memory safety

A newly recorded weakness in Python’s standard HTTP client lets a malicious server force a client process to allocate huge amounts of memory by abusing the Content-Length handling, creating a remote Denial‑of‑Service (DoS) and out‑of‑memory (OOM) risk for applications that use the library...

A heap buffer over-read has been disclosed in the libpng library’s simplified write API: CVE-2025-64506 affects libpng versions 1.6.0 through 1.6.50 and is patched in libpng 1.6.51; the flaw stems from an incorrect conditional in png_write_image_8bit that can cause 8-bit image buffers to be...

Ashlar‑Vellum’s Cobalt family and related products were disclosed as containing multiple high‑impact memory‑safety vulnerabilities that can lead to information disclosure and arbitrary code execution; operators must treat these defects as urgent and update to vendor‑supplied builds or apply...

Microsoft’s advisory confirms an out‑of‑bounds read (information‑disclosure) vulnerability in Excel tracked as CVE‑2025‑62202, and the vendor has published updates to remediate the issue; organizations should treat this as an urgent operational priority because memory‑safety disclosure...

The Linux kernel received a targeted fix for an out‑of‑bounds read in the UDF filesystem parser — a small defensive change that closes a KASAN‑reported use‑after‑free triggered by malformed Allocation Extent Descriptors and prevents crc_itu_t from being invoked on memory outside the descriptor...

Microsoft has assigned CVE-2025-58736 to a class of vulnerabilities in Inbox COM Objects (Global Memory) that were patched in the October 2025 security updates; the issue is part of a broader family of COM/COM+ defects (race conditions, use‑after‑free and related memory‑safety faults) that can...

The LibTIFF codebase contains a long‑standing, practical memory‑safety defect tracked as CVE‑2016‑9535 — a heap buffer overflow in the predictor/tile handling code — that was introduced in the 4.0.6 release and patched in subsequent versions. This vulnerability arises in tif_predict.c /...

Microsoft’s advisory confirms an out‑of‑bounds read in Excel that can disclose process memory when a specially crafted workbook is opened, and organizations should treat CVE‑2025‑59235 as a high‑priority patch and containment event until all affected endpoints are updated. Background Microsoft...

Google released an emergency Chrome stable update that fixes a use‑after‑free (UAF) vulnerability in the WebRTC component tracked as CVE‑2025‑10501, and Microsoft Edge (Chromium‑based) customers should treat the issue as relevant until Microsoft ships the Chromium ingestion for Edge. Background...

Firefox’s latest release delivers the kind of practical Windows-focused refinements power users have been asking for — and a high-profile AI tie‑in that will keep privacy wonks and enterprise admins debating for weeks. Background / Overview Mozilla’s rapid-release cadence means the browser you...

Rust’s orange crab may be cute, but the language it represents is reshaping engineering decisions at the deepest levels of modern software: from browsers and kernels to cloud services and consumer devices. At RustConf 2025 the community celebrated a decade since Rust’s 1.0 release while also...

The recent churn in the Linux world—Rust maintainer resignations, high-profile upstream disputes and filesystem governance fights—has breathed new life into a different conversation: developers who feel alienated by the Linux kernel’s culture and process do not necessarily have to fork Linux...

Microsoft’s advisory classifies CVE-2025-54901 as a buffer over-read (out‑of‑bounds read) in Microsoft Office Excel that can disclose process memory contents when a crafted spreadsheet is opened. Executive summary What it is: CVE-2025-54901 is an information‑disclosure vulnerability in...

Microsoft’s Security Response Guide lists CVE-2025-54112 as a vulnerability in the Microsoft Virtual Hard Disk (VHD/VHDX) handling code that can be abused by an authorized local attacker to achieve elevation of privilege on Windows hosts, a condition vendors and incident responders classify as...

Microsoft’s security advisory for CVE-2025-54094 identifies a type‑confusion flaw in the Windows Defender Firewall Service that can be triggered by an authorized local actor to perform a local Elevation of Privilege (EoP) — in short, an attacker with the ability to run code as a non‑privileged...

Microsoft’s advisory classifies CVE-2025-53810 as a local elevation‑of‑privilege (EoP) in a privileged Windows service that results from “access of resource using incompatible type” (a type‑confusion memory safety bug); Microsoft lists the issue in its Security Update Guide and recommends...

Microsoft’s Security Update Guide lists CVE-2025-53808 as an Elevation of Privilege vulnerability in the Windows Defender Firewall Service that stems from an “access of resource using incompatible type” (commonly called type confusion), and the vendor warns that a locally authorized attacker...

A newly reported Windows NTFS vulnerability described as a stack-based buffer overflow that “allows an authorized attacker to execute code locally” has raised immediate concern—but the specific CVE identifier you provided (CVE-2025-54916) could not be located in public vendor and vulnerability...

Microsoft’s advisory link for CVE-2025-54908 points to a PowerPoint use‑after‑free that “allows an unauthorized attacker to execute code locally,” but that specific CVE number could not be corroborated in public vulnerability trackers at the time of verification; when attempting to load the...

Microsoft’s security tracker now lists CVE-2025-54899 as a memory-safety flaw in Microsoft Excel that can lead to local code execution when a crafted spreadsheet is opened — an entry that joins a steady stream of Excel parsing bugs that remain a favored initial-access vector for attackers...