Denial of Service

Out-of-bounds memory access in zstd-jni versions 1.3.3-1 through 1.5.7-13 enables unauthenticated network-accessible attackers to crash the JVM by supplying crafted sample-size arrays to the Zstd.trainFromBufferDirect dictionary-training API. The native C implementation (jni_zdict.c) failed to sum caller-supplied sample lengths against the DirectBuffer's actual capacity before iterating, allowing the native code to walk past the buffer allocation boundary and trigger a hard JVM termination. A patched release (v1.5.7-14) is available; no public exploit has been identified at time of analysis.

Deserialization in t-digest 3.1 through 3.3 allows remote attackers to inject IEEE 754 NaN values as centroid means via crafted byte streams passed to MergingDigest.fromBytes(), bypassing absent validation checks. The injected NaN values corrupt the internal total-ordering invariant of the centroid list, causing sort comparisons to return inconsistent results and degrading subsequent merge operations from O(n log n) to O(n²) algorithmic complexity. The result is severe CPU exhaustion and service delays for any application that deserializes attacker-controlled t-digest payloads; no public exploit code or CISA KEV listing exists at time of analysis.

Memory and CPU exhaustion in PocketMine-MP before 5.39.2 allows any authenticated in-game player to render the game server unresponsive by sending a ModalFormResponsePacket with an arbitrarily large JSON payload. The server processes incoming form response data without enforcing any size limit, enabling an attacker to exhaust server memory and CPU with JSON arrays containing millions of elements. A public proof-of-concept Node.js script is confirmed in vendor advisory GHSA-788v-5pfp-93ff; no public exploit identified at time of analysis in CISA KEV.

Unauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Minecraft Bedrock port to crash the process with a single crafted LoginPacket. The server's JsonMapper is configured to log unexpected clientData JWT properties using PHP's `var_export()` without any size or depth bounds; an attacker embeds a deeply nested or massive object structure in an unknown property, causing the PHP process to exhaust all available memory during serialization. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing at time of analysis, but the zero-authentication, pre-auth attack vector and public PoC make this a high-priority patch for any publicly reachable PocketMine-MP instance.

Unauthenticated remote denial-of-service in PocketMine-MP before 5.43.1 allows any network client to crash the Minecraft Bedrock server by sending a malformed Certificate field during offline login. The LoginPacketHandler fails to validate the Certificate JSON structure before mapping it to an internal auth chain object, leaving PHP class properties uninitialized and triggering a fatal error that terminates the server process. A publicly available proof-of-concept is referenced in the vendor's GitHub Security Advisory (GHSA-g2fj-p69p-9chp); no CISA KEV listing is confirmed at time of analysis.

Memory exhaustion denial of service in PocketMine-MP before 5.32.1 allows any authenticated Bedrock client to crash the server by sending a single crafted ResourcePackClientResponsePacket. The server iterates the client-supplied packIds array without deduplicating UUIDs, so a custom client supplying hundreds of copies of a valid pack UUID causes the server to transmit ResourcePackDataInfoPacket repeatedly, rapidly exhausting PHP process memory. No public KEV listing, but exploit details are publicly available via GHSA-fqqv-56h5-f57g.

Denial-of-service via compression bomb in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed payloads that expand dramatically upon decompression. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.

Regular expression denial of service in GitPython before 3.1.60 allows unauthenticated remote attackers to exhaust server CPU resources by supplying a crafted commit with a malformed author or committer field. The vulnerable regex Actor.name_email_regex exhibits quadratic backtracking when processing an unterminated angle bracket in the author string, stalling affected processes for over two minutes per commit access. Any application that reads attacker-influenced git repositories using GitPython is exposed; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Server-Side Request Forgery in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to cause denial of service against both the Application and Appliance (Virtual Edition) deployment forms. The CVSS vector confirms fully unauthenticated network exploitation with no user interaction, targeting availability exclusively - confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified; EPSS places this in the 8th percentile, and the CISA SSVC assessment lists exploitation status as none.

Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Remote denial of service in the utcp OCaml TCP userspace library before version 0.0.6 is possible via crafted out-of-order TCP segment sequences that expose a flaw in the segment reassembly logic. Unauthenticated network attackers can exploit this against any service built on the affected library, causing complete availability loss. No public exploit code or active exploitation has been identified at time of analysis.

