Memory Corruption

Code execution in AzeoTech DAQFactory versions 21.1 and prior is achievable when a user opens a maliciously crafted .ctl project file, triggering a CWE-843 type confusion that corrupts memory. The flaw was reported through CISA ICS-CERT, which is significant because DAQFactory is HMI/SCADA software where engineering project files are routinely shared between integrators and operators. There is no public exploit identified at time of analysis, but the file-borne delivery pattern is well-suited to phishing or supply-chain handoffs targeting OT engineers.

Out-of-bounds write in FFmpeg's libavcodec MagicYUV decoder (libavcodec/magicyuv.c) affects all FFmpeg versions before 8.1.2, allowing remote attackers to cause denial-of-service and potentially achieve remote code execution when a victim processes a crafted MagicYUV-encoded media file. No public exploit identified at time of analysis, but the broad deployment of FFmpeg across media players, transcoding pipelines, browsers, and server-side processing makes this a high-priority patch. EPSS and CISA KEV data were not provided in the input.

Use-after-free in NGINX Open Source's ngx_http_v3_module allows remote unauthenticated attackers to crash worker processes and potentially execute arbitrary code on hosts where HTTP/3 QUIC is enabled. Exploitation requires a specially crafted HTTP/3 session that reopens a QPACK encoder stream, with code execution contingent on ASLR being disabled or bypassed; no public exploit identified at time of analysis, though SSVC technical impact is rated total.

Out-of-bounds write in Zephyr RTOS Bluetooth Classic Hands-Free Profile (HFP) parser allows an adjacent Bluetooth peer acting as an Audio Gateway to corrupt heap/static memory on devices with CONFIG_BT_HFP_HF enabled. A single malformed +CIND response sent during Service Level Connection setup can crash the Bluetooth host or corrupt adjacent connection state with no user interaction. No public exploit identified at time of analysis, and the upstream fix is available via commit cf7693a in the zephyrproject-rtos repository.

Sandbox escape in Google Chrome's Extensions component (versions prior to 149.0.7827.155 on desktop) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it is a second-stage bug requiring a prior renderer compromise plus user interaction. There is no public exploit identified at time of analysis, EPSS is low (0.27%), and SSVC records exploitation status as none.

Sandbox escape in Google Chrome desktop before 149.0.7827.155 lets an attacker who has already compromised the renderer process leverage a use-after-free in the privileged Browser process to break out of the renderer sandbox via a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a second-stage exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS is low (0.27%), consistent with SSVC exploitation status of 'none'.

Arbitrary code execution in Google Chrome's Media component (versions prior to 149.0.7827.155) lets an attacker who has already compromised the renderer process run code within the sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 7.5, the flaw is a use-after-free (CWE-416); there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.37%, 28th percentile), consistent with the SSVC 'Exploitation: none' status. In practice it functions as a second-stage bug useful for extending a renderer foothold rather than an initial-access vulnerability.

Use-after-free in the Tab Strip component of Google Chrome before 149.0.7827.155 allows a remote attacker to trigger heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to code execution in the renderer. Google rated it High severity and a vendor patch is available, but no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.30% (21st percentile), and SSVC records exploitation status as none.

Heap corruption in the Downloads component of Google Chrome for Android before 149.0.7827.155 lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially achieving code execution in the renderer. Rated High severity by Chromium with an 8.8 CVSS, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.30%, 21st percentile), consistent with a patched browser bug not yet weaponized.

Sandbox escape in Google Chrome's DigitalCredentials component before 149.0.7827.155 lets a remote attacker who has already compromised the renderer process break out of the sandbox and gain broader host access via a crafted HTML page. Reported internally by Google's Chrome security team and rated High severity; no public exploit is identified at time of analysis, and EPSS remains low (0.27%, 19th percentile). CISA SSVC lists exploitation status as none, indicating no observed in-the-wild use despite total technical impact.

Local privilege escalation in Google Chrome for Windows before 149.0.7827.155 stems from a use-after-free in the Chromoting (Chrome Remote Desktop) component, letting a local attacker who convinces a user to open a malicious file execute code at OS-level privilege. Chromium rates the severity High and a vendor patch is available; currently there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (6th percentile). SSVC lists exploitation as none but technical impact as total.

