Buffer Overflow

Local privilege escalation in the winsqlite3 SQLite component bundled with Windows lets an authenticated low-privileged user on an affected host leverage an out-of-bounds read (CWE-125) to elevate to higher privileges, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because winsqlite3 is a default, always-present core Windows component, no special configuration is required, but the attack is strictly local - the attacker must already be able to execute code or interact with the SQLite library on the machine, so this is a post-compromise escalation rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), and a vendor patch is available from Microsoft.

A heap-based buffer overflow in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated attacker positioned on the same adjacent network segment to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server hosts. The assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects total loss of confidentiality, integrity, and availability if exploitation succeeds, but high attack complexity and the adjacency prerequisite mean exploitation depends on favorable heap layout/memory-grooming conditions and cannot be reliably automated (SSVC Exploitation: none, Automatable: no). There is no public exploit identified at time of analysis and no evidence of active exploitation; a vendor patch is available from Microsoft, making timely but non-emergency patching the appropriate response.

Remote code execution in Windows iSCSI allows an unauthenticated, network-positioned attacker to trigger an out-of-bounds write and potentially achieve full compromise of confidentiality, integrity, and availability. The vulnerability affects many Windows client and server versions (Windows 10, 11, and Windows Server 2012 through 2025), but exploitation requires the iSCSI service to be enabled and reachable; hosts without that service are not exposed. No public exploit has been identified at time of analysis, though the CISA SSVC framework rates the technical impact as total and the issue as automatable, and a vendor patch is available.

Remote code execution in Windows Libarchive (CVE-2026-69639) affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core installations) at build levels below their fixed revisions, allowing an unauthenticated attacker to corrupt the heap and execute code in the context of whatever process parses a malformed archive. Microsoft scores it 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and has released a patch, and CISA's SSVC evaluation records no observed exploitation, with no public exploit code identified at time of analysis - making this a high-priority but not yet emergency patching item whose real-world severity hinges on whether the affected host exposes a network-reachable, automatic archive-parsing path.

Remote unauthenticated code execution in the Windows iSCSI service (CVE-2026-69634) allows an attacker who can reach the service over the network to trigger a heap-based buffer overflow and run code in the context of the affected Windows component, with full confidentiality, integrity, and availability impact per Microsoft's CVSS 3.1 rating of 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects a wide spread of Windows client and server releases, including Windows 10, Windows 11 23H2 through 26H2, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, so mitigation coverage must span legacy and current builds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal is present in the supplied intelligence; the practical risk is concentrated on storage-connected hosts where iSCSI is enabled and reachable from untrusted network segments, since the service is not enabled by default on typical workstations. Vendor patches are available per Microsoft's advisory, and the fixed builds are enumerated below.

Local privilege escalation in the Windows Update component of default Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 installations lets an attacker who already holds low-privileged local access on a host corrupt heap memory and, per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector, obtain high confidentiality, integrity, and availability impact at a higher privilege context. Exploitation requires the attacker to already possess local, low-privileged authenticated access (PR:L, AV:L) and no user interaction (UI:N); the flaw cannot be reached remotely or by an unauthenticated actor, so it functions as a post-compromise privilege-escalation primitive rather than an initial-access vector. Vendor patches are available from Microsoft and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Unauthenticated remote attackers can disclose sensitive memory contents from Microsoft Azure Attestation and the Windows Server Device Health Attestation Service through an out-of-bounds read (CWE-125) triggered by a crafted request to an exposed attestation endpoint, rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The practical exposure is limited: on-premises Device Health Attestation is an optional Windows Server role, so only hosts where it is enabled and network-reachable are at risk, specifically Windows Server 2019 before 10.0.17763.9376, Windows Server 2022 before 10.0.20348.5761, and Windows Server 2025 before 10.0.26100.33650. Impact is confined to information disclosure with high confidentiality loss and no integrity or availability effect, and no public exploit code or confirmed active exploitation has been identified at time of analysis.

Integer overflow in the Windows iSCSI implementation can lead to memory corruption and remote code execution on an affected host, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack requires user interaction: the victim host must initiate or process a connection to an attacker-controlled iSCSI target or portal so that a crafted iSCSI response reaches the vulnerable parser - no prior authentication is required (PR:N), but the victim must be using the iSCSI initiator/service path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is the reporting and advisory source (MSRC update guide). The practical limiting factor is the need for a victim to engage a hostile iSCSI endpoint, which makes this a serious, high-priority but not automatic-emergency issue.

Heap-based buffer overflow in the Microsoft Windows Installer service allows an authenticated, low-privileged local user to elevate to full SYSTEM privileges on unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 hosts (CVSS 7.8, CWE-122). Exploitation requires the attacker to already hold valid local access and to invoke an MSI/msiexec installer operation that reaches the vulnerable heap-handling code path, so there is no remote or network-facing exposure; CISA SSVC records Exploitation as none and no public exploit was identified at time of analysis. Microsoft has released vendor patches, so residual risk is concentrated on systems still below the fixed build numbers listed in the Microsoft advisory.

Information disclosure in the Microsoft Azure Attestation service and the Device Health Attestation Service on Windows Server lets an unauthenticated remote attacker read out-of-bounds memory (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), leaking data processed by the attestation stack. No privileges or user interaction are required, but reachability is limited to hosts that actually run and network-expose the attestation endpoint; affected builds are Windows Server 2019 below 10.0.17763.9376, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2025 below 10.0.26100.33650, including Server Core installations. There is no public exploit identified at time of analysis, vendor patches are available, and impact is confined to confidentiality with no integrity or availability effect.

