Memory Corruption

Local privilege-escalation-class memory corruption in the Linux kernel's blk-mq multi-queue block layer allows a local low-privileged user to trigger a use-after-free when submitting a bio: if the task sleeps after peeking a cached request but before popping it, the plug flush frees the cached_rqs, leaving a dangling pointer. The flaw affects mainline and multiple stable trees (6.1.x, 6.5.x, 6.6.x, 6.7) and carries CVSS 7.8 (high CIA impact). There is no public exploit identified at time of analysis, and the very low EPSS (0.15%, 5th percentile) reflects the difficulty of winning the required timing race rather than low structural severity.

Kernel use-after-free in ksmbd, the Linux in-kernel SMB3 server, occurs when a durable handle reconnect succeeds but smb2_open() then hits a later error path. The cleanup logic double-frees the same ksmbd_file (once via ksmbd_fd_put and again via the non-session-aware ksmbd_put_durable_fd), freeing the file object while its volatile-id entry remains published in the session table. This dangling entry can be reused, giving a remote SMB client a path to kernel memory corruption; it is not in CISA KEV and no public exploit identified at time of analysis, with EPSS at a low 0.17%.

Local privilege escalation risk arises from a use-after-free in the Linux kernel's NFC LLCP subsystem, where llcp_sock_release() unconditionally unlinks a socket from the local sockets list even when the socket is still in the connecting state and actually resides on the connecting list. A local user able to open NFC LLCP sockets can trigger memory corruption during socket release, with high confidentiality, integrity and availability impact per the CVSS 7.8 rating. No public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a local-only, hardware-gated attack surface.

Local privilege-scoped memory corruption in the Linux kernel's IPsec/xfrm subsystem allows a low-privileged user with network-configuration capability to trigger a massive out-of-bounds kernel write. The xfrm_state_mtu() helper computes an ESP MTU in unsigned modulo-2^32 arithmetic; by installing an IPv4 ESP tunnel SA with an oversized truncated auth key, a tiny interface MTU, and a large XFRMA_TFCPAD value, an attacker forces the result to underflow, and esp_output() later treats it as a negative signed length passed to memset() — producing a near-16 EB write of zeroes at the skb tail. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and the flaw is not in CISA KEV, but the ubiquity of the Linux kernel makes patching important.

Local privilege escalation via use-after-free in the Linux kernel accel/rocket driver (Rockchip NPU accelerator) allows an authenticated local user with access to the accel device node to dereference freed slab memory. The flaw stems from rocket_ioctl_create_bo() registering a GEM handle in the file IDR before fallible operations (sgt allocation, drm_mm insert, iommu_map); on failure the object is freed while the handle stays live, and any later PREP_BO/FINI_BO/SUBMIT ioctl triggers the UAF. No public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile).

Kernel memory corruption in the Linux netfilter SYNPROXY module (synproxy_tstamp_adjust) lets remote hosts trigger a use-after-free write against systems that deploy the SYNPROXY target for TCP SYN-flood mitigation. When processing a cloned or non-linear packet, skb_ensure_writable() reallocates and frees the old skb->head, but the code then writes the recomputed TCP checksum through a stale header pointer - landing in freed slab memory or leaving a wrong on-wire checksum. Rated CVSS 9.8 by the automated feed, but EPSS is only 0.18% (7th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.

Use-after-free in the Linux kernel's IPv4 sysctl teardown path (ipv4_sysctl_exit_net) can corrupt kernel memory because net->ipv4.sysctl_local_reserved_ports is freed before unregister_net_sysctl_table(), leaving a window where threads accessing /proc/sys/net/ipv4/ip_local_reserved_ports reference freed memory. A local low-privileged attacker able to trigger network namespace teardown could leverage the dangling pointer for memory corruption, information disclosure, or potential privilege escalation. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not on CISA KEV, consistent with a fix delivered quietly through the kernel stable process.

Use-after-free in the Linux kernel's ALSA OSS PCM emulation layer allows a local, authenticated attacker holding write access to the OSS setup procfs entry to corrupt kernel memory and potentially escalate privileges, if the attacker can also force a kstrdup allocation failure during snd_pcm_oss_proc_write(). Successful triggering leaves a freed setup entry linked on setup_list, so a subsequent OSS PCM device open dereferences freed memory (CWE-416), yielding High confidentiality, integrity and availability impact; the independent reassessment rates the vector as local with High attack complexity and PR:L, so although the base score is 7.8, exploitation is limited to kernels built with CONFIG_SND_PCM_OSS and requires a non-deterministic ENOMEM condition, making real-world exploitation difficult. EPSS is low at 0.17% (6th percentile), there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor patches are available in stable releases 6.12.93, 6.18.35, 7.0.12 and 7.1.

