The internet is broken right now.

Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Memory safety Browser & mail Google Chrome

Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.

Memory safety

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.

Memory safety Library

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.

Memory safety

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.

Memory safety Server

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 24h2

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 21h2

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 11 23h2

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1809

Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 21h2

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.

Memory safety

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.

Memory safety Nasa Cfitsio

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.

Memory safety Network gear

Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Memory safety

Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Memory safety

In the Linux kernel, the following vulnerability has been resolved: xen-blkback: Avoid UAF when reading I/O statistics Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading of the statistics data is not synchronized with freeing the data. Use a rwlock for synchronizing. This is XSA-528 / CVE-2026-100082

Memory safety OS & kernel

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.

Memory safety Library Freerdp

psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.

Memory safety Server

Out of bounds write in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted file. (Chromium security severity: High)

Memory safety Browser & mail Google Chrome

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.

Memory safety

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data.

Memory safety Server

Memory Corruption when processing firmware update data in Download mode due to a missing bounds check.

Memory safety Device

A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.

Memory safety Network gear

A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Memory safety

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker which sends a specific set of BGP communities to cause a Denial-of-Service (DoS) as rpd crashes when graceful-shutdown sender community is added when attempting to advertise.

Memory safety Network gear

L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.

Memory safety

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

Memory safety OS & kernel Microsoft Windows 10 1607

A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Memory safety Library

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01857954; Issue ID: MSV-8247.

Memory safety Device

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.

Memory safety Device

In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.

Memory safety Device

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01874018 / MOLY01774038; Issue ID: MSV-9802.

Memory safety Device

In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801.

Memory safety Device

In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775865; Issue ID: MSV-8895.

Memory safety Device