The internet is broken right now.

Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 21h2

Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 21h2

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 26h1

Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Now Playing Session Manager allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 23h2

Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Integer underflow (wrap or wraparound) in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 21h2

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows Security App

Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos hands each processed descriptor back to the DMA by writing desc->read.control = rx_desc_refresh_flags, which sets OWN_FLAG and BUF1_ADDR_VALID_FLAG. RDES0 of a receive descriptor is the DMA buffer address in read format, but the hardware write-back aliases that word with the VLAN tag fields (or, for a context descriptor, the timestamp low word), so it is destroyed on every completion. The success path rewrites desc->read.buf1_addr before re-arming; the four drop paths — errored or non-first descriptor, net_pkt_rx_alloc() failure, invalid descriptor length, and net_pkt_get_frag() failure — did not, re-arming the ring slot with the write-back residue as its DMA target address. The drop paths are driven entirely by received traffic and need no privilege or special configuration. With the defaults for this driver (CONFIG_NET_BUF_DATA_SIZE of 128 and 16 receive descriptors) a single full-size frame consumes twelve ring slots and twelve K_NO_WAIT fragment allocations, so a short burst of frames sent to the device exhausts the receive pools and reaches the allocation-failure paths; a frame with a receive error, or any frame whose first descriptor was already dropped, reaches the non-first-descriptor path. Once a slot has been poisoned, the DMA writes the next frame received in that slot to an address derived from the frame's VLAN tag fields rather than to a receive buffer. On the supported MCX SoCs that address falls in flash or reserved space, so the transfer raises a fatal bus error that the driver only logs — there is no reset or recovery path — and reception stops permanently until the device is rebooted; where the write is silently discarded instead, the untouched buffer is later handed to the network stack with a length, delivering stale buffer contents as if they were a received frame. A single triggering event is enough to make the condition persistent, so an attacker able to send traffic to the device can permanently disable its network interface.

Memory safety OS & kernel Zephyrproject Zephyr

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review.

Memory safety Network gear

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.

Memory safety Sqlite

Buffer overflow in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory safety Browser & mail Google Chrome

Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Memory safety Browser & mail

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.

Memory safety Library