Heap corruption in Google Chrome's Extensions component (versions prior to 149.0.7827.155) allows an attacker who convinces a victim to install a malicious extension to trigger a use-after-free and potentially achieve arbitrary code execution within the renderer or browser process. Rated High by Chromium and scored CVSS 7.5, the flaw was reported internally by the Chrome team and is patched in the stable channel; no public exploit identified at time of analysis and EPSS is low at 0.19%.

Remote code execution in Google Chrome (desktop) versions prior to 149.0.7827.155 stems from a use-after-free in the Web Authentication (WebAuthn) component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code. Chromium rates the flaw Critical severity; it carries CVSS 8.8 and requires user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and EPSS remains low at 0.44%, but the SSVC 'total' technical impact and the memory-corruption class make it a high-priority browser patch.

Remote code execution in Google Chrome on Android before 149.0.7827.155 stems from a use-after-free in the Passwords component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser process. Chromium rates the flaw Critical, though the assigned CVSS is 8.8; there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low at 0.39% (30th percentile), consistent with a patched, not-yet-exploited memory bug.

Heap corruption via use-after-free in Google Chrome's File Input component on Linux affects all versions prior to 149.0.7827.155, allowing a remote attacker to exploit memory corruption through a crafted HTML page that the victim visits. Chromium rates this Critical severity and a vendor patch is available; no public exploit has been identified at time of analysis and the SSVC framework records exploitation status as none. EPSS is low at 0.29% (21st percentile), consistent with a freshly patched, not-yet-weaponized browser flaw.

Sandbox escape in Google Chrome on Windows before 149.0.7827.155 stems from a use-after-free in the DigitalCredentials component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. Rated Critical by Chromium with a CVSS of 9.6 and a scope-changing vector, though there is no public exploit identified at time of analysis and EPSS remains low at 0.31%. Exploitation requires user interaction (visiting a malicious page) but no privileges or authentication.

Heap corruption in Google Chrome's Digital Credentials component (versions prior to 149.0.7827.155) allows remote attackers to trigger a use-after-free condition by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution within the renderer process. Chromium rates this issue as Critical severity, and Google has released a patched stable-channel build; no public exploit identified at time of analysis and EPSS sits at 0.31% (23rd percentile), indicating low predicted near-term exploitation pressure despite the high CVSS of 8.8.

Sandbox escape in Google Chrome's WebShare component on Windows (versions before 149.0.7827.155) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a critical-severity use-after-free (CWE-416) rated CVSS 8.3; there is no public exploit identified at time of analysis, CISA SSVC lists exploitation status as none, and EPSS is low at 0.31%. It is a second-stage bug meant to be chained after an initial renderer compromise rather than a standalone remote takeover.

Remote code execution in the Android Modem component (per the Pixel 2026-06-01 security bulletin) is possible via an out-of-bounds write triggered without user interaction. Authenticated remote attackers (PR:L per CVSS) can corrupt memory to execute arbitrary code at the same privilege level as the Modem process. No public exploit identified at time of analysis, EPSS is low at 0.23% (13th percentile), and the issue is not listed in CISA KEV.

Remote code execution in Google Android's AudioSdpParser component (AudioSdpParser.cpp) allows attackers to corrupt memory through a type-confusion flaw (CWE-843) triggered while parsing SDP payloads in ParsePayloads, with no user interaction required. The bug affects Android across Pixel and AOSP-derived devices and is addressed in the June 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' with a low EPSS score of 0.23%, so risk is currently theoretical despite the total technical impact.

Out-of-bounds heap write in Android's native RTP stack (numberOfReportBlocks handling in RtpSession.cpp) allows a network-adjacent attacker to corrupt memory and achieve remote escalation of privilege without user interaction. The flaw stems from an integer overflow when counting RTCP report blocks, and it affects Android/Pixel builds prior to the June 2026 security patch level. There is no public exploit identified at time of analysis, EPSS risk is low (0.23%), and CISA has not listed it in KEV.