Heap-based buffer overflow in Windows Error Reporting (WER) lets an authenticated attacker who already holds a low-privilege foothold - and who can induce a victim to interact with the vulnerable reporting path - corrupt heap memory and elevate privileges, with high impact to confidentiality, integrity and availability. The 8.0 score is driven by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, so this is explicitly not an unauthenticated, no-interaction remote takeover: a prior foothold (PR:L) and user action (UI:R) are both required. Microsoft has shipped fixed builds and CISA's SSVC assessment records Exploitation: none and Automatable: no, so no public exploit has been identified at time of analysis; this is a moderately serious but not top-tier emergency, and the practical risk is further dampened by the mandatory existing authentication and the required user interaction.

Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an authenticated, low-privileged attacker who already has access to an affected Windows host to trigger a heap-based buffer overflow and elevate privileges. The vulnerability affects numerous unpatched Windows 10, Windows 11, and Windows Server builds and carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, CISA SSVC lists exploitation as none, and our independent assessment rates this as a credible second-tier priority because exploitation requires a pre-existing local foothold.

Heap-based buffer overflow in the Windows Graphics/Fonts subsystem (CVE-2026-69326) lets remote attackers execute arbitrary code on affected Windows client and server systems when a victim opens or renders content containing a malformed embedded font. All Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the advisory are affected, and the vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a total technical impact rating under CISA's SSVC framework. Exploitation is gated by mandatory user interaction - there is no unattended or server-side trigger - and there is no public exploit identified at time of analysis and no CISA KEV listing, so while severity signals are consistent, urgency signals diverge.

Local privilege escalation in Microsoft Windows kernel32.dll lets an authenticated attacker with standard user rights trigger a heap-based buffer overflow (CWE-122) and gain code execution at SYSTEM level. Scoring 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires an existing foothold on the host but no user interaction, making it a dependable post-compromise escalation primitive rather than a remote entry point; no special non-default feature must be enabled since the flaw sits in a core DLL present on every affected build. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server versions tracked under EUVD-2026-99269.

Local privilege escalation in the Windows VHD Miniport Driver allows an authenticated attacker with low privileges to gain full system control by triggering a heap-based buffer overflow. The vulnerability is locally exploitable and requires high attack complexity (AC:H), indicating a race condition or precise heap grooming is necessary for successful exploitation. No public exploit code has been identified, and the EPSS score is not available; however, a vendor patch is available via Microsoft's security update guide.

Heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an authorized, authenticated attacker (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N, base score 8.8) to deliver crafted PostScript content over a network path the driver processes and achieve code execution with high confidentiality, integrity, and availability impact. The driver ships by default with supported Windows 10, Windows 11 (22H2 through 26H2), and Windows Server 2012 through 2025 builds enumerated in the EUVD data, so exposure is broad, but exploitation is gated on the attacker already holding valid credentials on the target or a system in the print path; no user interaction is required (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and the assessed technical impact is total, making this a serious but not emergency-tier issue that should be remediated on a normal patch cadence.

Memory corruption in the Microsoft Windows PDF rendering component allows an unauthenticated remote attacker to execute arbitrary code on unpatched Windows 10, Windows 11, and Windows Server systems by supplying a crafted PDF document, resulting in total loss of confidentiality, integrity, and availability (CVSS 8.1, CWE-787). Exploitation is not confirmed as active: the CISA SSVC assessment records exploitation as 'none' and no public exploit has been identified, while the high attack complexity (AC:H) and SSVC Automatable=no reflect the heap-layout manipulation normally required to turn the out-of-bounds write into reliable code execution. Vendor patches are available, so the residual risk is concentrated in systems that have not yet applied the current cumulative updates - the assessed vector (PR:N/UI:N) implies a parsing path that may not require an explicit user action, but that precondition should be verified with Microsoft before treating the issue as fully drive-by.

Remote code execution in Microsoft's HEVC Video Extensions codecs allows an unauthenticated attacker to run arbitrary code on a Windows host when a victim opens or previews a maliciously crafted HEVC-encoded media file. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CVSS 8.8), no credentials are needed, but exploitation is not automatable because it hinges on user interaction (UI:R) and on the optional HEVC codec being installed - it is not present on every Windows system, though it ships preinstalled on many OEM devices, which narrows the exposed population. At time of analysis there is no KEV entry and no public exploit identified, so this is a credible, moderately high priority issue rather than a drop-everything emergency; the CWE-190 integer overflow/wraparound in Windows Codecs Library parsing corrupts memory in a way that can be turned into code execution.

Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.

Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an attacker who already holds authenticated, low-privilege code execution on a host to corrupt heap memory inside a highly privileged VBS component and elevate to full machine control (CVSS 7.8, C:H/I:H/A:H). Only unpatched Windows 11 24H2/25H2/26H1/26H2 builds and Windows Server 2025 (including Server Core) below the vendor's fixed build numbers are affected, and exploitation requires local access (AV:L) with low privileges (PR:L) and no user interaction (UI:N). No public exploit code has been identified at time of analysis and CISA SSVC records no known exploitation, making this a credible but not emergency-tier priority; Microsoft has released patched builds, so remediation is straightforward for managed fleets.

An out-of-bounds write (CWE-787) in Adobe FrameMaker allows an attacker to corrupt memory and potentially execute arbitrary code with the privileges of the user who opens a maliciously crafted document. Affected builds are FrameMaker 2026 at or below 18.0.0.206 and FrameMaker 2022 at or below 17.0.9.866. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) confirms there is no network or unauthenticated trigger: exploitation depends on social engineering a victim into opening a booby-trapped file, and any code that runs is confined to the current user's rights with no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a credible but not emergency-tier patching priority.

Local privilege escalation in Microsoft Sysinternals allows an authenticated low-privileged attacker to elevate privileges by exploiting a stack-based buffer overflow, requiring user interaction. The vulnerability has a CVSS 3.1 base score of 7.3 (High). No public exploit code or active exploitation has been identified at time of analysis.

