CVE Vulnerability Advisory Database

[Affected Scope] Android and embedded devices powered by Qualcomm Snapdragon chipsets utilizing specific KGSL GPU driver versions

[Impact] Local attackers can trigger kernel memory corruption via crafted IOCTL calls, leading to Local Privilege Escalation (LPE) and arbitrary code execution with root privileges

[Mitigation] Immediately apply the official security patches released by device OEMs and Qualcomm in or after December 2023

[Affected Scope] Android and embedded devices powered by Qualcomm chipsets utilizing DSP (Digital Signal Processor) services

[Impact] Local attackers with low privileges can trigger a Use-After-Free condition via remote calls from HLOS to DSP, leading to kernel-level privilege escalation and arbitrary code execution (actively exploited in the wild)

[Mitigation] Immediately apply the Qualcomm December 2023 security patch or the latest Android security update provided by your device OEM

[Affected Scope] Apple iOS prior to 17.1.2, iPadOS prior to 17.1.2, macOS Sonoma prior to 14.1.2, and Safari prior to 17.1.2

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution, with active exploitation reported in the wild

[Mitigation] Immediately apply the official Apple software updates to upgrade operating systems and Safari to the patched versions

[Affected Scope] Apple devices running versions prior to iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2

[Impact] Processing maliciously crafted web content may lead to out-of-bounds memory access, disclosing sensitive information and potentially enabling sandbox escape or remote code execution

[Mitigation] Immediately apply the official security updates (iOS/iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2 or later) and enable Lockdown Mode for high-risk users

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 119.0.6045.199

[Impact] A remote attacker who has compromised the renderer process can exploit this vulnerability via a malicious file to escape the browser sandbox and execute arbitrary code

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable channel (119.0.6045.199 or higher)

[Affected Scope] Microsoft Windows operating systems utilizing the CLFS driver, including Windows 10, 11, and Windows Server 2016, 2019, 2022

[Impact] A locally authenticated attacker can execute a specially crafted application to elevate privileges to NT AUTHORITY\SYSTEM, gaining full control over the system

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and monitor unpatched assets

[Affected Scope] Windows 10, 11, and Windows Server operating systems utilizing the Cloud Files Mini Filter Driver (cldflt.sys)

[Impact] Local attackers can exploit this vulnerability to execute arbitrary code in kernel mode, achieving full SYSTEM privileges (actively exploited in the wild)

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the affected driver service as a temporary workaround

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server utilizing the Desktop Window Manager (DWM) core library.

[Impact] A local attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete system compromise.

[Mitigation] Immediately apply the official Microsoft cumulative security updates released in November 2023 or later.

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server

[Impact] Attackers can completely bypass Windows SmartScreen warnings and Mark of the Web (MotW) protections via crafted internet shortcut (.url) files, leading to silent malicious code execution

[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict the execution of untrusted .url and .lnk files from external sources

[Affected Scope] All supported versions of Microsoft Windows 10, 11, and Windows Server

[Impact] Attackers can bypass MotW warnings and SmartScreen blocks to execute malicious files without user warnings

[Mitigation] Apply the latest Microsoft Cumulative Updates (LCU) immediately and harden SmartScreen policies

[Affected Scope] Microsoft WordPad application on Windows operating systems

[Impact] Attackers can force the system to leak NTLM credentials (hashes) by inducing users to open a specially crafted document, enabling offline brute-force or NTLM relay attacks

[Mitigation] Apply the official Microsoft cumulative security updates, block outbound NTLM traffic, and restrict outbound SMB connections

[Affected Scope] iPhone and iPad devices running iOS 16.6 and prior

[Impact] A local attacker can bypass sandbox restrictions to elevate privileges to kernel level, leading to complete device compromise

[Mitigation] Immediately update affected devices to iOS 16.7.1 / iPadOS 16.7.1 or later

[Affected Scope] Major Linux distributions (RHEL, Ubuntu, Debian, Fedora, etc.) running glibc version 2.34 and newer that support the GLIBC_TUNABLES environment variable.

[Impact] Local attackers can exploit a heap-based buffer overflow by crafting malicious GLIBC_TUNABLES environment variables when executing SUID binaries, leading to full root privilege escalation.

[Mitigation] Immediately update the glibc package to the latest patched version using the OS package manager and reboot the system.

[Affected Scope] Android and embedded devices utilizing ARM Mali GPU Midgard, Bifrost, Valhall, and 5th Gen architecture drivers

[Impact] A local non-privileged user can exploit improper GPU memory processing operations to access freed memory (Use-After-Free), potentially leading to local privilege escalation and sensitive kernel data exposure

[Mitigation] Apply the latest security patches and kernel driver updates provided by chipset vendors and device OEMs immediately

[Affected Scope] Apple WebKit-based browsers and applications on iOS versions prior to 16.7 and macOS prior to Sonoma 14

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution on the target system

[Mitigation] Immediately update Apple operating systems to the latest versions (iOS 16.7+ / macOS Sonoma 14+)

[Affected Scope] Apple iOS devices prior to 16.7, iPadOS prior to 16.7, macOS Monterey prior to 12.7, and macOS Ventura prior to 13.6

[Impact] A local attacker can bypass security boundaries to elevate privileges to kernel level, enabling arbitrary code execution and full device compromise; actively exploited in the wild

[Mitigation] Immediately apply the official security updates to iOS/iPadOS 16.7, macOS Monterey 12.7, macOS Ventura 13.6, or later versions

[Affected Scope] Apple devices running iOS versions prior to 16.7, iPadOS versions prior to 16.7, and macOS Ventura versions prior to 13.6

[Impact] A malicious application can bypass signature and certificate validation, allowing it to execute with elevated privileges and compromise the system. This has been actively exploited in the wild

[Mitigation] Immediately update all affected devices to iOS/iPadOS 16.7 or later, and macOS Ventura 13.6 or later

[Affected Scope] Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security, and Worry-Free Business Security Services

[Impact] An attacker with administrative console access can manipulate the 3rd party AV uninstaller module to execute arbitrary commands with elevated privileges

[Mitigation] Immediately apply the official security patches provided by Trend Micro and restrict access to the administrative console

[Affected Scope] Adobe Acrobat and Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier), and 20.005.30514 (and earlier)

[Impact] Successful exploitation allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious PDF file

[Mitigation] Immediately apply the official security patches provided by Adobe and restrict opening untrusted PDF documents

[Affected Scope] Microsoft Streaming Service Proxy driver (mskssrv.sys) in Windows 10, Windows 11, and Windows Server families

[Impact] Local attackers can execute arbitrary code with SYSTEM privileges, leading to full system compromise; actively exploited in the wild

[Mitigation] Apply the official Microsoft security patches immediately, or restrict access to the vulnerable driver as a temporary workaround