Local privilege escalation in the Android kernel's msg_to_host_buffer.cc component allows a low-privileged local process to corrupt memory via an out-of-bounds write, gaining elevated privileges without user interaction. The flaw stems from an incorrect bounds check on a host buffer write path and carries a CVSS 7.8 (High) rating with total technical impact. No public exploit has been identified at time of analysis, and CISA's SSVC framework marks exploitation as none, consistent with the very low EPSS score (0.11%).

Remote code execution in the WC-Radio component on Google Android (Pixel) devices allows network-adjacent attackers to corrupt memory via an out-of-bounds write with no authentication or user interaction. The flaw carries a CVSS 9.8 rating and is addressed in the Pixel security bulletin dated 2026-06-01; no public exploit identified at time of analysis and EPSS is low at 0.15%.

Heap buffer overflow in the leejet stable-diffusion.cpp pickle .ckpt parser allows arbitrary code execution when a user or host application loads a maliciously crafted checkpoint file. The flaw resides in the GLOBAL opcode handler within src/model.cpp, where missing newline validation lets a -1 length value drive a heap memory copy, corrupting the heap of the diffusion inference process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the attack surface (community model-sharing sites) makes weaponization plausible.

Heap buffer overflow in stable-diffusion.cpp versions prior to master-584-0a7ae07 allows attackers to corrupt memory and potentially achieve code execution when a victim loads a malicious PyTorch .ckpt checkpoint file. The flaw resides in the SHORT_BINUNICODE opcode handler of the pickle parser in src/model.cpp, where a signed length field is mishandled and passed to memcpy. No public exploit identified at time of analysis, but the upstream fix is committed and the attack surface (untrusted model files from sharing sites) is realistic for AI/ML workloads.

Denial of service (and potential limited memory corruption) in the Zephyr RTOS IPv6 networking stack (versions 3.3.0 through 4.4.0) stems from a use-after-free in the IPv6 Neighbor Discovery send paths, where per-interface ICMP statistics are updated by reading from a network packet after the stack has already freed it. Any unauthenticated on-link node can trigger the Neighbor Advertisement path simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 and CONFIG_NET_STATISTICS_PER_INTERFACE enabled, causing a freed slab block to be dereferenced. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); a vendor patch is available, and impact is largely limited to crashes/DoS with only theoretical limited memory corruption.

Use-after-free in Zephyr RTOS's ICMPv6 stack (v4.2.0-v4.4.0) allows an unauthenticated remote attacker to crash the networking stack and potentially corrupt memory by sending a standard ICMPv6 Echo Request or any IPv6 packet that elicits an ICMPv6 error response. Both `icmpv6_handle_echo_request()` and `net_icmpv6_send_error()` call `net_pkt_iface()` on a packet after transferring it to `net_try_send_data()`, which may synchronously or asynchronously free the packet's memory slab before the statistics update executes. When `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the stale interface pointer is written through (`iface->stats.icmp.sent++`), escalating the read UAF into an attacker-influenced memory write; no public exploit has been identified at time of analysis, but the trigger is a universally available IPv6 primitive.

Remotely triggerable denial of service in the Zephyr RTOS networking stack (versions 1.12.0 through 4.4.x) arises from a use-after-free in the IPv6 MLD code path, where mld_send() reads net_pkt_iface(pkt) after net_send_data() has already transferred packet ownership and the L2 driver freed it back to its memory slab. An unauthenticated attacker on the local link can elicit the vulnerable path by sending a crafted MLDv2 General Query, causing a NULL-pointer dereference crash or, in a narrow race, memory corruption via a stray statistics increment. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.

Memory corruption in Mozilla Firefox's Graphics: WebGPU component (fixed in Firefox 152) allows an attacker who lures a victim to a malicious page to trigger a use-after-free (CWE-416), potentially leading to information disclosure or arbitrary code execution in the content process. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, though CISA's SSVC framework rates its technical impact as total and marks it automatable. EPSS is low at 0.15% (5th percentile), consistent with no observed in-the-wild exploitation.