Heap buffer overflow in OpenIDC/cjose versions prior to 0.6.2.5 allows a remote unauthenticated attacker to corrupt process heap memory by submitting a crafted JWE token with an oversized `encrypted_key` segment targeting the AES Key Wrap decryption path. The `cjose_jwe_import()` and `cjose_jwe_decrypt()` functions are pre-authentication entry points that accept fully attacker-controlled input, making every application that decrypts AES-KW JWEs with this library directly reachable. Impact ranges from a reliable denial of service (process crash) to potential memory-corruption-based code execution depending on heap layout and allocator behavior. No public exploit has been identified at time of analysis, but the patch commit confirms the exact boundary condition and includes a regression test demonstrating the overflow trigger.

Use-after-free in Google Chrome's DevTools component (versions prior to 153.0.8010.36) enables arbitrary code execution within the renderer sandbox when a victim is socially engineered into visiting a crafted HTML page. The CVSS score of 8.8 reflects full C/I/A impact, but Chromium's own internal severity classification of 'Low' signals that exploitation is sandboxed - OS-level compromise requires an additional chained sandbox escape. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Remote code execution in Google Chrome's DevTools component before 153.0.8010.36 stems from a use-after-free (CWE-416) that, per the advisory, allows a crafted HTML page to execute arbitrary code outside the browser sandbox. All desktop Chrome builds prior to the fixed stable release are affected; the flaw was reported internally by the Chrome team, is fixed in the stable channel, and has no public exploit identified at time of analysis. Notably, the assigned CVSS is 9.6 (Critical) while Chromium itself rated the security severity only 'Low', a significant conflict discussed below.

Sandbox-escaping remote code execution in Google Chrome's WebPackaging component affects all desktop versions prior to 153.0.8010.36. A use-after-free (CWE-416) reachable from a crafted HTML page can let a remote attacker potentially execute arbitrary code outside the renderer sandbox with no authentication, requiring only that the victim visit a malicious page. No public exploit has been identified at time of analysis; Chromium's own internal triage rated the security severity 'Low', which sits in notable tension with the 9.6 CVSS assigned to the record.

Remote code execution in Google Chrome on iOS before 153.0.8010.36 stems from a use-after-free in the Sharing component (CWE-416), letting a remote attacker who lures a victim to crafted network content execute arbitrary code outside the browser sandbox. Google has shipped a patched Chrome build; no public exploit is identified at time of analysis, and Google/Chromium rated the underlying bug 'Medium' severity even though the assigned CVSS base score is 9.6.

Remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the Passwords component that, when triggered via crafted UI interaction and social engineering, can let a remote attacker escape the renderer sandbox and run arbitrary code. All Chrome desktop builds before the 153.0.8010.36 stable release are affected. No public exploit identified at time of analysis, and no EPSS or KEV data was provided; note that Google's Chromium team rated the underlying bug only 'Medium' severity, which sits in tension with the supplied CVSS 9.6.

Sandbox-escaping remote code execution in Google Chrome's Aura windowing layer affects all desktop builds prior to 153.0.8010.36. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and potentially execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the fix ships in the stable-channel desktop update.

Remote code execution in Google Chrome for macOS prior to 153.0.8010.36 stems from a use-after-free in the Extensions component, letting a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw carries a CVSS 9.6 (scope-changed, network vector with user interaction), though Chromium's own security team rated it 'Medium'. No public exploit has been identified at time of analysis, and the fix is available in the stable channel.

Use-after-free in Chrome's V8 JavaScript engine allows a remote attacker who can socially engineer a victim into installing a crafted Chrome extension to execute arbitrary code within the browser's renderer sandbox, affecting all Chrome versions prior to 153.0.8010.36. The vulnerability is constrained to in-sandbox execution - it does not constitute a standalone sandbox escape - which aligns with the S:U CVSS metric and Chromium's internal 'Medium' severity rating despite the 8.8 base score. No public exploit code or active exploitation has been identified at time of analysis, and Google has shipped a patch in the stable channel.

Use-after-free in Google Chrome's DevTools component prior to 153.0.8010.36 enables a local attacker to escape the browser sandbox and execute arbitrary code at the host OS level via a crafted local program. Chromium's own severity rating is 'Medium', reflecting the local access prerequisite, while the CVSS 8.1 score captures the high-impact sandbox-escape outcome once exploitation succeeds. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score (0.12%, 2nd percentile) confirms low observed exploitation probability.

