) and per-version patches are available.

Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.

Denial of service in libsolv's PGP signature verification (solv_pgpvrfy) allows remote attackers to crash automated package and repository processing by supplying a crafted Ed25519 signature. The flaw is a stack-based buffer overflow (CWE-121) triggered when the EdDSA 's' MPI is copied into a fixed 64-byte stack buffer using an attacker-controlled mismatched length. It affects the libsolv dependency solver embedded in Red Hat Enterprise Linux 7/8/9/10, OpenShift, Satellite, RHUI, openSUSE/SUSE, Ubuntu and Debian; no public exploit identified at time of analysis and it is not in CISA KEV.

Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.

Out-of-bounds heap write in Tencent's ncnn neural-network inference framework allows a crafted .param model file to corrupt heap memory when parsed by Net::load_param(). Because ParamDict::load_param() and load_param_bin() validated the parsed parameter id only against the upper bound (id >= NCNN_MAX_PARAM_COUNT), a negative id indexes before the params[] array, giving an attacker a write primitive below the allocated buffer. No public exploit is identified at time of analysis and the issue is not in CISA KEV; an upstream source-code fix is available.

Denial of service in TDengine time-series database versions prior to 3.4.1.15 allows unauthenticated remote attackers to crash the server by sending a malformed compressed RPC packet. The transDecompressMsg() function trusts a compression-length field without verifying the packet is large enough to contain the 8-byte STransCompMsg header, leading to an out-of-bounds read, uncontrolled/underflowed allocation, and process crash. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; a vendor fix exists in 3.4.1.15.

Stack-based buffer overflow in TDengine (open-source IoT time-series database) versions 3.4.1.6 and earlier allows an authenticated user to trigger a one-byte out-of-bounds write by submitting SQL containing crafted escape sequences (\%, \_, or \x), leading to denial of service and potentially remote code execution. The flaw sits in the SQL parser's trimString() routine, which validates only a single byte of remaining space in the tmpTokenBuf stack buffer before writing escape-processed data. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in version 3.4.1.14.

Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.

Memory-corruption vulnerabilities in Cisco RoomOS Software, disclosed by Cisco as a bundled hardening release from an internal security review, are scored CVSS 9.8 and could let remote unauthenticated attackers trigger buffer-overflow conditions on Cisco video collaboration endpoints. Per the CVSS vector the flaw is network-reachable with no authentication or user interaction and yields total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records exploitation status as none, indicating no observed exploitation despite the critical score.

Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (DoS) and, on hosts with ASLR disabled or bypassed, potentially execute arbitrary code by sending crafted HTTP requests. The flaw is a data-plane-only issue triggered when a regex-based map directive references the map's regex capture variables before the map output variable in a string expression, or via a non-cacheable variable under certain conditions. F5 has released a patched version; no public exploit identified at time of analysis and it is not listed in CISA KEV.

A heap buffer overflow in ntfs_index_walk_down() in libntfs-3g/index.c lets an attacker corrupt heap memory inside the SUID-root ntfs-3g binary by supplying a crafted NTFS image whose file metadata is parsed during normal filesystem operations. The impact is local privilege escalation or code execution with root privileges: the assessed vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C, score 8.1) requires the attacker-controlled volume to be mounted or processed - for example a USB/removable device under an auto-mount policy, or a user mounting an attacker-supplied image - and success additionally depends on defeating heap-layout unpredictability (AC:H), so no network-reachable path exists. No public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). A vendor-released patch is available in NTFS-3G 2026.7.7, with distribution updates from Ubuntu (USN-8554-1) and SUSE.

Heap-based buffer overflow in NTFS-3G through 2026.2.25 enables a local attacker to corrupt heap memory inside the SUID-root ntfs-3g binary by supplying a crafted NTFS image, with potential for privilege escalation to root. The flaw in build_inherited_id() (libntfs-3g/security.c) is triggered when a file is created inside a specially structured directory on the malicious volume. No public exploit identified at time of analysis; vendor patches are confirmed available for Ubuntu and SUSE.

