Memory Corruption

Internet Explorer 6 through 8 contain a use-after-free vulnerability in CDwnBindInfo object handling that allows remote code execution through crafted websites, exploited as a zero-day in December 2012.

Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 84.4%.

Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.

Microsoft XML Core Services 3.0 through 6.0 access uninitialized memory locations, allowing remote attackers to execute code or cause memory corruption through a crafted website, actively exploited before patch availability.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.

Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote code execution, exploited as a zero-day in December 2011 through crafted PDF files.

Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.

A stack-based buffer overflow in win32k.sys RtlQueryRegistryValues function allows local privilege escalation and UAC bypass on Windows XP through Windows 7 via crafted REG_BINARY registry values.

Remote code execution in Microsoft Office 2003-2010 and Office for Mac 2004-2011 allows attackers to execute arbitrary code via malicious RTF documents. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code and an EPSS score of 93.79% (100th percentile), indicating extremely high real-world exploitation likelihood. Microsoft released patches via security bulletin MS10-087. The vulnerability affects a wide range of Office versions across Windows and macOS platforms, representing significant enterprise exposure despite the 2010 disclosure date.

Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was actively exploited as a zero-day in December 2009 via crafted PDF files with ZLib compressed streams.

Microsoft Office Excel 2002 through 2007 and Office for Mac contain a memory corruption vulnerability triggered by a specially crafted spreadsheet with a malformed FEATHEADER record, allowing remote code execution.

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such as Google Chrome and Microsoft Edge, allows unauthenticated remote attackers to trigger memory corruption via a crafted web page, potentially leading to code execution within the renderer sandbox. User interaction (UI:R) is required to visit the malicious content, but the flaw is confirmed actively exploited (CISA KEV) and affects a wide range of products per CPE data, including Apple platforms. No authentication or privileges are needed; patching is urgent.

Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed, threatening the integrity and availability of the processing host. Tracked upstream as GHSA-cfh2-vwfq-qfmm and packaged by Alpine Linux, the flaw requires a victim to run jq against attacker-controlled data (local vector, user interaction required). No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.

A use-after-free (CWE-416) in Libreswan's IKE daemon allows unauthenticated remote attackers to crash the service, causing a denial of service against the affected IPsec/VPN endpoint; the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5) confirms a network-reachable, low-complexity, no-authentication flaw with impact limited to availability. Affected deployments are Alpine Linux hosts shipping a Libreswan package older than the fixed 5.3.3-r0 build and running the daemon as an IPsec responder - that is, any host that accepts IKE negotiation on the default UDP ports 500 and 4500 without restricting them to trusted peers. Hosts that do not run Libreswan as a responder, or that firewall UDP 500/4500 to known peers, are not reachable and are not exposed; no public exploit identified at time of analysis, and while the advisory tags mention information disclosure alongside use-after-free and memory corruption, the authoritative assessment scopes the impact to a daemon/VPN crash rather than data compromise.

Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.

Use-after-free in libarchive's archive_entry_copy_mac_metadata() function allows an attacker who can influence the input an application feeds that API to crash the linked application or cause it to read uninitialized heap memory, yielding a CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). The flaw is not remotely reachable by default and requires the consuming application to perform a self-copy in which the source buffer overlaps the entry's existing mac_metadata pointer; it is a genuinely low-priority memory-safety issue with impact limited to denial of service and minor information disclosure, with no integrity or code-execution outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat has published an upstream fix (libarchive PR #3318) alongside its advisory and Bugzilla tracking entry.

An out-of-bounds write in the Lenovo Energy Management kernel-mode driver lets a local authenticated user crash the affected Windows host with a blue-screen (kernel bugcheck) error, producing a denial-of-service condition on systems where the driver is installed and loaded. The flaw is availability-only: the assessed impact is kernel memory corruption leading to a crash, with no demonstrated path to code execution or data disclosure, and it requires the attacker to already hold a local session on the machine (PR:L) - there is no network-reachable attack surface. No public exploit code and no evidence of active exploitation were identified at time of analysis, so this should be treated as a moderate-severity, patch-and-move-on item rather than an emergency; the vendor advisory is Lenovo LEN-218444.

Stack-based out-of-bounds read and write in nifti_clib through 3.0.1 allows an attacker who supplies a crafted 540-byte NIfTI-2 header to crash or corrupt stack memory in any application that parses that file through nifti_image_read(). The flaw is unauthenticated per the published CVSS vectors but is local and file-driven: the target must actively open or process the malicious NIfTI-2 file, so there is no remote network-triggered path, and the dominant impact is denial of service (CVSS 6.9, AV:L/AC:L/UI:P, A:H with only I:L and C:N in the independent assessment). No public exploit identified at time of analysis; exposure is confined to software that links the vulnerable nifti_clib versions and accepts untrusted NIfTI-2 header data.

Processing a malicious DSM module file with libmodplug through 0.8.9.1 triggers a heap-based out-of-bounds write in CSoundFile::ReadDSM(), corrupting heap memory and crashing the consuming process. Exploitation is local in nature: it requires a victim to open or load a crafted DSM file whose header declares more than 240 PATT chunks or whose patt_len value wraps, defeating the missing nPat bound against MAX_PATTERNS. Impact is bounded to availability (process crash) with limited integrity effect and no confidentiality disclosure, and no public exploit code was identified at time of analysis; a public technical write-up of the defect exists, and the risk converges on a medium-severity memory-safety issue rather than a top-tier priority.

Information disclosure in Microsoft Word allows a remote, unauthenticated attacker to read memory contents from an affected Office installation by getting a user to open or preview a maliciously crafted Word document delivered over the network, such as an email attachment or a download. The flaw is a use-after-free (CWE-416) that is present in Microsoft 365 Apps for Enterprise and in Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024; per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) the impact is limited to confidentiality, with no code execution, integrity, or availability effect. This is a moderate-priority issue rather than a critical one: exploitation is gated by the mandatory UI:R user-interaction requirement, and no confirmed active exploitation (CISA KEV) or publicly available exploit code was identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center advisory.