Out-of-bounds read in Microsoft Excel allows a remote, unauthenticated attacker to execute arbitrary code when a victim opens a maliciously crafted spreadsheet. The vulnerability requires user interaction (CVSS UI:R) and stems from improper input validation (CWE-20); successful exploitation can fully compromise confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the high CVSS score (8.8) and the lack of a confirmed fixed version in the provided data make this a high-priority patching item.

Heap-based buffer overflow in Microsoft Access lets an attacker execute arbitrary code at the privilege level of a user who opens a specially crafted Access database file, scoring CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No credentials or target-side configuration are needed, but the attack chain depends on the victim opening or interacting with the malicious file (UI:R), making file delivery and social engineering the main barrier; Microsoft has published a fix via its update-guide advisory. There is no CISA KEV entry and no public exploit identified at time of analysis, though the high impact across confidentiality, integrity and availability makes prompt patching a genuine priority.

Heap-based buffer overflow in Microsoft Office Access allows remote code execution when a victim opens a malicious, attacker-crafted Access file such as an .accdb or .mdb database or an embedded object. Affected users are those with Access installed on the target host: no authentication to the system is required (PR:N) and attack complexity is low (AC:L), but exploitation is gated by the mandatory victim interaction (UI:R) of opening the crafted file, and any code executes only with the opening user's privileges (S:U). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the MSRC advisory is the authoritative reference, and CVSS 8.8 reflects high confidentiality, integrity, and availability impact, making this a credible operational priority rather than a drop-everything emergency.

Integer overflow (CWE-190) in Microsoft Word's document parsing can allow an unauthenticated, network-delivered attacker to execute code in the context of the victim by convincing them to open a specially crafted Word document. Exploitation requires user interaction (UI:R) and high attack complexity (AC:H), and impact is confined to the user's Word process (scope unchanged). No public exploit identified at time of analysis, making this a moderately high but not top-tier priority for most organizations.

Heap-based buffer overflow in Microsoft Access enables unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted database file. Exploitation is non-trivial due to high attack complexity (AC:H) and requires user interaction (UI:R), but successful exploitation grants code execution with the user's privileges. No public exploit code has been identified at time of analysis, and a vendor patch is available via the Microsoft Security Response Center.

Heap-based buffer overflow in Microsoft PowerPoint allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted presentation file, but exploitation requires user interaction and reliable heap corruption against modern memory-safety mitigations (AC:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the risk is considered moderate-to-high due to the social engineering delivery and Protected View defenses that can impede successful attacks. This vulnerability affects Microsoft Office PowerPoint installations that have not received the update referenced in the Microsoft Security Update Guide.

Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a victim opens a specially crafted Access database file, with an attacker needing no credentials but depending on user interaction to trigger the flaw. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning successful exploitation yields full loss of confidentiality, integrity, and availability within the Access process context, though the mandatory opening of the malicious file limits automated, hands-off exploitation. Based on available intelligence, no public exploit identified at time of analysis and EPSS scoring was not supplied; the entry appears only in the Microsoft Security Response Center update guide, and no CISA KEV listing or other exploitation signal is present.

Heap-based buffer overflow in Microsoft Office Access lets unauthenticated remote attackers execute arbitrary code in the context of the user who opens a specially crafted Access database (.accdb/.mdb) file. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms that no credentials are required and attack complexity is low, but the mandatory user interaction (UI:R) - typically a phishing attachment, download, or shared file - is the gating factor that prevents automated, widespread exploitation; code runs only with the privileges of the user who opened the file. There is confirmed KEV? no - no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so this is a credible, patchable priority rather than an actively exploited emergency.

Remote code execution in Microsoft Office Access occurs when a victim opens an attacker-supplied, specially crafted Access database file that triggers a heap-based buffer overflow during file parsing (CWE-122). The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): it is network-deliverable, low-complexity and needs no authentication, but is gated entirely by the requirement that a user open the malicious document, and scope is unchanged so code runs in the victim's user context rather than granting system-wide control. No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.

Microsoft Access (part of Microsoft Office) contains an out-of-bounds read (CWE-125) that can be exploited to execute arbitrary code when a victim opens a specially crafted database file. The CVSS vector (8.8, AV:N/AC:L/PR:N/UI:R) indicates that unauthenticated remote attackers can achieve high confidentiality, integrity, and availability impact, but the required user interaction makes this a serious yet not top-tier emergency. No public exploit code or active exploitation has been identified at time of analysis.

Heap-based buffer overflow in Microsoft Access allows unauthenticated remote attackers to execute code when a victim opens a maliciously crafted Access database, scoring CVSS 8.8. Exploitation requires user interaction (UI:R), so there is no zero-click or server-side vector, and code runs in the context of the user who opens the file, limiting immediate blast radius. No public exploit identified at time of analysis; this is serious but not emergency-tier because the victim must open the attacker-supplied file.

Heap-based buffer overflow in Microsoft Office Access allows an unauthenticated remote attacker to execute code in the security context of the user who opens a specially crafted Access database file. Exploitation is not autonomous despite the AV:N vector: the attacker must deliver the malformed file and persuade the victim to open it (UI:R), and reliable code execution further depends on heap-layout grooming to control the corrupted allocation (AC:H), so any code that runs inherits only the opening user's privileges (S:U). No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the assessed risk is mixed-priority given the mandatory user interaction and high attack complexity.

Heap-based buffer overflow in Microsoft Office Access allows unauthenticated remote attackers to execute arbitrary code when a victim opens a maliciously crafted Access database file. The vulnerability requires user interaction (UI:R) but no authentication (PR:N), and successful exploitation grants code execution with the privileges of the current user (S:U). No public exploit code or active exploitation has been identified at time of analysis; however, the high CVSS score (8.8) and low attack complexity make this a significant risk for organizations using affected Access versions.

