Memory Corruption

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full code execution upon successful exploitation, with high impact across confidentiality, integrity, and availability. The vulnerability requires user interaction - such as opening a malicious file or running a crafted application - making social engineering a likely delivery vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Microsoft Security Response Center has acknowledged the issue.

Use-after-free memory corruption in Microsoft Office Word enables local code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a social-engineering-dependent attack - no system privileges are required, but the victim must open a malicious file, making phishing or drive-by document delivery the likely delivery mechanism. All three impact dimensions (Confidentiality, Integrity, Availability) are rated High, yielding a 7.8 CVSS score; no public exploit or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.

Type confusion (CWE-843) in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms the attack is file-based: no attacker privileges are required, but the target user must open a malicious document, making this a high-impact phishing-delivery vector. No public exploit code and no CISA KEV listing are identified at time of analysis, but the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a critical priority for organizations where Excel is deployed.

Out-of-bounds write (CWE-787) in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file, yielding full confidentiality, integrity, and availability impact at CVSS 7.8. The attack is file-delivery based - typical phishing or drive-by download - requiring no system privileges from the attacker but requiring the victim to open the malicious document. No public exploit code or CISA KEV listing has been identified at time of analysis.

Type confusion (CWE-843) in Microsoft Office Excel enables local code execution by an unauthenticated attacker when a victim opens a specially crafted Excel document. The CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a file-borne attack requiring user interaction but no attacker privileges, with full High/High/High C/I/A impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the memory corruption tag suggests the type confusion leads to exploitable heap or stack corruption.

Type confusion in Microsoft Office Excel's file-processing engine enables remote code execution when a user opens a specially crafted spreadsheet document. The vulnerability carries a CVSS 8.8 High score with full confidentiality, integrity, and availability impact against the Excel process, requiring only user interaction to trigger - the classic phishing-attachment threat model. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Remote code execution via use-after-free memory corruption in Windows DNS enables unauthenticated network attackers to achieve full system compromise against exposed DNS servers. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network-reachable, zero-privilege exploitation, though high attack complexity signals that reliable triggering requires precise memory state manipulation rather than simple packet delivery. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Privilege escalation in Windows Desktop Window Manager (DWM) is possible via a use-after-free memory corruption flaw exploitable by a locally authenticated low-privileged attacker. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected system, consistent with elevation to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.

Local privilege escalation in Windows Autopilot on Windows 11 (versions 24H2 and 25H2) allows a low-privileged authenticated local attacker to achieve full system compromise through a use-after-free memory corruption flaw (CWE-416). The CVSS vector (AV:L/AC:H/PR:L) confirms local access with elevated complexity - consistent with a race condition or specific heap state requirement inherent to UAF exploitation. Microsoft has released patches at builds 10.0.26100.9168 and 10.0.26200.9168; no public exploit or CISA KEV active exploitation listing has been identified at time of analysis.

Privilege escalation via use-after-free in Windows Autopilot on Windows 11 allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level or elevated access. The vulnerability stems from improper memory management in the Autopilot provisioning component, where a freed memory region can be referenced again under a race condition (AC:H). Affected builds span both Windows 11 24H2 and 25H2 prior to the 9168 patch revision; no public exploit or CISA KEV listing has been identified at time of analysis.