Off-by-one stack out-of-bounds write in libADLMIDI 1.6.2 through 1.6.2.1 lets an attacker corrupt stack memory in the BW_MidiSequencer when a crafted MIDI file is parsed through adl_openFile() or adl_openData(). The trigger is a note-on event with status byte 0x9F and note 0x7F (127), which overruns the noteStates index and can crash the hosting media player or game engine. This is a local, file-based issue requiring the victim to load the malicious MIDI (CVSS 6.9 Medium); no public exploit identified at time of analysis, and the demonstrated impact is denial of service rather than reliable code execution.

Heap out-of-bounds write in SoX (the sox CLI and any application linking libsox) through 14.4.2 allows a crafted MS ADPCM WAV file with an odd samplesPerBlock value in its fmt chunk to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt(), corrupting adjacent memory. Triggering the flaw requires the victim to open or submit the malicious file to sox/libsox (local attack vector, user interaction), but no authentication or privileges are needed; publicly available exploit code exists and no CISA KEV listing is present. The assessed impact is low integrity and high availability (CVSS 3.1 6.9, CWE-787), with exposure concentrated in automated audio-processing services that decode untrusted files.

Out-of-bounds write in libTiMidity through 0.2.8 allows unauthenticated local attackers to corrupt heap memory and crash applications by loading a crafted SoundFont (.sf2) file whose preset header 'bank' or 'preset' values index past the fixed 128-entry tonebank or drumset arrays in init_soundfont(). The vendor CVSS 4.0 base score is 6.9 (moderate), reflecting high availability impact (crash) and low integrity impact, with exploitation requiring passive user interaction to open the malicious file. Publicly available exploit code exists, increasing the likelihood of targeted attacks against applications that process untrusted SoundFonts.

Stack out-of-bounds write in libTiMidity through 0.2.8 occurs when the SoundFont loader parses crafted .sf2 files, allowing an unauthenticated local attacker to corrupt stack memory via out-of-range pgen/igen generator operators in parse_gen, which writes chosen 16-bit values near the stack Layer object. This leads primarily to denial of service (crash) with a constrained memory corruption primitive; exploitation requires the victim to load a malicious SoundFont file (user interaction), and publicly available exploit code exists but there is no confirmed active exploitation. The assessed severity is moderate (CVSS 3.1 base score 6.1), consistent with a file-parsing memory-safety bug rather than a top-priority threat.

Heap out-of-bounds write in OpenJPH 0.32.0 and earlier allows memory corruption when the library decodes a crafted JPEG 2000 codestream (.j2c or .jph) that uses small precinct sizes to create degenerate one-row codeblocks; the HTJ2K cleanup-pass decoder then writes a second row beyond the end of the codeblock buffer, causing heap corruption and crashes. Publicly available exploit code exists, including a detailed technical write-up, but there is no indication of confirmed active exploitation (no CISA KEV listing), and the assessed attack vector is local with user interaction (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, integrity impact low, availability impact high). Realistic exposure requires OpenJPH to sit in a decode path that accepts untrusted images, such as an upload handler, image viewer, or batch conversion service, where a victim is induced to open the malicious file.

Out-of-bounds write in libsmi through 0.5.0 allows attackers to corrupt adjacent library globals via a crafted MIB file that supplies an OCTET STRING DEFVAL of 512 or more octets beginning with a 0x00 byte, causing smiValueAsString() to overflow a fixed 1024-byte static buffer during hex rendering and crash smidump or other consumers. Exploitation requires the victim to load the malicious MIB (UI:P per CVSS 4.0; UI:R per independent CVSS 3.1 assessment) and is limited to local memory corruption with high availability impact and low integrity impact. Publicly available exploit code exists.

Heap out-of-bounds write in libInstPatch through 1.1.7 allows a crafted SoundFont 2 (.sf2) file to corrupt process memory when a victim loads it in Swami or any other application that uses the library's SF2 loader. The flaw lives in ipatch_sf2_gen_is_valid(), which fails to range-check pgen or igen generator IDs before the validity-mask test, so out-of-range IDs cause values to be written past the zone genarray into adjacent heap memory, crashing or potentially corrupting the consumer. The vector is local and requires user interaction (the victim must open the untrusted file), no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV, though a public technical writeup describing the root cause is available.

Out-of-bounds write in FluidSynth (versions through 2.6.1) allows an attacker to corrupt heap and stack memory by getting a crafted SF2 SoundFont loaded and played - unvalidated PMOD/IMOD modulator destination values of 63 to 255 are used to index the per-voice generator array and updated_gen_bit bitfield without bounds checking. Because the attack vector is local and the victim (or an application acting on their behalf) must open or play the malicious SoundFont, the realistic impact is memory corruption and application crashes (availability) rather than code execution or data theft. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the write-up and source references point to a code-review/crash class of issue rather than an urgent, remotely exploitable defect.

AdPlug through 2.4 contains a heap-based buffer overflow in the KSM (Ken Silverman Music) module player, CksmPlayer::update() in src/ksm.cpp, where register writes accumulated for a single time slot overflow the fixed databuf[2048] array and corrupt the heap-resident player object. A crafted .ksm module whose notes share one time slot triggers the out-of-bounds write without authentication (CVSS PR:N), but the attacker-supplied file must reach and be opened or played on the target (AV:L, UI:R/UI:P), so the real-world exposure is local and interaction-dependent, with the dominant impact being availability loss (A:H) and minor integrity effects (I:L) rather than code execution. An upstream fix is available in GitHub PR #295; no public exploit code was identified at time of analysis.

Out-of-bounds memory write in HPE NonStop RDMA Services NSK can corrupt memory, and the 5.8 CVSS score reflects a local attack path that also requires high privileges, user interaction, and high attack complexity. Only HPE NonStop systems using the RDMA Services NSK component are affected based on the supplied CPE, and no public exploit code or CISA KEV entry is present in the data. Realistic exploitation is limited to a privileged local user who can induce a separate user to interact under race/condition-dependent circumstances, making this a moderate-severity, low-priority issue in practice.

