Threats affecting pkg:generic/kimageformats

A sandbox escape vulnerability exists in the Widget: Win32 component of Microsoft software version 4.0 due to incorrect boundary conditions. This flaw could potentially allow an attacker to break out of the sandbox environment. No CVSS score or detailed impact information is provided.

CVE-2026-100774 is a use-after-free vulnerability affecting the DOM Core and HTML components in Microsoft software version 4.0. The vulnerability involves improper memory handling that could lead to use-after-free conditions.

CVE-2026-12299 is a vulnerability involving a JIT miscompilation issue in the DOM Core and HTML components of Microsoft software version 4.0. The vulnerability is identified as CWE-843, which relates to improper control flow or logic errors in code generation. No CVSS score or detailed impact information is provided, and there are no known exploits in the wild. No patch or remediation details are available in the provided data.

A privilege escalation vulnerability exists in the Crash Reporting component of Microsoft software version 4.0. This flaw could allow an attacker to gain elevated privileges. No CVSS score or detailed impact information is provided. There is no indication of public exploits or active exploitation in the wild. No patch or remediation details are currently available.

A use-after-free vulnerability exists in the Storage: IndexedDB component of Microsoft software version 4.0. This type of flaw involves accessing memory after it has been freed, which can lead to unpredictable behavior or potential exploitation.

A memory safety bug identified as CVE-2026-12298 was fixed in Thunderbird 152. The vulnerability is related to a memory safety issue classified under CWE-125. No CVSS score or detailed impact information is provided. There is no indication of known exploitation in the wild. The affected version explicitly stated is version 4.0 of the Microsoft product referenced, though the title mentions Thunderbird 152, suggesting some ambiguity in product naming.

A use-after-free vulnerability has been identified in the Graphics component of Microsoft software version 4.0. This type of flaw involves accessing memory after it has been freed, which can lead to undefined behavior or potential exploitation. No CVSS score or detailed impact information is provided. There are no known exploits in the wild, and no official patch or remediation details have been disclosed yet.

CVE-2026-4724 is a vulnerability in the Microsoft Audio/Video component characterized by undefined behavior. The advisory does not provide specific technical details or impact information. The affected version is Microsoft version 4.0. No CVSS score or exploit information is available.

CVE-2026-100772 is a use-after-free vulnerability in the DOM Core and HTML component of Microsoft software version 4.0. The vulnerability involves improper memory handling that could lead to use of freed memory. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-12297 affects Microsoft software version 4.0, involving a sandbox escape due to incorrect boundary conditions in the Networking component. This flaw could potentially allow an attacker to break out of a restricted execution environment. No CVSS score or detailed impact information is provided. No known exploits are reported in the wild, and no patch or remediation details are available.

A vulnerability identified as CVE-2026-92045 affects Microsoft software version 4.0, involving a sandbox escape due to incorrect boundary conditions in the WebRTC component. This flaw relates to improper handling of memory boundaries, classified under CWE-119. No CVSS score or patch information is currently available, and no known exploits are reported in the wild.

CVE-2026-100771 is a vulnerability in Microsoft software version 4.0 related to undefined behavior in the DOM Streams component. The issue is categorized under CWE-758, which involves undefined behavior. No CVSS score or detailed impact information is provided, and no known exploits or patches are currently documented.

A use-after-free vulnerability has been identified in the JavaScript Engine component of Microsoft software version 4.0. This type of vulnerability involves improper handling of memory, which can lead to undefined behavior or potential exploitation. No CVSS score or detailed impact information is provided.

CVE-2026-12296 is a sandbox escape vulnerability in the Security: Process Sandboxing component of Microsoft software version 4.0. The vulnerability allows a process to break out of its sandboxed environment, potentially undermining security boundaries.

CVE-2026-92044 is an information disclosure vulnerability in the Networking: HTTP component of Microsoft software version 4.0. The vulnerability could allow unauthorized disclosure of information. No CVSS score or detailed technical impact is provided. There is no indication of active exploitation in the wild or available patches.

This vulnerability is a use-after-free flaw in the DOM Content Processes component of Microsoft software, which can lead to sandbox escape. It affects version 4.0 of the product. No CVSS score or detailed impact information is provided, and there is no indication of known exploitation in the wild. No patch or remediation details are available from the vendor at this time.

Memory safety bugs have been fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150, and Thunderbird 150. The vulnerability is identified as CVE-2026-6786 and is associated with Microsoft. The advisory references the Microsoft Support Lifecycle for software support details. No CVSS score or detailed impact information is provided.

CVE-2026-4722 is a published vulnerability involving privilege escalation in the IPC component of Microsoft software version 4.0. No CVSS score or detailed technical information about the flaw or its impact is provided. There is no indication of known exploitation in the wild or available patches.

A privilege escalation vulnerability exists in the Audio/Video component of Microsoft software version 4.0 due to incorrect boundary conditions. This flaw could allow an attacker to gain elevated privileges. No CVSS score or detailed impact information is provided.

This entry refers to memory safety bugs fixed in various Mozilla products including Firefox ESR and Thunderbird ESR, as well as Firefox 150. The provided data references a Microsoft product version 4.0 as affected by CVE-2026-6785, but no detailed description of the vulnerability or its impact is given. There is no CVSS score or detailed technical information available. No patch links or vendor advisory content are provided, and no known exploits in the wild are reported.