CWE-787: Out-of-bounds Write vulnerabilities

CVE-2026-96219 is a critical out-of-bounds write vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) affecting multiple builds of Windows 10 Version 1809 and related versions. This flaw allows an unauthorized attacker to execute code remotely over a network without user interaction. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. Official patches have been released by Microsoft to address this issue.

CVE-2026-70197 is a high-severity out-of-bounds write vulnerability in Microsoft .NET 10.0 installed on Linux. This flaw allows an unauthorized attacker to execute code remotely over a network. Multiple versions of .NET 8.0, 9.0, 10.0, 11.0 preview, and 16.11 are affected. Official fixes have been released for all impacted versions.

CVE-2026-70303 is an out-of-bounds write vulnerability in the Windows Kernel affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-88165 is a high-severity out-of-bounds write vulnerability in Active Directory Domain Services on Microsoft Windows 10 Version 1607 and related builds. It allows an authorized attacker to execute code remotely over a network without user interaction. The flaw affects multiple Windows 10 versions prior to specific fixed releases.

CVE-2026-85826 is an out-of-bounds write vulnerability in the Windows Fast FAT Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score and has been officially fixed in specific Windows 10 builds.

CVE-2026-84016 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds, involving an out-of-bounds write in the Windows EAPHost Service. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. An official fix is available from Microsoft.

CVE-2026-83929 is a high-severity out-of-bounds write vulnerability in the Windows Graphics Device Interface (GDI) affecting multiple versions of Microsoft Windows 10, including Version 1607. The flaw allows an unauthorized attacker to execute code remotely over a network. Microsoft has released official fixes for all affected versions.

CVE-2026-83712 is an out-of-bounds write vulnerability in the NTFS component of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to execute arbitrary code on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8. Microsoft has issued official fixes for all affected versions.

CVE-2026-69705 is a critical out-of-bounds write vulnerability in the Windows iSCSI component affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network without user interaction. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. Official patches are available from Microsoft to remediate this issue.

CVE-2026-70058 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions involving an out-of-bounds write in the Windows DHCP Server component. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-108457 is an out-of-bounds write vulnerability in the Microsoft Windows PDF component affecting Windows 10 Version 21H2 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.1 and is officially fixed in specific Windows 10 builds.

Adobe FrameMaker 2026 contains an out-of-bounds write vulnerability (CWE-787) that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866.

Adobe FrameMaker 2026 contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects multiple versions up to 18.0.0.206 and 17.0.9.866. The CVSS 3.1 base score is 7.8, indicating high severity.

Adobe FrameMaker 2026 contains an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS 3.1 score is 7.8, indicating high severity.

CVE-2026-77094 is an out-of-bounds write vulnerability (CWE-787) in Commvault Cloud's CvFWD component that can affect service availability. The issue impacts multiple Commvault software components including CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale. Customers are advised to upgrade to the resolved maintenance releases to mitigate the vulnerability. The CVSS 4.0 base score is 7.1, indicating a high severity level.

AMI APTIOV contains vulnerabilities in BIOS where users may cause  "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.

NVIDIA DALI contains an out-of-bounds write vulnerability (CWE-787) that could be exploited by an attacker to cause denial of service, information disclosure, and data tampering. The vulnerability affects versions 0.0 through 2.2. The CVSS 3.1 base score is 7.3, indicating a high severity. No patch or remediation information is currently provided.

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.

CVE-2026-6232 is an out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR1110 transceiver firmware. A crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes beyond the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus. The vulnerability has a medium severity score of 5.2 (CVSS 4.0).

CVE-2026-84286 is a critical out-of-bounds read vulnerability in Turboderp-org's ExLlamaV3 version 3. The EXL3 loader uses an untrusted model-supplied index to select a CUDA kernel without verifying bounds, allowing a malicious model to cause a crash or potentially achieve controlled indirect kernel dispatch under specific memory conditions.