CVE Vulnerability Advisory Database

[Affected Scope] Microsoft Management Console (MMC) component across various supported Microsoft Windows operating systems

[Impact] Local attackers can bypass critical security boundaries and Mark-of-the-Web (MotW) protections via user interaction, potentially leading to privilege escalation and arbitrary code execution

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict the execution of untrusted .msc files using AppLocker or WDAC

[Affected Scope] Systems running Windows Operating Systems utilizing the NTFS file system driver (ntfs.sys)

[Impact] A local authorized attacker can exploit this vulnerability to trigger a heap-based buffer overflow, leading to local privilege escalation (LPE) and arbitrary code execution with SYSTEM privileges

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict the mounting of untrusted external storage media and disk images

[Affected Scope] Windows 10, Windows 11, and Windows Server families utilizing the NTFS file system driver

[Impact] Local authorized attackers can disclose sensitive kernel memory information, potentially facilitating subsequent privilege escalation (EoP) attacks

[Mitigation] Immediately apply the February 2025 Microsoft Patch Tuesday security updates and restrict local access for unauthorized users

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Fast FAT File System Driver (fastfat.sys)

[Impact] Local unauthorized attackers can execute arbitrary code with SYSTEM privileges by exploiting kernel-level memory corruption

[Mitigation] Apply the official Microsoft security updates immediately, or restrict auto-mounting of untrusted storage media and virtual disk images

[Affected Scope] All Windows operating system deployments utilizing the NTFS file system

[Impact] An unauthorized attacker with physical access can extract sensitive information written in plaintext within NTFS system log files

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and enforce BitLocker Full Disk Encryption (FDE)

[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Win32k kernel subsystem

[Impact] An authorized local attacker can elevate privileges to SYSTEM level, gaining full control over the affected system

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local access

[Affected Scope] Active Directory environments and Windows operating systems utilizing the NTLM authentication protocol

[Impact] Unauthorized remote attackers can control file names or paths to perform network-based spoofing and credential relay attacks

[Mitigation] Apply the latest Microsoft cumulative security updates and restrict NTLM authentication traffic

[Affected Scope] FreeType versions 2.13.0 and below

[Impact] Heap buffer overflow during TrueType GX and variable font parsing, potentially leading to arbitrary code execution (RCE) with active in-the-wild exploitation detected

[Mitigation] Immediately upgrade FreeType to a non-vulnerable version (2.13.1 or newer)

[Affected Scope] VMware ESXi, Workstation, and Fusion environments utilizing the Host-Guest File System (HGFS) for file sharing.

[Impact] A malicious actor with local administrative privileges on a guest VM can read out-of-bounds memory from the host's vmx process, potentially bypassing ASLR to facilitate hypervisor escape.

[Mitigation] Apply the official security patches provided by Broadcom, or disable the HGFS (Shared Folders) feature in the virtual machine configuration as a temporary workaround.

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-24989

[Impact] An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially byp...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server utilizing the WinSock Ancillary Function Driver (afd.sys)

[Impact] Local attackers can trigger kernel memory corruption (Heap-based Buffer Overflow) to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the Microsoft February 2025 Patch Tuesday cumulative updates and restrict unauthorized local execution privileges

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems utilizing Windows Storage components

[Impact] Local attackers with low privileges can exploit symbolic link creation to overwrite critical system files, leading to arbitrary code execution with SYSTEM privileges

[Mitigation] Apply the Microsoft February 2025 security updates immediately and restrict local symbolic link creation privileges on unpatched systems

[Affected Scope] Apple iPhone and iPad devices running iOS/iPadOS versions prior to 15.8.4, 16.7.11, 17.7.5, or 18.3.1

[Impact] A physical attacker can disable USB Restricted Mode on a locked device, potentially allowing unauthorized data extraction and forensic access

[Mitigation] Immediately update all affected devices to iOS/iPadOS 15.8.4, 16.7.11, 17.7.5, 18.3.1 or later

[Affected Scope] Apple operating systems prior to iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, and other legacy versions

[Impact] A malicious application can exploit a Use-After-Free vulnerability to elevate privileges to system/kernel level and execute arbitrary code

[Mitigation] Immediately upgrade all affected Apple devices to the latest patched versions (iOS 18.3, macOS 15.3, etc.) via official software update channels

[Affected Scope] All unpatched installations of 7-Zip software

[Impact] When extracting files from a crafted archive, the Mark-of-the-Web (MotW) is not propagated, allowing arbitrary code execution under the current user context without security warnings

[Mitigation] Immediately upgrade 7-Zip to the latest patched version and monitor unpatched endpoint assets

[Affected Scope] Windows Server and Desktop operating systems running Windows Hyper-V virtualization environments

[Impact] A local attacker with low privileges can exploit a Use-After-Free (UAF) vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete host compromise

[Mitigation] Immediately apply the February 2025 Microsoft Patch Tuesday security updates and restrict local access to virtualization hosts

[Affected Scope] Windows 10, 11, and Windows Server systems with the Hyper-V virtualization role enabled

[Impact] Local attackers can exploit a Use-After-Free (UAF) vulnerability to execute arbitrary code with kernel-level (SYSTEM) privileges, leading to complete host compromise

[Mitigation] Immediately apply the February 2025 Microsoft Cumulative Security Updates and disable unnecessary Hyper-V services

[Affected Scope] Windows Server and Desktop operating systems with the Windows Hyper-V virtualization role enabled

[Impact] A local attacker can exploit a heap-based buffer overflow (CWE-122) to execute arbitrary code with SYSTEM privileges, leading to complete host compromise

[Mitigation] Apply the official Microsoft security patches immediately, or temporarily disable non-essential Hyper-V services to reduce the attack surface

[Affected Scope] Linux kernel environments utilizing specific USB audio devices such as Creative Extigy and Digidesign Mbox

[Impact] Connecting a maliciously crafted USB device can trigger an out-of-bounds memory access in the kernel, potentially leading to a Denial of Service (Kernel Panic) or Local Privilege Escalation (LPE)

[Mitigation] Apply the latest stable kernel patches from your distribution or blacklist the unused ALSA USB audio kernel module

[Affected Scope] Systems running the Linux kernel with the ALSA (Advanced Linux Sound Architecture) USB-Audio driver enabled.

[Impact] A local attacker can trigger an out-of-bounds read by connecting a malicious USB audio device, potentially leading to kernel memory disclosure or system crash (DoS).

[Mitigation] Apply the latest Linux kernel security patches and restrict unauthorized USB device connections and driver loading.