Type confusion in the Palo Alto Networks GlobalProtect app on Windows lets an authenticated local user with low privileges crash the client and produce a denial-of-service condition (CWE-843; vendor CVSS 4.0 score 4.3; assessed CVSS:3.1 4.3 with AV:L/PR:L/UI:N and availability-only impact). Only the Windows client is affected - GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly not vulnerable - so the exposed population is limited to Windows endpoints running GlobalProtect 6.3.0 before 6.3.3-h16, 6.2.0 before 6.2.8-h15, or 6.0.0 before 6.0.15. There is no remote attack surface, no confidentiality or integrity impact, and no privilege escalation or lateral movement, and no public exploit code was identified at time of analysis. Vendor-released patches are available, so this should be treated as a low-to-moderate priority maintenance item rather than an emergency.

An out-of-bounds write in the DPDK vhost-crypto backend allows a guest VM to overflow a host-side buffer and crash the host data plane. The flaw combines an integer overflow in the chain-length validation logic with missing length checks on the RSA request path, so crafted virtio-crypto descriptors can bypass size validation and corrupt host memory. Exposure is confined to hosts that have explicitly enabled the vhost-crypto (virtio-crypto) backend, exploitation requires low-privileged access from within a guest, and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).

An out-of-bounds write in the DPDK lib/vhost vhost-crypto backend lets a guest VM that is authorized to issue vhost-crypto requests corrupt host memory by supplying an avail-ring descriptor index that the backend uses without validating it against the ring size. The affected code ships in Red Hat Fast Datapath packages for RHEL 8, 9, and 10 and is therefore inherited by related RHEL, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens) deployments that consume those DPDK builds. Exploitation is restricted to hosts where the vhost-crypto backend is actually enabled and a virtio-crypto device is exposed to a guest (CVSS 6.5, AV:L/PR:L/S:C), and the assessed outcome is host datapath denial of service rather than data disclosure or modification; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.

Out-of-bounds write in the Zephyr CC1200 sub-GHz IEEE 802.15.4 driver lets an unauthenticated attacker within radio range transmit a frame whose first byte declares a PHY length above the IEEE 802.15.4 maximum of 127, driving an oversized net_buf allocation and a single SPI burst that can write up to 127 bytes past the end of the first 128-byte buffer fragment. The flaw affects builds that enable CONFIG_IEEE802154_CC1200 with a physically attached CC1200 radio in the driver's default variable-length mode (PKT_LEN = 0xFF), and exploitation is constrained by RF framing/timing requirements (CVSS 3.1 AV:A/AC:H/PR:N/UI:N, CWE-787), with the resulting overflow containing FIFO-underflow bytes so the realistic outcome is network-buffer-pool corruption and crashes rather than a controlled write. An upstream fix is available as a commit to verify_rxfifo_validity(), but no public exploit code or confirmed active exploitation was identified at time of analysis, and no independently confirmed tagged release containing the fix is documented here.

An out-of-bounds write in the eventd relay service of Juniper Junos OS and Junos OS Evolved allows an attacker who already holds high-privilege local access on the device to crash the event-processing daemon, causing a denial of service. Our independent assessment (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) confirms the attack is local rather than remote, requires high privileges, needs no user interaction, and affects availability only with no confidentiality or integrity impact and only a low downstream system-availability effect. There is no public exploit identified at time of analysis, no CISA KEV entry confirms active exploitation, and the vendor-rated CVSS 4.0 base score of 6.7 places this in the medium-severity range.

An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent BGP peer crash rpd and cause a denial of service by sending a crafted set of BGP communities. Per the CVSS vector (AV:A/PR:L) the attacker must already sit within the routing trust boundary with an accepted BGP peering session rather than being an arbitrary internet host, and exploitation additionally requires BGP to be configured on the target and the device to add the graceful-shutdown sender community while advertising a route. The impact is availability only (no confidentiality or integrity effect), rated 6.8 (Medium); confirmed actively exploited status is not indicated, and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority availability issue rather than a top-tier emergency.

Heap out-of-bounds write in the Radiance HDR (.hdr) image decoder of Godot Engine through 4.7.2 allows an attacker-supplied .hdr file to corrupt heap memory with contents and overflow length controlled by the file, during project import or runtime image loading. The vendor's CVSS 3.1 vector places this at local, high-complexity, user-interaction-required, unauthenticated (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L per the independent assessment), because the victim must import or load the crafted file and success depends on heap layout. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor disputes that attacker-supplied asset delivery is inside the current Godot threat model, leaving real-world priority LOW.

An infinite cleanup loop in DPDK's vhost-crypto library can be triggered by a local attacker with guest-level access via a crafted writeback descriptor chain, causing a denial of service (host/service hang). The vulnerability is rated CVSS 6.5 (Medium) with a local attack vector (AV:L), low complexity, and scope change; it only affects deployments where vhost-crypto is exposed as a virtio-crypto device backend to untrusted guests. No public exploit code or active exploitation has been identified at time of analysis.

Stack and heap buffer overflow in DPDK's nfp vDPA driver for Netronome/Corigine NFP SmartNICs allows a malicious guest VM with control of the virtqueue to corrupt host memory, leading to high integrity and availability impact and low confidentiality impact. The vulnerability is only exploitable when the host runs DPDK with the nfp vDPA driver active on NFP SmartNIC hardware, and the attacker must be positioned as a local guest able to drive the guest-side virtqueue. No public exploit code has been identified at time of analysis, and the vendor-rated CVSS 3.1 score is 6.5 (Medium); however, our independent assessment assigns a higher impact vector of AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H.