Local privilege escalation in NTFS-3G (libntfs-3g) through 2026.2.25: a heap-based buffer overflow in ntfs_ib_cut_tail() in libntfs-3g/index.c lets a local user corrupt heap memory in the SUID-root ntfs-3g binary by mounting a crafted NTFS image and creating a file inside a specially crafted directory within it. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 7.4), no privileges are required (PR:N) but exploitation is local (AV:L), demands some heap-grooming skill for reliable code execution (AC:H), and only yields privilege escalation where ntfs-3g is installed with the SUID-root bit set - its common default - and unprivileged users can invoke it directly or via automatic mounting of removable media; hardened configurations using a non-privileged FUSE/polkit mount path or with auto-mount disabled substantially reduce the impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, making this a credible local privilege-escalation issue rather than a remote mass-exploitation threat. Vendor-released patch: ntfs-3g 2026.7.7.

Heap buffer overflow in NTFS-3G through 2026.2.25 (libntfs-3g/index.c, ntfs_ib_copy_tail()) enables a local attacker who can supply a crafted NTFS image, such as via a mount or auto-mounted removable media, to corrupt heap memory in the SUID-root ntfs-3g binary by extending a directory, for example by creating a file. Scored CVSS 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), impact is integrity and availability, with privilege escalation to root only when ntfs-3g is installed setuid-root; many modern distributions instead mediate mounts through FUSE with udisks/polkit, where the consequence degrades to a crash in the invoking user's context. No public exploit identified at time of analysis, EPSS is low at 0.17% (6th percentile), and vendor patch 2026.7.7 is available.

Heap-based buffer overflow in NTFS-3G's compression-handling path allows an attacker with low-privileged local access to corrupt a single byte of heap memory inside the setuid-root ntfs-3g binary when it reads a maliciously crafted NTFS image, giving a potential path to root privilege escalation. The flaw affects NTFS-3G through 2026.2.25 and is rated 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), reflecting high integrity and availability impact with no confidentiality impact; exploitation is local only, requires prior low-privileged access, and additionally requires that ntfs-3g be installed setuid-root and be induced to mount or read the attacker-supplied image. No public exploit has been identified at time of analysis, and a vendor-released fix is available in the upstream 2026.7.7 release, with corresponding distribution updates from Ubuntu and SUSE.

Heap buffer overflow in NTFS-3G through 2026.2.25 lets a local attacker corrupt heap memory inside the setuid-root ntfs-3g binary by supplying a crafted NTFS image, mounting it, and then extending a directory on it - for example by simply creating a file - so the corrupted privileged process may be leveraged to escalate privileges or crash. Rated CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), the issue is strictly local: it requires a low-privileged local account (or access to removable NTFS media that is auto-mounted on the user's behalf) and does not apply where ntfs-3g is not installed setuid-root and auto-mounting of untrusted media is disabled. There is no public exploit identified at time of analysis, but vendor patches are available (upstream 2026.7.7 plus Ubuntu USN-8554-1 and SUSE-SU-2026:3213/3214) and it is tracked as EUVD-2026-94355.

Heap buffer overflow in the ntfscat utility shipped with NTFS-3G through 2026.2.25 allows a crafted NTFS image to corrupt heap memory when a user runs ntfscat to read a file from that image, potentially leading to code execution in the privilege context of the invoking user. The issue is local (AV:L), requires user interaction (UI:R), and per the CVSS vector needs no privileges (PR:N) with no scope change (S:U); the normal ntfs-3g mount driver path is not affected by default, so realistic exposure is limited to forensic, recovery, and image-analysis workflows that process untrusted disk images. No public exploit code has been identified at time of analysis, EPSS is low (0.17%, 6th percentile), the issue is not in CISA KEV, and a vendor patch (2026.7.7) is available.

Remote code execution or permanent denial of service in the Tenda AC10 v3 SOHO router (firmware V03.03.16.09) stems from a classic buffer overflow reachable through the /cgi-bin/UploadCfg web endpoint. Attackers who can reach the router's management interface can send oversized crafted input to crash the device permanently or potentially run arbitrary code on it. Proof-of-concept material appears to be published on GitHub, though this is not listed in CISA KEV and carries a low EPSS score of 0.17% (7th percentile), indicating no confirmed widespread exploitation yet.

Heap-based buffer overflow in 7-Zip's XZ archive parser enables arbitrary code execution when a victim opens a crafted archive on 7-Zip 26.01 and earlier; fixed in 7-Zip 26.02. Reported by Landon Peng of Lunbun LLC through the Zero Day Initiative, this flaw carries full confidentiality, integrity, and availability impact at the process level. A public POC is confirmed available via the Italian ACN portal, though EPSS sits at only 0.92% (57th percentile) and no CISA KEV listing exists, indicating targeted rather than widespread exploitation at time of analysis.