Remote code execution in Microsoft QUIC (msquic) allows unauthenticated network attackers to execute arbitrary code via a heap-based buffer overflow (CWE-122). Per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, no authentication or user interaction is required, and the flaw carries full confidentiality, integrity, and availability impact (base score 9.8). Only hosts exposing a QUIC/HTTP-3 or SMB-over-QUIC listener over UDP (typically port 443) are affected, and successful exploitation depends on defeating standard heap and control-flow mitigations; no public exploit has been identified at time of analysis.

Elevation of privilege in Windows NDIS (ndis.sys) allows a local authenticated user to run processes in an elevated context by exploiting an out-of-bounds read caused by a missing buffer-length check. The vulnerability affects all Windows systems with the default NDIS driver, requiring the attacker to already have local access and the ability to execute a malicious application. No public exploit code has been identified at time of analysis, and Microsoft has released a security update to address the flaw.

Remote code execution in Windows Schannel can be triggered by unauthenticated attackers who can reach a TLS/SSL service that relies on Schannel-such as RDP with TLS, IIS HTTPS, LDAPS, or EAP/TLS endpoints-by sending crafted handshake data that causes an out-of-bounds write (CWE-787). The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact, meaning no authentication or user interaction is required, but successful exploitation is constrained by high attack complexity and dependence on specific memory state, likely requiring heap grooming or repeated attempts. No public exploit identified at time of analysis, and no CISA KEV active exploitation is indicated in the provided data.

Local privilege escalation in the Windows Overlay Filter (wof.sys) driver on affected Windows systems allows an authenticated attacker with low-privileged code execution to trigger an out-of-bounds read (CWE-125) and elevate privileges to a higher integrity level. The flaw is rated CVSS 7.8 (High) and requires no user interaction (UI:N), but the attacker must already have a local foothold (PR:L, AV:L). No public exploit code or active exploitation has been identified at time of analysis; a vendor advisory is available via the Microsoft Security Response Center.

Heap-based buffer overflow in the Windows HID class driver allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM by sending crafted HID input, with a CVSS 3.1 base score of 7.8. The flaw requires local access (PR:L) and cannot be triggered remotely, and no public exploit code or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft Security Response Center advisory.

Arbitrary code execution in Adobe FrameMaker is possible via a heap-based buffer overflow (CWE-122) that is triggered when the victim opens a specially crafted file. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (score 7.8) indicates the flaw is local to the desktop application, requires user interaction, needs no prior authentication, and gives the attacker only the privileges of the user who opens the document. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the main risk is social engineering against FrameMaker users.

Out-of-bounds write in Adobe FrameMaker allows arbitrary code execution in the context of the current user when a victim opens an attacker-crafted document. Rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787), the flaw is reached locally and requires user interaction, so exploitation depends on social engineering to deliver a malicious file that the target then opens; no authentication is required of the attacker and no non-default configuration is implicated, meaning any installation that opens the file is affected. Impact is bounded by the privileges of the user running FrameMaker (S:U), and there is no public exploit code or confirmed active exploitation identified at time of analysis.

Heap-based buffer overflow in Adobe FrameMaker (CWE-122) lets an attacker achieve arbitrary code execution in the context of the user who opens a crafted FrameMaker document. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no prior authentication or privileges are needed, but exploitation depends on the victim opening an attacker-supplied file, and code runs only with that user's rights due to unchanged scope. Impact is therefore bounded by the victim's privilege level and by successful social engineering; there is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited.

An out-of-bounds write (CWE-787) in Adobe FrameMaker allows arbitrary code execution in the context of the current user when a victim opens a crafted FrameMaker document. Exploitation is file-based and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 7.8 HIGH): the attacker must socially engineer the target into opening malicious content, and the resulting code runs with only that user's privileges rather than gaining system-level control. No confirmed active exploitation or publicly available exploit code was identified at time of analysis, but the full confidentiality, integrity, and availability impact makes prompt patching important for engineering and technical-publishing environments that routinely exchange FrameMaker files.

Heap-based buffer overflow in Adobe FrameMaker enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted file. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) confirms the attack is local and requires user interaction, with no privileges needed to trigger the flaw but no remote or automatable path either. No public exploit was identified at time of analysis, exploitation is bounded to systems where FrameMaker is installed and used to open untrusted documents, and code runs only with the current user's privileges - there is no automatic elevation of privilege.

Information disclosure in Microsoft Windows IKE Extension (IKEEXT) allows a remote, unauthenticated attacker to send crafted IKE/IPsec traffic to UDP ports 500 or 4500 and trigger an out-of-bounds read that may disclose memory contents. The flaw is rated CVSS 7.5 HIGH with high confidentiality impact and no integrity or availability impact; the principal exposure requirement is that the target Windows host processes inbound IKE/IPsec traffic. No public exploit code or confirmed active exploitation is identified in the provided data, so no public exploit identified at time of analysis.

Local privilege escalation in Windows Credential Providers allows an attacker who already holds authenticated low-privileged access on a host to trigger a race condition in concurrently accessed shared resources and escalate privileges. Exploitation is complicated by a high attack-complexity rating (AC:H) - the attacker must repeatedly invoke the credential provider code path and win a narrow, non-deterministic timing window, so success is probabilistic rather than reliable. There is no remote or unauthenticated vector and no user-interaction requirement (AV:L, PR:L, UI:N, S:C), and no public exploit code or confirmed active exploitation was identified at time of analysis; risk is concentrated on multi-user, shared, or already-foothold Windows systems rather than single-user desktops without untrusted local access.

Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an attacker who already holds a low-privileged local account corrupt kernel heap memory and potentially elevate to SYSTEM. The defect is a heap-based buffer overflow (CWE-122) reachable by submitting I/O to the VHD storage stack, and with a CVSS 3.1 base score of 7.0 and High attack complexity (AC:H), reliable exploitation usually depends on heap-layout grooming or winning a timing window rather than a single deterministic request. Microsoft is the reporting vendor and no public exploit code or confirmed active exploitation has been identified at time of analysis; this is best treated as a moderate-priority local privilege escalation, not an emergency remote threat.

Local privilege escalation in the Windows Partition Management Driver lets an already-authorized, low-privileged user who can execute code on the host elevate privileges by triggering an out-of-bounds read against malformed partition-related structures handled by the kernel driver. Microsoft rates it CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with a CWE-125 root cause, and because the driver is a standard in-box Windows component, default installations are affected with no non-default configuration required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limiter is the prerequisite local foothold, making this a credible, patch-worthy privilege-escalation building block rather than an emergency or an initial-access vector.

Heap-based buffer overflow in Microsoft OneNote allows unauthenticated remote attackers to execute arbitrary code in the security context of the user who opens a crafted OneNote file, rated CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Exploitation is not zero-click: per the UI:R component of the assessed vector, the victim must open or preview an attacker-supplied OneNote/Office document delivered by email, web, or file share, and code then runs with that user's privileges without scope change (S:U), so no inherent privilege escalation is provided. No public exploit identified at time of analysis and the CVE is not in CISA KEV; no EPSS score was supplied in the available data.

Heap-based buffer overflow in Microsoft Office Visio enables remote code execution when a victim opens a maliciously crafted Visio drawing file (CVSS 8.8, CWE-122). The attack is unauthenticated (PR:N) and remotely deliverable (AV:N), but requires user interaction (UI:R): the target must have the separately licensed Visio application installed and must be persuaded to open the attacker-supplied file, typically delivered by phishing email or a hosted download. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; real-world risk is materially reduced by Protected View, Mark-of-the-Web, attachment blocking, and the fact that Visio is not present in most Office installations.

Heap-based buffer overflow in Microsoft Visio allows remote, unauthenticated attackers to execute arbitrary code in the context of the user who opens a specially crafted Visio document. Exploitation is not zero-click: it requires user interaction (UI:R), with the malicious file typically delivered as an email attachment or download link that the victim must open, and no credentials or special target-side configuration are needed (PR:N). No public exploit code or confirmed active exploitation is identified in the available data, no EPSS score was supplied, and Microsoft's MSRC Update Guide is the authoritative reference for fixes.

Heap-based buffer overflow in Microsoft Office Access allows an unauthenticated remote attacker to execute arbitrary code in the security context of the user who opens a crafted Access database file. Exploitation is gated by user interaction (UI:R) - the victim must open an attacker-supplied file delivered by email, web download, or shared location - with low attack complexity (AC:L) and no credentials required from the attacker (PR:N), and code runs as the invoking user rather than as SYSTEM. Rated 8.8 (C:H/I:H/A:H); no public exploit code and no confirmed active exploitation were identified at time of analysis, and environments that do not install or use Access are not exposed.

Remote code execution in Microsoft Access is possible when a user opens a specially crafted Access file, exploiting a heap-based buffer overflow (CWE-122) to let an unauthenticated attacker execute code in the context of the victim. Affected are systems with Microsoft Access installed; the attack requires user interaction (UI:R in the CVSS vector) and no public exploit code or confirmed active exploitation is identified at time of analysis, though the vendor advisory should be consulted for updates.

Heap-based buffer overflow in Windows Resilient File System (ReFS) enables a locally authenticated low-privileged attacker to execute arbitrary code with elevated privileges when a ReFS volume is mounted or parsed. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior local access to the target Windows host; it is not remotely exploitable, and exploitation depends on ReFS being in use, which is common on Windows Server storage, Storage Spaces, and Hyper-V/backup deployments but not default NTFS-only endpoints. At time of analysis, no public exploit code or confirmed active exploitation (CISA KEV) has been identified; EPSS data is not provided.

Out-of-bounds read in Windows Text Shaping allows a remote, unauthenticated attacker to execute code on affected Windows systems when a victim opens or renders attacker-controlled content (UI:R), such as a document, web page, email, or font. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but with a CVSS score of 8.8 and high impact to confidentiality, integrity, and availability, it represents a credible high-priority risk that is not a top-of-queue emergency on current signals.

Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker with existing low-privileged execution to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122) while the driver parses a crafted UDF volume, such as a malicious ISO image or optical/removable disk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the local prerequisite and high confidentiality, integrity, and availability impact, while requiring no separate victim interaction. No public exploit code has been identified at time of analysis, and a vendor advisory is available through the Microsoft Security Response Center.

Local privilege escalation in the Windows Universal Disk Format (UDFS) file system driver allows an authenticated, low-privileged attacker to corrupt kernel heap memory and elevate to SYSTEM by having the driver parse an attacker-controlled UDF volume. The defect is a heap-based buffer overflow (CWE-122) triggered when the driver processes a crafted UDF image - such as a malicious ISO, optical disc, or USB/removable media image - that is mounted or opened; no additional user interaction is required once the volume is presented (UI:N) and attack complexity is low (AC:L). Exploitation is not confirmed in the wild: no public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score of 7.8 reflects the local, low-privilege prerequisite (AV:L/PR:L) combined with full confidentiality, integrity, and availability impact.

Heap-based buffer overflow in the Windows Text Shaping (DirectWrite text-layout and font-rendering) component allows unauthenticated remote code execution, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-122. Per the assessed vector, the flaw is network-reachable and requires no authentication and no user interaction, so any default Windows system that passes attacker-controlled text or font data into the affected text-shaping path can be at risk of full loss of confidentiality, integrity, and availability through code execution in the target process. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was provided; however, given the unauthenticated network vector, this is a genuinely high-priority issue that should be patched urgently. The vendor advisory is the Microsoft MSRC update guide entry for CVE-2026-102210.

