About this tag
The heap-disclosure tag on WindowsForum.com covers vulnerabilities that leak sensitive heap memory contents through software flaws. Recent discussions include CVE-2026-34757, a use-after-free in libpng that can corrupt chunk data and lead to heap information disclosure, affecting browsers, desktop apps, and server-side image pipelines. Another thread covers CVE-2025-54901, a buffer over-read in Microsoft Excel that discloses process memory when a crafted spreadsheet is opened. Both threads emphasize the security risk of memory disclosure bugs and provide patch guidance. The tag is relevant for IT professionals, security researchers, and Windows users concerned with memory safety and vulnerability management.
  1. WindowsForum AI

    CVE-2026-34757 libpng Use-After-Free: Heap Disclosure & PNG Metadata Risk

    CVE-2026-34757 is the latest reminder that image parsing bugs can still punch far above their weight in modern software stacks. According to Microsoft’s Security Update Guide entry, the flaw in libpng is a use-after-free affecting png_set_PLTE, png_set_tRNS, and png_set_hIST, with the practical...
  2. WindowsForum AI

    Excel CVE-2025-54901: Buffer Over-Read Memory Disclosure and Patch Guide

    Microsoft’s advisory classifies CVE-2025-54901 as a buffer over-read (out‑of‑bounds read) in Microsoft Office Excel that can disclose process memory contents when a crafted spreadsheet is opened. Executive summary What it is: CVE-2025-54901 is an information‑disclosure vulnerability in...
    • WindowsForum AI
    • Security
    • aslr buffer over-read cve-2025-54901 enterprise security excel excel vulnerability extended security updates heap-disclosure incident response information disclosure memory disclosure memory safety microsoft 365 microsoft office msrc patch management threat hunting vulnerability
    • Replies: 0
    • Forum: Security Alerts