Heap out-of-bounds read/write in OpenHTJ2K (High-Throughput JPEG 2000 reference codec) v0.18.4 and earlier lets an attacker corrupt heap memory by supplying a crafted J2K/JP2 codestream, with a confirmed heap information-leak primitive and vendor-claimed arbitrary code execution. The flaw is reached through every decoder entry point (invoke, invoke_line_based, invoke_line_based_stream, invoke_line_based_predecoded) and, notably, through a JPIP server's startup codestream load, making it network-reachable without user interaction. There is no public exploit identified at time of analysis, though the vendor changelog references non-public PoC files, and the issue is not listed in CISA KEV.

Arbitrary code execution in OpenHTJ2K (an open-source High Throughput JPEG 2000 codec by osamu620) versions 0.18.4 and earlier stems from an unchecked coding-pass counter overflowing the fixed pass_length[128] array while parsing crafted JPEG 2000 packet headers. An attacker who supplies a malicious J2K/HTJ2K image to an application built on the library can corrupt adjacent memory and potentially execute code. No public exploit identified at time of analysis; EPSS is low (0.20%) and CISA SSVC rates current exploitation as none, though technical impact is total and the flaw is automatable.

Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing and requires user interaction, so it is not remotely exploitable without victim action. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.

Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) stems from an out-of-bounds write when parsing a maliciously crafted file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a booby-trapped file, so it is a file-format/client-side attack rather than a remotely reachable service flaw. No public exploit has been identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.14% (4th percentile).

Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows a remote attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). Exploitation hinges on user interaction, so it is a file-delivery/social-engineering vector rather than a remotely automatable one.

Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.

Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file that triggers a heap-based buffer overflow (CWE-122), letting an attacker run code in the context of the current user. The flaw was reported by Adobe and disclosed in advisory APSB26-81; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is file-borne and requires user interaction, so it is not remotely triggerable without a user opening attacker-supplied content.

Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.

Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) that executes attacker-controlled code in the context of the current user. The flaw affects Adobe Bridge as reported by Adobe (advisory APSB26-81) and is rated CVSS 7.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is local and hinges entirely on user interaction - the victim must open the malicious file.

Code execution in NVIDIA TensorRT is possible when the SDK processes a maliciously crafted input that overflows a heap-based buffer (CWE-122), corrupting adjacent heap memory. The flaw affects the TensorRT deep-learning inference library and requires a local user to load attacker-supplied content, per the AV:L/UI:R CVSS vector; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Successful exploitation yields full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) in the context of the process running the inference job.

Local code execution in NVIDIA TensorRT is possible when the library parses an attacker-supplied input (such as a crafted model/engine file), triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and lead to arbitrary code execution in the context of the process using TensorRT. The CVSS 3.1 vector (AV:L/UI:R) indicates the attacker needs local access and must induce a user or application to load malicious content, and there is no public exploit identified at time of analysis. TensorRT is NVIDIA's deep-learning inference SDK, so the affected population is developers, MLOps pipelines, and inference servers that load third-party or untrusted models.

Renderer-side arbitrary code execution in Google Chrome for Windows (versions prior to 150.0.7871.125) stems from a heap buffer overflow in the bundled libyuv video color-conversion library, letting a remote attacker who lures a victim into loading a crafted video file run code within the renderer sandbox. Chromium rates the severity High; the flaw was reported internally by the Chrome team and a fixed stable build is available. There is no public exploit identified at time of analysis, and EPSS is low (0.33%, 25th percentile), consistent with SSVC exploitation status 'none'.

Arbitrary code execution in Adobe After Effects arises from an out-of-bounds write (CWE-787) that runs in the context of the current user when a victim opens a maliciously crafted project or media file. Adobe (via advisory APSB26-78) confirms the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects high impact tempered by the local vector and required user interaction.

Arbitrary code execution in Adobe After Effects arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted project or media file, running attacker code with the privileges of the current user. Adobe self-reported the flaw in advisory APSB26-78; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 7.8 (High) rating reflects high confidentiality, integrity, and availability impact but is gated by required user interaction and local file delivery.