Sandbox-escaping remote code execution in Google Chrome's Browser process on Windows (all versions prior to 153.0.8010.36) stems from a use-after-free flaw. A remote attacker who lures a victim into opening a crafted HTML page can corrupt reclaimed heap memory in the privileged browser process and execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the vendor has shipped a fixed stable build.

Use-after-free in Chrome's ANGLE graphics layer on Windows enables sandbox escape and arbitrary code execution when a renderer process has already been compromised. Affected versions are all Chrome releases prior to 153.0.8010.36 on Windows; exploitation requires an attacker to first compromise the renderer and then deliver a crafted HTML page triggering the ANGLE memory corruption. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.28% (20th percentile) reflects low observed exploitation probability.

Use-after-free in Chrome's Chromecast component allows remote attackers to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Affected are all Google Chrome releases prior to 153.0.8010.36 across desktop platforms. Exploitation is sandboxed - code execution is confined to the renderer process - but the C:H/I:H/A:H impact rating reflects full compromise of data accessible within that context. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.

Sandbox-escaping remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the browser's Core component that a remote attacker can trigger through a maliciously crafted Chrome extension. Successful exploitation lets attacker-controlled code run outside the renderer sandbox with the browser process's privileges, but it requires convincing the victim to install or interact with the malicious extension (social engineering). There is no public exploit identified at time of analysis, EPSS is low (0.24%, 15th percentile), and CISA SSVC records exploitation as none, so the risk is high-impact but currently unproven in the wild.

Remote code execution in Google Chrome before 153.0.8010.36 stems from a use-after-free in the browser's Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Chromium rates the severity High, and the supplied CVSS is 9.6 reflecting the sandbox-escape scope change. EPSS is low (0.35%, 29th percentile) and no public exploit is identified at time of analysis.

Remote code execution inside the Chrome sandbox is possible in Google Chrome versions prior to 153.0.8010.36 via a use-after-free vulnerability in the V8 JavaScript engine, triggered by a specially crafted HTML page. An unauthenticated remote attacker who can lure a user to a malicious page can execute arbitrary code within the Chrome renderer process sandbox - a significant foothold even without a sandbox escape. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.21% reflects low observed exploitation activity, though V8 UAF primitives are historically attractive to threat actors.

Sandbox-escape code execution in Google Chrome's Printing subsystem (all versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a crafted HTML page, leveraging a use-after-free in the print handling path. This is a secondary exploit in a multi-stage chain: renderer compromise is a hard prerequisite, not something this bug alone provides. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.

Sandbox-escaping remote code execution in Google Chrome's Payments component (versions prior to 153.0.8010.36) lets a remote attacker who successfully social-engineers a victim into visiting a crafted HTML page trigger a use-after-free and potentially run arbitrary code outside the renderer sandbox. Chromium rates the security severity 'High'; the supplied CVSS is 9.6 reflecting scope change and full CIA impact. No public exploit is identified at time of analysis and EPSS is low (0.26%, 17th percentile), and CISA SSVC records exploitation status as none.

Remote code execution in Google Chrome on macOS prior to 153.0.8010.36 stems from a use-after-free in the Payments component, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the browser sandbox. The provided CVSS vector (9.6) reflects a scope-changing sandbox escape requiring user interaction (a page visit), while Chromium rated the underlying bug 'High' rather than 'Critical'. A vendor patch is available; EPSS is low (0.30%, 22th percentile) and no public exploit is identified.

Sandbox-escape remote code execution in Google Chrome's Device component on macOS (versions prior to 153.0.8010.36) allows a remote attacker to potentially run arbitrary code outside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; Chromium assigned it 'High' severity while the CVSS base score is 9.6. No public exploit identified at time of analysis, and EPSS is low (0.26%).

Use-after-free in V8, Chrome's JavaScript engine, enables remote code execution within the browser's renderer sandbox when a victim visits a crafted HTML page. All Chrome releases prior to 153.0.8010.36 are affected across desktop platforms. No public exploit has been identified and EPSS sits at 0.21% (12th percentile), but SSVC rates the technical impact as total, and the Chromium security team classified this as High severity.

Use-after-free in Chrome's WebPackaging component enables full sandbox escape to arbitrary code execution for attackers who have already established a foothold in the renderer process. All Chrome desktop releases prior to 153.0.8010.36 are affected. No public exploit code has been identified and EPSS is low (0.34%), but the scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms that successful exploitation fully escapes Chrome's multi-process sandbox, translating a renderer compromise into OS-level code execution.