Out-of-bounds kernel write in the Linux kernel's ethtool CMIS CDB handling (cmis_cdb_process_reply) allows a malicious or buggy SFP/QSFP transceiver module to corrupt kernel memory by returning a CDB reply whose rpl_len exceeds the expected rpl_exp_len. Affected callers (password validation, module feature discovery, and firmware-management feature discovery) cast the reply payload to fixed-layout structs at fixed offsets, so an over-long reply writes past the kmalloc'd page buffer. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%), and it is not on CISA KEV; the fix is a defensive exact-length check merged upstream and backported to stable trees.

Out-of-bounds kernel write in the Linux kernel's ethtool CMIS firmware-update path (cmis_fw_update_start_download) lets a malicious or malfunctioning pluggable transceiver module overflow a 112-byte stack/heap buffer by returning an oversized start_cmd_payload_size in its CDB FW Management Features reply. The value is used unchecked as a memcpy byte count, so any attacker able to present a crafted module-or corrupt its CDB response-can corrupt adjacent kernel memory. EPSS is very low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix simply rejects payload sizes larger than the destination buffer.

Use-after-free in the Linux kernel IP tunnel path-MTU discovery code (iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6()) arises because ip_hdr()/ipv6_hdr() pointers were cached before an skb_cow() that can reallocate skb->head, leaving the code operating on freed memory when generating ICMP/ICMPv6 fragmentation-needed messages for tunnel traffic. On systems with IP tunnels configured, an attacker able to drive oversized traffic through the tunnel can trigger the freed-memory access, risking a kernel information leak (the issue is tagged Information Disclosure) or memory corruption/crash. No public exploit identified at time of analysis, EPSS probability is low (0.18%), and the fix is already merged across the stable trees.

Use-after-free in the Linux kernel's VXLAN tunnel driver (drivers/net/vxlan) arises because the transmit path caches the result of ip_hdr() into old_iph and reuses it after skb_tunnel_check_pmtu(), which may reallocate skb->head and invalidate that pointer. Affected are kernels from 5.9 through the fix commits (patched in 6.1.176, 6.6.143, 6.12.93, 5.15.210, 5.10.259, 6.18.35, 7.0.12 and 7.1) on hosts using VXLAN overlays; an attacker able to drive traffic through the tunnel can trigger memory corruption leading to information disclosure or a kernel crash. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), so this is not currently associated with active exploitation despite the CVSS 9.8 rating.

Out-of-bounds heap write in the Linux kernel ethtool netlink coalesce interface allows a local privileged user (CAP_NET_ADMIN) to corrupt kernel memory beyond a 5-element IRQ moderation profile buffer, enabling privilege escalation, denial of service, or information disclosure. The flaw lives in ethnl_update_profile(), which trusts a fully user-controlled Netlink nest count while writing into a kmemdup()'d array sized at NET_DIM_PARAMS_NUM_PROFILES (5). This has been resolved upstream and is not known to be exploited; EPSS probability is low (0.17%, 6th percentile) and no public exploit has been identified at time of analysis.

Denial-of-service (kernel crash) in the Linux kernel Bluetooth L2CAP subsystem lets an in-range attacker trigger memory corruption by sending a crafted Enhanced Credit-Based (ECRED) connection response that reuses an already-assigned destination CID, corrupting the list_for_each_entry_safe cursor during channel teardown. All Linux systems with Bluetooth enabled and processing LE CoC ECRED channels are affected until patched. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile); the issue is not listed in CISA KEV.

Local memory corruption in the Linux kernel's vsock/virtio transport (AF_VSOCK) arises from a reference-counting lifetime mismatch in the MSG_ZEROCOPY send path, affecting kernels from 6.7 onward. Because virtio_transport_send_pkt_info() reuses or allocates the zerocopy uarg before virtio_transport_alloc_skb() fills the skb, a rollback after a partial fixed-buffer vectored zerocopy attach frees an skb that is flagged SKBFL_MANAGED_FRAG_REFS but has no uarg, causing skb_release_data() to take the wrong unref path. The CVSS 7.8 rating reflects high confidentiality, integrity, and availability impact from local access; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.

