Memory Corruption

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. [CVSS 7.8 HIGH]

In display, there is a possible use after free due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. [CVSS 7.0 HIGH]

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. [CVSS 7.8 HIGH]

Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results. [CVSS 8.1 HIGH]

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT bridge client component (implemented via the underlying NanoNNG library). [CVSS 4.9 MEDIUM]

An out-of-bounds memory write in the firmware of the Delta DVP-12SE11T programmable logic controller allows remote attackers to corrupt memory on a network-reachable device, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating no authentication or user interaction is required and full loss of confidentiality, integrity, and availability. The flaw is classified as CWE-787 (out-of-bounds write) and is reported against the DVP-12SE11T firmware with no version constraint in the CPE record, meaning all observed firmware builds of that model should be treated as affected until the vendor advisory (Delta PCSA-2025-00022) narrows the range. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; realistic exploitation depends on an attacker first reaching the controller on an OT/plant network segment, since the exact triggering protocol, port, or message type is not disclosed in the available data.

Type confusion in the jsish 2.0 JavaScript interpreter lets a crafted script reach the OP_NEXT opcode with an unintended array reference left on the stack, which the VM then dereferences as an iterator's iterCmd function pointer, causing a crash and potentially enabling code execution where heap layout permits. Exploitation is bounded rather than maximal: the assessed vector is local with high complexity (AV:L/AC:H/PR:N/UI:N), requires the attacker to get attacker-controlled JavaScript executed by jsish 2.0, and code execution is not guaranteed without heap grooming, though publicly available exploit code exists (a public writeup) and no CISA KEV entry confirms active exploitation. EPSS is 0.53% (43rd percentile), and the input 9.8 network-vector score is not supported by the multi-source signals.

A data race in NanoMQ MQTT Broker versions prior to 0.24.2 can free subscription-info list memory while another thread still references it, producing a heap use-after-free that crashes the broker and denies MQTT service to connected clients. The flaw is reachable by remote attackers who hold an MQTT session able to perform subscribe/unsubscribe operations (CVSS PR:L, treated as authenticated, though deployments allowing anonymous connections remove that barrier), and exploitation is nondeterministic because the attacker must win a concurrent timing window (CVSS AC:H). Publicly available exploit code exists, and no confirmed active exploitation (CISA KEV) has been reported; independent assessment rates availability-only impact (C:N/I:N/A:H), while NVD's original vector claimed high confidentiality and integrity impact, so the confidentiality/integrity exposure should be treated as unproven. Upgrading to 0.24.2 eliminates the condition.

An out-of-bounds write in the BlueDroid AVRCP implementation of Espressif's ESP-IDF (avrc_vendor_msg) allows an attacker within Bluetooth Classic radio range to corrupt memory on affected ESP32-class devices, potentially causing crashes, undefined behavior, or controlled memory modification. The flaw affects ESP-IDF 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier, but only firmware that actually uses the BlueDroid Bluetooth Classic host stack with the AVRCP profile active and that constructs or passes through vendor-dependent AVRCP commands with a large vendor_len; the CVE carries a CVSS 4.0 base score of 6.1 (AV:A/AC:L/AT:P/PR:N/UI:N) from the GitHub advisory, and an independent mapping to CVSS 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) rates it moderate rather than critical because exploitation is proximity-bound and profile-dependent. No public exploit code has been identified at time of analysis, and vendor fixes are available through upstream commits referenced in GitHub advisory GHSA-43gh-7r4f-qp57. Note that the vulnerability's impact is worst on builds where assertions are disabled, since the original length check was implemented as an assert; mitigation is an update, not a configuration change, for devices that require AVRCP.

Out-of-bounds write in the BlueDroid Bluetooth host stack shipped with Espressif ESP-IDF 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier allows a nearby attacker-controlled Bluetooth Classic device to corrupt memory on a target during SDP service discovery. The flaw is unauthenticated and requires only Bluetooth radio proximity (assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), because a peer advertising more than 32 service UUIDs overflows the fixed-size uuid_list[32][MAX_UUID_SIZE] buffer in bta_dm_sdp_result(). No public exploit has been identified at time of analysis; upstream fixes are already committed and documented in GitHub advisory GHSA-hmjj-rjvv-w8pq.