Use-after-free memory corruption in Windows Autopilot on Windows 11 (24H2 and 25H2) enables a locally authenticated, low-privileged user to escalate privileges, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The attack requires local access and high complexity (AV:L/AC:H/PR:L), meaning an attacker must meet specific memory state or race conditions - reducing opportunistic risk but not eliminating it for determined local threat actors. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Autopilot on Windows 11 (versions 24H2, 25H2, and 26H1) is caused by a use-after-free memory corruption flaw (CWE-416) that allows a locally authenticated low-privileged attacker to achieve SYSTEM-level access. The CVSS 7.0 score reflects full CIA impact offset by a strictly local attack vector and high attack complexity, consistent with a race condition or heap manipulation requirement rather than a trivial trigger. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows Autopilot on Windows 11 versions 24H2 and 25H2 arises from a use-after-free memory corruption flaw, enabling a local low-privileged attacker to achieve full SYSTEM-level access with complete confidentiality, integrity, and availability impact. High attack complexity (AC:H) constrains opportunistic exploitation, making this most relevant to insider threat and post-breach lateral movement scenarios rather than broad automated attacks. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Privilege escalation via use-after-free in Windows Win32K (win32k.sys) affects Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 in both full and Server Core installations. An authenticated local attacker exploiting CWE-416 memory corruption in the Win32K kernel subsystem can elevate from low-privileged user to SYSTEM-level access. No public exploit or CISA KEV listing has been identified at time of analysis; however, Microsoft has released a patch addressing all affected build ranges.

Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.

Use-after-free memory corruption in Microsoft Office enables an attacker to execute arbitrary code in the context of the victim user, scoring CVSS 7.8 (High). Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. Exploitation requires a victim to open a specially crafted Office document - a delivery mechanism trivially achieved via phishing - and no public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft Office's ubiquitous enterprise footprint and adversary interest in document-borne malware elevate this beyond a theoretical risk.

Type confusion (CWE-843) in Microsoft Office enables local code execution across multiple Office product lines when a user opens a crafted file. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. With high confidentiality, integrity, and availability impact and user-interaction-only as the sole prerequisite, the vulnerability presents meaningful risk in phishing and malicious-document delivery scenarios. No public exploit identified at time of analysis, though a vendor patch is available.

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to unauthenticated remote attackers over the network, resulting in high-severity information disclosure. Affected software spans .NET 8.0, 9.0, and 10.0 runtimes and Microsoft Visual Studio 2022 and 2026, all of which embed MsQuic as their QUIC and HTTP/3 transport layer. No CISA KEV listing or public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack vector gives this a realistic exposure profile for any .NET service accepting QUIC connections from untrusted networks.

Remote code execution in Windows Deployment Services (WDS) allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on the affected server. The flaw spans virtually every supported Windows Server release (2012 through 2025) plus Windows 10 clients running the WDS role, and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released patches; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low-complexity, no-auth network vector makes this a high patch priority.

Privilege escalation in the Windows Capability Access Management Service (camsvc) allows a local authenticated attacker to gain SYSTEM-level access via a use-after-free (UAF) memory corruption flaw. The vulnerability spans a wide surface including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2019, 2022, and 2025, covering both standard and Server Core installations. No public exploit code or active exploitation has been confirmed at time of analysis; however, the breadth of affected builds and the high CIA impact upon successful exploitation make patching a priority for organizations with multi-user or shared Windows environments.

Privilege escalation in Windows Desktop Window Manager (DWM) Core Library via a use-after-free memory corruption flaw allows a locally authenticated, low-privileged attacker to achieve full SYSTEM-level code execution. Affected systems span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core), representing a broad cross-section of the active Microsoft OS estate. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide version coverage make patching a near-term priority.

Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.

Remote code execution in Microsoft Active Directory Certificate Services (AD CS) is achievable by low-privileged authenticated network attackers through a use-after-free (CWE-416) memory corruption flaw. All supported Windows Server versions from 2012 through 2025 are affected, along with Windows 10 versions 1607 and 1809. Microsoft has released patches via the MSRC update guide; no public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version coverage make this a high-priority remediation item.

Remote code execution in Windows DNS exposes a wide range of Windows Server and desktop systems to unauthenticated exploitation from adjacent network positions. Rooted in a CWE-787 out-of-bounds write triggered during DNS processing, the flaw carries a CVSS 8.8 score reflecting full confidentiality, integrity, and availability impact with no credentials or user interaction required. No public exploit identified at time of analysis, but a vendor-released patch is available and the broad affected version list - spanning Windows 10/11 and Server 2019 through 2025 - makes prioritized patching urgent for any environment where the DNS service is internet-edge or internally exposed.

Remote code execution in Microsoft's QUIC transport implementation (MsQuic) allows an unauthenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) in the QUIC protocol handler across supported Windows 11 (23H2/24H2/25H2/26H1) and Windows Server 2022/2025 builds. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical, reflecting no authentication or user interaction and full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Remote code execution in Windows LDAP (Lightweight Directory Access Protocol) affects a broad swath of Microsoft Windows desktop and server editions, from Windows 10 through Windows 11 and Windows Server 2012 through 2025. A use-after-free memory corruption flaw (CWE-416) in the LDAP client implementation allows a network-accessible, unauthenticated attacker to achieve arbitrary code execution with high confidentiality, integrity, and availability impact, contingent on user interaction - most likely the victim system initiating or being induced to make an LDAP connection to an attacker-controlled server. No public exploit identified at time of analysis and no CISA KEV listing, but the CVSS score of 8.8 and the breadth of affected Windows versions make this a high-priority patching target.

Privilege escalation via use-after-free in the Windows Kernel affects Windows 11 (versions 23H2, 24H2, 25H2, and 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to elevate to SYSTEM-level control. The CWE-416 root cause combined with high attack complexity (AC:H) indicates exploitation likely requires precise timing or race-condition engineering rather than a trivial one-shot trigger. Vendor patches are available via MSRC; no active exploitation has been confirmed by CISA KEV at time of analysis.

Remote code execution via use-after-free in the Windows DNS service allows an authenticated, network-based attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025 and is exploitable over the network, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit identified at time of analysis; vendor-released patches with specific build targets are available via the Microsoft Security Response Center.

Privilege escalation in Windows Schannel via a use-after-free (CWE-416) memory corruption flaw allows a locally authenticated, low-privileged attacker to elevate privileges - likely to SYSTEM - on Windows 11 and Windows Server 2025 systems. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects reliable, low-complexity exploitation requiring only a standard user account and no user interaction. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in the Windows Graphics Kernel exposes a use-after-free condition that allows a low-privileged local user to achieve SYSTEM-level code execution. Affected products span Windows 10, Windows 11, and Windows Server 2016 through 2025 across 15 distinct version ranges, making the blast radius extremely broad. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all affected builds via the MSRC advisory.

Privilege escalation in Windows Kerberos via a use-after-free memory corruption flaw allows a locally authenticated attacker to gain SYSTEM-level access on affected Windows systems. The vulnerability spans nearly all current Microsoft Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis; Microsoft has released patches addressing all affected builds.

Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 installations. The flaw (CWE-416) involves kernel memory mismanagement where freed memory can be accessed under specific high-complexity timing conditions, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all affected versions.

Privilege escalation in Windows Telephony Service (TAPI) via a use-after-free memory corruption flaw enables a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected hosts. The vulnerability spans a broad range of Microsoft Windows versions from Server 2012 through Windows 11 26H1 and multiple Windows Server 2022/2025 builds, confirmed by Microsoft MSRC and catalogued under EUVD-2026-56640. No public exploit code or active exploitation has been identified at time of analysis, though the pervasive Windows deployment footprint makes patch deployment a meaningful operational priority.

Local privilege escalation via use-after-free (CWE-416) in the Windows Telephony Service (TAPI) affects every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized low-privileged local attacker can trigger improper memory lifecycle management in the privileged tapisrv process, achieving full confidentiality, integrity, and availability impact on the compromised system. No public exploit code has been identified at time of analysis and high attack complexity constrains opportunistic mass exploitation, but vendor-released patches are available and should be prioritized given the ubiquitous deployment footprint.

