Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability

Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.

Windows Imaging Component Information Disclosure Vulnerability

Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally.

Windows USB Print Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.

Windows NTFS Elevation of Privilege Vulnerability

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer, potentially disclosing memory or crashing the process. This issue is fixed in version 13.0.0.

Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Bluetooth: btintel: validate version TLV value lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintel_parse_version_tlv() verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value can therefore cause an out-of-bounds read through get_unaligned_le16(), get_unaligned_le32(), or memcpy(). Reject values shorter than the minimum required by each known TLV type. Also reject responses that do not contain the Command Complete Status field.

Bluetooth: btintel: bound firmware ID by TLV length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response. Limit the conversion to the advertised TLV value length.

openjdk: Enhance JPEG loading (Oracle CPU 2026-10)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Windows Print Spooler Components Information Disclosure Vulnerability

Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.

Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.

Windows NTFS Elevation of Privilege Vulnerability

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

Desktop Window Manager Elevation of Privilege Vulnerability

Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

HID Parser Library Information Disclosure Vulnerability

Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally.

Windows Fast FAT File System Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows Fast FAT Driver allows an unauthorized attacker to disclose information locally.

Substance3D - Painter | Out-of-bounds Read (CWE-125)

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.

Windows Bluetooth Port Driver Remote Code Execution

Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.

Windows Remote POS Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to disclose information locally.

HTTP.sys Information Disclosure Vulnerability

Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to disclose information locally.