Adjacent network attackers can exploit an uninitialized pointer vulnerability in TP-Link WR940N and WR941ND routers to cause denial of service and potentially execute arbitrary code as root. Affected firmware versions are WR940N

Remote code execution in Mozilla Firefox via use-after-free in Disability Access APIs allows unauthenticated network attackers to compromise browser integrity with high impact. The vulnerability (CWE-416) affects Firefox versions prior to 146.0.1 and requires no user interaction or special privileges. With CVSS 9.8 (Critical) but low EPSS (0.07%, 21st percentile), real-world exploitation probability remains limited despite theoretical severity. No public exploit identified at time of analysis, and vendor-released patch 146.0.1 available.

Type confusion in Apple's WebKit engine, used by Safari and other WebKit-based applications, can be triggered by processing maliciously crafted web content, leading to an unexpected Safari crash on unpatched devices. Affected versions include Safari before 26.2, iOS/iPadOS before 18.7.3 and 26.2, macOS before Tahoe 26.2, and visionOS before 26.2. No public exploit code has been identified at time of analysis, though the EPSS score is elevated at 34.14% (98th percentile). The vulnerability requires user interaction and is unauthenticated (PR:N), but impact is limited to denial of service (availability only) with no confidentiality or integrity impact.

An out-of-bounds write (memory corruption) in Apple's WebKit rendering engine lets remote, unauthenticated attackers crash Safari and other WebKit-based components on affected Apple platforms by convincing a victim to load maliciously crafted web content. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L vector, the realistic outcome is limited to an unexpected process (tab/renderer) crash - a recoverable availability-only denial of service - with no code execution, data disclosure, or integrity impact, and exploitation requires mandatory victim interaction (navigating to or rendering the attacker-controlled content) with no automatic or wormable trigger. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.77% (54th percentile), and Apple has released fixes in Safari 26.2, iOS and iPadOS 18.7.3 and 26.2, macOS Tahoe 26.2, and visionOS 26.2.

Heap corruption via use-after-free in Google Chrome's WebGPU implementation (CWE-416) affects all builds prior to 143.0.7499.147, allowing a remote, unauthenticated attacker to corrupt memory in the renderer process when a victim simply visits a crafted HTML page that exercises the WebGPU API. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) - the priority here is driven by Chrome's enormous deployment footprint and by the fact that exploitation needs only user interaction (UI:R) with no credentials (PR:N). Google rates the issue as High severity and has shipped a fixed build in the stable channel, and because the flaw lands in the sandboxed renderer, full host compromise would still require chaining an additional sandbox escape.

An out-of-bounds write in the UEFI-MM Secure Partition of Ampere AmpereOne platform firmware can be triggered by a malformed SMC (Secure Monitor Call) issued to the MMCommunicate service, allowing memory corruption inside the secure partition context on affected devices running firmware earlier than AC03 3.5.9.3, AC04 4.4.5.2, or AmpereOne M 5.4.5.1. Although the NVD-published CVSS 3.1 vector scores this 9.8 with AV:N/PR:N, that rating does not match the attack surface: the MMCommunicate SMC interface is a local, privileged interface, and our independent assessment reassesses the flaw as CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, meaning an attacker must already hold OS kernel/EL1-level execution on the host before reaching the vulnerable code. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so real-world risk is gated behind a prior operating-system compromise rather than direct remote reachability. Full technical details and fixed firmware versions are published by the vendor in advisory AMP-SB-0007.

An out-of-bounds write in the UEFI-MM PCIe driver of Ampere AmpereOne server firmware lets code that already holds kernel- or hypervisor-level control (EL1 and above on AArch64) corrupt memory inside the driver's S-EL0 secure-partition address space by issuing a malformed SMC call. Only systems running AmpereOne AC03 firmware below 3.5.9.3, AC04 below 4.4.5.2, or AmpereOne M below 5.4.5.1 are affected. Although the input scores this 9.8 with a AV:N/PR:N vector, the SMC instruction is privileged and cannot be reached by an unauthenticated remote user; the practical precondition is pre-existing privileged execution on the host (assessed CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; vendor firmware fixes are available.

Memory corruption in Autodesk Shared Components allows arbitrary code execution when a user opens a maliciously crafted SLDPRT file in an affected Autodesk product. The attack vector is local (AV:L) and requires user interaction (UI:R) but no authentication (PR:N), and code executes only with the privileges of the current process (S:U), limiting impact to the user context. No public exploit code or active exploitation has been identified at time of analysis.