Privilege escalation via use-after-free memory corruption in the Windows Telephony Service (TAPI) affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An authorized local attacker with low-privilege credentials can exploit a race condition to corrupt freed memory within the telephony service process, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed by CISA KEV, and no public exploit has been identified at time of analysis; Microsoft has released patched builds for all affected platforms.

Local privilege escalation in the Windows Telephony Service (TAPI) allows an already-authenticated, low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans a wide range of Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the availability of a vendor patch make patching urgent in environments where Telephony Service is active.

Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects a broad spectrum of Windows client and server releases, from Windows Server 2012 through Windows 11 25H2. An authenticated local attacker can exploit this flaw with low complexity and no user interaction to achieve full SYSTEM-level privileges (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, but the low-complexity local exploitation profile - combined with the near-universal deployment footprint of Windows - makes this a high-priority patch for both endpoint and server environments.

Privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged local attacker to gain SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The root cause is CWE-416 (Use After Free), a memory-safety flaw in the MDM component where a freed memory object is dereferenced, enabling controlled memory corruption that can redirect execution to attacker-supplied code. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV entry is identified at time of analysis.

Privilege escalation via use-after-free in the Windows Telephony Service (TAPI) allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access across a broad range of Windows desktop and server releases. The vulnerability affects Windows 10, Windows 11 (all current feature releases), and Windows Server 2012 through 2025, representing near-universal coverage of supported and legacy Microsoft platforms. No public exploit identified at time of analysis; vendor-released patches are available via Microsoft Update.

Use-after-free in Windows Winlogon enables a locally authenticated attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server editions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires an existing low-privileged foothold and high attack complexity, placing this squarely in the post-compromise privilege escalation category rather than an initial access vector. No public exploit identified at time of analysis; Microsoft has released patches covering all affected build branches.

Privilege escalation in Windows Installer (msiexec) on Windows 11 and Windows Server 2025 allows a locally authenticated low-privileged user to gain SYSTEM-level privileges by exploiting a use-after-free memory corruption condition. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core deployments. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft.

Privilege escalation via use-after-free in the Windows Bind Filter Driver affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing a locally authenticated attacker to gain SYSTEM-level privileges. The memory corruption flaw (CWE-416) is triggered through the kernel-mode filter driver component, yielding full confidentiality, integrity, and availability impact per CVSS. SSVC signals no confirmed exploitation and non-automatable attack path; a vendor patch is available and should be prioritized given the total technical impact rating.

Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated low-privilege attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025. The vulnerability carries a CVSS 7.0 score with high attack complexity (AC:H), indicating exploitation likely requires precise timing or heap-grooming to succeed. No public exploit identified at time of analysis, and Microsoft has released patches addressing all affected build versions.

Local code execution in the Windows DHCP Client exposes Windows 11 and Windows Server 2025 systems to privilege escalation by authorized local users via a use-after-free memory corruption condition. The flaw (CWE-416) requires high attack complexity - consistent with race-condition-dependent UAF exploitation - and an existing local foothold (PR:L, AV:L), limiting its practical reach compared to its full C:H/I:H/A:H impact triad. No public exploit has been identified at time of analysis, and Microsoft has released a vendor-confirmed patch.

Local privilege escalation in Windows Application Information Services (appinfo) allows an authenticated local user to gain SYSTEM-level privileges through a use-after-free memory corruption flaw (CWE-416). Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, plus Windows Server 2025 and its Server Core variant - all current, widely-deployed Microsoft platforms. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and full CIA impact (C:H/I:H/A:H) make this a high-priority patch for any environment where untrusted or low-privileged users have local access.

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to elevate to SYSTEM-level access by exploiting a use-after-free memory corruption condition in the kernel-mode driver. The flaw spans a wide swath of Microsoft's supported and legacy Windows ecosystem, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, making the patching surface unusually broad. No public exploit code or active exploitation has been confirmed at time of analysis; however, the combination of kernel-level impact, full C/I/A compromise upon success, and low privilege prerequisite makes this a meaningful post-compromise escalation risk.