Arbitrary code execution in Adobe Premiere Pro is possible via a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted project or media file, running attacker code in the context of the current user. The flaw is local and requires user interaction, with no public exploit identified at time of analysis; Adobe self-reported it in advisory APSB26-76. CVSS 7.8 reflects high confidentiality, integrity, and availability impact but a local attack vector gated by the user opening a malicious file.

Arbitrary code execution in Adobe Premiere Pro via an out-of-bounds write (CWE-787) that lets an attacker run code in the context of the current user when a victim opens a maliciously crafted project or media file. The flaw is memory-corruption based and file-driven, requiring user interaction rather than network exposure; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS data was not provided, but the local, user-interaction-gated vector places this in the file-format/client-side attack category typical of Adobe desktop products.

Arbitrary code execution in Adobe Premiere Pro is possible when a victim opens a maliciously crafted project or media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw was reported by Adobe (advisory APSB26-76) and carries a CVSS 3.1 base score of 7.8 (local vector, requires user interaction). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently driven by the ease of social-engineering a user into opening a booby-trapped file.

Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attacker corrupt heap memory by supplying a crafted serialized tensor, potentially causing information disclosure, data tampering, or denial of service. All platforms running affected TensorRT-LLM versions are impacted. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; NVIDIA rates exploitation as high-complexity (AC:H).

Arbitrary code execution in Adobe Media Encoder arises from a stack-based buffer overflow (CWE-121) triggered when a victim opens a maliciously crafted media file, allowing an attacker to run code in the context of the current user. The CVSS 3.1 base score is 7.8 (local vector, user interaction required, no privileges needed). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is file-delivery-driven rather than remotely wormable.

Arbitrary code execution in Adobe Media Encoder is possible through an out-of-bounds write triggered when a victim opens a maliciously crafted media file, running attacker code in the context of the current user. The flaw was reported by Adobe and is addressed in advisory APSB26-72; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on user interaction (opening the file) and yields high impact to confidentiality, integrity, and availability.

Arbitrary code execution in Adobe Media Encoder is possible when a victim opens a maliciously crafted media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw is local and requires user interaction, so it is not remotely wormable, but successful exploitation grants full compromise of the user's session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe published advisory APSB26-72 addressing the issue.

Arbitrary code execution in Adobe Media Encoder arises from an out-of-bounds write (CWE-787) that lets a crafted media file corrupt memory and run attacker-controlled code in the context of the current user. Any user who opens a malicious file in the affected desktop application is at risk, with full loss of confidentiality, integrity, and availability on the host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Denial of service in NVIDIA Triton Inference Server for Linux stems from a stack-based buffer overflow (CWE-121) reachable by remote, unauthenticated attackers over the network. Per the CVSS 3.1 vector, exploitation requires no privileges or user interaction and impacts only availability (A:H), with no confidentiality or integrity effect. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.

Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) and .NET Framework (3.5 through 4.8.1) allows a remote, unauthenticated attacker to crash affected applications by triggering a stack-based buffer overflow (CWE-121) over the network. The flaw impacts availability only - there is no confidentiality or integrity loss and no code execution per the CVSS vector (A:H, C:N, I:N). Microsoft has published an advisory with fixes; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Denial of service in Open5GS (open-source 5G/EPC core) through version 2.7.7 lets remote unauthenticated attackers crash the AMF by sending a malformed NAS 5GS mobile-identity information element, triggering a heap out-of-bounds read before authentication completes. Because the AMF handles mobility management for the entire network, a single crafted pre-authentication message can produce a subscriber-wide outage rather than affecting only the sender. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the pre-auth network-reachable nature makes it a high-priority availability issue for anyone running Open5GS in production.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, allowing an attacker to run code in the context of the current user. The flaw is Adobe-reported (advisory APSB26-71) and carries a CVSS 7.8 (High) rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation is local and requires user interaction, weaponization depends on social engineering rather than remote automated attack.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, letting an attacker run code with the privileges of the current user. The CVSS 3.1 base score is 7.8 (local vector, requires user interaction), and no public exploit has been identified at time of analysis. Reported by Adobe via advisory APSB26-71.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the context of the current user when a victim opens a maliciously crafted media/project file. All affected versions covered by Adobe advisory APSB26-71 are impacted, and while no public exploit has been identified at time of analysis, the local attack vector with required user interaction makes it a classic file-format weaponization risk. The CVSS 7.8 (High) reflects full confidentiality, integrity, and availability impact once the file is opened.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, letting an attacker run code in the context of the current user. The flaw was reported by Adobe and is documented in advisory APSB26-71; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation is local and requires user interaction, it is a file-format/client-side memory-corruption issue rather than a remotely-triggerable server flaw.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a maliciously crafted media/project file, letting an attacker run code with the privileges of the current user. Affects Adobe Audition and was reported by Adobe under advisory APSB26-71. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS not provided.