Local privilege escalation or denial of service in the Linux kernel's GFS2 filesystem is possible via a use-after-free in gfs2_qd_dealloc(), where an RCU callback dereferences the superblock (sdp) through qd->qd_sbd after gfs2_put_super() may have already freed it via free_sbd() during unmount. The race is exploitable when GFS2 quota cleanup RCU callbacks outlive the 60-second sd_kill_wait timeout or are re-scheduled by gfs2_gl_hash_clear(). No public exploit has been identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.

Local privilege escalation via kernel use-after-free in the Linux kernel's hdlc_ppp WAN driver allows a user able to configure synchronous HDLC/PPP network devices to corrupt kernel memory. The bug stems from per-protocol LCP/IPCP/IPV6CP timers embedded in the hdlc->state (struct ppp) allocation being freed with kfree() during device teardown or protocol re-attach without synchronizing a possibly-running timer callback, so an in-flight ppp_timer dereferences freed memory. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; not listed in CISA KEV.

Local privilege-escalation-capable memory corruption in the Linux kernel's blk-cgroup (block I/O controller) subsystem allows a local user to trigger a use-after-free in __blkcg_rstat_flush() by concurrently releasing multiple block cgroups (blkgs) within the same blkcg. Affected kernels span 6.4 through the fixed 6.6.144 / 6.12.95 / 6.18.38 / 7.1.3 / 7.2-rc1 line; the flaw carries CVSS 7.8 (local, low-privilege) and is fixed upstream. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Use-after-free (KASAN slab-use-after-free read) in the Linux kernel's TIPC cryptographic subsystem allows freed per-netns tipc_crypto state to be dereferenced by an asynchronous decrypt completion callback. When TIPC encryption is enabled and crypto_aead_decrypt() is offloaded asynchronously (e.g. via the SIMD/cryptd wrapper), tipc_aead_decrypt() never takes a netns reference, so if the bearer's network namespace is torn down mid-flight the cryptd worker's tipc_aead_decrypt_done() reads freed memory (aead->crypto->stats, ->net, ->aead[] and the node table). There is no public exploit identified at time of analysis and it is not in CISA KEV; it was surfaced by 0sec automated security-research tooling with a KASAN reproducer, and CVSS is rated 8.8.

Use-after-free in the Linux kernel pNFS (parallel NFS) client, specifically in pnfs_update_layout(), lets a stale layout header (lo) be read by a tracepoint after pnfs_put_layout_hdr() has already freed it when execution takes the NFS_LAYOUT_RETURN branch. The flaw affects Linux NFS clients that mount pNFS-backed exports across a wide range of stable series (5.4.x, 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x and 7.x-rc). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the tags label it Information Disclosure, consistent with a tracepoint reading freed memory. The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) appears inflated for what is a client-side, race-dependent memory-safety bug.

Use-after-free in the Linux kernel's rpmsg character device driver (rpmsg_char) allows local attackers on rpmsg-enabled platforms to trigger access to freed endpoint memory during a probe-failure race. The flaw exists because rpmsg_chrdev_probe() publishes the newly allocated eptdev in the default endpoint's priv pointer before rpmsg_chrdev_eptdev_add() completes, so a failed add frees eptdev while the default endpoint can still dispatch callbacks against the stale pointer. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list; it is a defensive stable-tree fix rather than an observed in-the-wild vulnerability.

Use-after-free and refcount underflow in the Linux kernel's 9p (Plan 9) filesystem client allows a local attacker interacting with a 9p mount to corrupt kernel memory, potentially escalating privileges or crashing the system. The flaw lives in p9_client_walk(): when called with clone=false the new fid aliases oldfid, and a failed multi-component walk incorrectly drops oldfid's reference via the clunk_fid error path, freeing a fid the caller still holds. No public exploit is identified at time of analysis (a reproducer exists only 'on request'), and it is not listed in CISA KEV; the vendor-supplied CVSS of 10.0 appears substantially overstated for a bug requiring an active 9p mount.

Out-of-bounds heap write in the AMD SEV debug-encrypt path (sev_dbg_crypt/__sev_dbg_encrypt_user) of the Linux kernel's KVM/SVM code (kvm_amd) lets a local, privileged VMM process corrupt kernel slab memory by up to 15 bytes past a single-page buffer. The per-iteration transfer length is bounded by the source page offset but not the destination page offset, so when d_off > s_off the PSP command and a following memcpy()/copy_from_user() spill beyond the 4096-byte dst_tpage allocation. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but a KASAN slab-use-after-free splat is included in the report, confirming reliable reproducibility.