Use-after-free in Chrome's Input component enables in-sandbox remote code execution against all Chrome versions prior to 153.0.8010.36. The vulnerability is triggered when a victim visits a crafted HTML page, requiring no authentication and no special configuration - only a single browse action. Google has rated this High severity, the patch is available in 153.0.8010.36, and no public exploit has been identified at time of analysis, with EPSS at 0.21%.

Use-after-free in Chrome's Platform component (all versions prior to 153.0.8010.36) enables remote code execution confined within the browser sandbox when a user visits a crafted HTML page. The Chromium team rated this 'High' severity - consistent with the CVSS 8.8 score and distinguishing it from Critical-rated full sandbox-escape vulnerabilities addressed in the same release cycle. No public exploit code has been identified, and the EPSS score of 0.21% (12th percentile) reflects limited observed exploitation activity at this time; no CISA KEV listing exists.

Remote code execution outside the browser sandbox affects Google Chrome versions prior to 153.0.8010.36 through a use-after-free flaw in the Web Authentication (WebAuthn) component. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code with the privileges of the browser process, escaping the renderer sandbox (scope change). No public exploit has been identified at time of analysis and EPSS is low (0.34%), but the sandbox-escape RCE nature and Chrome's enormous install base make prompt patching important.

Use-after-free in Chrome's Views UI framework enables local attackers to escape the browser sandbox and execute arbitrary code at browser-process privilege level. The vulnerability affects all Google Chrome desktop versions prior to 153.0.8010.36. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects low near-term exploitation probability.

Sandbox-escape remote code execution in Google Chrome on Android (versions prior to 153.0.8010.36) stems from a use-after-free in Dawn, Chromium's WebGPU implementation. A remote attacker who lures a victim to a crafted HTML page can trigger the freed-object reuse to execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; there is no public exploit or CISA KEV listing, and EPSS is low (0.30%), indicating no evidence of active or widespread exploitation at time of analysis.

Use-after-free in Google Chrome's Core component on Windows prior to 153.0.8010.36 enables a renderer-compromised attacker to escape the browser sandbox and execute arbitrary code on the host OS. The vulnerability is platform-specific to Windows and functions as the second stage of a chained exploit: an attacker must first achieve renderer-level compromise before triggering this UAF to pivot into the privileged browser process. No public exploit code or active exploitation has been identified at time of analysis; vendor patch 153.0.8010.36 is available.

Use-after-free in Chrome's Receiver component allows an adjacent, unauthenticated attacker to execute arbitrary code outside the renderer sandbox via crafted network traffic, affecting all Chrome versions prior to 153.0.8010.36. The scope change in the CVSS vector confirms this is a full sandbox escape - successful exploitation yields OS-level code execution on the victim machine without requiring any user interaction. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) indicates low observed exploitation activity.

Sandbox-escape remote code execution in Google Chrome's Views UI framework prior to 153.0.8010.36 allows a local attacker to execute arbitrary code outside the browser sandbox by inducing a specific UI interaction that triggers a use-after-free condition. The CVSS scope change (S:C) confirms the vulnerability crosses the renderer sandbox boundary into the broader OS context, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.20% (10th percentile) reflects low automated exploitation probability, though sandbox escapes are high-value for privilege escalation chains.

Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a use-after-free in ANGLE, Chrome's graphics abstraction layer that translates OpenGL ES calls to Direct3D. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code outside the browser sandbox, giving full compromise of the renderer host process. No public exploit identified at time of analysis, and EPSS is modest (0.35%), but the sandbox-escape impact and one-click delivery make this a high-priority browser patch.

Use-after-free in Chrome's Cast (Chromecast streaming) component allows an adjacent unauthenticated attacker to potentially escape the browser sandbox and execute arbitrary code by delivering crafted network traffic over a local or Wi-Fi network. All Chrome desktop versions prior to 153.0.8010.36 are affected, with Chromium rating this Critical due to the full-CIA, scope-changed impact. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal observed exploitation activity despite the high severity classification.

Remote code execution in Google Chrome for Android prior to 153.0.8010.36 stems from a use-after-free in the WebGL implementation that a remote attacker can trigger with a crafted HTML page to execute arbitrary code outside the browser sandbox. Chromium rates this Critical and the CVSS is 9.6, reflecting a full renderer-to-sandbox-escape chain requiring only that a victim visit a malicious page. No public exploit is identified at time of analysis and EPSS is low (0.36%), but the sandbox-escape impact makes it a priority patch.

