Heap Overflow

Heap-based buffer overflow in Bosch Sensortec COINES_SDK versions 2.10 through 2.12.2 allows a malicious or compromised USB or BLE peripheral to corrupt host heap memory, leading to process crash or potential arbitrary code execution on the developer's machine. The root cause is that the PC bridge protocol decoder in bridge_decoder.c unconditionally trusts the packet length field supplied by the connected peripheral, passing it directly to mqueue_add_data without validating it against the fixed 255-byte queue slot - enabling a payload of up to ~3 KB to overwrite adjacent heap metadata via memcpy. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for physical or BLE proximity and user-initiated device pairing.

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based buffer overflow in the ASN.1 decoder that parses VPN certificates, reachable by unauthenticated remote attackers. Because the flaw sits in the certificate-handling path of the internet-facing VPN service, a single crafted certificate or handshake can overflow heap memory and execute attacker-controlled code on security appliances that sit at the network perimeter. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, but the pre-auth network-reachable RCE profile makes it a top-tier patching priority.

Heap buffer overflow in Samsung KnoxVault trustlet (hwvault trusted application) on Samsung Mobile Devices prior to SMR Sep-2026 Release 1 enables local privileged attackers to execute arbitrary code within the Trusted Execution Environment. The CVSS 4.0 score of 7.1 with AV:L/AC:H/PR:H reflects a high technical bar: exploitation demands pre-existing high-privilege local access plus significant exploit engineering to achieve reliable heap corruption. Samsung confirmed the fix in the September 2026 Monthly Security Release; no public exploit or active exploitation has been identified.

Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of libimagecodec.quram.so (the proprietary Quram/Qmage image codec) on builds prior to SMR Sep-2026 Release 1. A remote attacker who delivers a maliciously crafted JPEG image to a vulnerable device can corrupt heap memory and execute arbitrary code in the context of the image-processing component. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV; Samsung rates it CVSS 4.0 9.2 (critical).

Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimagecodec.quram.so) affects Samsung mobile devices on Android 14, 15, 16, and 17 prior to the SMR Sep-2026 Release 1 patch. A crafted DNG image parsed by the library triggers a heap-based buffer overflow, letting a remote attacker run arbitrary code in the context of the process handling the image. No public exploit identified at time of analysis, and it is not on the CISA KEV list, but Quram image-parsing flaws have a strong historical track record of weaponization on Samsung/Android.

Heap buffer overflow in OpenIDC/cjose versions prior to 0.6.2.5 allows a remote unauthenticated attacker to corrupt process heap memory by submitting a crafted JWE token with an oversized `encrypted_key` segment targeting the AES Key Wrap decryption path. The `cjose_jwe_import()` and `cjose_jwe_decrypt()` functions are pre-authentication entry points that accept fully attacker-controlled input, making every application that decrypts AES-KW JWEs with this library directly reachable. Impact ranges from a reliable denial of service (process crash) to potential memory-corruption-based code execution depending on heap layout and allocator behavior. No public exploit has been identified at time of analysis, but the patch commit confirms the exact boundary condition and includes a regression test demonstrating the overflow trigger.

Heap-based buffer overflow in Google Chrome's WebRTC component (all versions prior to 153.0.8010.36) enables a remote unauthenticated attacker to potentially execute arbitrary code within the Chrome renderer sandbox by luring a target to a crafted HTML page. The vulnerability is classified CWE-122 and carries a CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); however, Chromium's own internal severity rating is 'Low,' which is notably discordant and implies that exploitation is constrained to within-sandbox code execution rather than full OS compromise. No public exploit code and no CISA KEV listing have been identified at the time of analysis.

Heap-based buffer overflow in the WebRTC component of Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. The RCE is sandbox-confined (CVSS S:U), meaning a chained sandbox-escape exploit would be needed for full host-level compromise. No public exploit or active exploitation has been identified at time of analysis, and EPSS sits at a low 0.24% (15th percentile), consistent with Chromium's own 'Medium' severity designation despite the 8.8 CVSS base score.

Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a heap buffer overflow in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can corrupt heap memory and execute arbitrary code outside the renderer sandbox, gaining full compromise of the host. No public exploit is identified at time of analysis and EPSS is low (0.33%), but the sandbox-escape scope and Chrome's near-universal footprint make prompt patching essential.

Remote code execution in Google Chrome prior to 153.0.8010.36 allows a remote attacker to escape the renderer sandbox and run arbitrary code on the host by luring a victim to a crafted HTML page that triggers a heap buffer overflow in the WebGL implementation. Chromium rates this Critical and the CVSS 9.6 score reflects a scope-changing sandbox escape; no public exploit is identified at time of analysis, and EPSS is low at 0.29% (21st percentile). Patched in the September 2026 stable-channel desktop release.

Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution at current-user privilege level when a victim opens a crafted PDF or supported file format. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383 across all supported platforms, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation in the wild has been identified at the time of this analysis, but Adobe Acrobat's ubiquity in enterprise document workflows makes this a credible phishing or spear-phishing vehicle.

Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. Affected versions span both the Photoshop 2025 line (≤26.11.6) and Photoshop 2026 line (≤27.6), covering a broad install base of creative and enterprise users. No public exploit has been identified at time of analysis, though the file-based delivery mechanism makes phishing or watering-hole distribution a natural attack path.

Local privilege escalation affects Android versions 16, 16-qpr2, and 17 via heap-based buffer overflow triggered by integer overflow in multiple framework locations. An attacker with basic local code execution (low-privileged app or shell) can exploit the memory safety flaw - requiring no additional privileges or user interaction - to gain full control of the device, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is identified at time of analysis; EPSS of 0.12% (2nd percentile) indicates low probability of near-term observed exploitation.

Heap buffer overflow in Android's HEVC decoder (`ihevcd_get_tu_data_size` in `ihevcd_utils.c`) enables local privilege escalation across Android 14 through Android 17 with no additional execution privileges or user interaction required. A low-privileged attacker - such as a malicious application - can craft HEVC video input that triggers an out-of-bounds write on the heap, corrupting adjacent memory structures and ultimately gaining elevated device privileges. No public exploit code has been identified at time of analysis, and SSVC currently rates active exploitation as none, though the technical impact is classified as total.

Heap-based buffer overflow in parseParts of PduParser.java enables local privilege escalation across Android 14 through 17 (including Android 16-QPR2). A low-privileged process on the device can trigger an out-of-bounds read via a malformed PDU, corrupting heap memory to achieve full confidentiality, integrity, and availability compromise without requiring user interaction. No public exploit code or KEV listing has been identified at time of analysis.

Remote code execution in Google Android (versions 14 through 17, including 16-qpr2) arises from a heap buffer overflow (CWE-122) present in multiple system code paths, per the September 2026 Android Security Bulletin. The flaw is reported by Google's Android security team as exploitable with no additional execution privileges and no user interaction, giving a remote attacker full compromise of the affected process context. SSVC rates exploitation as 'none' and there is no public exploit identified at time of analysis, but CISA's automatable=yes / technical-impact=total assessment marks it as a high-priority patch target.

Remote code execution is achievable in Android's NFC subsystem across Android 14 through 17, including Android 16-QPR2, via a heap buffer overflow in the MIFARE Classic tag reader function rw_mfc_handle_read_op() within rw_mfc.cc. An attacker within NFC proximity can present a crafted MIFARE Classic tag that overflows a heap-allocated buffer in the NFC daemon, yielding full device control with no victim interaction required and no privileges needed on the target. No public exploit has been identified at time of analysis, though the SSVC framework rates the technical impact as total given the unauthenticated RCE capability.