Memory corruption in the SLDPRT file parser of Autodesk Shared Components allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted file. All versions of the Shared Components library (CPE cpe:2.3:a:autodesk:shared_components:*:*:*:*:*:*:*:*) are affected, and any Autodesk desktop product that relies on this component to import SolidWorks SLDPRT parts inherits the exposure. Exploitation requires the victim to open an attacker-supplied SLDPRT file (AV:L, UI:R, PR:N), and there is no public exploit identified at time of analysis; no CISA KEV entry was provided, and impact is confined to the user-privileged process, with no automatic privilege escalation.

An out-of-bounds write in Autodesk Shared Components lets a maliciously crafted MODEL file corrupt memory and potentially achieve arbitrary code execution in the context of the current process when parsed by an affected Autodesk product. Exploitation requires the victim to open the crafted file locally (CVSS AV:L/UI:R, PR:N), so it is not remotely or automatically triggerable; no authentication is required on the target and impact is not elevated beyond the current user (S:U). Scoring is 7.8 (High) with full confidentiality, integrity, and availability impact, and no public exploit code or confirmed in-the-wild activity was identified at time of analysis.

An out-of-bounds write in Autodesk Shared Components allows a maliciously crafted MODEL file to corrupt memory when the file is parsed by an affected Autodesk product, giving an attacker the ability to crash the application, corrupt data, or execute arbitrary code in the context of the current user process. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so it is not remotely triggerable: an attacker must deliver a crafted MODEL file and convince a user to open or import it, and exploitation is bounded by the user's own privileges with no scope change. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing); no EPSS score was supplied with the available intelligence.

Out-of-bounds write in Autodesk Shared Components allows local attackers to execute arbitrary code in the context of the current process when a user opens a maliciously crafted MODEL file. Exploitation requires user interaction (UI:R) and no authentication (PR:N), and impact is limited to the privileges of the user running the affected Autodesk application (S:U). No public exploit code or active exploitation has been identified at time of analysis, though the CVSS base score is 7.8 (High).

An out-of-bounds write (CWE-787) in Autodesk Shared Components (CVE-2025-10888, CVSS 7.8) can be triggered when an affected Autodesk product parses a maliciously crafted MODEL file, producing memory corruption that can crash the application, corrupt data, or execute arbitrary code in the context of the user running the application. Per the CVSS vector (AV:L/AC:L/PR:N/UI:R), exploitation is local and unauthenticated but requires the victim to open or parse the malicious file, so it is not remotely triggerable and cannot self-propagate; code execution is confined to the current user's privileges, not elevated rights. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the vendor advisory ADSK-SA-2025-0024 should be consulted for the definitive list of affected products and available fixes.

Out-of-bounds write in Autodesk Shared Components (the shared CAD file-parsing library embedded across multiple Autodesk products) allows attackers to crash the application, corrupt data, or execute arbitrary code in the context of the current user process when a malicious CATPART (CATIA V5 part) file is opened. Per the assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, exploitation is local and requires user interaction: there is no remote or unauthenticated network path, and the attacker must socially engineer a victim into opening an untrusted CATPART file. No public exploit code has been identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); risk is concentrated in environments that routinely ingest externally sourced CAD files such as supplier exchanges and model-sharing portals. Affected products are identified through the CPE cpe:2.3:a:autodesk:shared_components, with Autodesk's advisory adsk-sa-2025-0024 documenting the issue.

Opening a maliciously crafted X_T (Siemens Parasolid) model file in an Autodesk product that bundles the affected Shared Components drives an out-of-bounds write in the geometry parser, rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation can crash the application, corrupt data, or execute arbitrary code in the context of the current user process, with no privilege escalation beyond the victim's own rights. The attack is local and user-driven - the attacker must deliver the file and convince a victim to open it in a vulnerable Autodesk application - and no public exploit identified at time of analysis (no KEV listing, no published PoC).