Memory corruption via use-after-free in the Networking: HTTP component of Mozilla Firefox enables remote attackers to potentially execute arbitrary code or trigger crashes when a user visits a malicious page. The flaw affects Firefox prior to version 152, Firefox ESR before 140.12, and Firefox ESR before 115.37, and carries a CVSS 3.1 score of 8.8 with high impact across confidentiality, integrity, and availability. With an EPSS of 0.16% (5th percentile) and no public exploit identified at time of analysis, opportunistic mass exploitation appears unlikely despite the high severity rating.

Local code execution in Avira Antivirus engine builds prior to 8.3.27.12 on Windows, macOS, and Linux occurs when the scanner parses a malformed POSIX tar archive, triggering a heap out-of-bounds write that can either crash the AV process (DoS) or execute attacker code in the scanner's context. No public exploit identified at time of analysis, but the on-access scanning model means a victim only has to write the malicious tar to disk for the engine to touch it. Reported by GEN (Gen Digital, Avira's parent).

Local privilege escalation in Imagination Technologies Graphics DDK (GPU kernel driver) allows non-privileged users to issue crafted GPU system calls that perform read/write operations on arbitrary freed physical memory pages, enabling kernel memory corruption. The flaw stems from missing deferred-free handling, meaning the GPU can still access pages after the kernel module has released them. No public exploit identified at time of analysis and EPSS is very low (0.02%), but CVSS 7.8 reflects high local impact on confidentiality, integrity, and availability.

Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim loads a web page containing crafted WebGPU content into the GLES GPU render process, corrupting memory and crashing the browser or GPU process. The flaw stems from an integer overflow in size calculation driven by untrusted input, which produces an undersized allocation that subsequent writes exceed. EPSS exploitation probability is very low at 0.02% (5th percentile) and no public exploit identified at time of analysis.

Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged process to corrupt kernel memory by issuing crafted GPU sparse memory API calls, enabling privilege escalation to kernel context. Affected releases include Graphics DDK 24.2 RTM and the 25.1 RTM through 25.3 RTM line. No public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.02%, 5th percentile).

Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier) occurs through an out-of-bounds write triggered when a victim opens a malicious PDF file. Successful exploitation runs attacker code in the context of the current user, making this a classic client-side attack suitable for phishing campaigns. No public exploit identified at time of analysis, but Adobe Reader memory corruption flaws have a long history of being weaponized in targeted attacks.

Out-of-bounds write in Apple's SwiftNIO ByteBuffer affects all releases from 1.0.0 through 2.99.0 and is fixed in 2.100.0. The flaw stems from UInt32 truncation in internal index/capacity converters, so when an attacker can influence an index, offset, or length passed to specific ByteBuffer write methods with a value above UInt32.max (~4 GiB), safety preconditions silently pass and subsequent writes can corrupt heap memory outside the buffer. No public exploit identified at time of analysis, and the high data-size threshold makes practical exploitation narrow but severe where applicable.

Memory disclosure and denial of service in MongoDB Server's server-side JavaScript engine allow an authenticated user with read privileges and JavaScript execution rights to read freed heap memory or crash the mongod process. The flaw is triggered during BSON-to-JavaScript array conversion when operators such as $where or $function are evaluated. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by MongoDB.

Heap corruption in Google Chrome's Views UI framework on Windows (versions prior to 149.0.7827.115) lets a remote attacker exploit a use-after-free by luring a victim to a crafted HTML page. Google rates the Chromium severity High, and the CVSS 8.8 vector reflects full compromise of the renderer/browser process, though exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and EPSS is very low (0.03%), indicating no observed weaponization yet.

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.115 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the Video component. Rated High by Chromium and CVSS 8.3 with a scope change (S:C), it requires user interaction (visiting a malicious page) and is typically the second stage of a full RCE chain. There is no public exploit identified at time of analysis, and the low EPSS score (0.07%, 21st percentile) plus SSVC 'Exploitation: none' indicate no observed in-the-wild activity yet.

Sandbox escape in the GPU process of Google Chrome for Android before 149.0.7827.115 lets a remote attacker who has already compromised the renderer process break out of the sandbox and potentially achieve code execution in a higher-privileged context via a crafted HTML page. This is a memory-corruption (use-after-free) bug rated High by Chromium and fixed in the June 2026 stable channel; there is no public exploit identified at time of analysis and EPSS is very low (0.07%), but the total technical impact makes it a meaningful second-stage primitive in a browser exploit chain.