Local privilege escalation in the Windows Graphics Kernel exposes a broad range of Windows 10, Windows 11, and Windows Server editions to a use-after-free memory corruption flaw (CWE-416). An attacker holding a low-privileged local account who can satisfy a race condition in the kernel graphics subsystem can gain SYSTEM-level control of the affected host. Microsoft has released patches across all identified product lines; no public exploit has been identified at time of analysis.

Privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver affects Windows 10, 11, and Server 2016 through 2025, enabling a low-privileged local attacker to achieve full kernel-level control via a use-after-free memory corruption in a kernel-mode driver. The CVSS AC:H rating indicates the exploit path likely requires precise timing - consistent with a race condition in driver memory management - which reduces but does not eliminate real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch from Microsoft is available.

Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.

Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.

Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.

Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 enables code execution within the application's process when a user opens a specially crafted PSM part model file. Affected versions are SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7, confirmed by Siemens PSIRT via advisory SSA-621657. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Use-after-free in Siemens Solid Edge SE2025 and SE2026 enables arbitrary code execution in the context of the current process when a user opens a specially crafted DFT file. Both affected annual release branches are vulnerable until patched - SE2025 prior to V225.0 Update 15 and SE2026 prior to V226.0 Update 7 - as confirmed by Siemens Security Advisory SSA-621657. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 AC:H rating indicates non-trivial exploit development is required.

Use-after-free memory corruption in Siemens Solid Edge SE2025 and SE2026 allows code execution in the context of the current user process when a specially crafted DFT (draft) file is parsed. Affected are all SE2025 releases prior to V225.0 Update 15 and all SE2026 releases prior to V226.0 Update 7, as confirmed by Siemens advisory SSA-621657. No public exploit code or active exploitation has been identified at time of analysis, and the local attack vector combined with required user interaction meaningfully constrains real-world exposure.

Out-of-bounds write in Siemens Solid Edge SE2025 and SE2026 allows code execution within the application process when a user opens a specially crafted DFT file. The vulnerability resides in the DFT file parser and can deliver full confidentiality, integrity, and availability impact on the vulnerable system if a victim is induced to open a malicious file. No public exploit identified at time of analysis, and the product is not listed in CISA KEV; however, Siemens has released patched versions and published advisory SSA-621657.

Type confusion in the Send Email node of the n8n workflow automation platform allows an attacker-supplied non-string expression value to pass uncoerced into Nodemailer, which then interprets it as a file path or URL rather than literal email content - enabling arbitrary local file disclosure and server-side request forgery (SSRF). Affected are n8n versions before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1, as confirmed by GitHub Security Advisory GHSA-2x35-3fw4-9jr4. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; exploitation depends on a specific non-default workflow configuration that requires an unauthenticated webhook, pre-configured SMTP credentials, and direct mapping of untrusted input into the email body field.

Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.

Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-controlled data before a destination buffer in S-EL1 memory via RSA NOPAD encrypt and decrypt operations. The flaw exists in both the mbedTLS software cryptographic backend and the NXP SE050 hardware driver: when the caller supplies an input length exceeding the RSA modulus size, an unsigned integer underflow in the size subtraction produces a huge value, causing a subsequent memcpy to write well before the intended destination buffer in the secure-world heap. No public exploit has been identified at time of analysis; the upstream fix is available at commit 7b8b494 in the OP-TEE GitHub repository.

Use-after-free in the OP-TEE OS Trusted Application loader (all versions through 4.10.0) allows an attacker who controls a signed Trusted Application to corrupt S-EL1 secure-world kernel memory. By setting TA_FLAG_CONCURRENT in the TA's signed header - a flag reserved exclusively for pseudo-TAs - an adversary can force two concurrent sessions to share a context without locking, triggering a race on uctx->vm_info.regions that frees vm_region nodes still referenced by live mappings. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the high CVSS 4.0 score of 8.4 and confirmed patch availability underscore its seriousness in TEE-dependent deployments.