Memory corruption via out-of-bounds write in Apple operating systems allows remote attackers to execute arbitrary code when victims process a malicious file. The vulnerability affects macOS (Sonoma 14.x, Sequoia 15.x, Tahoe 26.x), iOS/iPadOS (18.x, 26.x), tvOS, visionOS, and watchOS 26.x. Despite a high CVSS score of 8.8, EPSS data indicates only 0.05% exploitation probability (15th percentile), and no public exploit code or active exploitation is confirmed. The flaw stems from inadequate bounds checking (CWE-787) in file processing routines, requiring user interaction but no authentication, making it a realistic phishing or malicious download target.

Use-after-free memory corruption in Apple WebKit allows remote attackers to crash Safari and iOS/iPadOS applications via maliciously crafted web content, resulting in denial of service. The vulnerability affects Safari 26.2, iOS 18.7.2 and 26.2, iPadOS 18.7.2 and 26.2, macOS Tahoe 26.2, visionOS 26.2, and watchOS 26.2. No public exploit code has been identified, and the vulnerability is not confirmed as actively exploited; however, the network-accessible attack vector and low complexity make it a moderate priority despite the low EPSS score.

Memory corruption in macOS kernel allows authenticated local users to execute arbitrary code or crash the system. Apple fixed the vulnerability via improved memory handling in macOS Sequoia 15.7.4, Sonoma 14.8.4, and Tahoe 26.1. With CVSS 7.8 (High severity) reflecting local attack vector requiring low privileges, and EPSS at 0.01% (2nd percentile), this represents a moderate real-world risk despite high CVSS scoring. No public exploit identified at time of analysis, and no evidence of active exploitation (not in CISA KEV).

Parsing a malformed DICOM file with crafted encapsulated PixelData fragments in the Grassroots DICOM (GDCM) library triggers an out-of-bounds write caused by unsigned integer underflow in buffer indexing, crashing the parsing application and producing a denial-of-service condition. The flaw is only reachable through local file input (AV:L) with explicit user interaction (UI:A) - the malicious file must be delivered to and opened by a user inside a GDCM-based application, and there is no network-exposed service path and no code execution demonstrated, so impact is limited to availability. Exploitation risk is low at time of analysis: EPSS is 0.15% (3rd percentile), no CISA KEV listing exists, and no public exploit code has been identified. Vendor-released patch: GDCM v3.2.2.

Use-after-free in the Password Manager component of Google Chrome prior to 143.0.7499.110 allows a remote, unauthenticated attacker to corrupt memory and potentially pivot out of the browser sandbox when a victim opens a crafted HTML page. The attack is not autonomous: it requires the victim to load the malicious page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the resulting primitive is only a sandbox-escape building block, so realistic impact depends on chaining a separate renderer compromise. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is low at 0.24% (14th percentile), which combined with Chrome's automatic update mechanism makes this a moderate-risk rather than high-priority issue. Google rates the underlying Chromium bug as Medium severity and has shipped a fix in Chrome 143.0.7499.110.

Arbitrary code execution in System Management Mode (SMM) is possible on Insyde UEFI-based devices when a local high-privileged attacker (e.g., kernel-level or administrator) passes crafted input to a vulnerable SMM handler, triggering an out-of-bounds write (CWE-787) that can corrupt SMRAM. The flaw affects specific Insyde firmware versions on OEM platforms, but no public exploit has been identified at time of analysis and EPSS is low (0.15%, 3rd percentile). This high-barrier vulnerability requires prior OS compromise to gain the necessary privileges, making it a platform-firmware risk rather than a remotely exploitable one.

Out-of-bounds write in AzeoTech DAQFactory release 20.7 (Build 2555) enables arbitrary code execution or denial of service when a local user opens or interacts with attacker-supplied content. The flaw was reported through CISA ICS-CERT and disclosed in ICS advisory ICSA-25-345-03, indicating ICS/SCADA operational technology impact, though no public exploit identified at time of analysis and no CISA KEV listing exists.

Arbitrary code execution in AzeoTech DAQFactory release 20.7 (Build 2555) is possible when a local user opens or interacts with attacker-supplied content that triggers an access-of-uninitialized-pointer condition. The flaw was reported through CISA ICS-CERT and is tracked in ICS advisory ICSA-25-345-03; no public exploit identified at time of analysis and the CVSS 4.0 vector (AV:L/AC:L/PR:N/UI:A) indicates local vector with required user interaction rather than remote network exploitation.