Heap buffer overflow in the `read_boot_region` function of Android's filesystem check utility (`fsck.c`) allows a local, low-privileged process to escalate privileges with full system impact. The flaw spans Android 14 through 17 (including QPR2 branches) and was disclosed in Google's September 2026 Android Security Bulletin. No public exploit code has been identified at time of analysis, and EPSS signals a very low current exploitation probability.

Heap buffer overflow in Android's Bluetooth A2DP Opus vendor codec decoder allows a local low-privileged attacker to escalate privileges with no user interaction required. The flaw resides in `a2dp_vendor_opus_decoder_decode_packet` within `a2dp_vendor_opus_decoder.cc`, where a crafted Opus-encoded audio stream can trigger an out-of-bounds write on the heap. Affected versions span Android 14 through Android 17; no public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none.

Heap buffer overflow in Android's Wi-Fi P2P (Wi-Fi Direct) provision discovery handler enables proximal unauthenticated attackers to achieve remote code execution on affected devices without requiring user interaction. The flaw resides in `p2p_process_prov_disc_bootstrap_req()` within `p2p_pd.c`, where a malformed provision discovery bootstrap request triggers an out-of-bounds write on the heap. Android 16, Android 16-QPR2, and Android 17 are confirmed affected per the September 2026 Android Security Bulletin; no public exploit code exists and EPSS at 0.13% (3rd percentile) reflects minimal current exploitation activity.

Heap buffer overflow in Android's OAPV video codec decoder (oapv.c) enables remote code execution on Android 16 and 17 without requiring user interaction. The flaw resides in dec_frm_prepare(), where insufficient bounds checking during frame decoding preparation allows an attacker to overwrite heap memory via crafted video content. EPSS sits at 0.18% (8th percentile) with SSVC exploitation status rated 'none', but technical impact is classified as 'total' and no public exploit has been identified at time of analysis.

Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.

Remote code execution in Windows Print Spooler Components (Windows 11 24H2, build < 10.0.26100.9445) via a heap-based buffer overflow triggered over the network. An unauthenticated remote attacker can exploit this by delivering a maliciously crafted print-related payload that a victim user must interact with, resulting in full C:H/I:H/A:H compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible vector and zero-privilege requirement make this a meaningful patching priority.

Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.

Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.

Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.

Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.

Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.

Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.

Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.

Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.

Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.

Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.

Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.

Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.

Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.

Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.

Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.

Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.

Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows a locally authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows 11 and Windows Server 2025 builds. The CWE-122 flaw resides in the ReFS kernel driver and requires no user interaction, making it a reliable local privilege escalation primitive when combined with any initial-access vector. Microsoft has released patches via MSRC; no public exploit code or active CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Microsoft Office Excel allows a local attacker to execute arbitrary code with the privileges of the victim user by convincing them to open a specially crafted Excel file. The vulnerability spans a wide range of currently supported Office releases - Excel 2016 through Microsoft 365 Apps for Enterprise, plus Office for Mac editions - making the attack surface broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has issued patches across all affected channels.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024 editions, including Mac variants. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.

Heap-based buffer overflow in Microsoft's Graphics Component enables remote code execution across a broad swath of Windows operating system versions and Microsoft Office products. An unauthenticated network attacker who delivers a specially crafted file can trigger the overflow when the victim opens or renders the content, achieving full C:H/I:H/A:H compromise of the affected system. No public exploit code or CISA KEV listing is associated at time of analysis, but the breadth of affected products - spanning every supported Windows release and multiple Office generations - makes this a high-priority patching target.

Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow (CWE-122) triggered when a user opens a specially crafted document. The flaw affects a broad swath of Office product lines - Microsoft 365 Apps for Enterprise, Office 2016/2019/LTSC 2021/LTSC 2024 on Windows, and Office for Mac variants - with vendor patches available at specific build thresholds. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of patched-but-unconfirmed-exploited, though the enormous deployment footprint and phishing-friendly delivery model elevate real-world priority.