Heap overflow in GIMP's Seattle Filmworks file loader allows an attacker who tricks a user into opening a specially crafted SFW file to write several kilobytes of attacker-controlled data beyond the intended buffer, resulting in memory corruption that can lead to arbitrary code execution or denial of service. Affected platforms confirmed via CPE data are Red Hat Enterprise Linux 6 through 9 with GIMP installed. No public exploit code has been identified and this CVE is not listed in CISA's KEV catalog, but the high CVSS 7.8 score reflects the full confidentiality, integrity, and availability impact achievable once a victim is socially engineered into opening the malicious file.

Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.

Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated remote attacker to crash the Ruby process by supplying a crafted truncated JSON stream with duplicate object keys to any application using JSON::ResumableParser. The root cause is that the parser's input buffer is freed without resetting the state.start, state.cursor, and state.end pointers, which are subsequently dereferenced when partial_value processes the duplicate-key warning path via cursor_position, producing a heap-use-after-free confirmed by AddressSanitizer and a native SIGSEGV on official RubyGem releases. Impact is limited to availability - no code execution or information disclosure is claimed - and no public exploit code has been identified at time of analysis, though a private end-to-end TCP proof-of-concept was submitted with the advisory.

Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to elevate their own access to full administrator by exploiting a type-confusion flaw (CWE-843) in the REST privilege update endpoint. Exploitation is constrained to specific role configurations, but the network-accessible attack surface and high confidentiality and integrity impact (VC:H/VI:H per the CVSS 4.0 vector) make this a meaningful insider or compromised-account risk in enterprise DevOps environments. A vendor-released patch is available in the Nexus Repository 3.95.0 release; no public exploit code or CISA KEV listing has been identified at time of analysis.

Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupware through Rollout 524, where an unauthenticated attacker can crash the server by sending a specially crafted JSON body to a vulnerable API endpoint - a payload as small as 8 characters beginning with a number triggers an out-of-bounds stack write. The reliably reachable impact is a server crash, but the underlying buffer overflow could escalate to full server compromise if a stack canary is disclosed via a separate vulnerability. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the high CVSS 4.0 base score (9.5) reflects the worst-case RCE potential rather than confirmed code execution.

Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware through Rollout 524, where the Webbox endpoint "//serverClient_close.html" fails to bounds-check multiple form-data parameters. An attacker submitting over-long parameter values triggers an out-of-bounds write (CWE-787) that crashes the server; if a stack canary can be leaked via a separate flaw, the memory corruption could escalate to full server compromise. No public exploit identified at time of analysis, and this CVE is one of 22 reported in the David platform by researchers at InfoGuard/NCSC.ch.

Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration suite affects all releases through Rollout 524. Multiple file-upload handlers fail to bounds-check the supplied filename, so an unauthenticated attacker who sends an upload request with an excessively long filename triggers an out-of-bounds stack write (CWE-787) that reliably crashes the server; where the stack layout is favorable or a stack canary can be leaked via a separate flaw, the same overflow may yield code execution and full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw was reported by Switzerland's NCSC and detailed by InfoGuard Labs as one of 22 CVEs in David.

Out-of-bounds kernel memory read and GPU use-after-free in Imagination Technologies Graphics DDK exposes systems to kernel memory disclosure and potential arbitrary page corruption by local, non-privileged users. Incorrect array index validation in the GPU driver stack allows crafted GPU system calls to bypass kernel memory safety boundaries, resulting in both information disclosure (kernel memory read) and high-availability impact (UAF of arbitrary GPU-managed pages). No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), indicating very low current exploitation probability.