Sandbox escape in Google Chrome on macOS (versions prior to 149.0.7827.115) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the GPU component. This is a chain-stage bug rather than a standalone entry point - it presumes prior renderer compromise - and Google rates the Chromium severity as High. No public exploit identified at time of analysis, and the EPSS probability is low (0.07%, 21st percentile).

Heap corruption in Google Chrome's Autofill component on macOS (versions prior to 149.0.7827.115) lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer. Google rates the Chromium severity as High and has shipped a fix in the stable channel. There is no public exploit identified at time of analysis, and EPSS is very low at 0.07%.

Sandbox escape in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a heap buffer overflow in the Codecs component triggered by a crafted HTML page. Google rates the underlying issue as High severity and a vendor patch is available, but no public exploit is identified at time of analysis and the bug is not listed in CISA KEV. Exploitation is conditional on chaining with a prior renderer compromise, which raises real-world complexity.

Sandbox escape in Google Chrome's Cast component (versions prior to 149.0.7827.115) lets an attacker positioned on the same local network segment corrupt memory via crafted network traffic and potentially break out of the renderer sandbox. Rated High by Chromium with a CVSS 8.3 (scope-changed, total impact), it is patched in the June 2026 Stable channel. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but a successful escape yields total control over the affected process.

Heap corruption via a use-after-free in the Media component of Google Chrome on Windows before 149.0.7827.115 allows a remote attacker to potentially achieve code execution when a victim opens a crafted HTML page. Rated High by Chromium with CVSS 8.8, it requires user interaction (loading a malicious page) but no authentication. There is no public exploit identified at time of analysis, EPSS is low (0.07%), and CISA SSVC lists exploitation as none.

Heap corruption in Google Chrome's Network component (versions prior to 149.0.7827.115) allows an attacker in a privileged network position to trigger a use-after-free via malicious network traffic, potentially leading to memory corruption and code execution within the browser process. Google rates the Chromium severity as High, and a fixed stable-channel build is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%), while CISA's SSVC framework records exploitation status as none.

Use-after-free in Chrome's WebMIDI implementation on Windows lets a remote attacker who has already compromised the renderer process escape the sandbox via a crafted HTML page, elevating a renderer-level foothold toward host-level control. Rated Critical by Chromium and affecting all Chrome builds prior to 149.0.7827.115, the flaw has a patch available from Google but shows no public exploit identified at time of analysis and a very low EPSS of 0.06%.

Sandbox escape in Google Chrome's DigitalCredentials component (versions prior to 149.0.7827.115) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, it is a use-after-free memory-corruption bug used as the second stage of an exploit chain. There is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is very low (0.07%), consistent with a fix shipped before disclosure.

Remote code execution in Google Chrome on Windows prior to 149.0.7827.115 allows remote attackers to trigger a use-after-free condition in the Core component via a crafted HTML page, leading to arbitrary code execution within the renderer process. Chromium rates the severity as Critical, and no public exploit has been identified at time of analysis, but the bug class (UAF in Core) is historically a frequent target for in-the-wild exploitation against Chrome. The vulnerability requires the victim to visit attacker-controlled content (UI:R).

Out-of-bounds heap write in ImageMagick's ICON decoder allows remote attackers to crash the application by supplying a maliciously crafted ICON file processed by versions prior to 6.9.13-50 and 7.1.2-25. The flaw stems from an incorrect loop condition during ICON parsing, leading to memory corruption and denial of service. No public exploit identified at time of analysis, but ImageMagick's broad deployment as an image-processing backend in web applications makes drive-by exposure plausible.