Local information disclosure and use-after-free in the Linux kernel NTFS filesystem driver lets a low-privileged local user read freed kernel memory by racing the FS_IOC_GETFSLABEL and FS_IOC_SETFSLABEL ioctls against a mounted NTFS volume. Because vol->volume_label is copied to userspace via copy_to_user without serialization, a concurrent SETFSLABEL that replaces the label can free the buffer mid-read, leaking kernel data or crashing the system. No public exploit is identified at time of analysis and it is not in CISA KEV; a vendor patch is available in Linux 7.1.3 and 7.2-rc1.

Local privilege escalation and kernel memory corruption in the Linux kernel's omap2 framebuffer driver (omapfb) arises from a use-after-free race between omapfb_mmap() and the OMAPFB_SETUP_PLANE/OMAPFB_SETUP_MEM ioctls. Because fb_mmap() holds only mm_lock while the ioctl path holds only fb_info->lock, a local user on a TI OMAP2 device can reassign a framebuffer region mid-mmap so that the map_count of the freed region is never incremented, leaving userspace with a mapping to freed physical memory. This is an information-disclosure/corruption primitive (tagged 'Information Disclosure') with no public exploit identified at time of analysis; the upstream fix is merged and a patched release exists.

Use-after-free in the Linux kernel's TCP Authentication Option (TCP-AO) subsystem lets a local low-privileged user leak freed slab memory by adding a signing key with set_current/set_rnext=1 while a socket is in CLOSE state, transitioning it to LISTEN, then deleting the key asynchronously and reading TCP_AO_INFO. The del_async cleanup path fails to clear the dangling current_key/rnext_key pointers, so a later getsockopt(TCP_AO_INFO) dereferences freed key memory (CVSS 7.8, tagged Information Disclosure). No public exploit identified at time of analysis and EPSS probability is low (0.17%), making this a patchable memory-safety defect rather than an actively exploited threat.

Use-after-free in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows a local low-privileged attacker to access or corrupt freed kernel memory by racing a request abort against the page-cache folio replacement path in fuse_try_move_folio(). Because the function unlocks the request on entry but fails to re-lock it on the success path, fuse_chan_abort() can end the request and free the fuse_io_args (e.g., via fuse_readpages_end()) while the subsequent copy-chain logic still dereferences that structure. Rated CVSS 7.8 (local, high C/I/A impact); no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile).

Use-after-free in the Linux kernel's 8250_dw (Synopsys DesignWare) serial driver arises when dw8250_probe() fails during clk_notifier_register(): the already-registered 8250 port is left occupying its slot while its devm-allocated driver data is freed, leaving stale private_data and serial_in/serial_out callbacks that reference freed memory. The flaw affects kernels from 5.9 through the fixed stable releases and is tagged as an information-disclosure risk; there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile). Despite an NVD CVSS of 9.8, exploitation is gated by a probe-failure error path in a specific UART driver, so real-world reachability is far narrower than the score implies.

Local privilege escalation and memory corruption in the Linux kernel's virtiofs (virtio-fs) driver arises from a use-after-free triggered when an auto-submount is unmounted, where iput() called from fuse_release_end() can dereference an already-destroyed superblock. Because the FUSE num_waiting counter is per-connection rather than per-superblock, the shutdown wait only protects the last submount instance, leaving earlier submounts exposed. The fix reverts virtiofs auto_submounts to synchronous release requests; no public exploit is identified at time of analysis and EPSS risk is low (0.19%).

Local privilege escalation and kernel memory disclosure in the Linux kernel's Renesas RZ/V2H IVC media driver (rzv2h-ivc) stems from a race condition where rzv2h_ivc_transfer_buffer() calls list_del() on the shared buffer queue from a workqueue context without holding the protecting spinlock. On affected embedded systems using the RZ/V2H SoC, a local low-privileged user can concurrently modify the buffer list to corrupt kernel memory, potentially leaking data or achieving code execution. EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis; the flaw is fixed upstream in the stable kernel tree.

Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.

Heap use-after-free in YAML::Syck for Perl before version 1.47 lets a crafted YAML document corrupt parser memory when it redefines a previously declared anchor. The bug lives in the bundled libsyck C code (syck_hdlr_add_anchor), where an anchor name string is shared between a node's node->anchor field and the parser's anchors-table key; freeing the node frees the shared key, and a subsequent anchor redefinition makes st_delete/st_strcmp compare against freed heap memory. Any Perl application that calls Load or LoadFile on untrusted YAML is affected on the default code path (anchors need no special flags). Reported by CPANSec and disclosed via oss-security; publicly documented proof-of-concept trigger inputs exist, but there is no CISA KEV listing and no evidence of active exploitation.

