CVE-2026-59886

Summary: pyasn1 before 0.6.4 contains a vulnerability in the univ.Real ASN.1 type where mantissa/base/exponent are converted to a Python float via exact big-integer exponentiation. This can cause excessive CPU/memory usage when decoding untrusted ASN.1 data and subsequently printing, logging, or ...

CVE-2026-59886 pyasn1: Uncontrolled resource consumption when converting decoded REAL values

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float...

CVE-2026-59886 pyasn1: Uncontrolled resource consumption when converting decoded REAL values

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float...

Microsoft SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...

Microsoft SQL Server Remote Code Execution Vulnerability

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

Microsoft Exchange Server Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally...

Azure Active Directory Denial of Service Vulnerability

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...

Microsoft SharePoint Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network...

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally...

PT-2026-58588

Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network...

PT-2026-58224

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

PT-2026-58107

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.4 Description The univ.Real type converts its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value containing a very large exponent can...

PT-2026-58480

Name of the Vulnerable Software and Affected Versions Windows Wireless Wide Area Network Service affected versions not specified Description Deserialization of untrusted data in the Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally...

PT-2026-58284

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Enterprise Server 2016 versions prior to 16.0.5556.1005 Microsoft SharePoint Server 2019 versions prior to 16.0.10417.20153 Microsoft SharePoint Server Subscription Edition versions prior to 16.0.19725.20384 Description An...

VulnCheck KEV: CVE-2026-58644

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...

PT-2026-58718

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Microsoft Visual Studio affected versions not specified Description An issue exists in the deserialization mechanism of .NET and Microsoft Visual Studio. Deserialization is the process of converting a strea...

PYSEC-2026-2865 pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager

Deserialization of untrusted data CWE-502 in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents using Python's standard object-serialization module before performing any HMAC integrity check. Any file dropped into the sessions directo...

PYSEC-2026-2574 LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

Context A Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializerpicklefallback=True. When...

PYSEC-2026-2673 NVIDIA NeMo Framework Deserializes Untrusted Data

NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering...