OESA-2025-2649 golang security update

. Security Fixes: tar.Reader in the Go archive/tar component did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to read an unbounded amount of data fr...

MsMpEng: UIF decoder will spin forever processing sparse blocks

The UIF Universal Image Format is a proprietary file format used by the old shareware utility MagicISO. Microsoft have a dedicated unpacker for UIF that runs as SYSTEM on all filesystem activity !?!. The UIF format has an index structure at a fixed offset from the end of the file, with a pointer ...