Use-after-free in Cloud Hypervisor versions 21.0 through 51.1 allows a malicious guest VM to corrupt host memory in the cloud-hypervisor VMM process by racing duplicate virtio-block descriptor chains against the host's asynchronous I/O completion path. The flaw carries a CVSS 4.0 score of 8.9 with high impact on both the affected VMM and subsequent system scope, indicating a credible VM escape primitive. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651, and earlier) occurs when a victim opens a maliciously crafted PDF, triggering a use-after-free memory corruption that lets the attacker run code with the privileges of the logged-on user. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; however, Acrobat Reader is a perennial target for phishing-delivered malware, making patching a near-term priority. Adobe has issued APSB26-63 with fixed builds.

Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651, and earlier) is triggered when a user opens a malicious PDF, exploiting a Use-After-Free memory corruption flaw to run code as the current user. No public exploit identified at time of analysis, and EPSS data was not provided, but the high CVSS of 7.8 combined with Reader's massive install base makes this a routine patch priority. Vendor (Adobe) issued advisory APSB26-63 with corrective updates.

Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier results from a use-after-free memory corruption bug (CWE-416) triggered when a victim opens a malicious PDF. Code runs in the security context of the current user, making this a credible client-side initial-access vector via phishing or drive-by document delivery. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier) is possible when a victim opens a maliciously crafted PDF, triggering a use-after-free memory corruption flaw. Code runs with the privileges of the current user, and no public exploit identified at time of analysis, though Adobe has released APSB26-63 as the corresponding advisory.

Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier is possible when a victim opens a maliciously crafted file that triggers a use-after-free in the document parser. The flaw runs code in the context of the logged-in user and carries a CVSS 7.8 (High) score, but requires user interaction; no public exploit identified at time of analysis and EPSS data is not provided in the input.

Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651, and earlier) is possible when a victim opens a maliciously crafted document, triggering a use-after-free condition in the renderer. The flaw runs code in the context of the current user and has no public exploit identified at time of analysis, though Adobe issued advisory APSB26-63 confirming the vulnerability class and affected versions.

Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier occurs through a use-after-free flaw triggered when a victim opens a maliciously crafted PDF document. Code executes in the context of the current user, making this a classic client-side document exploit vector. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier) is possible when a victim opens a maliciously crafted PDF that triggers a use-after-free condition in the parser. Exploitation runs at the privilege of the user opening the file, and no public exploit identified at time of analysis. CVSS 7.8 reflects the local attack vector and required user interaction, but Reader's massive install base makes this a high-value target for phishing-driven campaigns.

Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier stems from a Use After Free condition (CWE-416) that triggers when a victim opens a malicious PDF, yielding execution in the context of the current user. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the file-opening attack pattern is a perennial favorite in phishing and document-borne campaigns targeting Acrobat. Adobe has shipped fixed builds under advisory APSB26-63.

Arbitrary code execution in Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier occurs through a use-after-free condition triggered by opening a malicious PDF document. Successful exploitation runs code in the context of the current user, but no public exploit identified at time of analysis and the issue requires user interaction to open the crafted file.

Arbitrary code execution in Adobe Acrobat Reader 24.001.30365, 26.001.21651, and earlier versions occurs through a use-after-free condition triggered when a victim opens a malicious PDF file. Successful exploitation runs attacker-supplied code with the privileges of the current user, making this a viable phishing and drive-by document attack vector. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Arbitrary code execution in Adobe Acrobat Reader (versions 24.001.30365, 26.001.21651 and earlier) is possible when a victim opens a malicious PDF file that triggers an out-of-bounds write condition. The flaw executes code in the context of the logged-in user, and while no public exploit identified at time of analysis, the CVSS 7.8 rating reflects high impact across confidentiality, integrity, and availability. Adobe has published advisory APSB26-63 with a fix.

Arbitrary code execution in Adobe Dreamweaver Desktop versions 21.7 and earlier allows attackers to run code in the context of the current user when a victim opens a malicious file. The flaw stems from access of an uninitialized pointer (CWE-824) and is tracked under Adobe advisory APSB26-62. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Arbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted asset file that triggers an out-of-bounds write in the application's parsing logic. Exploitation runs in the context of the logged-in user and requires user interaction to open the file; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Arbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs through an out-of-bounds write triggered when a user opens a maliciously crafted file. The flaw executes code in the context of the current user and requires victim interaction, with no public exploit identified at time of analysis and no CISA KEV listing.