Local privilege escalation in the Microsoft Graphics Component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a heap-based buffer overflow and gain full control over confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected machine. The flaw is exploitable only from the local attack vector (AV:L) by an authenticated low-privileged principal (PR:L) with no user interaction required (UI:N), and the high attack complexity (AC:H) means success depends on winning a race or precisely grooming the heap layout, making exploitation non-deterministic rather than reliable. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it is primarily a post-compromise escalation primitive rather than a remote entry point.

Local privilege escalation in the Windows Universal Disk Format File System Driver (udfs.sys) allows an attacker with low-privileged local credentials to gain SYSTEM-level rights by triggering a heap-based buffer overflow when the driver parses a maliciously crafted UDF volume. The attacker must mount a rogue disk, ISO image, or removable media formatted with UDF; no user interaction by a victim is required. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited.

Local privilege escalation in the Windows Storage component lets an authenticated, low-privileged user already running code on a Windows host drive a heap-based buffer overflow to gain high-integrity (SYSTEM-level) privileges. Exploitation is not remote: it requires an existing local session (CVSS AV:L, PR:L) and no user interaction (UI:N), but the high attack complexity (AC:H) means the attacker must win a non-deterministic heap-layout or timing condition, which makes reliable weaponization harder than a typical PR:L/AC:L elevation-of-privilege bug. At the time of analysis there is no public exploit identified, no EPSS or KEV signal in the provided intelligence, and the authoritative source for fixed builds is the Microsoft MSRC update guide; the moderate-priority character of this issue reflects that prior host access is a hard prerequisite and success is probabilistic.

Heap-based buffer overflow in the Windows Storage subsystem (CWE-122) allows an authenticated local attacker holding low privileges to elevate to a higher-privileged context on the affected host. The CVSS vector (AV:L/AC:H/PR:L/UI:N) and the assessment confirm the attacker must already be able to execute code locally and that exploitation is gated by high complexity, most likely a race condition or a carefully groomed heap layout, making success unreliable rather than repeatable. This is a moderate-priority local privilege-escalation issue rather than a remote emergency; no public exploit identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV). The supplied data does not enumerate affected Windows builds, so the MSRC update guide must be consulted for the precise vulnerable and fixed versions.

Local privilege escalation in Microsoft's Windows Storage component allows an attacker who already holds authenticated, low-privileged local access to trigger a heap-based buffer overflow and obtain elevated rights on the affected host. Exploitation is gated by High attack complexity (AC:H), meaning success depends on controlling heap layout or allocation state rather than being deterministic, so this is best treated as a second-stage escalation primitive following an initial compromise rather than an easily weaponized or remotely reachable bug. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).

Unauthenticated remote code execution affects Microsoft's Network Policy Server (NPS), the Windows RADIUS role, through a heap-based buffer overflow in the code path that parses incoming authentication requests. With a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), any host that can reach the NPS listener can attempt to corrupt heap memory and achieve code execution at the service's privilege level, with no credentials or user interaction required. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the practical barrier to exploitation is low wherever the role is installed and reachable, so exposure should be treated as the primary risk factor.

Heap-based buffer overflow in the Windows Media Video Decoder allows remote, unauthenticated attackers to achieve code execution when a victim opens or renders a specially crafted Windows Media Video file. Exploitation is gated by the user-interaction requirement (CVSS UI:R) - the decoder is a standard, default-installed Windows component with no special configuration needed, so the realistic risk is bounded by delivery and social-engineering success rather than by access controls. No public exploit code or evidence of active exploitation has been identified at time of analysis (no CISA KEV listing), and no EPSS score was supplied; the overflow yields full confidentiality, integrity, and availability impact (CVSS 8.8) if triggered successfully.

Local privilege escalation in Microsoft's Windows Storage component allows an authenticated attacker who already holds low-level privileges on the host to trigger a stack-based buffer overflow and gain elevated (likely SYSTEM-level) code execution. The vulnerability is not remotely reachable and requires no user interaction, but the high attack complexity (AC:H) means exploitation likely depends on winning a race or achieving a precise memory state, so it is harder to weaponize than the 7.0 base score suggests. No public exploit code has been identified and it is not listed in CISA KEV; this is an escalation-from-foothold primitive rather than an initial-access vector, making it a moderate-priority local privilege escalation for patching rather than a top-tier emergency.

Local code execution in Microsoft Graphics Component is enabled by a heap-based buffer overflow, triggered when a user opens or renders an attacker-supplied image or document; the attack vector is local (AV:L) and requires user interaction (UI:R), with no authentication required of the attacker (PR:N). Successful exploitation runs in the context of the user who opened the file, so a low-privilege victim limits immediate impact to that account unless chained with a separate privilege-escalation exploit. No public exploit identified at time of analysis, and the provided data does not indicate CISA KEV active exploitation; this is a genuine patch-priority issue despite not being the maximum-severity class.

Heap-based buffer overflow in Microsoft Excel enables an unauthenticated, remote attacker to execute arbitrary code in the context of the victim user, provided the victim opens or previews a specially crafted Excel workbook (CVSS 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation depends on social engineering to deliver the malicious file, and default Office protections such as Protected View and Mark-of-the-Web meaningfully reduce real-world risk. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and signals are moderately strong but not top-tier urgent.