Out-of-bounds write in Autodesk Revit's PDF parser allows arbitrary code execution in the context of the current user process when a maliciously crafted PDF file is opened. The CVSS vector (AV:L/UI:R) confirms exploitation requires local user interaction - a victim must be socially engineered into opening a weaponized PDF. Impact scope covers full confidentiality, integrity, and availability of the running process (C:H/I:H/A:H), consistent with classic memory-corruption RCE chains. No public exploit identified at time of analysis and no CISA KEV listing, but the vendor-confirmed write primitive and RCE potential make this a credible threat for targeted attacks against AEC professionals.

Out-of-bounds heap write in FFmpeg's native GoPro CineForm HD (CFHD) decoder affects versions 4.4 through 8.x, allowing remote attackers to corrupt heap memory by supplying a crafted AVI file that is opened or probed by a vulnerable build. The root failure - missing output-width bounds enforcement in the transform-type-2 reconstruction path - causes horiz_filter_clip() to write 16-bit sample rows far beyond the allocated frame buffer, with a concrete escalation path to arbitrary code execution through overwrite of a live cleanup callback pointer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; three upstream fix commits and PR #23898 are available at code.ffmpeg.org pending a formal stable release.

Out-of-bounds write in the Contiki-NG MQTT client (os/net/app-layer/mqtt/mqtt.c) lets a malicious or compromised MQTT broker overflow a 65-byte topic[] buffer and corrupt the adjacent payload_chunk pointer, producing an arbitrary-pointer-write primitive that can escalate to remote code execution on embedded targets lacking memory protection. The flaw stems from parse_publish_vhdr() setting topic_len_received=1 before enforcing the 64-byte topic length limit, so an over-length topic split across TCP segments bypasses the guard on parser re-entry and reaches a memcpy() that trusts the unvalidated 16-bit topic_len. Because the stack has no TLS, the plaintext channel also exposes devices to network man-in-the-middle injection; there is no public exploit identified at time of analysis and it is not in CISA KEV.

Use-After-Free in Autodesk Revit's PDF parser allows arbitrary code execution, sensitive data disclosure, or application crash when a user opens a maliciously crafted PDF file. Affected versions span Revit 2026 (prior to 2026.5.0) and Revit 2027 (prior to 2027.2.0), with full high-impact potential across confidentiality, integrity, and availability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via advisory ADSK-SA-2026-0011.

Use-after-free in Skia, Chrome's 2D graphics rendering engine, enables arbitrary code execution within the renderer sandbox in Google Chrome versions prior to 151.0.7922.109. Exploitation requires an attacker to have already achieved renderer process compromise, making this a second-stage chained payload rather than a standalone initial access vector - a prerequisite that materially constrains real-world exploit delivery. No public exploit code has been identified at time of analysis, and SSVC confirms Exploitation: none and Automatable: no, though C/I/A impacts are rated High within the sandboxed scope.

Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.109 stems from a use-after-free in the Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 due to a scope change, though exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and no CISA KEV listing, but Chrome renderer/sandbox-escape bugs are historically high-value targets.

Out-of-bounds write in Skia enables sandbox escape in Google Chrome prior to 151.0.7922.109, allowing a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is explicitly a second-stage chaining vulnerability - it does not independently achieve initial code execution but elevates a renderer-level compromise to full OS-level access. No public exploit code or active exploitation has been identified at time of analysis, though the scope-changing nature of this vulnerability makes it a high-value target for chained browser exploit chains.

Use-after-free in Chrome's Views component prior to version 151.0.7922.109 enables a sandbox escape for remote attackers who have already compromised the renderer process, via a crafted HTML page. The CVSS scope change (S:C) confirms the potential for OS-level code execution beyond Chrome's renderer sandbox, earning a Critical severity designation from the Chromium security team despite an NVD score of 8.3. No public exploit code or CISA KEV confirmation has been identified at time of analysis, though this vulnerability class is a high-value target frequently weaponized as the second stage of browser exploit chains by sophisticated threat actors.