Remote code execution in Google Chrome desktop prior to 153.0.8010.36 arises from a use-after-free in the WebGL implementation, allowing a remote attacker to run arbitrary code outside the browser sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as Critical and the CVSS is 9.6, reflecting a full renderer-to-host sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.28% (20th percentile).

ReDoS (regular expression denial of service) in n8n's Git node clone operation allows an authenticated workflow editor to freeze the entire n8n instance with a single workflow execution. The vulnerability stems from catastrophic backtracking in the default N8N_BLOCK_FILE_PATTERNS regex (`^(./).git(/.)$`), which runs synchronously in the main process against an attacker-controlled destination path. Fixed versions 1.123.76, 2.37.7, and 2.38.2 are available; no public exploit or KEV listing identified at time of analysis.

Unvalidated input sizes on the OAuth Dynamic Client Registration endpoint in n8n allow unauthenticated remote attackers to exhaust database storage by repeatedly submitting oversized client_name and grant_types values. Affected versions are all n8n releases prior to 2.37.7 (in the 2.37.x branch) and prior to 2.38.2 (in the 2.38.x branch). Because the endpoint is publicly accessible without authentication and the attack is trivially automatable, a single attacker can render the n8n instance unavailable by filling database disk capacity, taking down all workflow automation for any organization relying on the platform.

Server process termination in gRPC-Go's xDS routing layer allows any network-reachable attacker to crash a server instantiated with `xds.NewGRPCServer()` by sending a single crafted HTTP/2 request. The vulnerability stems from the xDS routing interceptor unconditionally reading index 0 of the authority slice before checking whether the slice is empty - triggered when both `:authority` and `Host` headers are absent from an otherwise valid HTTP/2 stream. Because the per-RPC goroutine provides no panic recovery, the unhandled Go runtime panic terminates the entire server process; vendor-released patches v1.82.2 and v1.83.2 address this by rejecting such requests at the transport layer before they reach the interceptor.

Use-After-Free in Adobe Acrobat Reader and Adobe Acrobat allows arbitrary code execution in the security context of the current user upon opening a specially crafted PDF file. Affected versions span Acrobat Reader up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit identified at time of analysis, but the file-delivery attack vector makes this a realistic phishing and drive-by-download threat given Acrobat Reader's ubiquity as an enterprise PDF handler.

Use After Free in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious document. Affected across both the continuous track (≤26.002.21900) and the classic 2024 track (≤24.001.30383), this is a memory corruption vulnerability rooted in improper object lifecycle management within Acrobat's rendering engine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open attack surface and high impact make this a credible phishing or watering-hole delivery risk.

Use-after-free (UAF) in Adobe Acrobat Reader allows arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious PDF or document file. Affected versions span Acrobat 2024 (≤24.001.30383) and both Acrobat and Acrobat Reader (≤26.002.21900), making the exposure broad across the current release track. No public exploit or active exploitation has been confirmed at time of analysis, but the file-based delivery vector makes this class of vulnerability routinely weaponized via phishing campaigns.

Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted PDF file. Affected versions include Acrobat Reader and Adobe Acrobat up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis, but the ubiquity of Acrobat Reader across enterprise environments and the reliable code-execution impact make patching a high priority.

Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.

Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.

Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.

Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.

Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.

Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.

Local privilege escalation in the Android kernel's KVM IOMMU subsystem allows a low-privileged user to gain full kernel control via a use-after-free condition in kvm_iommu_map_sg (iommu.c). The root cause is a missing permission check that enables memory to be accessed after it has been freed, allowing an unprivileged local process to achieve read/write/execute control over the kernel. No public exploit has been identified at time of analysis, but Google's September 2026 Android Security Bulletin confirms the issue and provides a kernel patch via android.googlesource.com.

Local privilege escalation in Android's memory allocator affects versions 14 through 17, enabling a low-privileged process to gain elevated system privileges without any user interaction. The root cause is a logic error in the LimitRealloc function within malloc_limit.cpp that produces a use-after-free condition, granting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.12% (2nd percentile), though the SSVC framework rates technical impact as total.

LocalImageResolver.java in Android 14 through 17 (including QPR2 releases) contains a DNG image rendering authorization check bypass (CWE-863) that enables remote privilege escalation with full confidentiality, integrity, and availability impact. The flaw requires only low-level privileges and no user interaction, expanding the attack surface beyond typical media-processing vulnerabilities that normally depend on explicit user file-opening. Google's Android Security Team disclosed the issue via the September 2026 Android Security Bulletin; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.

Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.

Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.

Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.

Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.

Remote code execution in Microsoft 365 Apps for Enterprise PowerPoint (versions below 16.0.20326.20136) is possible via a use-after-free (CWE-416) triggered when a user opens a specially crafted PowerPoint file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full CIA impact achievable without attacker authentication, requiring only that the victim opens a malicious document. No public exploit code or CISA KEV listing has been confirmed at time of analysis, but Microsoft has released a patch and the memory corruption primitive makes this a high-priority update for enterprise environments.

Remote code execution via use-after-free (CWE-416) in Microsoft Office Outlook allows a network-based attacker to execute arbitrary code on a victim's system when the user opens or previews malicious content. The vulnerability affects a broad range of Microsoft Office versions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Word 2016. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects the high severity, tempered only by the requirement for user interaction.

Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.

Privilege escalation in Windows Security Health Service (a core Windows security monitoring component) allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level access via a use-after-free memory corruption flaw. Affected platforms span Windows 11 (24H2, 25H2, 26H1) and Windows Server 2022/2025 - all fully patched by Microsoft's latest cumulative updates. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 7.0 with AC:H reflects real exploitation complexity.

Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.

Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.

Type confusion (CWE-843) in the Windows DHCP Server service enables unauthenticated remote attackers to crash or deny service to the DHCP daemon over the network. The flaw spans Windows Server 2012 through 2025 and Windows 10 builds where the DHCP Server role is installed. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.5 AV:N/AC:L/PR:N/UI:N vector signals straightforward, low-complexity network exploitation requiring no authentication.

Remote code execution in Microsoft Windows DNS Server allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw in the DNS service. Affected systems span Windows Server 2012 through Server 2025 and two Windows 10 variants running the DNS Server role. CVSS 8.1 (AC:H) reflects the high-complexity exploitation requirement, but successful exploitation yields full C:H/I:H/A:H impact. No public exploit identified at time of analysis; vendor patch is available.

Local privilege escalation in Windows Biometric Service (WbioSrvc) allows any low-privileged authenticated user to gain SYSTEM-level access via a null pointer dereference (CWE-476) in the Windows Biometric Framework. Affecting Windows 10 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw is present across virtually the entire modern Windows ecosystem. No public exploit identified at time of analysis; Microsoft has released patches across all affected branches.

Local privilege escalation in Microsoft SQL Server affects versions 2017 through 2025 via a use-after-free memory corruption flaw exploitable by an authenticated low-privilege user. An attacker with existing local access and SQL Server login credentials can trigger the UAF condition to achieve full C:H/I:H/A:H impact, effectively gaining elevated privileges on the host. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected CU and GDR servicing channels.

Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.

Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.

Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.

Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.

Use-after-free in the Windows SMB Client component enables unauthenticated remote code execution against a broad range of Windows 11 and Windows Server builds. An attacker operating a malicious SMB server can trigger a freed-memory dereference during client-side protocol processing, yielding arbitrary code execution with a full C:H/I:H/A:H impact triad. Microsoft has released cumulative updates addressing the flaw; no CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.

Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.

Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. No public exploit code or CISA KEV listing is present at time of analysis; a vendor patch has been released addressing build 10.0.26100.33438.

Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.

Uncontrolled memory consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows unauthenticated remote attackers to terminate a .NET host process by submitting a small, specially crafted YAML OpenAPI document containing nested anchors and aliases. The attack exploits a 'billion laughs' style amplification at the boundary between SharpYaml's directed acyclic graph representation and System.Text.Json.Nodes.JsonNode materialization: because a JsonNode cannot be shared across parents, each alias must be deep-copied independently, yielding k^N allocations for N nested anchor levels each referenced k times. No public exploit has been identified at time of analysis, but SSVC confirms the attack is automatable, meaning tooling can deliver it at scale once a payload is known.

Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.

Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.

Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.

Use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows network-reachable unauthenticated attackers to elevate privileges to SYSTEM level on affected Windows hosts. The vulnerability spans a broad surface - every supported Windows release from Server 2012 through Windows 11 25H2 and Server 2025 is confirmed affected. SSVC rates exploitation status as none and the attack as non-automatable, but technical impact is total, meaning successful exploitation yields full system compromise. No public exploit or KEV listing has been identified at time of analysis.