Local privilege escalation in the Microsoft Windows Update Service allows an attacker who already holds a low-privileged, authenticated local account to trigger a heap-based buffer overflow and corrupt memory in a service that runs with high privileges, potentially yielding full control of confidentiality, integrity and availability on the host (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the service listens on no network interface for this issue, exploitation requires an existing local foothold rather than remote access, and the High attack-complexity rating indicates a real reliability barrier - most likely a timing window or a specific heap layout that must be won before corruption succeeds. No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied, so this should be treated as a post-compromise escalation primitive rather than an opportunistic remote threat.

Local privilege escalation in the Windows Client License Service (ClipSVC) allows an authenticated low-privileged local attacker to execute arbitrary code at elevated integrity, potentially SYSTEM, via a heap-based buffer overflow (CWE-122). The vulnerability requires local access and high attack complexity (CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0), and there is no remote or unauthenticated path. No public exploit has been identified at the time of analysis, and exploitation is limited to scenarios where an attacker already has a foothold on the host, such as multi-user or terminal-server environments.

Denial of service against the QAPI service in Commvault Cloud can be triggered by an authenticated low-privilege user who sends a crafted request that overflows a stack buffer on CommServe, Web Server, Command Center, or Index Server. Per the vendor's advisory, exploitation is limited to service availability - there is no data disclosure, data tampering, or code execution impact (CVSS:4.0 vector VC:N/VI:N/VA:H, score 7.1), and the independent CVSS:3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees that only availability is affected. Valid credentials are mandatory and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority availability issue rather than an emergency, but Commvault has directed customers to a resolved maintenance release.

A heap-based buffer overflow in Commvault MediaAgent (and the associated HyperScale deployment) can be triggered over the network by an unauthenticated attacker, causing the service to crash and denying backup/data-protection availability. The affected component is the MediaAgent service within Commvault Cloud; per the provided CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, though exploitation depends on the attacker being able to reach the MediaAgent/HyperScale service port, so firewall-segmented backup networks are materially less exposed. Impact is confined to availability (VA:H, with VC:N/VI:N), and there is no public exploit identified at time of analysis; CISA KEV does not list this issue. The input assigns CVSS 4.0 base 8.7 (HIGH); the independent assessment scores it 7.5 (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and both agree the effect is denial of service only.

An out-of-bounds write in Commvault's CvFWD network-communication daemon allows a low-privilege authenticated attacker who can reach the service over the network to crash it, producing a denial of service against the affected Commvault component. The flaw is availability-only (CVSS 4.0 7.1, VA:H with VC:N/VI:N) and offers no path to data disclosure or code execution; it affects Commvault Cloud deployments, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale, until the resolved maintenance release is applied. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

An integer overflow in CvFWD, the Commvault network-forwarding daemon used across Commvault Cloud deployments, lets a low-privilege authenticated attacker on the network crash or degrade the forwarding service, producing an availability-only denial of service with no confidentiality or integrity impact. All Commvault components that ship or communicate with CvFWD are in scope - CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale - so risk is highest in environments where these services are reachable from broad or untrusted network segments rather than restricted management networks. The vendor classifies this as a 7.1 (CVSS 4.0) issue requiring PR:L; there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS data was not provided, so the practical near-term driver is patch hygiene rather than active exploitation.

Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead to privilege escalation and full compromise of confidentiality, integrity, and availability on the targeted client. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) requires user interaction and high attack complexity, and it indicates low privileges are needed even though the vendor description claims unauthenticated access-this authentication prerequisite is unverified. No public exploit identified at time of analysis.

Heap buffer overflow in Wazuh Manager's File Integrity Monitoring alert generation lets an enrolled agent corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage across all monitored endpoints. Affected versions are Wazuh 3.12.0 through 4.14.7, fixed in 4.14.8; the attacker must hold a valid agent enrollment key (PR:L, authenticated), and because FIM/syscheck is enabled by default on agents no special manager-side configuration is required. The vendor CVSS 4.0 score of 7.1 (HIGH) is driven almost entirely by availability impact (VA:H), and no public exploit code has been identified at time of analysis.

A malicious or compromised RDP server can crash FreeRDP clients versions 3.11.0 up to but not including 3.32.0 when video redirection is enabled, due to an integer overflow in the handling of positive mapped-video coordinates. This moderate-severity denial-of-service requires the victim to connect to the attacker-controlled server and results only in client termination, with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis.

An out-of-bounds read in FreeRDP's smartcard redirection channel (CVE-2026-109677) lets a malicious or compromised RDP server leak heap memory from the connecting client by sending a LocateCardsByATRA request whose cbAtr byte count exceeds the fixed 36-byte rgbAtr/rgbMask buffers. Affected versions are 2.0.0-beta1 through 3.27.x (fixed in 3.28.0), and per the independent assessment the impact is confidentiality-only: the client must initiate the RDP session to the hostile server and must have smartcard device redirection negotiated so the LocateCardsByATRA handler is reachable. Repeated timing-oracle queries can extract memory bit-by-bit to defeat ASLR as a precursor to remote code execution, but no code execution occurs directly; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.

Use-after-free in FreeRDP's smartcard redirection allows a malicious RDP server to corrupt memory on a connecting client, potentially leading to crashes or code execution. Affected versions are 3.0.0-beta1 through 3.31.x; exploitation requires the victim to connect to an attacker-controlled server with the smartcard channel active, and no public exploit identified at time of analysis.

Stack-based buffer overflow in NVIDIA DALI lets a locally authenticated, low-privileged user who can get a crafted input file processed through a DALI pipeline corrupt memory and potentially achieve code execution, information disclosure, data tampering, or denial of service. Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3 High), exploitation is not remotely reachable: it requires an existing local foothold with at least low privileges plus some form of user interaction, which in practice means a victim or automated process must load attacker-controlled data. There is no public exploit identified at time of analysis and the flaw has not been added to CISA KEV; the practical risk concentrates on multi-tenant or pipeline-automation GPU hosts where untrusted files are routinely fed into DALI. Exact affected versions are unconfirmed because the CPE is a wildcard, so defenders must verify their deployed DALI build against the NVIDIA advisory.