Type confusion in AzeoTech DAQFactory 20.7 (Build 2555) enables arbitrary code execution when a user opens a maliciously crafted .ctl project file, corrupting memory in the parser and running attacker-controlled code in the process context. Reported through CISA ICS-CERT and tracked in ICS advisory ICSA-25-345-03, the flaw affects industrial data acquisition and HMI deployments; no public exploit identified at time of analysis and EPSS data was not provided.

Local code execution in AzeoTech DAQFactory release 20.7 (Build 2555) is possible when a user opens a maliciously crafted .ctl project file, triggering a use-after-free condition (CWE-416) in the parser. The flaw was reported by ICS-CERT (DHS) and documented in CISA ICS advisory ICSA-25-345-03, but there is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Out-of-bounds write in Android's AudioDecoder (audio_decoder.cc, AudioDecoder::HandleProduceRequest) lets a remote, unauthenticated attacker execute code by feeding crafted audio data into the decoder path, with no user interaction required, as the faulty bounds check on the produce request's size/offset fields can be bypassed. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with CWE-787; the practical prerequisite is that some application or service must route untrusted audio into this decoder and the device must be running an unpatched build. There is no public exploit identified at time of analysis, and the only vendor reference is the December 2025 Pixel bulletin, so real-world exposure appears limited to Pixel/AOSP builds carrying this decoder below the 2025-12-01 patch level.

Local privilege escalation in Android's Trusty TEE allows a low-privileged attacker with local code execution to corrupt memory via uninitialized data in the trusty_ffa_mem_reclaim function, potentially achieving full confidentiality, integrity, and availability impact (CVSS 7.8). The vulnerability resides in the FF-A shared-memory reclaim SMC handler and requires no user interaction or additional execution privileges. No public exploit identified at time of analysis; patch is available via the December 2025 Pixel security bulletin.

An out-of-bounds write in the WAVES_send_data_to_dsp routine of libaoc_waves.c can allow a local attacker to escalate privileges on affected Google Pixel/Tensor devices. Per the CVSS vector (AV:L/AC:L/PR:L/UI:N), an attacker must already have the ability to run code at low privilege on the device and reach the Always-On Compute (AoC) WAVES audio/DSP path; no further privileges and no user interaction are needed to trigger the memory corruption. The issue is host-specific to Pixel/Tensor firmware rather than generic Android, carries no confirmed active exploitation or known public exploit at time of analysis, and is addressed through the Android Pixel security bulletin dated 2025-12-01.

Local privilege escalation and information disclosure in the BIGO IOMMU driver of the Google Pixel/Tensor kernel arise from a use-after-free in bigo_map() (bigo_iommu.c) that lets an attacker who already holds System execution privileges read reclaimed kernel memory or corrupt kernel state. The CVSS:3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms local access with no user interaction, but exploitation is gated behind the high pre-existing privilege requirement, which confines the flaw to the post-exploitation/privilege-escalation stage of a chain on affected Pixel devices. There is no public exploit identified at time of analysis, and EPSS is negligible at 0.08% (0th percentile).

Use-after-free in Foxit PDF Reader and Foxit PDF Editor for Windows and macOS (versions before 13.2 and 2025 releases before 2025.2) allows an attacker to corrupt memory or crash the application by delivering a crafted PDF containing JavaScript that attaches an OnBlur action to a form field, destroying an annotation; the victim must then right-click that field so internal focus-change handling prematurely releases the annotation object. The vector is local with high attack complexity and required user interaction (assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 6.7), and there is no public exploit identified at time of analysis - EPSS is low at 0.14% (3rd percentile) and the issue is not in CISA KEV. This is a genuine but moderate-priority client-side memory-safety flaw whose practical exploitability depends on winning a focus-handling race rather than on a trivial one-click trigger.

Use-after-free in Foxit PDF Reader and PDF Editor for Windows (older than 13.2, and 2025 builds older than 2025.2) allows an attacker who convinces a user to open a crafted PDF to corrupt memory in the rendering process. The trigger is embedded JavaScript that calls closeDoc() while internal document objects are still referenced, leaving dangling pointers that can be reused for information disclosure and, per the assessed vector, high confidentiality impact with limited integrity and availability impact. Exploitation is not remote-automatable: it requires local delivery of a malicious file plus explicit user interaction, and the high attack-complexity rating reflects a timing/state-dependent condition that does not trigger reliably; there is no public exploit identified at time of analysis and EPSS is only 0.14% (3rd percentile), so this is a genuine but moderate-priority issue rather than a top-tier emergency.