Sandbox escape in Google Chrome's Media component on Windows (versions prior to 151.0.7922.109) lets a remote attacker break out of the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 9.6 because a successful escape yields full confidentiality, integrity, and availability impact beyond the sandboxed process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome UAF media bugs are historically attractive targets.

Sandbox escape in Google Chrome for Android before 151.0.7922.109 stems from a use-after-free in the WebGL graphics component (CWE-416), letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Chromium rates this Critical and CVSS scores it 9.6 with a scope change (S:C), reflecting the cross-boundary sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Chrome WebGL memory-corruption bugs are historically high-value exploitation targets.

Sandbox escape in Google Chrome's Web Authentication (WebAuthn) component before 151.0.7922.109 lets a remote attacker who lures a victim to a crafted HTML page corrupt memory via a use-after-free and potentially break out of the renderer sandbox. Rated High by Chromium and scored CVSS 9.6 (scope-changed), it affects the vast installed base of desktop Chrome; Google has shipped a fixed Stable-channel build. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Use-after-free in the Chrome Extensions subsystem allows sandboxed arbitrary code execution in Google Chrome prior to 151.0.7922.109, requiring a victim to install a crafted malicious extension. The UAF (CWE-416) memory corruption condition is exploitable remotely but demands high attack complexity and active user interaction, resulting in code execution confined within Chrome's sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis; Google has released a fix in the stable channel update of 01 August 2026.

Use-after-free exploitation in Google Chrome's Media component on Windows enables sandbox escape for attackers who have already compromised the renderer process. Chrome versions prior to 151.0.7922.109 on Windows are affected, with a crafted HTML page serving as the trigger mechanism to corrupt freed memory and break out of the renderer sandbox. SSVC rates current exploitation as none and non-automatable, though the total technical impact class reflects full OS-level compromise if the two-stage attack chain is completed successfully.

Remote code execution within the Chrome renderer sandbox is possible in Google Chrome versions prior to 151.0.7922.109 through an out-of-bounds write flaw in the V8 JavaScript engine, triggerable by a crafted HTML page. An unauthenticated remote attacker needs only to lure a victim to a malicious page, achieving code execution confined to the sandboxed renderer process. No public exploit or active exploitation has been identified at time of analysis; however, the CVSS 8.8 score and SSVC total technical impact classification indicate significant potential consequences if exploitation is developed.

Use-after-free in the Views UI rendering component of Google Chrome (all versions prior to 151.0.7922.109) enables a remote attacker to corrupt heap memory via a crafted HTML page, requiring the victim to perform specific UI gestures. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a fully network-delivered attack with no authentication barrier, though high attack complexity and mandatory user interaction substantially reduce opportunistic exploitation likelihood. No public exploit code or CISA KEV listing has been identified at time of analysis; Google rated this High severity internally and shipped a patch in the stable channel update.

Use-after-free in Google Chrome's Views UI framework on Windows, fixed in version 151.0.7922.109, exposes users to heap corruption with full confidentiality, integrity, and availability impact. Exploitation requires convincing a target to perform specific UI gestures while visiting a crafted HTML page, making this a social-engineering-dependent but high-consequence flaw. No public exploit code or CISA KEV listing has been identified at the time of analysis; however, the severity and platform breadth make patching urgent for Windows enterprise fleets.

Sandbox escape in Google Chrome for Android before 151.0.7922.109 stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/GPU translation layer, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt GPU-process memory and potentially break out of the renderer sandbox. Chromium rates the issue Critical and a vendor patch is available, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. The high CVSS 9.6 reflects the scope-changing sandbox-escape potential rather than confirmed in-the-wild use.

Use-after-free in the Payments component of Google Chrome prior to 151.0.7922.109 enables a sandbox escape when an attacker has already compromised the renderer process. Exploitation requires chaining a prior renderer compromise with delivery of a crafted HTML page, placing this firmly in the category of multi-stage browser exploitation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and SSVC classifies exploitation status as none, though the technical impact is rated total due to the full sandbox escape capability.