Arbitrary code execution in Adobe Substance3D Sampler versions 6.0.0 and earlier occurs when a victim opens a maliciously crafted file, triggering an out-of-bounds write (CWE-787) in the application's file parser. Exploitation runs in the context of the current user and no public exploit identified at time of analysis, though the high CVSS of 7.8 reflects the full local impact triad once a user is socially engineered into opening the file.

Arbitrary code execution in Adobe Substance3D Sampler 6.0.0 and earlier occurs when a user opens a maliciously crafted 3D asset file, triggering an out-of-bounds write that runs attacker code with the current user's privileges. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the local attack vector combined with high impact and required user interaction makes this a classic targeted-phishing/social-engineering risk against artists and 3D designers.

Arbitrary code execution in Adobe InCopy 21.3, 20.5.3, and earlier allows attackers to run code as the current user when a victim opens a maliciously crafted file. The flaw stems from an out-of-bounds write (CWE-787) in file parsing logic, carries a CVSS 7.8 (local, user-interaction required), and has no public exploit identified at time of analysis. Adobe published advisory APSB26-59 addressing the issue.

Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through an out-of-bounds write triggered when a user opens a maliciously crafted document, allowing attacker code to run with the privileges of the current user. The flaw carries a CVSS 7.8 (High) rating, requires victim interaction, and no public exploit identified at time of analysis.

Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier stems from a use-after-free condition triggered when a user opens a maliciously crafted document, allowing an attacker to run code with the privileges of the logged-in user. The flaw is reported by Adobe with a CVSS 3.1 base score of 7.8 and tagged for RCE, denial of service, and memory corruption, but there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier allows attackers to run code as the logged-in user when a victim opens a maliciously crafted document file. The flaw is an out-of-bounds write (CWE-787) memory corruption issue requiring user interaction, and no public exploit has been identified at time of analysis.

Local privilege escalation in Microsoft Windows Kernel allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free condition (CWE-416). The flaw carries a CVSS 7.8 score with local attack vector and low privileges required, and no public exploit has been identified at time of analysis. Microsoft Security Response Center (MSRC) is the sole referenced authoritative source, indicating this is a vendor-discovered and vendor-tracked issue.

Remote code execution in Microsoft Remote Desktop Client is possible via a heap-based buffer overflow that an unauthenticated remote attacker can trigger when a user is convinced to connect to a malicious RDP server. The flaw is rated CVSS 7.5 (High) with attack complexity High and required user interaction, and no public exploit identified at time of analysis. The CWE-416 classification combined with the vendor's tags points to a use-after-free condition reachable through crafted RDP server responses.

Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled or compromised RDP server, triggering a heap-based buffer overflow that leads to arbitrary code execution on the client machine. The flaw is unauthenticated from the server side but requires user interaction and high attack complexity, and no public exploit identified at time of analysis. CVSS is rated 7.5 (High) with confidentiality, integrity, and availability impact.

Remote code execution in Microsoft Remote Desktop Client occurs when a user connects to an attacker-controlled RDP server, allowing the server to corrupt heap memory and execute arbitrary code on the client endpoint. The flaw carries a CVSS 8.8 (High) rating reflecting network reach with required user interaction, and no public exploit is identified at time of analysis. The attack pivots the traditional RDP threat model - attackers compromise clients that initiate outbound connections rather than exposed servers.

Local privilege escalation in Microsoft Office Click-To-Run stems from a use-after-free condition (CWE-416) that lets an authorized low-privilege user elevate to higher privileges on the host. The flaw, reported by Microsoft's MSRC, carries a CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation requires local access, low privileges, and a successful race-window or memory-state condition. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Local code execution in Microsoft Windows Hyper-V allows an authenticated attacker on a guest or host to escape sandbox boundaries by triggering an out-of-bounds read condition (CWE-843, type confusion) in the hypervisor. The flaw affects Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), and Windows Server 2022/2025, with a vendor-released patch available and no public exploit identified at time of analysis. EPSS scoring of 0.15% and SSVC exploitation status of 'none' suggest limited near-term exploitation likelihood despite total technical impact potential.

