CVE Vulnerability Advisory Database

[Affected Scope] F5 BIG-IP APM virtual servers configured with an OAuth Authorization Server profile.

[Impact] Unauthenticated attackers can execute arbitrary code with system privileges via specially crafted traffic, leading to full system compromise.

[Mitigation] Immediately apply the latest security patches or Hotfixes provided by F5, and consider disabling the OAuth Authorization Server profile until patched.

[Affected Scope] Locally authenticated users across Microsoft Windows operating systems

[Impact] Local attackers can elevate privileges to SYSTEM level, gaining full control over the target system and executing arbitrary code

[Mitigation] Apply the official Microsoft security patches immediately and restrict local access on unpatched assets

[Affected Scope] Linux kernel systems utilizing UDPv6 sockets with MSG_MORE and MSG_SPLICE_PAGES flags

[Impact] Unprivileged local users can trigger a heap out-of-bounds write, leading to system crash (Denial of Service) or Local Privilege Escalation (LPE)

[Mitigation] Apply the latest stable kernel patches from upstream or your Linux distribution vendor, and restrict unprivileged user namespaces if immediate patching is not feasible

[Affected Scope] FortiOS versions 6.4 through 7.6 and FortiSwitchManager versions 7.0 through 7.2.

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands with system privileges by sending crafted packets, leading to full system compromise.

[Mitigation] Immediately apply the latest firmware updates provided by Fortinet and restrict exposure of management interfaces and VPN services to the public internet.

[Affected Scope] Systems running Windows Operating Systems utilizing the NTFS file system driver (ntfs.sys)

[Impact] A local authorized attacker can exploit this vulnerability to trigger a heap-based buffer overflow, leading to local privilege escalation (LPE) and arbitrary code execution with SYSTEM privileges

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict the mounting of untrusted external storage media and disk images

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Fast FAT File System Driver (fastfat.sys)

[Impact] Local unauthorized attackers can execute arbitrary code with SYSTEM privileges by exploiting kernel-level memory corruption

[Mitigation] Apply the official Microsoft security updates immediately, or restrict auto-mounting of untrusted storage media and virtual disk images

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server utilizing the WinSock Ancillary Function Driver (afd.sys)

[Impact] Local attackers can trigger kernel memory corruption (Heap-based Buffer Overflow) to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the Microsoft February 2025 Patch Tuesday cumulative updates and restrict unauthorized local execution privileges

[Affected Scope] Windows Server and Desktop operating systems with the Windows Hyper-V virtualization role enabled

[Impact] A local attacker can exploit a heap-based buffer overflow (CWE-122) to execute arbitrary code with SYSTEM privileges, leading to complete host compromise

[Mitigation] Apply the official Microsoft security patches immediately, or temporarily disable non-essential Hyper-V services to reduce the attack surface

[Affected Scope] Windows 10, 11, and Windows Server systems utilizing the Common Log File System (CLFS) driver

[Impact] Local attackers can exploit this vulnerability to execute arbitrary code in kernel mode, escalating privileges to SYSTEM

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict unauthorized creation of CLFS log (.blf) files

[Affected Scope] VMware vCenter Server versions 7.0 and 8.0, VMware Cloud Foundation versions 4.x and 5.x

[Impact] An unauthenticated remote attacker can trigger a heap overflow via specially crafted DCERPC packets, potentially executing arbitrary code with root privileges

[Mitigation] Immediately apply the official Broadcom security patches (vCenter 8.0 U3b / 7.0 U3s or later) and restrict network access to vCenter management ports

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems utilizing the Desktop Window Manager (DWM) Core Library

[Impact] Local attackers can trigger a heap-based buffer overflow to execute arbitrary code with SYSTEM privileges, leading to full host compromise

[Mitigation] Immediately apply the Microsoft May 2024 Patch Tuesday cumulative security updates and restrict unauthorized local access

[Affected Scope] Windows 10, 11, and Windows Server operating systems utilizing the Cloud Files Mini Filter Driver (cldflt.sys)

[Impact] Local attackers can exploit this vulnerability to execute arbitrary code in kernel mode, achieving full SYSTEM privileges (actively exploited in the wild)

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the affected driver service as a temporary workaround

[Affected Scope] Major Linux distributions (RHEL, Ubuntu, Debian, Fedora, etc.) running glibc version 2.34 and newer that support the GLIBC_TUNABLES environment variable.

[Impact] Local attackers can exploit a heap-based buffer overflow by crafting malicious GLIBC_TUNABLES environment variables when executing SUID binaries, leading to full root privilege escalation.

[Mitigation] Immediately update the glibc package to the latest patched version using the OS package manager and reboot the system.

[Affected Scope] FortiOS versions 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below; FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all 1.2/1.1 versions with SSL-VPN enabled

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target appliance via specifically crafted HTTP requests

[Mitigation] Immediately upgrade FortiOS and FortiProxy to the patched versions, or disable the SSL-VPN service as a temporary workaround

[Affected Scope] Windows 10, 11, and Windows Server 2008, 2012, 2016, 2019, 2022 utilizing the clfs.sys driver

[Impact] Local attackers can execute arbitrary code with SYSTEM privileges, fully compromising the host and disabling security controls

[Mitigation] Apply the Microsoft April 2023 security updates immediately, or restrict .blf file creation permissions as a temporary workaround

[Affected Scope] Microsoft Windows operating systems including Windows 10, 11, and Windows Server 2016, 2019, 2022 utilizing the CLFS driver

[Impact] A local attacker with low privileges can execute arbitrary code in kernel mode, leading to complete system takeover with SYSTEM privileges

[Mitigation] Immediately apply the official Microsoft cumulative security updates (February 2023 Patch Tuesday) and monitor unpatched assets

[Affected Scope] FortiOS versions 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier; FortiProxy versions 7.2.0 to 7.2.1, 7.0.7 and earlier

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target system by sending specifically crafted HTTP/HTTPS requests

[Mitigation] Immediately upgrade to the patched firmware versions or disable the SSL-VPN service and restrict access using local-in policies if patching is delayed

[Affected Scope] Adobe Acrobat and Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier), and 2017.011.30188 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code in the context of the current user by tricking them into opening a crafted PDF

[Mitigation] Immediately apply the official Adobe security updates (APSB21-09) to upgrade to the latest secure versions

[Affected Scope] Google Chrome for Android prior to version 86.0.4240.185

[Impact] A remote attacker who has compromised the renderer process can trigger a heap buffer overflow in the UI component via a crafted HTML page, potentially leading to a complete sandbox escape and arbitrary code execution on the target device

[Mitigation] Immediately update Google Chrome for Android to version 86.0.4240.185 or later via the Google Play Store

[Affected Scope] WhatsApp and WhatsApp Business prior to specific patched versions across Android, iOS, Windows Phone, and Tizen platforms

[Impact] Remote attackers can execute arbitrary code (RCE) and compromise target devices without user interaction by sending specially crafted RTCP packets

[Mitigation] Immediately update WhatsApp applications to the latest official patched versions via respective app stores