Local privilege escalation in AutomationDirect Productivity Suite programming software stems from an out-of-bounds write (CWE-787) reachable through a crafted IOCTL request to a privileged kernel-mode component, corrupting kernel memory. An authenticated local attacker on an engineering workstation running the software can leverage the corruption to escalate to SYSTEM/kernel privileges or crash the host. No public exploit identified at time of analysis; the flaw is documented in CISA ICS advisory ICSA-26-197-04 (reported by ICS-CERT) but is not listed in CISA KEV, and no EPSS score was supplied.

Local privilege escalation in AutomationDirect Productivity Suite lets an authenticated local attacker corrupt kernel memory by issuing a crafted IOCTL request to an out-of-bounds write flaw (CWE-787). Successful exploitation can elevate privileges to SYSTEM/kernel level or crash the host running this engineering workstation software for AutomationDirect Productivity-series PLCs. Reported through CISA ICS-CERT (ICSA-26-197-04); no public exploit identified at time of analysis and no KEV/EPSS signal is present.

Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.

Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.

Heap buffer over-read in the ngx_http_ssi_module of NGINX Open Source and NGINX Plus lets an unauthenticated man-in-the-middle attacker who can control upstream responses corrupt worker-process memory or crash the worker, but only in the non-default configuration combining Server-Side Includes, proxy_pass, and proxy_buffering off. The impact is confined to the data plane with no control-plane exposure, yielding limited memory modification and worker restarts (denial of service) rather than full code execution. No public exploit identified at time of analysis, though a vendor patch is available and the flaw carries a CVSS 4.0 score of 8.3.

Heap buffer overflow in NTFS-3G through 2026.2.25 (libntfs-3g/index.c, ntfs_ib_copy_tail()) enables a local attacker who can supply a crafted NTFS image, such as via a mount or auto-mounted removable media, to corrupt heap memory in the SUID-root ntfs-3g binary by extending a directory, for example by creating a file. Scored CVSS 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), impact is integrity and availability, with privilege escalation to root only when ntfs-3g is installed setuid-root; many modern distributions instead mediate mounts through FUSE with udisks/polkit, where the consequence degrades to a crash in the invoking user's context. No public exploit identified at time of analysis, EPSS is low at 0.17% (6th percentile), and vendor patch 2026.7.7 is available.

Heap buffer overflow in the ntfscat utility shipped with NTFS-3G through 2026.2.25 allows a crafted NTFS image to corrupt heap memory when a user runs ntfscat to read a file from that image, potentially leading to code execution in the privilege context of the invoking user. The issue is local (AV:L), requires user interaction (UI:R), and per the CVSS vector needs no privileges (PR:N) with no scope change (S:U); the normal ntfs-3g mount driver path is not affected by default, so realistic exposure is limited to forensic, recovery, and image-analysis workflows that process untrusted disk images. No public exploit code has been identified at time of analysis, EPSS is low (0.17%, 6th percentile), the issue is not in CISA KEV, and a vendor patch (2026.7.7) is available.

Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing and requires user interaction, so it is not remotely exploitable without victim action. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.

Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) stems from an out-of-bounds write when parsing a maliciously crafted file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a booby-trapped file, so it is a file-format/client-side attack rather than a remotely reachable service flaw. No public exploit has been identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.14% (4th percentile).

Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows a remote attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). Exploitation hinges on user interaction, so it is a file-delivery/social-engineering vector rather than a remotely automatable one.

Arbitrary code execution in Adobe Bridge is possible through an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. All versions covered by Adobe advisory APSB26-81 are affected, and while there is no public exploit identified at time of analysis, the local user-interaction attack pattern is consistent with weaponized document/asset lures. The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once a victim is socially engineered into opening the file.

Arbitrary code execution in Adobe Bridge results from an out-of-bounds write (CWE-787) that a victim triggers by opening a malicious file, running attacker-supplied code with the privileges of the current user. The flaw is local (AV:L) and requires user interaction, so it is a client-side, file-borne bug rather than a remotely reachable service vulnerability. No public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe patched it in advisory APSB26-81.

Arbitrary code execution in Adobe Bridge is possible when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) that executes attacker-controlled code in the context of the current user. The flaw affects Adobe Bridge as reported by Adobe (advisory APSB26-81) and is rated CVSS 7.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is local and hinges entirely on user interaction - the victim must open the malicious file.