Heap-based buffer overflow in Microsoft Excel enables local code execution with full user-level privileges when a victim opens a specially crafted workbook file. Affected products span the entire current Office portfolio - Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise - on both Windows and macOS. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis, but the broad install base and file-delivery attack path make it a meaningful phishing vector.

Heap-based buffer overflow (CWE-122) in Microsoft Office Excel allows a local, unauthenticated attacker to execute arbitrary code with the privileges of the victim user by convincing them to open a specially crafted Excel file. The vulnerability affects a broad range of Office releases spanning Excel 2016 through Office LTSC 2024, on both Windows and macOS. Microsoft has released patches addressing this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span nearly every current Office release line - Excel 2016, Office 2019, Office LTSC 2021 and 2024 (Windows and Mac), Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office Online Server. An attacker who tricks a user into opening a malicious workbook can achieve full code execution at the victim's privilege level, with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution across nine distinct Office SKUs ranging from Excel 2016 through Microsoft 365 Apps for Enterprise. Exploitation requires a victim to open a specially crafted Excel file, making phishing and malicious-document delivery the primary attack vectors. Microsoft has released patched builds for all affected Windows variants; Mac-platform fixed builds should be confirmed via the MSRC advisory. No public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook. The vulnerability (CWE-122) affects all major Office perpetual and subscription editions across Windows and Mac, spanning Excel 2016 through Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, but the file-open trigger and full C/I/A impact make this a high-priority patch for organizations relying on email-delivered spreadsheets.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span the full Office portfolio - Excel 2016, Office 2019, 2021, 2024 LTSC editions, and Microsoft 365 Apps for Enterprise on both Windows and Mac. An attacker who can convince a user to open a malicious workbook can achieve full C:H/I:H/A:H compromise of the victim's session. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds.

Heap-based buffer overflow in Microsoft Office Excel enables local code execution across all major Office release tracks when a victim opens a maliciously crafted spreadsheet file. The vulnerability is rooted in improper heap memory management during Excel's file parsing routines (CWE-122), resulting in full compromise of confidentiality, integrity, and availability on the victim system. No public exploit code has been identified at time of analysis, but the breadth of affected versions - spanning Office 2016 through Microsoft 365 and Mac variants - makes this a high-priority patch target for enterprise environments.

Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver enables a local attacker already holding administrator-level privileges to execute arbitrary code with scope change - meaning successful exploitation can affect components beyond the vulnerable driver itself, most critically the Hyper-V hypervisor or co-hosted VMs. The flaw spans virtually all supported Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. Vendor-released patches are available via Microsoft MSRC; no public exploit identified at time of analysis.

Privilege escalation via heap-based buffer overflow (CWE-122) in Windows Hello affects Windows 10, Windows 11, and Windows Server 2019 across numerous build versions, allowing an authorized local attacker with high privileges to cross a security boundary and achieve full system compromise. The CVSS scope-change indicator (S:C) combined with C:H/I:H/A:H signals the overflow can propagate impact beyond the vulnerable Windows Hello component into other security principals - consistent with an admin-to-SYSTEM or authentication-subsystem boundary crossing. No public exploit or CISA KEV listing is present at time of analysis, but a vendor patch is available.

Heap-based buffer overflow in the Microsoft Windows Codecs Library HEIF Image Extension (versions 1.0.0.0 through 1.2.48.0) enables local code execution with full compromise of confidentiality, integrity, and availability on the affected system. Exploitation requires the victim to open or preview a maliciously crafted HEIF image file, making this vulnerability well-suited for file-based social engineering campaigns. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-supplied patch raising the component to version 1.2.48.0 is available.