Heap out-of-bounds read and write in MuJS 1.3.6 through 1.3.8 allows attackers to corrupt process memory by supplying JavaScript that inflates a simple/dense array's length property and then invokes Array.prototype.sort, driving the internal Ap_sort_cmp and Ap_sort_swap helpers to index slots past the allocated heap buffer; the practical result is memory corruption and a process crash (CVSS 4.0 base 6.9, AV:L/AC:L/PR:N/UI:P with high availability and low integrity impact). Publicly available exploit code exists, including a published proof-of-concept write-up demonstrating the array-length trigger, but the issue is not confirmed as actively exploited (no CISA KEV listing) and exploitation requires a target application embedding MuJS to execute attacker-controlled script that a victim loads or opens. Deployments that only ever run trusted, first-party JavaScript are not exposed, and MuJS 1.3.9 and later contain the fix; this is a genuine but moderate-priority memory-corruption flaw rather than an emergency.

Memory corruption in libzvbi through 0.2.45 can occur when a victim application decodes an attacker-supplied Teletext stream containing X/28/3 DRCS packets with unvalidated pixel-mode values, driving an out-of-bounds write in convert_drcs. Exploitation requires local decoding of the malicious stream and passive user interaction (opening or processing the stream/capture), and publicly available exploit code exists; there is no confirmed active exploitation. The out-of-bounds write (CWE-787) crashes the application and may corrupt memory, making this a moderate-severity, low-urgency issue rather than a top priority.

Crafted LAS/LAZ point-cloud files parsed by LASzip through 3.5.0 can trigger an invalid free inside laszip_read_header(), crashing the host application and corrupting its heap. A file whose header declares an inflated variable-length-record (VLR) count while supplying truncated VLR data leaves internal attribute pointers uninitialized, so they are freed when the reader is destroyed through the C API (CWE-824, access of uninitialized pointer). The issue is Medium severity (source-provided CVSS 4.0 base 5.8; independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), meaning a victim or automated pipeline must open an attacker-supplied file - there is no network-reachable or auto-triggered path - and impact observed is crash plus heap corruption rather than confirmed code execution; no public exploit identified at time of analysis, although a public technical writeup of the bug exists.

Processing a malformed KWAJ archive with libmspack through 0.11alpha can free uninitialized heap pointers, crashing the host application and potentially providing an arbitrary-free memory corruption primitive. The flaw is unauthenticated but local/file-delivery in nature: an application linked against libmspack must invoke the KWAJ decompressor (kwajd_open) on attacker-supplied input, and the attacker must present a truncated, zero-length, or wrong-signature file that forces an early error return before the filename and extra pointers are initialized. No public exploit code or CISA KEV entry was identified at time of analysis, and the independent assessment rates this as a moderate, not top-priority, issue whose reliable outcome is a crash, with arbitrary-free escalation conditional on platform- and compiler-specific uninitialized stack values.

A heap out-of-bounds write in libsixel's GIF decoder (gif_init_frame() in src/fromgif.c) allows a crafted GIF file to corrupt heap memory in any application that links the library and decodes untrusted images. Affected releases are libsixel before 1.8.7-r1 and versions 1.9.0 through 1.10.5. Successful exploitation is gated by several conditions - the decoder must be invoked with a non-NULL background color (the CVSS 4.0 AT:P attack requirement), the GIF must declare a transparent color via its graphic control extension, the active global or local color table must be small, and the transparent index must exceed that palette size - so the practical risk is medium (CVSS 4.0 base 5.8; assessed CVSS 3.1 AV:L/AC:H/PR:N/UI:R with integrity and availability impact only). The vector is local with required user interaction, no public exploit identified at time of analysis, and a vendor fix is available.

An out-of-bounds write in GStreamer's H.266/VVC Decoding Capability Information (DCI) parser inside libgstcodecparsers allows a remote attacker to crash or corrupt memory in any third-party application that directly calls the affected parsing API by supplying a crafted H.266 bitstream whose reserved DCI field carries an illegal value the parser wrongly accepts. Red Hat rates it CVSS 6.5 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) - network-reachable, unauthenticated and requiring no user interaction per the supplied vector, but with only Low integrity and Low availability impact and no confidentiality loss, consistent with a bounded out-of-bounds write (CWE-787). Exposure is sharply limited: the description states no standard GStreamer pipeline element invokes this code path, so default GStreamer installations and ordinary playback pipelines are not exploitable, and no public exploit has been identified at time of analysis.

Heap out-of-bounds write in the GStreamer ASF muxer plugin (asfmux) occurs when string metadata tags containing Unicode characters outside the Basic Multilingual Plane - such as emoji or supplementary-plane CJK characters - are written into an ASF/WMV container, because the buffer size calculation assumes 2 bytes per code point while UTF-16LE surrogate pairs actually require 4. Exploitation requires a local pipeline that muxes, remuxes, or transcodes attacker-supplied media into ASF while preserving metadata (AV:L, UI:R), enabling a user-assisted heap corruption that can cause a denial of service or limited memory corruption. Rated CVSS 6.1 with C:N/I:L/A:H, this is a medium-severity issue with a narrow attack path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and affected packages are tracked for Red Hat Enterprise Linux 7, 8, 9, and 10.

An out-of-bounds write in the Hitachi Disk Array Driver for IBM AIX (versions 01-00 through 01-22, fixed in 01-23-/A) and for Virtual I/O Server (versions 01-04 through 01-22, fixed in 01-23-/A) allows a local user who already holds high privileges to corrupt driver memory, which the assessed vector scores as high availability impact with limited integrity impact. Because exploitation requires the CVSS vector combination AV:L and PR:H with no user interaction, only already-privileged local accounts - or an attacker who has first compromised such an account - can reach the vulnerable code path; there is no network-facing or unauthenticated path. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV entry); a vendor patch is available, which makes this a low-to-moderate prioritization item rather than an emergency.