Local privilege escalation in Microsoft Windows allows an authenticated attacker to gain elevated privileges via a use-after-free in the Brokering File System component. Affected versions include Windows 11 24H2 and 25H2, Windows Server 2022 23H2, and Windows Server 2025. Exploitation requires local access (AV:L) and high attack complexity (AC:H) with low privileges (PR:L); no user interaction is needed. No public exploit code has been identified at time of analysis, and the EPSS score is 0.33%, indicating a low likelihood of exploitation in the wild.

Use-after-free in Microsoft Excel lets an attacker execute arbitrary code in the context of the user who opens a specially crafted Excel workbook. Affected builds include Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021 (Windows and macOS), and Office LTSC 2024 across x86 and x64; the CVSS vector shows PR:N (no authentication needed) but UI:R (the victim must open the malicious file, typically delivered as an email attachment, download, or shared file), so there is no remotely reachable service to attack. No public exploit code is identified and the issue is not in CISA KEV at time of analysis, while the EPSS score of 0.61% (48th percentile) indicates low predicted exploitation activity; because the code executes in the opening user's process and privilege context, the impact ceiling is that user's rights rather than SYSTEM.

Code execution in Microsoft Office results from a use-after-free (CWE-416) that is triggered when an affected build processes a maliciously crafted Office file. The vulnerable products include Microsoft 365 Apps Enterprise x64/x86, Office 2016, Office 2019, Office LTSC 2021 for x64/x86/macOS, and Office for Android; successful exploitation is local (AV:L) and can lead to arbitrary code execution in the context of the current user. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE; EPSS is 0.06% (18th percentile), suggesting low near-term exploitation likelihood.

Use-after-free memory corruption in Microsoft Office Word allows an attacker to execute code locally on a victim's machine when the victim opens a specially crafted Word document. Affected configurations include default installations of Microsoft 365 Apps for Enterprise (x64/x86), Office 2019 (x64/x86), and Office LTSC 2021 and 2024 (x64/x86 and macOS). Exploitation is gated by user interaction (UI:R) and is complicated by HIGH attack complexity (AC:H), since reliable control of heap reuse timing is required; no public exploit has been identified at time of analysis and EPSS is low at 0.52% (42nd percentile), and there is no CISA KEV confirmation of active exploitation. Under the provided assessment this is a genuine but not top-tier priority, with a CVSS base of 7.0 reflecting high confidentiality, integrity, and availability impact if successfully triggered.

Memory corruption through type confusion (CWE-843) in Microsoft Office lets an attacker execute code locally with the privileges of the current user when a victim opens or previews a specially crafted document. Affected deployments include Microsoft 365 Apps (enterprise x64/x86), Office 2016 and 2019, Office LTSC 2021 on both Windows and macOS, and Office for Android, with unpatched installations of any of these being the prerequisite condition. Exploitation is not remote or unauthenticated over the network and depends on real-world user interaction to deliver and open the malicious file, so this is a genuine but not top-tier priority (EPSS 0.12%, 31st percentile); no public exploit code exists and there is no confirmed active exploitation (CISA KEV). Microsoft rates the flaw 7.8, and our independent assessment models the vector as PR:N/UI:R rather than NVD's PR:L/UI:N, while agreeing on the high confidentiality, integrity and availability impact confined to the user's own security scope.

Use-after-free memory corruption in Microsoft Excel allows code execution in the context of the user who opens a specially crafted Excel workbook on a vulnerable local installation. Affected builds span Microsoft 365 Apps for Enterprise (x86/x64), Excel 2016 (x86/x64), Office 2019 (x86/x64), and Office LTSC 2021 (x86/x64/macOS) and Office LTSC 2024 (x64), per the published CPE set. The vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) requires no prior credentials or privileges but does mandate user interaction - the victim must open the malicious file - so delivery depends on phishing or attachment-based social engineering rather than network exposure; no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, and EPSS is low at 0.66% (50th percentile).

Local privilege escalation in Windows Remote Access Connection Manager (RasMan) permits an authenticated low-privileged attacker to execute code with SYSTEM privileges via a use-after-free (CWE-416) or uninitialized resource memory corruption condition. The flaw affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and multiple Windows Server editions, though no public exploit code or active exploitation has been identified at time of analysis (EPSS 2.2%, 82nd percentile). Exploitation requires the attacker to already have local interactive or programmatic access and does not require user interaction.