An uncontrolled out-of-bounds read in NVIDIA DALI (Data Loading Library) can be triggered when a low-privileged local user processes specially crafted input through a DALI data-loading or augmentation pipeline (CVSS 3.1 base 7.3, AV:L/AC:L/PR:L/UI:R), resulting in memory disclosure, data tampering, and denial of service. Impact is bounded by the local attack vector and the requirement for both low privileges and user interaction - an unauthenticated remote attacker cannot trigger it directly, and an idle default installation is not exploitable. Exposure is greatest in workflows where DALI ingests untrusted or externally sourced datasets and media; the CPE record (cpe:2.3:a:nvidia:dali:*:*:*:*:*:*:*:*) indicates the issue is not version-scoped in the supplied data, and no public exploit code or CISA KEV entry has been identified at time of analysis.

An uncontrolled out-of-bounds write in NVIDIA DALI (the Data Loading Library used for GPU-accelerated data preprocessing) allows a locally positioned attacker who already holds low-level privileges to corrupt process memory when a DALI pipeline loads or decodes attacker-influenced input such as a crafted image, media file, or dataset record. A successful exploit can produce denial of service, information disclosure, and data tampering, consistent with the vendor rating of 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), which requires local access, low privileges, and user interaction (a victim or process must ingest the malicious data). There is no CISA KEV listing and no public exploit identified at time of analysis, so practical risk is concentrated in multi-tenant training clusters, pipelines consuming externally sourced datasets, and services that accept user-submitted media for GPU preprocessing rather than in default in-house-only deployments.

An uncontrolled out-of-bounds read in NVIDIA DALI is triggered while the library parses attacker-supplied data inside a data-loading pipeline, allowing crafted input to expose process memory contents and crash the workload, which results in information disclosure and denial of service. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H) the attack is local, requires the attacker to already hold low-level privileges on the host, and critically depends on user interaction - a user or training job must actually run DALI over the malicious sample, so environments that ingest only trusted, internally generated data are effectively not exposed. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); this is a moderate, not top-tier, priority.

A sandbox escape in Mozilla Firefox's Networking component allows unauthenticated remote attackers to break out of the browser's security sandbox and potentially execute code on the host when a victim loads attacker-controlled web content. The vulnerability stems from incorrect boundary conditions (CWE-119) and carries a CVSS score of 9.6, though exploitation requires user interaction (UI:R) and the sandbox escape alone must be chained with a separate content-process code-execution primitive for full host compromise. No public exploit code has been identified, and the EPSS score is low at 0.19% (8th percentile); patched versions are Firefox 158 and Firefox ESR 153.5.

Memory corruption in Mozilla Firefox's Layout engine lets a remote, unauthenticated attacker who convinces a victim to render attacker-controlled web content corrupt memory, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicating high confidentiality and integrity impact and a full availability impact on the client. All Firefox builds prior to 158 are affected, along with Firefox ESR releases prior to 115.43 and 153.5. Exploitation hinges entirely on user interaction - the victim must navigate to or render a hostile page - and no public exploit or active exploitation has been identified at time of analysis; EPSS is low at 0.16% (5th percentile), and vendor-released fixes (Firefox 158, ESR 115.43, ESR 153.5) are available per Mozilla advisories mfsa2026-106 through mfsa2026-110.

Integer overflow in Mozilla Firefox's Graphics component (CWE-190) can lead to memory corruption and potential remote code execution when a user loads a malicious web page. Affected versions are prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; exploitation requires user interaction (UI:R) and no authentication. No public exploit code has been identified, and the EPSS score is low at 0.16% (5th percentile), though the vulnerability is rated high severity (CVSS 8.8).

Mozilla Firefox releases prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5 contain incorrect boundary conditions in the JavaScript engine that let remote attackers corrupt or disclose memory when a user loads attacker-controlled web content. Because the weakness sits in script processing, no credentials or pre-existing privileges are needed - but exploitation is not unattended: the victim must actively browse to a malicious or compromised page with JavaScript enabled (the default), and the vendor rates availability impact as none, so the realistic outcome is memory disclosure/integrity corruption rather than a guaranteed crash or confirmed remote code execution. Publicly available exploit code has not been observed and there is no public exploit identified at time of analysis; CISA KEV does not list this CVE, and EPSS is only 0.16% (4th percentile), so this is a genuine patch-promptly issue rather than an emergency one.

Memory corruption in Mozilla Firefox's JavaScript engine can be triggered when a remote unauthenticated attacker convinces a user to load attacker-controlled JavaScript content, yielding high confidentiality and integrity impact with no availability impact. This is not a zero-click attack; exploitation requires user interaction (UI:R) to render a malicious page, so it depends on social engineering, malvertising, or a compromised site. Mozilla fixed the issue in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; at time of analysis there is no public exploit identified, and EPSS is very low at 0.16% (4th percentile), indicating a genuine but not emergency-level risk.

Stack-based buffer overflow in the TRENDnet TEW-432BRP (firmware 3.10B20) web management interface lets an attacker with a valid low-privilege session crash or execute code on the device by sending an overlong 'Name' parameter to the /goform/formTcpipSetup handler. Publicly available exploit code exists, so risk is elevated wherever the router's management interface is reachable from an untrusted network or is protected only by default or weak credentials; impact is negligible where management access is confined to a trusted LAN. The device reached end-of-life in 2011 and the vendor has confirmed it has no way to test or patch the issue, meaning no vendor fix will be issued and replacement is the only complete remediation. This is not confirmed as actively exploited (CISA KEV), but the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact when the authentication prerequisite is met.