Local, low-privileged users can cause a denial-of-service (BSOD) on Windows endpoints running Akamai Guardicore Platform Agent by sending a crafted outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header when the non-default IPv6 ICMP redirect policy is enabled. This use-after-free (CWE-416) in the WFP callout driver allows kernel pool grooming, leading to a system crash. The vulnerability requires local access (AV:L) and high attack complexity (AC:H); no public exploit code or active exploitation has been identified at time of analysis.

A use-after-free in the Windows WFP packet-capture driver of Akamai Guardicore Platform Agent (GPA) before 7.4 lets a local Administrator crash the host by sending a single crafted outbound IPv6 packet through a raw IPV6_HDRINCL socket while an IPv6 proxy/redirect rule is active, causing a fault at DISPATCH_LEVEL and an immediate system crash. The flaw is a denial-of-service only (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H): it grants no privilege gain because exploitation already requires local Administrator rights, and it only affects hosts where the IPv6 redirect/proxy feature is enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and all signals point to a LOW real-world priority given the strict non-default preconditions.

An out-of-bounds write in the Citrix Workspace app for Windows lets a locally present, low-privileged attacker corrupt memory inside the client process, which the vendor scopes to a high availability impact - realistically a client crash or denial of service rather than code execution or data disclosure. Affected builds are those before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1; fixed installers are available from Citrix, and at time of analysis there is no CISA KEV listing and no public exploit identified. With a CVSS 4.0 base score of 6.8 with a local vector, low privileges and no user interaction, this is a moderate-priority endpoint stability issue rather than a top-priority remote threat.

A use-after-free in Chrome's Bindings component allows a remote attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) and is confined to the sandboxed renderer process - the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3) reflects limited confidentiality impact only, with no integrity or availability effect and no sandbox escape, code execution, or privilege gain. Despite Google's 'High' Chromium severity label, there is no public exploit identified at time of analysis, EPSS is only 0.17% (6th percentile), and CISA's SSVC assessment rates exploitation as 'none' and the issue as not automatable, making this a low real-world priority that is mitigated by Chrome's rapid automatic update mechanism. A vendor patch is available (Chrome 155.0.8059.79).

Information disclosure in Microsoft Excel occurs when a user opens a specially crafted Excel workbook, triggering a use-after-free during file parsing that can leak sensitive memory contents. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac; exploitation is unauthenticated over the network (PR:N) but gated behind mandatory user interaction (UI:R), since the victim must open the malicious document. Impact is confined to confidentiality (C:H) with no integrity or availability effect per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (6.5), and there is no public exploit identified at time of analysis, with CISA SSVC recording Exploitation:'none' and Automatable:'no'.

Information disclosure in Windows Message Queuing (MSMQ) Queue Manager allows an authenticated local attacker to read data from an affected host via a type confusion flaw. Exploitation requires the optional MSMQ feature to be installed and the Queue Manager service running (not enabled by default), and impact is limited to confidentiality with no code execution or privilege escalation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.

Local authenticated attackers holding only low-level user privileges on a Windows host can cause the Device Association Service to misinterpret a resource's type (CWE-843 type confusion) and thereby leak sensitive information from the affected system. The flaw carries a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it cannot be triggered remotely or by an unauthenticated user and does not by itself yield code execution, tampering, or denial of service, and there is no public exploit identified at time of analysis. Microsoft has shipped vendor fixes, and CISA's SSVC assessment records exploitation as none and the issue as non-automatable, so this is a moderate-priority patching and hardening item rather than an urgent, actively exploited threat.

A use-after-free memory corruption flaw in the Microsoft Windows DHCP Server service lets an attacker who already holds high privileges, and who can reach the DHCP service over the network, execute arbitrary code on the server. Only hosts actually running the DHCP Server role (Windows Server 2012 through 2025, plus Windows 10 1607/1809 builds where the role is enabled) are exposed; default non-DHCP installations are not. Exploitation is constrained by high attack complexity (AC:H) and the PR:H requirement, and no public exploit code or confirmed in-the-wild activity has been identified at time of analysis, with CISA's SSVC decision framework rating exploitation as 'none' and automation as 'no' - though the technical impact is assessed as total once the memory race is won. Vendor patches are available, so remediation is straightforward for administrators who can schedule a reboot.

Use-after-free in the Microsoft QUIC (MsQuic) Schannel native library allows an unauthenticated, remote attacker who can reach a QUIC/HTTP-3 endpoint to disclose memory contents over the network, with impact limited to confidentiality (no integrity or availability effect). Affected software includes .NET applications referencing the Microsoft.Native.Quic.MsQuic.Schannel package in versions 1.9.0 through 2.6.1, plus a broad set of Windows 11 and Windows Server 2022/2025 builds and Visual Studio 2022/2026 that ship the vulnerable QUIC binaries. Exploitation is non-deterministic because the CVSS vector (AC:H) reflects a race condition the attacker must win, and no public exploit code has been identified at time of analysis; the CISA SSVC assessment records exploitation as none and the issue as not automatable, making this a genuine-but-moderate risk rather than a fire-drill.

Local privilege escalation in Windows NTFS lets an authenticated attacker with local access to an affected Windows host trigger a use-after-free in the NTFS file system driver, which can lead to high-integrity code execution in kernel context and elevation to SYSTEM. The issue affects specific Windows 11 24H2, 25H2, and 26H1 builds and Windows Server 2025 (including Server Core) below the fixed builds listed in the Microsoft advisory. CVSS base score is 6.7, it is not in CISA KEV, and no public exploit identified at time of analysis; SSVC records exploitation as none and automatable as no, keeping the practical risk moderate and requiring a local foothold.

Local information disclosure in the Windows Portable Device (WPD) File System driver affects Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 hosts that have not installed the corresponding cumulative update. A type-confusion flaw (CWE-843) lets an attacker who already holds an authenticated, low-privileged local session (CVSS AV:L/PR:L, no user interaction) coerce the driver into treating one object type as another and read memory the caller should not be able to access, yielding high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N). There is no network vector, no public exploit identified at time of analysis, and CISA SSVC rates the issue non-automatable with only partial technical impact, so it is best treated as a moderate-priority local information-leak primitive to be fixed on a normal patch cycle rather than as an emergency.