Local privilege escalation in the Windows Bluetooth Port Driver allows an authorized low-privileged attacker to elevate to higher privileges by triggering a use-after-free condition in the kernel-mode driver. The flaw is reported by Microsoft Security Response Center and carries a CVSS 7.0 (high) rating with high attack complexity, and no public exploit identified at time of analysis. EPSS data and CISA KEV status were not provided in the input, so widespread exploitation is not confirmed.

Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) Core Library enables an authorized low-privileged user to gain elevated privileges through a use-after-free memory corruption flaw. The vulnerability carries a CVSS 3.1 score of 7.8 with high impact on confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Exploitation requires the attacker to already have local code execution as a standard user, making it a strong candidate for post-compromise chaining toward SYSTEM-level access.

Remote code execution in the Microsoft Windows Universal Plug and Play stack (upnp.dll) allows unauthenticated network attackers to execute arbitrary code on affected hosts by triggering a memory-safety flaw in the UPnP service. The issue carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N), reflecting network reachability without credentials but high attack complexity. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV.

Local privilege escalation in the Windows Bluetooth Service stems from a use-after-free condition (CWE-416) that an authenticated low-privilege user can trigger to gain elevated rights on the host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects a fully local attack with high impact across confidentiality, integrity, and availability, and no public exploit has been identified at time of analysis. The flaw was reported by Microsoft (secure@microsoft.com) and tracked in the MSRC update guide.

Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an authenticated low-privileged user to elevate to SYSTEM via a type confusion (CWE-843) flaw. The vulnerability carries a CVSS 7.8 (High) with low attack complexity and no user interaction once local access is obtained, though no public exploit identified at time of analysis. Reported by Microsoft's MSRC, this fits the recurring pattern of Windows kernel driver EoP bugs frequently abused in post-compromise stages.

Remote code execution in the Windows Universal Plug and Play service (upnp.dll) allows unauthenticated network attackers to execute arbitrary code by triggering a use-after-free condition. The flaw carries a CVSS 3.1 base score of 8.1, lowered by high attack complexity (AC:H) reflecting the race-condition or memory-state requirements typical of UAF bugs. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV; EPSS data was not provided in the input.

Local code execution in Microsoft Office Word is possible when a user opens a maliciously crafted document that triggers an untrusted pointer dereference (CWE-416 use-after-free). The flaw lets an unauthorized attacker execute arbitrary code in the context of the current user, and no public exploit identified at time of analysis. Risk hinges on user interaction (UI:R), making phishing-style document delivery the realistic attack pathway.

Local privilege escalation in the Linux MANA (Microsoft Azure Network Adapter) driver allows an authenticated attacker with high privileges on the host to escalate privileges across security boundaries by exploiting a use-after-free condition. The flaw was reported by Microsoft Security Response Center and carries a CVSS 3.1 score of 8.2 driven by scope change and high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Local code execution in Microsoft Office is possible through a heap-based buffer overflow that an unauthorized attacker can trigger without user interaction. The flaw carries a CVSS 3.1 score of 8.4 with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Despite requiring local access, the absence of authentication and user-interaction requirements makes this a notable priority for endpoint patching cycles.

Local code execution in Microsoft Office via a heap-based buffer overflow allows an unauthorized attacker to run arbitrary code with the privileges of the user opening a malicious document. The CVSS vector (AV:L/PR:N/UI:N) indicates local attack vector without required authentication or user interaction, an unusual combination that warrants verification against the vendor advisory. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Local code execution in Microsoft Office via a heap-based buffer overflow that lets an unauthorized attacker run arbitrary code in the context of the current user. The flaw carries a CVSS 8.4 rating driven by high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Despite the 'unauthorized' wording, the CVSS vector specifies a local attack vector, indicating the attacker must already be able to deliver a crafted file or run code on the target system.

Local code execution in Microsoft Office via a type confusion flaw (CWE-416) permits unauthorized attackers to run arbitrary code in the context of the Office process without requiring privileges or user interaction. The issue carries a high CVSS 3.1 score of 8.4 with full impact across confidentiality, integrity, and availability, though exploitation requires local attack vector access to the target system. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.