EUVD-2026-92187

In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11242428; Issue ID: MSV-9038...

EUVD-2026-92186

In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11185225; Issue ID: MSV-9024...

EUVD-2026-92192

In apu, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249016; Issue ID: MSV-9169...

EUVD-2026-92181

In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11076799; Issue ID: MSV-8143...

CVE-2026-20542

The apusys component is vulnerable to a memory corruption issue caused by a use after free vulnerability (CWE-416). This flaw could enable a local escalation of privilege if a malicious actor has already acquired System privilege on the affected system. No user interaction is required for exploit...

CVE-2026-20537

A memory corruption vulnerability exists in aidl due to a use after free condition (CWE-416 ). This flaw could allow a malicious actor with System privilege to achieve local escalation of privilege . Exploitation does not require user interaction. Remediation is available via Patch ID: ALPS111852...

CVE-2026-20536

A memory corruption vulnerability exists in aidl due to a use after free condition. If a malicious actor has already obtained System privilege , they could leverage this flaw to achieve local escalation of privilege . Exploitation does not require user interaction. Remediation is available via Pa...

CVE-2026-20531

A memory corruption vulnerability exists in apu due to a use after free condition. This flaw could allow for local escalation of privilege without requiring additional execution privileges or user interaction. Remediation is available via Patch ID: ALPS11249016 (Issue ID: MSV-9169). No specific e...

Microsoft Windows Cloud Files Mini Filter Driver CldiStreamCompleteRequest use-after-free vulnerability

Summary A use-after-free vulnerability exists in the CldiStreamCompleteRequest functionality of Windows Cloud Files Mini Filter Driver versions: 10.0.26100.8457 WinBuild.160101.0800. A specially crafted sequence of Cloud Filter API calls can lead to privilege escalation. An attacker can execute a...

The vulnerability of the reconstructCoeff function in the vvdecapp decoder (VVdeC) lies in the use of memory after deallocation during the processing of specially created VVC streams. This allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...

The vulnerability of the reconstructCoeff function in the vvdecapp decoder (VVdeC) lies in the use of memory after deallocation during the processing of specially created VVC streams. This allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...

The vulnerability of the reconstructCoeff function in the vvdecapp decoder (VVdeC) lies in the use of memory after deallocation during the processing of specially created VVC streams. This allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow a hacker to cause a service failure or execute arbitrary code...

The vulnerability of the readAlf function in the vvdecapp (VVdeC) decoder allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the readAlf function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

The vulnerability of the `createSubPicRefBufs` function in the vvdecapp (VVdeC) decoder allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the createSubPicRefBufs function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

The vulnerability of the reconstructCoeff function in the vvdecapp decoder (VVdeC) allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after deallocation when processing specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Januscape

Januscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Januscape CVE-2026-53359 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/x86 environment. To the best of public knowledge, th...

CVE-2022-41218

はじめに 本脆弱性は、drivers/media/dvb-core/dmxdev.c に存在する競合状態の脆弱性です。 そのため、この dmxdev を使用する usb デバイスドライバでは競合状態が発生する可能性があります。 この脆弱性は、3つの UAF を引き起こすために使用される可能性があります。 脆弱性 1. vmalloc UAF 書き込み まず、エクスプロイトの順序は次のとおりです（drivers/media/usb/ttusb-dec/ttusbdec.c を使用してデバッグしました）： cpu0 cpu1 cpu 2 1. dvbdvropen 2...

CVE-2025-43529

CVE-2025-43529 JavaScriptCore の誤った DFG StoreBarrierInsertionPhase に起因する UAF 脆弱性、CVE-2025-43529 の根本原因分析。 このリポジトリには、この脆弱性に対する丁寧に構成された根本原因分析スライドが含まれています。観測可能な動作から正確な意味論上の根本原因へと、読者を段階的に導く階層的な説明として意図的に構成されています。 焦点は、悪用手法ではなく、明快さ、正確性、意味論的推論に置かれています。 お役に立てば、そしてお楽しみいただければ幸いです。😊 分析: CVE-2025-43529.pdf 謝辞...

CVE-2023-20938

CVE-2023-20938 English 脆弱性解析 1. クライアントAとクライアントBは、コンテキストマネージャーservicemanagerを介してBinder接続を確立する 2. Aがノード0xbeefを作成（node = bindernewnodeproc, fp;）、Bはref-targetnodeを介してnode 0xbeefを参照する 3. Bがまずtargetnode 0xbeefを正しく処理し、targetnode...