Information disclosure in the Windows Graphics Kernel affects a broad range of supported Windows releases, from Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. An attacker who already holds an authenticated local session (CVSS AV:L, PR:L, UI:N) and can run code on the host may drive the graphics kernel into a use-after-free condition and read the contents of freed kernel memory, disclosing potentially sensitive information; impact is limited to confidentiality (C:H) with no integrity or availability effect, and the high attack complexity (AC:H) reflects a non-deterministic memory-reuse race that CISA's SSVC assessment mirrors with Exploitation=none and Automatable=no. At CVSS 4.7 this is a low-to-moderate priority item rather than a critical emergency: no public exploit identified at time of analysis, no CISA KEV listing, no remote or unauthenticated path, and Microsoft has shipped a vendor patch for every affected build.

Information disclosure in the Windows Kernel (CVE-2026-70077) allows a locally authenticated attacker who already holds low-privileged code execution on the host to read kernel memory by winning a race condition in a use-after-free path. Exposure is broad - the vulnerable component ships in every supported Windows 10 and Windows 11 release and in Windows Server 2012 through Server 2025, including Server Core installations - but the attack requires prior local access (PR:L, AV:L) and reliable triggering is non-trivial because of the race (AC:H), and the outcome is limited to confidentiality (C:H with I:N/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; vendor patches are available, so this should be treated as a moderate-to-low priority hardening item rather than an emergency.

Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.

Local information disclosure in Windows Secure Kernel Mode (the Virtualization-Based Security / VTL1 secure kernel) affects Windows 10, Windows 11 from 23H2 through 26H1/26H2, and Windows Server 2019, 2022, and 2025. An attacker who already holds authenticated low-privileged local code execution on the host can force a type-confused resource access in the Secure Kernel path and read data they should not be able to reach, resulting in high-confidentiality impact with no integrity or availability effect. There is no remote or network-facing vector and no user interaction; no public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as 'none' with automability 'no', and Microsoft has released patched build updates.

Privilege escalation in Microsoft's Windows HID class driver lets an attacker who already has physical access to a machine elevate to kernel-level privileges by attaching a crafted USB/HID peripheral and winning a race condition in the driver's object lifetime handling. Because the vector is physical (CVSS:3.1/AV:P) and attack complexity is high (AC:H), the flaw is not remotely exploitable and is non-deterministic in practice; it is limited to shared, kiosk, unattended, or otherwise physically reachable endpoints. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained, and no public exploit identified at time of analysis; vendor patches are available. Impact is high for confidentiality, integrity, and availability on the compromised host (CVSS 6.4).

An out-of-bounds write in GPAC's MPEG-2 transport stream AIT parser (versions up to and including 26.07.0) allows remote attackers to corrupt memory by supplying a crafted stream whose AIT section declares more application descriptors than the fixed application_descriptors_id array can hold. Exploitation requires user interaction - someone or an automated workflow must feed the malicious stream into GPAC's M2TS/AIT parsing path - but no authentication or privileges are needed (CVSS:4.0 base 5.3; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:R, C:L/I:L/A:L). Publicly available exploit code exists (a PoC archive is linked from the VulDB entry and the upstream issue), though there is no evidence of confirmed active exploitation (not in CISA KEV); the practical risk is concentrated in services that automatically ingest untrusted media, such as transcoding pipelines and upload processors.

A use-after-free in Zephyr RTOS's Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) lets an adjacent Bluetooth peer crash or hang the entire device, producing a denial of service. The flaw is reachable only in builds where CONFIG_BT_HFP_AG is enabled (a profile Zephyr marks experimental and ships disabled by default) and where the application implements the optional asynchronous get_ongoing_call callback; a Hands-Free unit sends AT+CIND? during Service Level Connection setup, then tears down and re-opens the HFP RFCOMM DLC on the same ACL link within the ~10-second timeout window, deterministically reusing the same static pool slot while ag->ongoing_call_work is still armed and linked into the kernel timeout list. The repeated memset and k_work_init_delayable corrupt the kernel timeout dlist under an interrupts-locked announce loop, causing a fault or system hang; no attacker-controlled data is written, so code execution is not demonstrated. No public exploit code or in-the-wild exploitation was identified at time of analysis, and the exposed population is sharply limited by the non-default experimental configuration and physical Bluetooth proximity.

Use-after-free in the MongoDB Server aggregation engine lets an authenticated user holding read privileges trigger disclosure of unrelated process memory - or, depending on heap state, an unexpected mongod termination - by issuing an aggregate command that combines an internal aggregation stage with a cursor batch size of 0. The vendor-assigned CVSS 4.0 score is 6.0 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N), while our independent CVSS 3.1 assessment rates it 6.x as AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L, reflecting that exploitation demands valid credentials, the exact option combination, and a favourable memory-reuse window. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate-priority hardening item rather than an emergency.

A heap use-after-free in KeePassXC's legacy KeePass1/KDB import path can crash the application and permit a limited, attacker-influenced write when a user actively imports a crafted, unlockable .kdb file; all builds prior to 2.8.0-beta1 are affected. The flaw is local-only and requires the victim to manually run the legacy import against an attacker-supplied database, so normal day-to-day use of KeePassXC without importing untrusted KDB files is not exposed. Severity is modest - CVSS 4.0 base 4.3 (Medium) and an assessed CVSS 3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H (impact skewed to availability, with only low integrity impact and no confidentiality loss) - and no public exploit code or confirmed active exploitation was identified at time of analysis.

An out-of-bounds write (CWE-787) in AMI Aptio V (APTIOV) BIOS firmware can be triggered by a local attacker who already holds high privileges, potentially corrupting memory inside firmware code paths and enabling buffer overflows, arbitrary code execution, and loss of confidentiality, integrity, and availability. Successful abuse requires local access plus pre-existing administrative or kernel-level privileges, and the high attack complexity means specific state, timing, or configuration preconditions must be met before the write can be controlled, so this is best characterized as a firmware persistence/privilege-escalation primitive rather than an initial-access or remote attack vector. At time of analysis there is no public exploit identified, no CISA KEV listing, and no confirmed exact fix version in the available data, though AMI has issued security advisory AMI-SA-2026002 covering the issue.

