Windows DNS Information Disclosure Vulnerability

Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.

Windows Kernel Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.

Windows File Server Resource Management Service Elevation of Privilege Vulnerability

Out-of-bounds read in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges over a network.

Windows Win32k Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.

Microsoft Remote Registry Service Denial of Service Vulnerability

Out-of-bounds read in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.

Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

Windows DNS Information Disclosure Vulnerability

Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network.

Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

Windows Active Directory Domain Services Denial of Service Vulnerability

Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.

Windows RNDIS Elevation of Privilege Vulnerability

Out-of-bounds read in Windows RNDIS allows an unauthorized attacker to elevate privileges with a physical attack.

Microsoft Graphics Component Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.

Windows DHCP Server Remote Code Execution Vulnerability

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Windows GDI Information Disclosure Vulnerability

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.

Windows Remote Desktop Client Information Disclosure Vulnerability

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Improper handling of NAS DLTransport messages may lead to a baseband crash.

Out Of Bounds Read during string conversion when parsing a .DSB file in DASYLab

There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data.   This results in a read a past the end of an allocated heap buffer during string conversion.  Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file.  This issue affects all versions before 2026.0.0.

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.

Libsoup: libsoup: heap buffer overflow during websocket client-frame masking

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.

Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth

A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.