Local information disclosure, data tampering, and denial of service in the BlackBerry QNX Neutrino kernel stems from a stack buffer overflow in the entry handler of the TraceEvent() system call, affecting QNX Software Development Platform, QNX OS for Safety, and QNX OS for Medical. An attacker able to run code on the target can craft malicious TraceEvent() arguments to corrupt kernel stack memory, leaking sensitive kernel data, altering kernel state, or crashing the RTOS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; exploitation is rated high-complexity (AC:H) despite requiring no prior privileges.

Information disclosure in Microsoft Active Directory Federation Services (AD FS) lets an authenticated, network-based attacker read memory outside intended bounds and leak sensitive data, per Microsoft's own report of the flaw (tracked in MSRC as CVE-2026-58529). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H) indicates low-privilege remote exploitation with high confidentiality impact; there is no public exploit identified at time of analysis and it is not on CISA KEV. A vendor patch is available. Note a data discrepancy: the flaw is described as AD FS (a server role) yet the only CPE lists the Windows 11 version 26H1 client - verify affected platforms with Microsoft.

Remote code execution in Microsoft Windows Remote Desktop Protocol allows an unauthorized, unauthenticated network attacker to run arbitrary code by triggering an integer overflow (CWE-190) in RDP processing. The flaw carries a CVSS 9.8 and affects a broad range of Windows client and server builds from Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is a modest 0.78% (52nd percentile), so risk is currently theoretical but severe if weaponized.

Local code execution in Windows Media on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 lets an attacker run arbitrary code by luring a user into opening a maliciously crafted media file. The CVSS 3.1 base score is 7.8 with full confidentiality, integrity, and availability impact but requiring user interaction, and there is no public exploit identified at time of analysis. Microsoft has released a patch via MSRC.

Local privilege escalation in the Microsoft Windows UPnP Device Host service (upnp.dll) lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server 2019-2025 builds. Reported by Microsoft with a patch available, it carries CVSS 7.8 (local, low-complexity, low-privilege). There is no public exploit identified at time of analysis, EPSS is low (0.36%), and CISA SSVC records exploitation as none.

Local privilege escalation in the Microsoft Input Method Editor (IME) component across Windows 10, Windows 11, and Windows Server 2016 through 2025 allows an already-authenticated user to gain SYSTEM-level privileges by triggering a heap-based buffer overflow. The flaw carries a CVSS 7.8 (high) rating with total technical impact, but CISA's SSVC framework marks exploitation as 'none' and non-automatable, and the EPSS probability is low at 0.33% (25th percentile). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Local privilege escalation in the Microsoft Windows Kernel allows an authenticated attacker to elevate to SYSTEM by triggering an integer overflow (CWE-190) in a kernel code path. The flaw affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025). Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and no EPSS or KEV data supplied.

Information disclosure in Microsoft Windows Remote Desktop (RDP) allows a remote, unauthenticated attacker to read out-of-bounds memory over the network, potentially leaking sensitive process data from affected systems. The flaw (CWE-125) affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H1 and Server 2025, and is patched by Microsoft. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with a low EPSS probability (0.89%).

Local privilege escalation in the Windows Bluetooth Service affects a broad range of Microsoft Windows client and server editions (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025). A heap-based buffer overflow (CWE-122) lets an already-authenticated local attacker corrupt kernel/service memory to elevate from a low-privileged account to SYSTEM. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available from Microsoft.

Local code execution in Microsoft Windows' Resilient File System (ReFS) driver lets an attacker run arbitrary code by inducing a victim to mount or open a maliciously crafted ReFS volume. The flaw is a heap-based buffer overflow (CWE-122) in ReFS metadata parsing affecting Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025. CVSS is 7.8 (AV:L/UI:R); there is no public exploit identified at time of analysis and it is not in CISA KEV, so exploitation would require crafting a malicious volume and social-engineering the user to attach it.

Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL2) allows a low-privileged authenticated user on the Windows host to elevate to higher privileges by triggering a buffer over-read (CWE-126). Microsoft (the reporting vendor) has released a fix via MSRC, and there is no public exploit identified at time of analysis. With a CVSS 3.1 base score of 7.8 and full high impact to confidentiality, integrity and availability, it is a meaningful local EoP but requires prior code-execution access on the machine.

Local privilege escalation in Microsoft Windows Routing and Remote Access Service (RRAS) allows an authenticated low-privileged attacker to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.

Remote code execution in Microsoft Windows Media Foundation allows an attacker to run arbitrary code by inducing a victim to open a maliciously crafted media file, exploiting a heap-based buffer overflow (CWE-122). All supported Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 are affected. There is no public exploit identified at time of analysis; EPSS is low (0.83%) and CISA SSVC records exploitation status as none, but the technical impact is total.

Local privilege escalation in the Windows File History Service lets an authenticated, low-privileged attacker corrupt a stack buffer (CWE-121) to run code with elevated (SYSTEM-level) privileges on affected Windows client and server releases. The flaw spans a broad range of supported editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, including Server Core installations. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.

Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated attacker run arbitrary code in the victim's context by delivering a malicious media file or stream that the target opens or plays. The flaw affects the Media Foundation multimedia framework across supported Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025 builds, and carries CVSS 8.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS profile of confidentiality, integrity, and availability all rated High marks this as a high-priority client-side RCE.

Remote code execution in Microsoft Windows Media Foundation allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122) in the media-processing pipeline, per the CVSS:3.1 vector (AV:N/PR:N/UI:N). The flaw affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, with EPSS estimating a modest 0.83% 30-day exploitation probability.

Local privilege escalation in the Windows Network File System (NFS) component allows an authenticated attacker to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122). Reported by Microsoft and affecting a broad range of Windows 10, Windows 11, and Windows Server 2012-2025 releases, with a vendor patch available via MSRC. No public exploit identified at time of analysis, and no CISA KEV listing.

Privilege escalation in the Windows Remote Access Service (RRAS) Infrastructure allows an authenticated attacker to elevate privileges over the network by triggering an integer overflow (CWE-190) in affected code paths. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases (2012 R2 through 2025), and Microsoft has released a patch. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-reachable EoP profile with only low privileges required makes it a meaningful patch priority.

Privilege escalation via a heap-based buffer overflow in the Windows Network File System (NFS) role lets an authenticated, low-privileged network attacker send crafted requests to corrupt server heap memory and gain elevated privileges. Affected systems span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025 wherever the Server for NFS role is present. No public exploit was identified at time of analysis and the flaw is not in CISA KEV, but the 8.8 CVSS with a network-reachable, low-complexity, no-user-interaction profile makes it a meaningful patch priority on NFS hosts.

Local code execution in Microsoft Windows Terminal (shipped on Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025) arises from an integer overflow (CWE-190) that an unauthorized attacker can trigger, but only after luring a logged-on user into interacting with malicious content. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, so this is a defense-in-depth patch rather than an emergency, though the CVSS 7.8 reflects full confidentiality, integrity, and availability impact once triggered. Microsoft has released a patch via the MSRC update guide.

Remote code execution in Microsoft Fabric Data Warehouse allows an authenticated attacker to run arbitrary code over the network by triggering a stack-based buffer overflow (CWE-121). The flaw carries a CVSS 8.8 rating with high impact to confidentiality, integrity, and availability, and requires only low-privilege access with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via MSRC.

Local code execution in Microsoft Windows Media Foundation stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code in the context of the exploiting process across a broad range of Windows client and server builds, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft rates it CVSS 8.4 (AV:L) with total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC marks exploitation as none, while EPSS sits low at 0.48% (38th percentile).

Local privilege escalation in the Windows NTFS file system driver allows an authenticated low-privileged user to gain SYSTEM-level rights by triggering an integer overflow (CWE-190) during filesystem processing. It affects a broad range of supported Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available from Microsoft.

Local privilege escalation in the Windows NTFS driver lets an already-authenticated attacker corrupt heap memory to run code at a higher privilege level (typically SYSTEM) on affected Windows 10, Windows 11, and Windows Server builds. Microsoft reported the issue and has shipped a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 7.8 (AV:L/PR:L) it is a valuable post-compromise pivot rather than an initial-access bug.

