memory safety

Microsoft’s security tracker lists CVE-2025-54898 as an out-of-bounds read vulnerability in Microsoft Excel that can be triggered by a crafted spreadsheet and may allow an attacker to achieve local code execution when a user opens a malicious file. Background Microsoft Excel remains one of the...

Microsoft’s advisory identifies a vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that can be triggered locally to escalate privileges — described on the vendor page as a buffer overflow in the WinSock ancillary driver — and administrators must treat this as a...

Chrome’s September security update closes a high-severity use-after-free vulnerability in the V8 JavaScript engine — tracked as CVE-2025-9864 — that could allow an attacker to corrupt memory and potentially achieve remote code execution through a crafted web page, and administrators of...

Microsoft’s move to make Rust a first-class option for Windows driver development crystallizes a long-running strategy: reduce the class of memory-safety bugs that have dominated high-severity Windows vulnerabilities by shifting low-level, performance-sensitive code toward a language designed...

Microsoft's effort to let device-driver developers use Rust has moved from research and experiments into tangible tooling and samples, but the path to production-ready Windows drivers written in Rust remains long and cautious — working prototypes and Microsoft-backed crates exist, CodeQL now...

A recently disclosed memory-safety flaw in Chromium’s Aura windowing component — tracked as CVE-2025-8882 — allows a remote attacker who can trick a user into specific UI gestures to trigger a use‑after‑free that may lead to heap corruption; the bug was patched upstream in Google Chrome...

A high-severity heap buffer overflow in the AV1 codec library libaom — tracked as CVE-2025-8879 — has been fixed in the latest Chromium builds; Google pushed the patch in Chrome stable channel updates to versions 139.0.7258.127/.128 (Windows and macOS) and 139.0.7258.127 (Linux), and browser...

Microsoft’s Security Response Center (MSRC) has cataloged CVE-2025-50155 as an Elevation of Privilege (EoP) vulnerability in the Windows Push Notifications Apps component described as “Access of resource using incompatible type (‘type confusion’).” The issue allows an authorized local attacker —...

Microsoft’s Security Response Center has published an advisory listing CVE-2025-53739 — an Excel vulnerability described as “Access of resource using incompatible type (‘type confusion’)” that can lead to code execution when a crafted spreadsheet is processed by the desktop client. Background /...

Microsoft’s Security Update Guide lists CVE-2025-53736 as a Microsoft Word information-disclosure vulnerability caused by a buffer over-read in Word that can allow an unauthorized local actor to read memory and disclose sensitive information on a victim machine; administrators are strongly...

A newly reported elevation‑of‑privilege issue tied to Windows push/notification components has reignited concern about memory‑safety defects in user‑facing Windows subsystems — however, the precise CVE identifier you provided (CVE‑2025‑53725) could not be independently verified in public vendor...

Microsoft’s security advisory identifies CVE-2025-53724 as an elevation of privilege vulnerability in the Windows Push Notifications Apps component that stems from an access of resource using incompatible type (type confusion); when triggered by a locally authorized user, the bug can be abused...

Microsoft’s Security Response Center has published an advisory for CVE‑2025‑53140, a use‑after‑free vulnerability in the Windows Kernel Transaction Manager (KTM) that Microsoft says can be exploited by an authorized local attacker to elevate privileges on an affected system. Background /...

Microsoft has assigned CVE-2025-50168 to a Windows kernel vulnerability in the Win32K ICOMP component described as "Access of resource using incompatible type ('type confusion')" that can allow an authorized local user to elevate privileges; Microsoft’s advisory is published in the Security...

Microsoft’s security roadmap for Windows is increasingly explicit: stronger protections will arrive, but many of them require newer silicon and faster refresh cycles — meaning organizations that want to stay secure will need to buy into both Windows 11 (and beyond) and modern hardware platforms...

A critical security vulnerability, identified as CVE-2025-8292, has been discovered in Google Chrome's Media Stream component. This "use after free" flaw allows remote attackers to exploit heap corruption through specially crafted HTML pages, potentially leading to arbitrary code execution. The...

Microsoft is actively encouraging Windows driver developers to adopt Rust, a modern programming language renowned for its memory safety features. This strategic shift aims to enhance the security and reliability of drivers, particularly those integral to Surface devices. The Surface team has...

As the software landscape continually evolves, Microsoft’s renewed push for secure coding has taken a pivotal turn with the formal encouragement of Rust as a first-class language for Windows driver development. This strategic endorsement, once a future-looking promise, is rapidly becoming...

When the security of critical infrastructure is at stake, vulnerabilities in widely deployed platforms like Hitachi Energy’s Asset Suite command urgent attention across enterprise IT, operational technology, and national security communities. Recent revelations highlight significant security...

A newly disclosed vulnerability, CVE-2025-49725, has brought fresh scrutiny to the Windows notification system, spotlighting once again how seemingly innocuous components can become gateways for elevated attacks. This particular flaw, described as a “use after free” in Windows Notification...