memory safety

Microsoft’s advisory classifies CVE-2025-54901 as a buffer over-read (out‑of‑bounds read) in Microsoft Office Excel that can disclose process memory contents when a crafted spreadsheet is opened. Executive summary What it is: CVE-2025-54901 is an information‑disclosure vulnerability in...

Microsoft’s Security Response Guide lists CVE-2025-54112 as a vulnerability in the Microsoft Virtual Hard Disk (VHD/VHDX) handling code that can be abused by an authorized local attacker to achieve elevation of privilege on Windows hosts, a condition vendors and incident responders classify as...

Microsoft’s security advisory for CVE-2025-54094 identifies a type‑confusion flaw in the Windows Defender Firewall Service that can be triggered by an authorized local actor to perform a local Elevation of Privilege (EoP) — in short, an attacker with the ability to run code as a non‑privileged...

Microsoft’s advisory classifies CVE-2025-53810 as a local elevation‑of‑privilege (EoP) in a privileged Windows service that results from “access of resource using incompatible type” (a type‑confusion memory safety bug); Microsoft lists the issue in its Security Update Guide and recommends...

Microsoft’s Security Update Guide lists CVE-2025-53808 as an Elevation of Privilege vulnerability in the Windows Defender Firewall Service that stems from an “access of resource using incompatible type” (commonly called type confusion), and the vendor warns that a locally authorized attacker...

A newly reported Windows NTFS vulnerability described as a stack-based buffer overflow that “allows an authorized attacker to execute code locally” has raised immediate concern—but the specific CVE identifier you provided (CVE-2025-54916) could not be located in public vendor and vulnerability...

Microsoft’s advisory link for CVE-2025-54908 points to a PowerPoint use‑after‑free that “allows an unauthorized attacker to execute code locally,” but that specific CVE number could not be corroborated in public vulnerability trackers at the time of verification; when attempting to load the...

Microsoft’s security tracker now lists CVE-2025-54899 as a memory-safety flaw in Microsoft Excel that can lead to local code execution when a crafted spreadsheet is opened — an entry that joins a steady stream of Excel parsing bugs that remain a favored initial-access vector for attackers...

Microsoft’s security tracker lists CVE-2025-54898 as an out-of-bounds read vulnerability in Microsoft Excel that can be triggered by a crafted spreadsheet and may allow an attacker to achieve local code execution when a user opens a malicious file. Background Microsoft Excel remains one of the...

Microsoft’s advisory identifies a vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that can be triggered locally to escalate privileges — described on the vendor page as a buffer overflow in the WinSock ancillary driver — and administrators must treat this as a...

Chrome’s September security update closes a high-severity use-after-free vulnerability in the V8 JavaScript engine — tracked as CVE-2025-9864 — that could allow an attacker to corrupt memory and potentially achieve remote code execution through a crafted web page, and administrators of...

Microsoft’s move to make Rust a first-class option for Windows driver development crystallizes a long-running strategy: reduce the class of memory-safety bugs that have dominated high-severity Windows vulnerabilities by shifting low-level, performance-sensitive code toward a language designed...

Microsoft's effort to let device-driver developers use Rust has moved from research and experiments into tangible tooling and samples, but the path to production-ready Windows drivers written in Rust remains long and cautious — working prototypes and Microsoft-backed crates exist, CodeQL now...

A recently disclosed memory-safety flaw in Chromium’s Aura windowing component — tracked as CVE-2025-8882 — allows a remote attacker who can trick a user into specific UI gestures to trigger a use‑after‑free that may lead to heap corruption; the bug was patched upstream in Google Chrome...

A high-severity heap buffer overflow in the AV1 codec library libaom — tracked as CVE-2025-8879 — has been fixed in the latest Chromium builds; Google pushed the patch in Chrome stable channel updates to versions 139.0.7258.127/.128 (Windows and macOS) and 139.0.7258.127 (Linux), and browser...

Microsoft’s Security Response Center (MSRC) has cataloged CVE-2025-50155 as an Elevation of Privilege (EoP) vulnerability in the Windows Push Notifications Apps component described as “Access of resource using incompatible type (‘type confusion’).” The issue allows an authorized local attacker —...

Microsoft’s Security Response Center has published an advisory listing CVE-2025-53739 — an Excel vulnerability described as “Access of resource using incompatible type (‘type confusion’)” that can lead to code execution when a crafted spreadsheet is processed by the desktop client. Background /...

Microsoft’s Security Update Guide lists CVE-2025-53736 as a Microsoft Word information-disclosure vulnerability caused by a buffer over-read in Word that can allow an unauthorized local actor to read memory and disclose sensitive information on a victim machine; administrators are strongly...

A newly reported elevation‑of‑privilege issue tied to Windows push/notification components has reignited concern about memory‑safety defects in user‑facing Windows subsystems — however, the precise CVE identifier you provided (CVE‑2025‑53725) could not be independently verified in public vendor...

Microsoft’s security advisory identifies CVE-2025-53724 as an elevation of privilege vulnerability in the Windows Push Notifications Apps component that stems from an access of resource using incompatible type (type confusion); when triggered by a locally authorized user, the bug can be abused...