memory corruption

Microsoft’s Security Update Guide records CVE-2025-59289 as a memory‑corruption elevation‑of‑privilege issue affecting the Windows Bluetooth Service; public technical summaries and patch notes describe the root cause as a use‑after‑free (UAF) in privileged Bluetooth/device‑broker code that can...

Microsoft has confirmed a class of memory-corruption flaws in its Inbox COM Objects that include a local remote-code-execution (RCE)–style impact for certain realistic attack chains; CVE-2025-58730 is one member of that family and was remediated in Microsoft’s October 2025 security roll‑up, but...

Microsoft has confirmed a high‑impact elevation‑of‑privilege vulnerability in the PrintWorkflowUserSvc component of Windows, tracked as CVE‑2025‑55684, that allows a local, low‑privileged user to potentially escalate to SYSTEM under certain conditions — Microsoft classifies the bug as a...

A newly reported vulnerability tied to the Windows Connected Devices Platform Service (Cdpsvc) has raised alarms for administrators and defenders: while public trackers and community analyses describe memory‑corruption defects in CDPSvc that can lead to privilege escalation or execution under...

Microsoft has confirmed an elevation‑of‑privilege flaw in the Desktop Window Manager (DWM) core library tracked as CVE‑2025‑59255, a locally‑triggered memory‑safety issue that can let an authenticated user or process running under a standard account escalate to SYSTEM‑level privileges if...

Microsoft’s advisory that CVE-2025-50174 is an elevation‑of‑privilege vulnerability in the Windows Device Association Broker Service confirms a real, exploitable weakness that administrators should treat as high priority for patching and remediation across affected Windows builds. Background /...

National Instruments has confirmed a cluster of high‑severity memory‑corruption vulnerabilities in its Circuit Design Suite that let a crafted .sym symbol file crash, disclose data from, or — in the worst case — run arbitrary code on affected engineering workstations; the vendor issued a patch...

Google pushed an emergency Chrome update to address CVE-2025-10585, a type confusion vulnerability in the V8 JavaScript engine that Google says is being actively exploited in the wild — and because Microsoft Edge is Chromium-based, Windows users and enterprises must confirm their Edge builds...

Microsoft’s security advisory confirms a use‑after‑free defect in the BitLocker stack that can be triggered by an authorized local user to escalate privileges on affected Windows systems — administrators must treat CVE‑2025‑54912 as an urgent patching priority and assume a high‑impact threat...

Microsoft’s Security Update Guide lists CVE-2025-54910 as a heap-based buffer overflow in Microsoft Office that can allow an attacker to execute code locally when a crafted Office document is processed, but the vendor’s advisory requires direct inspection for exact builds and KB identifiers...

Microsoft’s Security Response Center (MSRC) has published an advisory for CVE-2025-54103 describing a use‑after‑free flaw in the Windows Management Service that can allow an unauthorized local user to elevate privileges on a vulnerable host. The vendor-classification marks this as an...

CVE-2025-54091 — Windows Hyper‑V integer overflow / wraparound (local elevation of privilege) Summary (one‑line) An integer overflow or wraparound in a Windows Hyper‑V component can be triggered by an authorized local actor and may lead to local elevation of privilege (EoP) on the Hyper‑V host...

Microsoft has published an advisory for CVE-2025-53801: an untrusted pointer dereference in the Windows Desktop Window Manager (DWM) Core Library that can be triggered by an authorized local user to elevate privileges on affected systems. The flaw resides in DWM’s memory handling and, when...

CVE-2025-55226 is a locally exploitable race‑condition vulnerability in the Windows Graphics Kernel that allows an authenticated (local) attacker to achieve code execution in kernel context by inducing concurrent access to a shared graphics subsystem resource without proper synchronization. This...

Microsoft's advisory confirms a use‑after‑free flaw in Microsoft Excel that can lead to local code execution when a specially crafted spreadsheet is opened, creating a potentially serious escalation path on unpatched systems. Overview This vulnerability, tracked as CVE‑2025‑54904, is listed in...

Microsoft has published an advisory for CVE-2025-54906, a Microsoft Office vulnerability described as a “free of memory not on the heap” condition that can lead to local remote‑code‑execution (RCE) when a user opens or previews a specially crafted Office document; Microsoft lists the...

Rockwell Automation’s 1783‑NATR I/O adapter has been flagged by CISA as vulnerable to a third‑party component flaw that can cause memory corruption, carrying a CVSS v4 base score of 6.9 and described as remotely exploitable with low attack complexity — operators should treat it as an immediate...

Delta Electronics’ CNCSoft‑G2 has been the focus of a coordinated disclosure that exposes a file‑parsing out‑of‑bounds write (CWE‑787) in the DPAX project file handler — a flaw tracked as CVE‑2025‑47728 that can lead to arbitrary code execution when a user opens a specially crafted file, and...

A high-severity memory-corruption flaw in Chromium’s V8 JavaScript engine, tracked as CVE-2025-9132, has been patched in the Chrome 139 stable update; the vulnerability is an out‑of‑bounds write that can lead to heap corruption and, in the worst case, remote code execution when a user visits a...

Microsoft’s security update guide lists a high‑risk elevation‑of‑privilege entry for the Windows MBT Transport driver that, according to the vendor advisory, stems from an untrusted pointer dereference and can be used by an authorized local user to escalate to SYSTEM — a kernel‑level impact that...