Use-after-free in Wasmi's linear memory implementation, triggered when a WebAssembly module drives memory growth, can lead to memory corruption, information disclosure, or code execution in host applications that embed the interpreter (versions 0.41.0-0.41.1, 0.42.0-0.47.0, 0.50.0-0.51.2, and 1.0.0). Exploitation requires local access and the ability to supply a malicious module (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8); hosts running only trusted, first-party modules are not practically exposed. No public exploit identified at time of analysis and EPSS is low (0.15%, percentile 3%); vendor patches are available in 0.41.2, 0.47.1, 0.51.3, and 1.0.1.

Unauthenticated memory corruption in SAP Web Dispatcher, SAP Internet Communication Manager (ICM), and SAP Content Server allows a remote attacker to crash the affected service by sending a crafted request that exercises logical errors in the code, resulting in a denial-of-service condition. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required; exploitation is bounded only by network reachability, so internet-facing or untrusted-network-exposed dispatcher/ICM/Content Server endpoints carry the highest risk. No public exploit code has been identified at time of analysis, EPSS is low at 0.54% (44th percentile), and SAP has published remediation guidance via its security notes and patch day. Impact is limited to availability (service crash/DoS) with no confidentiality or integrity consequence.

Multiple memory corruption flaws in Firefox and Thunderbird enable remote code execution via network-accessible attack vectors. Mozilla Firefox ESR 140.5, Firefox 145, Thunderbird ESR 140.5, and Thunderbird 145 contain memory safety bugs with evidence of corruption that Mozilla presumes exploitable for arbitrary code execution. Authentication requirements not confirmed from available data (CVSS vector shows PR:N). Vendor-released patches available: Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6. EPSS probability is low (0.09%, 25th percentile), and no public exploit identified at time of analysis.

Memory corruption vulnerabilities in Mozilla Firefox 145 and Thunderbird 145 enable remote code execution via multiple memory safety bugs. Unauthenticated remote attackers can exploit these flaws (CWE-787 buffer overflow) through network-based attack vectors with low complexity, requiring no user interaction. Mozilla has released patches in Firefox 146 and Thunderbird 146. EPSS score of 0.07% (21st percentile) suggests low observed exploitation probability, and no public exploit identified at time of analysis, though the vendor's assessment indicates memory corruption with exploitable potential.

Remote code execution in Mozilla Firefox and Thunderbird (pre-146) allows unauthenticated network attackers to execute arbitrary code via a use-after-free flaw in the GMP (Gecko Media Plugin) audio/video component. Despite a critical CVSS 9.8 rating, EPSS probability remains low (0.08%, 23rd percentile), and no public exploit identified at time of analysis. Mozilla patched both products in version 146, with vendor advisories and technical details available via Bugzilla.

JIT compiler miscompilation in Mozilla Firefox and Thunderbird's JavaScript engine enables remote attackers to achieve limited confidentiality, integrity, and availability impact without authentication or user interaction. Affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird ESR < 140.6. Vendor-released patches available in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. No public exploit identified at time of analysis, with EPSS score of 0.11% (30th percentile) indicating low predicted exploitation probability.

Remote code execution via use-after-free in Mozilla Firefox and Thunderbird WebRTC signaling allows unauthenticated network attackers to execute arbitrary code without user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Vendor-released patches available (Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6). CVSS 9.8 (critical) reflects maximum technical severity, though EPSS 0.09% (25th percentile) and absence from CISA KEV suggest limited real-world exploitation at time of analysis. No public exploit identified at time of analysis.

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

A use-after-free race condition in the Huawei HarmonyOS 6.0.0 audio module lets a locally installed application or local process with low-level privileges (PR:L) destabilize the audio subsystem, producing an availability-only impact (C:N/I:N/A:H). Because the flaw depends on winning a narrow timing window (AC:H), exploitation is non-deterministic and typically requires repeated attempts, and there is no scored path to code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis, EPSS is negligible at 0.01% (0th percentile), the issue is not in CISA KEV, and devices updated via the Huawei December 2025 security bulletin are not affected; this is a low-to-moderate priority issue rather than an urgent one.

