CVE Vulnerability Advisory Database

[Affected Scope] Apple operating systems prior to iOS 18.7.2, macOS Sequoia 15.7.2, and other legacy versions

[Impact] A local malicious application can trigger unexpected system termination or write directly to kernel memory, potentially leading to privilege escalation

[Mitigation] Immediately apply the official security updates released by Apple (iOS 18.7.2, macOS 15.7.2, etc.)

[Affected Scope] Windows operating system kernel components and environments utilizing shared resources

[Impact] An authorized local attacker can trigger a race condition to cause kernel memory corruption, leading to local privilege escalation (LPE) to SYSTEM level

[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict local access privileges on unpatched systems

[Affected Scope] Lanscope Endpoint Manager (On-Premises) Client program (MR) and Detection agent (DA)

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending specially crafted packets to the agent

[Mitigation] Immediately apply the official security patches provided by Motex and restrict network access to the agent communication ports

[Affected Scope] All Windows Server environments running Windows Server Update Services (WSUS).

[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges over the network by sending malicious serialized payloads.

[Mitigation] Apply the official Microsoft security patches immediately, and restrict network access to WSUS ports (8530, 8531) to trusted internal networks.

[Affected Scope] Windows and Windows Server systems running the Remote Access Connection Manager (RasMan) service

[Impact] An authorized local attacker can elevate privileges to SYSTEM, gaining full administrative control over the affected host

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the RasMan service as a temporary workaround

[Affected Scope] Microsoft Windows operating systems with the third-party Agere Modem driver (ltmdm64.sys) installed or natively shipped

[Impact] Local attackers can execute arbitrary code with SYSTEM privileges, leading to full host compromise. This vulnerability is actively exploited in the wild (CISA KEV)

[Mitigation] Apply the Microsoft October cumulative update to completely remove the driver, or manually disable and restrict the driver service

[Affected Scope] All systems and services utilizing the Linux Kernel Crypto API (AF_ALG) interface.

[Impact] Internal socket state inconsistency and potential Denial of Service (DoS) due to concurrent write operations.

[Mitigation] Update to the latest stable kernel version provided by your distribution and reboot.

[Affected Scope] Virtual machines with VMware Tools installed, managed by Aria Operations with SDMP (Service Discovery Management Pack) enabled

[Impact] A malicious local actor with non-administrative privileges can exploit this vulnerability to escalate privileges to root on the same VM

[Mitigation] Immediately apply the official security updates for VMware Tools and Aria Operations as recommended by Broadcom

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 140.0.7339.185

[Impact] Remote attackers can execute arbitrary code (RCE) and trigger heap corruption by enticing a user to visit a specially crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (140.0.7339.185 or higher)

[Affected Scope] Samsung Android mobile devices and the embedded libimagecodec.quram.so library prior to the SMR Sep-2025 Release 1 security patch

[Impact] Remote attackers can execute arbitrary code with high privileges without user interaction by tricking the system into processing a specially crafted image file

[Mitigation] Immediately apply the Samsung official software update (SMR Sep-2025 Release 1 or later) and restrict automatic downloading of media files from untrusted sources

[Affected Scope] Samsung Android mobile devices running security patch levels prior to SMR Apr-2025 Release 1

[Impact] Remote attackers can execute arbitrary code with high privileges and compromise the device without user interaction by triggering an out-of-bounds write during image decoding.

[Mitigation] Immediately apply the Samsung April 2025 Security Maintenance Release (SMR Apr-2025 Release 1) or later.

[Affected Scope] Linux systems utilizing in-kernel TLS (ktls) offload or software implementation.

[Impact] Remote attackers can trigger memory corruption or kernel panic, potentially leading to full system compromise (RCE).

[Mitigation] Immediately update the Linux kernel to the latest stable version provided by your distribution.

[Affected Scope] Android Operating System and Chrome browser environments

[Impact] Local attackers can escape the Chrome sandbox and escalate privileges to system_server without any user interaction or additional execution privileges

[Mitigation] Immediately apply the Android Security Bulletin - September 2025 patch or later to all affected devices

[Affected Scope] WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS prior to v2.25.21.78, and WhatsApp for Mac prior to v2.25.21.78

[Impact] Unrelated attackers can bypass authorization to trigger the processing of arbitrary URL content on target devices, potentially leading to full device compromise when chained with OS-level exploits

[Mitigation] Immediately update WhatsApp and WhatsApp Business to the latest secure versions via the App Store and apply pending Apple OS security patches

[Affected Scope] Apple devices running iOS/iPadOS versions prior to 15.8.5, 16.7.12, 18.6.2, iPadOS 17.7.10, or macOS versions prior to Sequoia 15.6.1, Sonoma 14.7.8, and Ventura 13.7.8

[Impact] Processing a maliciously crafted image file may lead to memory corruption, allowing remote attackers to execute arbitrary code or gain full system control without user interaction

[Mitigation] Immediately apply the official security patches provided by Apple (iOS 15.8.5, 16.7.12, 18.6.2, iPadOS 17.7.10, macOS 15.6.1, etc.)

[Affected Scope] N-able N-central versions prior to 2025.3.1

[Impact] Local attackers can execute arbitrary code and potentially compromise the entire management server

[Mitigation] Immediately upgrade N-able N-central to version 2025.3.1 or later

[Affected Scope] WinRAR for Windows (versions prior to 7.02)

[Impact] Attackers can execute arbitrary code (RCE) by tricking users into extracting a specially crafted malicious archive file, which drops payloads into arbitrary system directories

[Mitigation] Immediately upgrade WinRAR to the latest secure version (7.02 or higher) and avoid extracting archives from untrusted sources

[Affected Scope] Trend Micro Apex One (on-premise) management console

[Impact] A pre-authenticated remote attacker can upload malicious code and execute arbitrary commands with system privileges, leading to full server compromise

[Mitigation] Immediately apply the official security patch (KA-0020652) and restrict network access to the management console

[Affected Scope] Apple devices running Safari versions prior to 18.6, iOS/iPadOS prior to 18.6, macOS Sequoia prior to 15.6, tvOS prior to 18.6, visionOS prior to 2.6, and watchOS prior to 11.6

[Impact] Processing maliciously crafted web content may lead to memory corruption, potentially allowing remote attackers to execute arbitrary code (RCE) or cause a denial of service (DoS) on the target device

[Mitigation] Immediately apply the latest official security updates provided by Apple (Safari 18.6, iOS 18.6, macOS 15.6, etc.)

[Affected Scope] Linux kernel deployments where CONFIG_POSIX_CPU_TIMERS_TASK_WORK is disabled or not supported

[Impact] Local attackers can exploit a race condition to trigger a kernel panic (DoS) or potentially achieve Local Privilege Escalation (LPE) via memory corruption

[Mitigation] Apply the official stable kernel patches or ensure CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y is enabled in the kernel configuration