Heap-based out-of-bounds write in FreeRDP 3.18.0 through 3.31.x allows a malicious or compromised ARM routing service to crash the RDP client by returning a long redirectedUsername that overflows the CLI credential prompt buffer once the user types input. The vulnerability requires attacker control of the ARM/gateway redirection service in the connection path (AT:P) and passive user interaction (UI:P), and is unauthenticated (PR:N) per the CVSS 4.0 vector; successful exploitation results in a client-side denial of service with no confidentiality or integrity impact. No public exploit code or confirmed active exploitation has been identified at time of analysis.

A use-after-free in Mozilla Firefox's JavaScript/WebAssembly engine can be triggered when a user loads attacker-controlled web content containing crafted WebAssembly, allowing the attacker to corrupt memory and potentially read or alter data in the browser process. Affected are Firefox releases prior to 158; exploitation is remote and requires no authentication (PR:N) but does require user interaction (UI:R), since the victim must navigate to or render the malicious page, and WebAssembly is enabled by default so no non-default configuration is needed. Impact is scoped to partial confidentiality and integrity loss (C:L/I:L, A:N) rather than confirmed code execution, and no public exploit has been identified at time of analysis; Mozilla addressed the flaw in Firefox 158 and the issue is rated moderate priority rather than an emergency.

Use-after-free in Mozilla Firefox's DOM: Workers component allows remote attackers to trigger memory corruption and potential information disclosure in Firefox versions before 158 and Firefox ESR before 153.5 when a victim loads attacker-controlled web content that exercises the Workers API. This moderate-severity issue requires user interaction (UI:R) but no authentication (PR:N), and no public exploit code has been identified at time of analysis per CISA SSVC. The assessed vector is AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating limited confidentiality and integrity impact and no availability impact.

Firefox builds prior to version 158 carry a use-after-free in the JavaScript/WebAssembly (WASM) component that lets attacker-supplied web content corrupt memory inside the browser process, producing limited confidentiality and integrity effects (CVSS 5.4, C:L/I:L/A:N, S:U). Exploitation is unauthenticated (PR:N) but requires the victim to actively load attacker-controlled content that reaches the WASM code path (UI:R), so an idle or abandoned browser cannot be attacked and the flaw is not automatable for worm-style mass exploitation (SSVC Automatable=no). Independent signals rate real-world priority as low: CISA SSVC records Exploitation=none, and no public exploit code has been identified at time of analysis, leaving this a moderate-severity memory-safety bug best addressed by routine patching rather than emergency response.

A use-after-free (CWE-416) in Firefox's JavaScript WebAssembly component lets remote, unauthenticated attackers trigger memory corruption with low confidentiality and integrity impact (CVSS 5.4) when a victim loads attacker-supplied WASM/JS content in any build prior to Firefox 158. Exploitation is constrained by a mandatory user-interaction requirement - the target must open or render a malicious page or document - and by the absence of any availability impact, indicating a bounded disclosure/corruption primitive rather than full system compromise. CISA's SSVC evaluation rates exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis; Mozilla fixed the flaw in Firefox 158.

A use-after-free in Mozilla Firefox's Storage Bucket File System allows an unauthenticated remote attacker to corrupt memory or disclose information by convincing a victim to load crafted web content that exercises the Origin Private File System (OPFS) API. The flaw affects Firefox versions prior to 158 and Firefox ESR versions prior to 153.5, and exploitation requires user interaction while being complicated by heap state and timing, resulting in only low confidentiality, integrity, and availability impact. No public exploit code has been identified, and CISA's SSVC assessment rates exploitation as none with partial technical impact, making this a moderate-severity, low-priority issue despite the underlying memory-corruption class.

A use-after-free in Mozilla Firefox's Audio/Video Playback component allows unauthenticated remote attackers to cause partial memory disclosure and memory corruption when a victim loads crafted media content, affecting Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. Exploitation requires user interaction - the victim must visit a malicious or compromised page whose crafted media is processed by the playback pipeline - so this is best suited to targeted or opportunistic drive-by delivery rather than automated mass exploitation (CISA SSVC Automatable=no, Technical Impact=partial). Vendor-released patches exist in Firefox 158 and Firefox ESR 153.5, and no public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) with no availability impact and no confirmed path to full code execution from the available data.

Use-after-free in Mozilla Firefox's DOM Animation component allows remote attackers to corrupt memory by getting a victim to render attacker-controlled web content in a browser build prior to Firefox 158. The flaw is unauthenticated (PR:N) but requires user interaction (UI:R), since the victim must visit or render the crafted page and let it exercise animation handling; there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation=none with Automatable=no, so mass or automated exploitation is not expected. Impact is capped at partial confidentiality and integrity loss (CVSS 5.4, C:L/I:L/A:N), typically leaking data from freed memory or corrupting it, rather than a guaranteed full compromise.

Use-after-free in Mozilla Firefox's DOM: Core & HTML component allows unauthenticated remote attackers to trigger memory corruption when a victim loads attacker-controlled web content, yielding limited confidentiality and integrity impact. Affected versions are Firefox before 158 and Firefox ESR before 153.5, with fixes available in Firefox 158 and Firefox ESR 153.5. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none, automatable as no, and technical impact as partial, consistent with a moderate-severity memory-safety issue rather than reliable code execution.

Use-after-free in Firefox's DOM WebIDL bindings (CVE-2026-109717) lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled or attacker-influenced web content that reaches the affected binding code path; the CVSS UI:R metric means the user must visit a malicious or compromised page, and no special browser configuration is required. Impact is bounded to low confidentiality and low integrity with no availability impact per the vendor-rated vector, and there is no public exploit identified at time of analysis - CISA's SSVC records Exploitation: none, Automatable: no, and Technical Impact: partial. The flaw is fixed in Firefox 158 and Firefox ESR 153.5, making this a routine browser update-cycle item rather than an emergency patch.