Heap-based buffer overflow in Microsoft's Web Media Extensions component of the Windows Codecs Library allows an unauthenticated remote attacker to achieve arbitrary code execution by delivering a specially crafted media file. The EUVD identifies all versions from 1.0.0.0 through pre-1.2.42.0 as affected. Exploitation requires a user to interact with attacker-controlled media content - for example, opening a file or visiting a page that triggers media playback - after which the heap overflow can yield full C/I/A compromise of the user's session. No public exploit or active exploitation is identified at time of analysis.

Heap-based buffer overflow in Microsoft Office Word enables unauthenticated remote attackers to achieve arbitrary code execution at the privilege level of the target user. The vulnerability (CWE-122) is triggered when a victim opens a specially crafted Word document, covering Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise across both Windows and Mac platforms. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the broad product coverage and high CVSS of 8.8 make this a priority patching target.

Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) allows remote code execution on a victim's machine when the user connects to an attacker-controlled RDP server. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms full confidentiality, integrity, and availability impact at low attack complexity, constrained only by the requirement that the victim actively initiate the connection. Vendor patch has been released and no public exploit has been identified at time of analysis.

Heap-based buffer overflow in the Windows Work Folders synchronization component allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across Windows 10 and Windows 11. The vulnerability (CWE-122) stems from improper bounds checking in a privileged Work Folders process and requires only a standard user account with no secondary user interaction. Microsoft has released cumulative updates addressing the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through 1.2.7279.0 exclusive) allows a remote unauthenticated attacker to execute arbitrary code on the client machine when a user connects to an attacker-controlled or compromised RDP server. The flaw carries a CVSS 8.8 with full C/I/A impact, requiring only that the victim initiate an RDP session. No public exploit identified at time of analysis, and a vendor-released patch is available at version 1.2.7279.0.

Remote code execution in Microsoft Office Word via a heap-based buffer overflow (CWE-122) allows an unauthenticated network attacker to fully compromise a victim system upon opening a crafted document. All major Office licensing tracks are affected on both Windows and macOS, spanning Office 2016 through Microsoft 365 Apps for Enterprise. No CISA KEV listing or public exploit code is referenced in available data, but the low-complexity, no-privileges-required vector with full confidentiality, integrity, and availability impact makes this a critical priority for enterprise patch cycles.

Heap-based buffer overflow in Microsoft Office Word's document parsing engine enables remote unauthenticated attackers to execute arbitrary code on target systems when a user opens a specially crafted document. The vulnerability affects a wide range of Microsoft Office releases - Word 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - making the attack surface extremely broad. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis, though UI:R interaction remains the sole barrier to exploitation.

Heap-based buffer overflow in Microsoft Office Word enables remote unauthenticated code execution when a victim opens a specially crafted document. Affects the full breadth of Office deployments - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Word 2016, and their Mac equivalents - making the attack surface extremely wide. No public exploit identified at time of analysis, but the CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) with full C/I/A impact places this firmly in priority patching territory for enterprise environments.

Heap-based buffer overflow in Microsoft Word's document-parsing engine, arising from a numeric truncation error, enables remote code execution when a user opens a specially crafted Word document. The flaw spans a wide matrix of Office SKUs on both Windows and Mac - including Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - and carries CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting full compromise with the only friction being the required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the ubiquity of the Office install base makes this a high-priority patching target.

Remote code execution in Microsoft Office Word exposes virtually every Windows and macOS Office release channel - Word 2016, Office 2019, LTSC 2021/2024, 365 Apps for Enterprise, and Office for Mac - to full system compromise via a specially crafted document. The heap-based buffer overflow (CWE-122) fires during document parsing with no authentication required from the attacker, only standard user interaction to open the malicious file, yielding C:H/I:H/A:H impact under a low-complexity attack path. Microsoft has issued patches across all Windows release branches and flags macOS editions as affected; no public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow (CWE-122) that a remote attacker can trigger to run arbitrary code with the victim's privileges. It affects a broad set of Office builds including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and the macOS Office editions. Microsoft has released a patch; no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Remote code execution in Microsoft Office Outlook stems from a heap-based buffer overflow (CWE-122) that lets an unauthenticated network attacker run arbitrary code, per Microsoft's MSRC advisory and CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Word 2016, and Office for Mac builds; Microsoft has released fixed builds. No public exploit identified at time of analysis, but the critical severity and no-interaction network vector make it a high patch priority.

Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code on a victim's system when the victim opens a specially crafted Office document. Multiple product lines are affected, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and Mac variants of each. With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, this is a high-severity code execution path; no public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.

Heap-based buffer overflow in Microsoft SQL Server 2022 enables an authenticated low-privileged network attacker to execute arbitrary code on the database server host. Both the GDR and CU 26 servicing branches of SQL Server 2022 are affected, with Microsoft having released fixed builds in both channels. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and full network reachability make this a high-priority patching target for any organization running SQL Server 2022.

Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.

Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.

Heap-based buffer overflow in the Windows OLE DB component of Microsoft SQL Server 2017 and 2019 enables a network-adjacent unauthenticated attacker to achieve remote code execution when a user interacts with a malicious OLE DB data source. The vulnerability (CWE-122, CVSS 8.8) affects multiple servicing branches across both SQL Server versions, covering both Cumulative Update and General Distribution Release tracks. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected branches.

Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable via a heap-based buffer overflow triggered when a victim opens a specially crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates unauthenticated network-reachable exploitation requiring only that the target developer open an attacker-supplied artifact - a realistic social-engineering scenario in development environments. Full compromise of confidentiality, integrity, and availability of the victim's system is possible upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable by unauthenticated network-reachable attackers via a heap-based buffer overflow in the IDE, though user interaction is required to trigger the flaw. The CVSS score of 8.8 reflects the high impact potential - full compromise of confidentiality, integrity, and availability - moderated only by the need for a developer to open or process a crafted file. A vendor patch has been released; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.

Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.

Heap-based buffer overflow (CWE-122) in multiple Microsoft Office versions enables remote code execution when a victim opens a specially crafted document. The CVSS vector (AV:N/AC:H/PR:N/UI:R) confirms network-based delivery without attacker authentication, but exploitation requires high attack complexity and active user interaction - consistent with a maliciously crafted Office file that triggers a memory corruption condition in Office's document parsing subsystem. Affected builds span Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac-platform variants; patched build numbers are available for Windows-based SKUs per EUVD-2026-73290, while Mac SKU fix versions are not specified in available data.

Heap-based buffer overflow in Windows Imaging Component (WIC) enables network-delivered code execution on any Windows system where a user opens a crafted image file. The flaw affects an extremely broad surface spanning Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making it relevant to virtually every Windows-based enterprise environment. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, though the low-complexity, no-privileges-required vector is conducive to phishing-style mass targeting.

Remote code execution in Microsoft SQL Server 2017 and 2019 is enabled by an integer overflow that precipitates a heap-based buffer overflow (CWE-122), allowing an unauthenticated network attacker to execute arbitrary code on the database host. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low attack complexity and no required privileges, though some user interaction is required, moderating fully automated exploitation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all affected servicing branches.

Heap-based buffer overflow in Microsoft SQL Server 2017 and 2019 enables unauthenticated network attackers to execute arbitrary code on the database host with high impact across confidentiality, integrity, and availability. The flaw (CWE-122) is reachable without credentials over the network, though user interaction is required per the vendor CVSS vector (UI:R), placing the CVSS base score at 8.8. A vendor patch is available, and no public exploit or CISA KEV listing has been identified at time of analysis.

Heap-based buffer overflow in Microsoft SQL Server (versions 2017 through 2025) enables any authenticated network attacker holding a low-privileged SQL Server account to achieve full remote code execution on the database host. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires no user interaction and is low-complexity once a valid login is held, with complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; Microsoft has released patches across all affected major release branches including both CU and GDR servicing tracks.

Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.