Use-after-free in Google Chrome's UI component on Linux (versions prior to 150.0.7871.125) lets a remote attacker trigger heap corruption through a crafted HTML page, but only after luring the victim into performing specific UI gestures. Rated High severity by Chromium and CVSS 7.5, the flaw carries full confidentiality, integrity, and availability impact and could lead to code execution inside the renderer, though no public exploit identified at time of analysis and SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with the high attack complexity and required user interaction.

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.125) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Rated High by Chromium and CVSS 8.8, the flaw is a type-confusion class issue in V8 requiring only that the user browse to attacker-controlled content. There is no public exploit identified at time of analysis and EPSS is low (0.34%), but Chrome's ubiquity and the total technical impact make patching urgent.

Sandbox escape in Google Chrome desktop and ChromeOS builds prior to 150.0.7871.125 stems from a use-after-free in the Skia graphics library, allowing a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Google rates this High severity; SSVC technical impact is 'total' with a scope change (S:C), but exploitation is not observed (no public exploit identified at time of analysis) and EPSS is low at 0.24%. A vendor patch is available.

Sandbox escape in Google Chrome on Windows (versions prior to 150.0.7871.125) stems from a use-after-free in the browser's Core component, letting a remote attacker who lures a user to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. The flaw is rated High by Chromium and carries a 9.6 CVSS due to scope change and full CIA impact, though it requires user interaction (visiting the page). There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as none, with a low EPSS probability of 0.26%.

Sandbox escape in Google Chrome for Android (versions prior to 150.0.7871.125) stems from a use-after-free in the GPU process, allowing an attacker who has already compromised the renderer to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS of 8.3, it carries a scope-changing, total-impact profile but is gated by prior renderer compromise, and there is no public exploit identified at time of analysis. EPSS is low (0.24%, 16th percentile) and CISA SSVC records exploitation status as none.

Heap corruption in Google Chrome's Ozone graphics/windowing layer (versions prior to 150.0.7871.125) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free with total technical impact. Chromium rates the underlying bug Critical, though the CVSS is 7.5 because exploitation hinges on user interaction and high attack complexity. There is no public exploit identified at time of analysis, EPSS risk is low (0.30%, 22nd percentile), and CISA SSVC records exploitation status as none.

Heap corruption in Google Chrome's Ozone component on Linux (versions prior to 150.0.7871.125) allows a remote attacker to potentially execute arbitrary code within the browser process after luring a victim to a crafted HTML page and coaxing them into specific UI gestures. Chromium rated the flaw Critical severity, though its practical exploitability is tempered by the required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and CISA's SSVC framework records exploitation status as 'none'.

Arbitrary code execution in Adobe After Effects arises from an out-of-bounds write (CWE-787) that runs in the context of the current user when a victim opens a maliciously crafted project or media file. Adobe (via advisory APSB26-78) confirms the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects high impact tempered by the local vector and required user interaction.

Arbitrary code execution in Adobe After Effects arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted project or media file, running attacker code with the privileges of the current user. Adobe self-reported the flaw in advisory APSB26-78; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 7.8 (High) rating reflects high confidentiality, integrity, and availability impact but is gated by required user interaction and local file delivery.

Arbitrary code execution in Adobe Premiere Pro via an out-of-bounds write (CWE-787) that lets an attacker run code in the context of the current user when a victim opens a maliciously crafted project or media file. The flaw is memory-corruption based and file-driven, requiring user interaction rather than network exposure; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS data was not provided, but the local, user-interaction-gated vector places this in the file-format/client-side attack category typical of Adobe desktop products.

Arbitrary code execution in Adobe Premiere Pro is possible when a victim opens a maliciously crafted project or media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw was reported by Adobe (advisory APSB26-76) and carries a CVSS 3.1 base score of 7.8 (local vector, requires user interaction). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently driven by the ease of social-engineering a user into opening a booby-trapped file.

Arbitrary code execution in Adobe Media Encoder is possible through an out-of-bounds write triggered when a victim opens a maliciously crafted media file, running attacker code in the context of the current user. The flaw was reported by Adobe and is addressed in advisory APSB26-72; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation hinges on user interaction (opening the file) and yields high impact to confidentiality, integrity, and availability.

Arbitrary code execution in Adobe Media Encoder is possible when a victim opens a maliciously crafted media file, triggering an out-of-bounds write (CWE-787) that runs attacker code in the context of the current user. The flaw is local and requires user interaction, so it is not remotely wormable, but successful exploitation grants full compromise of the user's session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Adobe published advisory APSB26-72 addressing the issue.

