CVE Vulnerability Advisory Database

[Affected Scope] Systems running Linux kernel with the algif_aead crypto subsystem module enabled.

[Impact] A local attacker can exploit this vulnerability to cause kernel memory corruption, potentially leading to local privilege escalation (LPE) to root or system instability (Kernel Panic).

[Mitigation] Apply the latest stable kernel updates from your distribution or disable the algif_aead socket module if not required.

[Affected Scope] Windows systems with Microsoft Defender enabled and lacking the latest security updates.

[Impact] An authorized local attacker can exploit insufficient access control granularity to elevate privileges to SYSTEM, potentially disabling security controls.

[Mitigation] Immediately update the Microsoft Defender engine and definition files to the latest version, especially as this vulnerability is actively exploited in the wild.

[Affected Scope] Mobile and embedded devices powered by Qualcomm chipsets running affected Android kernel versions

[Impact] Local attackers can trigger an integer overflow (CWE-190) during memory alignment, leading to memory corruption and local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the March 2026 security patches released by Qualcomm and Android OEMs

[Affected Scope] Virtual machines with VMware Tools installed, managed by Aria Operations with SDMP (Service Discovery Management Pack) enabled

[Impact] A malicious local actor with non-administrative privileges can exploit this vulnerability to escalate privileges to root on the same VM

[Mitigation] Immediately apply the official security updates for VMware Tools and Aria Operations as recommended by Broadcom

[Affected Scope] Linux kernel deployments where CONFIG_POSIX_CPU_TIMERS_TASK_WORK is disabled or not supported

[Impact] Local attackers can exploit a race condition to trigger a kernel panic (DoS) or potentially achieve Local Privilege Escalation (LPE) via memory corruption

[Mitigation] Apply the official stable kernel patches or ensure CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y is enabled in the kernel configuration

[Affected Scope] Android and embedded devices powered by Qualcomm chipsets utilizing specific GPU micronode firmware

[Impact] Local attackers can execute unauthorized command sequences to bypass security controls, corrupt GPU memory, and achieve local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the latest security patches released by Qualcomm and device OEMs, and restrict the installation of untrusted applications

[Affected Scope] Android and embedded devices utilizing Qualcomm Adreno GPU chipsets and associated drivers

[Impact] Local attackers can execute unauthorized commands within the GPU micronode by sending a specific sequence of commands, leading to memory corruption and local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the official security patches released by Qualcomm and device OEMs in or after the June 2025 security bulletin

[Affected Scope] Junos OS versions prior to 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, and 24.2R1-S2/24.2R2

[Impact] A highly privileged local attacker with shell access can inject arbitrary code to compromise the integrity of the device

[Mitigation] Immediately upgrade to the recommended patched Junos OS releases and restrict local shell access to authorized administrators only

[Affected Scope] Systems running Windows Operating Systems utilizing the NTFS file system driver (ntfs.sys)

[Impact] A local authorized attacker can exploit this vulnerability to trigger a heap-based buffer overflow, leading to local privilege escalation (LPE) and arbitrary code execution with SYSTEM privileges

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict the mounting of untrusted external storage media and disk images

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems utilizing Windows Storage components

[Impact] Local attackers with low privileges can exploit symbolic link creation to overwrite critical system files, leading to arbitrary code execution with SYSTEM privileges

[Mitigation] Apply the Microsoft February 2025 security updates immediately and restrict local symbolic link creation privileges on unpatched systems

[Affected Scope] Linux kernel environments utilizing specific USB audio devices such as Creative Extigy and Digidesign Mbox

[Impact] Connecting a maliciously crafted USB device can trigger an out-of-bounds memory access in the kernel, potentially leading to a Denial of Service (Kernel Panic) or Local Privilege Escalation (LPE)

[Mitigation] Apply the latest stable kernel patches from your distribution or blacklist the unused ALSA USB audio kernel module

[Affected Scope] Android and embedded devices powered by Qualcomm chipsets utilizing specific HLOS (High-Level Operating System) memory drivers

[Impact] Local attackers with low privileges can trigger a Use-After-Free (UAF) condition, leading to kernel memory corruption and full local privilege escalation (LPE) to root

[Mitigation] Apply the official security patches released by OEMs (October 2024 or later) and restrict access to kernel memory drivers using strict SELinux policies

[Affected Scope] Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server editions

[Impact] A locally authenticated attacker can exploit flaws in the Windows Installer service to elevate privileges to NT AUTHORITY\SYSTEM and execute arbitrary code

[Mitigation] Apply the Microsoft September 2024 security updates immediately and restrict Windows Installer privileges for non-administrative users

[Affected Scope] Linux kernel versions utilizing the network subsystem, particularly environments running UDP socket-based applications

[Impact] Local attackers can exploit an RCU synchronization race condition to trigger a Use-After-Free (UAF), potentially leading to local privilege escalation (LPE) to root or system-wide Denial of Service (DoS)

[Mitigation] Immediately upgrade the Linux kernel to the latest patched stable release and perform a system reboot

[Affected Scope] Arm Bifrost GPU Kernel Driver and Valhall GPU Kernel Driver from r34p0 through r40p0.

[Impact] A local non-privileged user can exploit this vulnerability to access already freed memory, potentially leading to arbitrary code execution and kernel privilege escalation.

[Mitigation] Immediately upgrade the Arm Mali GPU kernel driver to version r41p0 or later.

[Affected Scope] Linux kernel versions from v5.14 up to v6.6.14 with the nf_tables module enabled

[Impact] Local unprivileged users can trigger kernel memory corruption, leading to arbitrary code execution and full root privilege escalation

[Mitigation] Apply the official kernel patch or restrict unprivileged user namespace creation as an immediate workaround

[Affected Scope] Apple devices running iOS and iPadOS versions prior to 17, or iOS and iPadOS versions prior to 15.8.7

[Impact] A local malicious application can exploit a Use-After-Free vulnerability to execute arbitrary code with kernel privileges, leading to complete system compromise

[Mitigation] Immediately apply official Apple software updates to upgrade to iOS 17, iOS 15.8.7, or later versions

[Affected Scope] Apple operating systems prior to iOS 16.2, iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2, and tvOS 16.2

[Impact] A local attacker with arbitrary read and write capabilities can bypass Pointer Authentication (PAC) to achieve full kernel-level code execution

[Mitigation] Immediately update affected devices to iOS 16.2, iPadOS 16.2, macOS Ventura 13.1, or later versions

[Affected Scope] Devices powered by Qualcomm Snapdragon chipsets running Linux or Android kernel-based graphics drivers

[Impact] Local attackers can trigger kernel memory corruption via malicious IOCTL calls, leading to Local Privilege Escalation (LPE) to Root/Kernel level

[Mitigation] Apply the official security patches released by Qualcomm and device OEMs in or after December 2023

[Affected Scope] Android and embedded devices powered by Qualcomm Snapdragon chipsets utilizing specific KGSL GPU driver versions

[Impact] Local attackers can trigger kernel memory corruption via crafted IOCTL calls, leading to Local Privilege Escalation (LPE) and arbitrary code execution with root privileges

[Mitigation] Immediately apply the official security patches released by device OEMs and Qualcomm in or after December 2023