A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to true due to underflow, allowing an out-of-bounds read.

Remote code execution in WatchGuard Fireware OS is achievable by an authenticated privileged user via a specially crafted CLI command that triggers an out-of-bounds write in the CLI component. The flaw spans three major release branches - 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - covering multiple years of Fireware development. No CISA KEV listing or public exploit has been identified at time of analysis; EPSS at 0.15% (35th percentile) reflects low current exploitation probability, consistent with the high-privilege requirement.

Arbitrary code execution in WatchGuard Fireware OS's CLI component affects authenticated privileged users who issue specially crafted IPSec configuration commands, triggering a CWE-787 out-of-bounds write. All major Fireware OS release trains from 11.0 through the current 2025.1.2 branch are affected, making this a broad-impact issue for organizations running WatchGuard network security appliances. No public exploit identified at time of analysis, and EPSS at 0.15% (35th percentile) indicates low near-term opportunistic exploitation probability, though the privileged-access requirement limits the realistic attacker pool to insiders or already-compromised admin accounts.

Out-of-bounds write in WatchGuard Fireware OS's certificate request CLI command enables arbitrary code execution on affected network security appliances. The flaw affects three distinct version branches - Fireware OS 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - and requires a privileged, authenticated session to trigger. No public exploit code or CISA KEV listing has been identified; EPSS of 0.11% (30th percentile) reflects low current exploitation probability, but the high-confidence RCE impact on a network security appliance warrants prompt patching for affected organizations.

Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.

Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184870; Issue ID: MSV-4752.

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4797.

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4803.

In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4807.

In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10259774; Issue ID: MSV-5029.

In mmdvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10267218; Issue ID: MSV-5032.

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297.

Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.

Samsung Android 13, 14, 15, and 16 devices running firmware prior to SMR Dec-2025 Release 1 contain an out-of-bounds memory access flaw in the Quram-supplied image decoder libimagecodec.quram.so, reachable by remote unauthenticated attackers who supply a crafted image for parsing. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), the confirmed impact is high confidentiality loss only, consistent with out-of-bounds read/disclosure rather than confirmed code execution, and no single-click user interaction is strictly required for the vulnerable decode path. Exploitation is currently limited by the low EPSS score (0.07%, 22nd percentile), no public exploit code and no confirmed active exploitation (not in CISA KEV), and the practical need to route a malicious image into the specific vulnerable codec, for example via message attachment or thumbnail auto-decoding.

Opening or previewing a maliciously crafted image on an unpatched Samsung Android device can force the Quram image codec (libimagecodec.quram.so) to read out-of-bounds memory while parsing an IFD (EXIF/TIFF) tag, disclosing memory contents to a remote attacker. The flaw affects Samsung Android 13, 14, 15, and 16 builds below patch level SMR Dec-2025 Release 1, is reachable without authentication (PR:N) but is gated by mandatory user interaction (UI:R) since the victim must receive and render the image, and its assessed impact is confidentiality-only (C:H/I:N/A:N, CVSS 6.5 Medium). EPSS is low at 0.07% (22nd percentile) and no public exploit code has been identified at time of analysis.

An out-of-bounds write in the fingerprint trustlet's metadata-decoding routine affects Samsung Android devices running Android 13 through 16 that have not yet received the SMR Dec-2025 Release 1 maintenance patch. Exploitation requires an attacker to already hold a privileged local foothold on the device (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - there is no remote path and no unprivileged-app path - and the assessed impact is integrity-only within the trustlet's security scope, with no confidentiality or availability effect. Severity is low: EPSS is 0.02% (4th percentile), no public exploit code and no confirmed active exploitation were identified at time of analysis, making the pre-existing privileged local access the dominant limiting factor rather than the memory-corruption class itself.

A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG Program stream.

A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS/AAC file.

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and write use-after-free. The Use After Free common weakness enumeration was chosen as the stale data can include handles to resources in which the reference counts can become unbalanced. This can lead to the premature destruction of a resource while in use.

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 through r54p1; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 through r54p1.

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 through r54p1; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 through r54p1.

An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.

UAF vulnerability in the USB driver module. Rated medium severity (CVSS 5.8). No vendor patch available.

Permission control vulnerability in the memory management module. Rated critical severity (CVSS 9.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Permission control vulnerability in the distributed component. Rated high severity (CVSS 8.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.