Arbitrary code execution in Adobe Media Encoder arises from an out-of-bounds write (CWE-787) that lets a crafted media file corrupt memory and run attacker-controlled code in the context of the current user. Any user who opens a malicious file in the affected desktop application is at risk, with full loss of confidentiality, integrity, and availability on the host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, allowing an attacker to run code in the context of the current user. The flaw is Adobe-reported (advisory APSB26-71) and carries a CVSS 7.8 (High) rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation is local and requires user interaction, weaponization depends on social engineering rather than remote automated attack.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, letting an attacker run code with the privileges of the current user. The CVSS 3.1 base score is 7.8 (local vector, requires user interaction), and no public exploit has been identified at time of analysis. Reported by Adobe via advisory APSB26-71.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (memory corruption) that runs in the context of the current user when a victim opens a maliciously crafted media/project file. All affected versions covered by Adobe advisory APSB26-71 are impacted, and while no public exploit has been identified at time of analysis, the local attack vector with required user interaction makes it a classic file-format weaponization risk. The CVSS 7.8 (High) reflects full confidentiality, integrity, and availability impact once the file is opened.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted media/project file, letting an attacker run code in the context of the current user. The flaw was reported by Adobe and is documented in advisory APSB26-71; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation is local and requires user interaction, it is a file-format/client-side memory-corruption issue rather than a remotely-triggerable server flaw.

Arbitrary code execution in Adobe Audition arises from an out-of-bounds write (CWE-787) triggered when a user opens a maliciously crafted media/project file, letting an attacker run code with the privileges of the current user. Affects Adobe Audition and was reported by Adobe under advisory APSB26-71. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS not provided.

Local privilege escalation in the Microsoft Windows Client-Side Caching (CSC) Service, driven by a use-after-free (CWE-416) memory-corruption flaw affecting Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. An authorized attacker who already holds low-level privileges (PR:L) on the host can trigger the freed-object reuse to gain elevated, likely SYSTEM-level, privileges. The issue was reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and no CISA KEV listing.

Local privilege escalation in the Windows 11 (version 26H1) Desktop Window Manager (DWM) allows an authenticated low-privileged user to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory-corruption flaw. Reported by Microsoft and carrying a CVSS 3.1 score of 7.8, the flaw grants full confidentiality, integrity, and availability impact once triggered locally. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but DWM EoP bugs are a historically favored post-compromise primitive.

Local privilege escalation in the Desktop Window Manager (DWM) component of Windows 11 version 26H1 allows an authenticated local attacker to elevate to SYSTEM by triggering a use-after-free memory corruption condition. The CVSS 3.1 vector (AV:L/PR:L) confirms an already-authenticated low-privileged user is required, and full compromise of confidentiality, integrity, and availability follows successful exploitation. Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an authenticated attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation in the Windows DirectX graphics subsystem allows an authenticated attacker with low privileges to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 (High), tempered by high attack complexity.

Remote code execution in Windows Remote Desktop Services (RDS) allows an authenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of currently-supported Windows client and server builds - Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025 (including Server Core). It was reported by Microsoft with a CVSS 8.8 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network vector combined with only low-privilege requirements makes it a strong patch priority.

Local privilege escalation in Microsoft Windows Sensor Data Service arises from a use-after-free (CWE-416) memory corruption flaw that an already-authenticated attacker can trigger to run code at higher privilege. It affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Reported by Microsoft with a patch available; no public exploit identified at time of analysis, and the CVSS:3.1 score is 7.0 (High).

Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level control. The flaw is a use-after-free (CWE-416) affecting a broad range of Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019-2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker to gain SYSTEM-level privileges by triggering a type-confusion (CWE-843) condition. The flaw affects a broad range of supported Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Reported internally by Microsoft with a vendor patch available; no public exploit identified at time of analysis.

Elevation of privilege in Microsoft Windows Management Services lets a low-privileged local user corrupt memory through a use-after-free (CWE-416) and gain higher privileges on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. A successful exploit yields high confidentiality, integrity, and availability impact, but the CVSS vector marks high attack complexity, reflecting the race-condition timing typically needed to win a use-after-free. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free memory corruption condition. The flaw affects a broad range of Windows client and server releases (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025) and was reported by Microsoft. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Local privilege escalation in Microsoft's NAT Helper Components (ipnathlp.dll), the driver behind Internet Connection Sharing and NAT translation on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. An authenticated attacker who already has low-privilege access can exploit a use-after-free memory corruption bug to run code at higher privilege (SYSTEM). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but Microsoft has released a patch.

Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or hang affected applications by triggering a type-confusion condition (CWE-843) over the network. The flaw was reported by Microsoft and a vendor patch is available via MSRC; there is no public exploit identified at time of analysis. The CVSS vector limits impact strictly to availability (A:H, C:N/I:N), meaning it is a service-disruption bug rather than a code-execution or data-exposure issue despite tag noise suggesting otherwise.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an already-authenticated user execute code in kernel context and gain SYSTEM-level rights, affecting a broad Windows client and server range from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. The flaw is a CWE-416 use-after-free that yields total technical impact (C:H/I:H/A:H). Microsoft has shipped a patch; there is no public exploit identified at time of analysis and CISA's SSVC framework lists exploitation as none, with a low EPSS of 0.25% (16th percentile).

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating from a guest partition corrupt kernel memory via a use-after-free and gain higher privileges, with a scope change (S:C) indicating a guest-to-host escape. Rated CVSS 9.9 and affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, this issue was reported by Microsoft and has a vendor patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in the Windows SMB Server Network Transport driver (srvnet.sys) allows unauthenticated network attackers to run arbitrary code by triggering a use-after-free condition, affecting a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N (9.8 Critical), exploitation needs no authentication or user interaction, giving this the structural profile of a wormable SMB flaw similar to prior srvnet.sys issues. No public exploit was identified at time of analysis and CISA SSVC lists exploitation as 'none', with a modest EPSS of 0.57% (43rd percentile).

Local privilege escalation in the Microsoft Windows Kernel allows an authenticated attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption condition, spanning Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2016 through 2025. Reported by Microsoft with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N), the flaw grants full confidentiality, integrity, and availability impact on the local system. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.

Local privilege escalation in the Microsoft Windows Kernel (CWE-416 use-after-free) lets an already-authenticated low-privilege user corrupt kernel memory and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. Microsoft self-reported the flaw and has shipped a patch through the Update Guide; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 7.8 (AV:L/PR:L) it is a classic Patch-Tuesday local EoP suitable as a second-stage primitive after initial access.

Local privilege escalation in the Windows MIDI Service Module on Windows 11 (versions 24H2, 25H2, and 26H1) allows an already-authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free memory-corruption condition (CWE-416). Reported by Microsoft with a vendor patch already available; there is no public exploit identified at time of analysis and SSVC records exploitation status as none. EPSS is low at 0.25% (16th percentile), consistent with a locally-exploitable EoP that is not yet weaponized.

Local privilege escalation in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, where a use-after-free (CWE-416) memory-corruption flaw lets an already-authenticated local user elevate to higher privileges. Exploitation requires winning a race condition (high attack complexity), and Microsoft has released a fix; no public exploit identified at time of analysis. Rated CVSS 7.0 with full confidentiality, integrity, and availability impact once triggered.

Local privilege elevation in the Windows WebView component affects a broad range of currently-supported Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019/2022/2025). By triggering a use-after-free (CWE-416) memory-corruption condition, an already-authenticated low-privilege attacker can execute code in a higher-privilege context, yielding full confidentiality, integrity, and availability impact on the local system. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Local privilege escalation in Microsoft XML Core Services (MSXML) lets an already-authenticated user on affected Windows 10, Windows 11, and Windows Server systems corrupt memory via a use-after-free (CWE-416) and run code at elevated privilege. The flaw was reported by Microsoft and is patched; there is no public exploit identified at time of analysis, and EPSS estimates a low 0.25% (16th percentile) exploitation probability. Impact is total (high confidentiality, integrity, and availability) but requires prior local access.

Arbitrary code execution in Microsoft Office Excel arises from a use-after-free (CWE-416) memory-corruption flaw affecting Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server. The CVSS 3.1 vector (AV:L/UI:R) makes this a user-interaction-dependent, locally-scoped issue: a victim must open a maliciously crafted Excel workbook, after which the attacker gains code execution in the user's security context. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted document. The flaw affects a broad Office footprint including Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and related SharePoint Server products that process Word documents. Microsoft has released a patch; no public exploit has been identified at time of analysis, and neither KEV nor EPSS/POC signals were provided in the input.

Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Word 2016) allows an attacker to run arbitrary code by exploiting a use-after-free memory corruption flaw when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 with a local attack vector requiring user interaction; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft, which reported the issue itself, has released a patch.

Local code execution in Microsoft Excel (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Office Online Server) arises from a type-confusion flaw (CWE-843) in how Excel parses spreadsheet content. An attacker who convinces a victim to open a malicious workbook can run arbitrary code in the context of the current user, gaining high confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.