Local privilege escalation in the Win32k GRFX subsystem across Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an authenticated low-privileged local attacker elevate to SYSTEM by triggering an out-of-bounds read (CWE-125). The flaw was reported internally by Microsoft, a vendor patch is available via MSRC, and there is no public exploit identified at time of analysis. CVSS is 7.8 (High), reflecting a local vector with low complexity and low privileges required.

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122) in the service's packet handling. The flaw carries a CVSS 9.8 with a fully remote, no-interaction, no-privilege vector and affects Windows Server 2012 through 2025 (plus the Windows 10 1607/1809 code base). At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, but the unauthenticated network-facing nature of the DHCP service makes it a high-priority patch.

Local code execution in Microsoft Office Excel (across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS counterparts) arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted spreadsheet. An unauthorized attacker can achieve arbitrary code execution in the context of the current user, gaining high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available from Microsoft.

Local code execution in Microsoft Excel (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) allows an attacker to run arbitrary code when a victim opens a maliciously crafted spreadsheet. The flaw is a heap-based buffer overflow (CWE-122) triggered during file parsing, giving full confidentiality, integrity, and availability impact in the user's context. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation currently appears theoretical rather than active.

Information disclosure in Microsoft Excel (across Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds heap memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process memory. The flaw (CWE-125, CVSS 7.1) requires local user interaction and no privileges, but is not remotely triggerable without the user opening the file. There is no public exploit identified at time of analysis, EPSS is low at 0.30%, and CISA SSVC rates exploitation as none.

Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted presentation file. An attacker who cannot log in to the target can still run code in the context of the current user by convincing that user to open the booby-trapped file, giving full confidentiality, integrity, and availability impact on the affected host. Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and their macOS variants) arises from a heap-based buffer overflow triggered when a victim opens a maliciously crafted presentation file. Successful exploitation runs attacker-controlled code with the privileges of the current user, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Microsoft has released a patch.

Local code execution in Microsoft Office OneNote (Microsoft 365 Apps for Enterprise and Office for Mac editions) arises from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code in the context of the current user when a victim opens a maliciously crafted OneNote file. The CVSS 3.1 score is 7.8 with a local attack vector requiring user interaction (AV:L/UI:R), and impact is total across confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and CISA SSVC lists exploitation status as none.

Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker run arbitrary code when a victim opens a maliciously crafted presentation file. The flaw affects a broad Office footprint - PowerPoint 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and multiple Office for Mac builds - and requires user interaction (opening the file) but no prior privileges. A vendor patch is available via MSRC; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-based buffer overflow triggered when a victim opens a maliciously crafted document. An attacker who convinces a user to open a booby-trapped file can run arbitrary code in that user's context, achieving full compromise of confidentiality, integrity, and availability on the host. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, though a vendor patch is available per Microsoft's MSRC advisory.

Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps for Enterprise, and Office for Mac) arises from a heap-based buffer overflow (CWE-122) that an attacker triggers by getting a victim to open a maliciously crafted Office document. Rated CVSS 7.8 with high impact to confidentiality, integrity, and availability, exploitation requires user interaction but no prior authentication or privileges. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but Microsoft has released a patch via the MSRC update guide.

Local code execution in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, LTSC 2021/2024, and Office for Mac) arises from a heap-based buffer overflow (CWE-122) that an attacker triggers by convincing a user to open a maliciously crafted document. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R) with high impact to confidentiality, integrity, and availability, meaning code runs in the context of the current user. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available via MSRC.

Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS builds) arises from a stack-based buffer overflow triggered when a victim opens a maliciously crafted document. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows an unauthenticated attacker needs no privileges but does require user interaction, and successful exploitation yields full confidentiality, integrity, and availability impact in the user's security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.

Arbitrary code execution in Microsoft Office Excel arises from a heap-based buffer overflow (CWE-122) that an attacker triggers when a victim opens a maliciously crafted spreadsheet, running code in the security context of the current user. The flaw spans a broad Office footprint including Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021/2024, the macOS Office editions, and Office Online Server. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 7.8 rating reflects high impact gated by required user interaction.

Information disclosure in Microsoft Office Excel (2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) lets an attacker read out-of-bounds memory when a victim opens a maliciously crafted spreadsheet, potentially leaking sensitive process data such as memory contents, pointers, or credentials. Rated CVSS 7.1 with a local attack vector requiring user interaction, the flaw stems from a CWE-125 out-of-bounds read in Excel's file parser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of Excel and Microsoft's confirmed patch make prompt patching important.