Use-after-free in Mozilla Firefox's Crash Reporting component lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled web content, producing the low confidentiality and integrity impact captured by the assessed CVSS 5.4 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Only Firefox builds before 158 and Firefox ESR builds before 153.5 are affected, and the flaw is fixed in those releases. There is no public exploit identified at time of analysis (SSVC exploitation: none; not automatable), and the mandatory user-interaction requirement keeps realistic risk moderate, making this a normal-patch-cycle item rather than an emergency.

Use-after-free in Mozilla Firefox's Graphics: Canvas2D component (CWE-416) allows a remote, unauthenticated attacker to corrupt memory and potentially disclose information when a victim loads attacker-controlled web content, requiring user interaction (UI:R) but no credentials (PR:N). The flaw affects Firefox builds before 158 and Firefox ESR builds before 153.5 and carries a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), with partial confidentiality and integrity impact but no availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as 'none' and Automatable as 'no'.

Use-after-free in Mozilla Firefox's DOM Streams component allows a remote, unauthenticated attacker to corrupt memory in the content process when a victim renders attacker-controlled web content, yielding limited information disclosure and limited data integrity impact (CVSS 5.4, C:L/I:L/A:N). All builds prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 are affected, and exploitation is gated by mandatory user interaction (UI:R) plus the heap-timing precision needed to win a use-after-free race. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is not an active-exploitation priority despite the memory-corruption class.

Use-after-free in Mozilla Firefox's JavaScript JIT compiler allows remote, unauthenticated attackers to corrupt browser memory by enticing a victim into loading attacker-controlled web content, producing limited information disclosure and limited integrity impact with no availability effect (CVSS 5.4, UI:R, S:U). Exploitation requires the target to visit or be redirected to a malicious page while JIT compilation is enabled, which is the default configuration, and the impact stays confined to the browser process. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and vendor-released fixes ship in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

Use-after-free in Mozilla Firefox's DOM Animation component lets a remote attacker corrupt memory by having a victim load attacker-controlled web content, yielding limited information disclosure and limited integrity impact rather than code execution. Exploitation requires user interaction (UI:R) but no authentication and no non-default browser configuration, so default installations below the fixed builds are affected; the attack is not automatable per CISA SSVC (Automatable=no, Exploitation=none), and no public exploit identified at time of analysis. Vendor-released patch: Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 - only versions below those builds remain exposed.

Use-after-free in Mozilla Firefox's Audio/Video component (CWE-416) permits unauthenticated remote attackers to trigger memory corruption, leading to limited information disclosure or low-integrity effects (CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), when a victim loads crafted media in an unpatched browser. Affected versions are Firefox before 158 and Firefox ESR before 115.43 and 153.5; no public exploit code has been identified at time of analysis, and CISA's SSVC assessment notes exploitation has not been observed and the flaw is not reliably automatable. The required user interaction and partial impact keep real-world urgency low, making this a moderate patch-management item rather than an emergency.

Use-after-free in Mozilla Firefox's SVG rendering component allows remote attackers to cause memory corruption leading to partial information disclosure or limited integrity impact when a user opens a crafted SVG document. Affected versions include Firefox prior to 158 and Firefox ESR prior to 115.43 and 153.5. Exploitation requires user interaction (UI:R), is not automatable, and no public exploit code has been identified; vendor patches are available.

Use-after-free in Mozilla Firefox's DOM: Core & HTML component allows remote attackers to trigger memory corruption when a victim loads attacker-controlled web content, requiring user interaction (UI:R) with no authentication or prior privileges needed (PR:N). Any default Firefox installation that browses to a malicious or compromised page is in scope, but the impact ceiling is limited to partial confidentiality and integrity loss with no availability impact (C:L/I:L/A:N), and Mozilla has already shipped fixes in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. There is no public exploit identified at time of analysis, exploitation is not automatable per SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), and this is a moderate-severity, low-real-world-priority issue despite belonging to the memory-corruption class (CWE-416).

Use-after-free in Mozilla Firefox's XML component can be triggered by unauthenticated remote attackers when a victim loads attacker-controlled web content containing crafted XML, leading to limited information disclosure or integrity impact. This moderate-severity flaw (CVSS 5.4) requires user interaction (UI:R) and does not allow full code execution or denial of service per the assessed vector; no public exploit has been identified and CISA SSVC rates exploitation as none. The issue is fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

Memory-safety flaws in Mozilla Firefox's Graphics: Text component allow remote attackers who convince a user to load crafted web content to trigger a use-after-free, potentially exposing or corrupting data in the browser's process memory. Impact is bounded to limited confidentiality and integrity effects with no availability loss (CVSS 5.4, C:L/I:L/A:N), and exploitation is limited to unpatched builds (versions before Firefox 158, ESR before 115.43, and ESR before 153.5) that render the malicious payload during normal browsing. No public exploit code has been identified at time of analysis and the CISA SSVC assessment rates exploitation as 'none', making this a moderate memory-safety fix to fold into routine browser patching rather than an emergency action.

Use-after-free in Mozilla Firefox's Storage: IndexedDB component (CWE-416) allows a remote, unauthenticated attacker to corrupt browser memory when a victim loads attacker-controlled web content that drives the IndexedDB API, yielding partial confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). The mandatory user interaction (UI:R) is the controlling barrier: the flaw cannot be triggered against a passive or idle target, and IndexedDB is enabled by default so no special configuration is required once a victim visits or interacts with a malicious or compromised page. Only Firefox builds prior to 158 and ESR builds prior to 115.43 and 153.5 are affected; no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' with non-automatable, partial technical impact, and the independent assessment keeps this at low real-world priority rather than an urgent threat.