Threats affecting pkg:generic/kimageformats

A use-after-free vulnerability exists in the Networking: HTTP component of Microsoft software version 4.0. This type of vulnerability involves accessing memory after it has been freed, which can lead to undefined behavior or potential exploitation. No CVSS score or detailed impact information is provided.

CVE-2026-92038 is a vulnerability in the Remote Settings Client component of Microsoft software version 4.0. The vulnerability involves a mitigation bypass, which could potentially allow an attacker to circumvent existing security protections. No CVSS score or detailed impact information is provided.

A denial-of-service vulnerability exists in the Audio/Video Playback component of Microsoft software version 4.0. This flaw could allow an attacker to disrupt service availability by exploiting the component. No CVSS score or detailed technical information is provided, and no public exploits are known. No patch or remediation details are available at this time.

A privilege escalation vulnerability exists in the Graphics: WebGPU component of Microsoft software due to incorrect boundary conditions. This flaw could potentially allow an attacker to gain elevated privileges. The vulnerability is identified as CVE-2026-100764 and affects version 4.0 of the product. No CVSS score or detailed impact information is provided. No patch or remediation guidance is currently available from the vendor.

This entry reports internally found bugs fixed in Thunderbird versions 155, Thunderbird ESR 153.2, and Thunderbird ESR 140.15. The vulnerability is identified as CVE-2026-84143 and is associated with Microsoft products. The description references the Microsoft Support Lifecycle for software support details but does not provide specific technical details or impact information about the vulnerability itself.

CVE-2026-4717 is a privilege escalation vulnerability in the Netmonitor component of Microsoft software version 4.0. The vulnerability has been published but lacks detailed technical information and a CVSS score. No known exploits in the wild have been reported, and no patch or remediation details are provided.

A memory safety vulnerability identified as CVE-2026-12290 has been fixed in Thunderbird 152. The vulnerability relates to a memory safety bug classified under CWE-119. No CVSS score or detailed impact information is provided. There is no evidence of exploitation in the wild. The affected version explicitly mentioned is version 4.0 of the Microsoft product referenced.

CVE-2026-92037 is a vulnerability in Microsoft software version 4.0 involving incorrect boundary conditions in the DOM animation component. The issue relates to improper handling of boundaries, categorized under CWE-119. No CVSS score or detailed impact information is provided.

CVE-2026-6776 is a vulnerability in the WebRTC networking component of Microsoft software version 4.0 caused by incorrect boundary conditions. The issue relates to improper handling of memory boundaries, categorized under CWE-119. No CVSS score or detailed impact information is provided, and no known exploits or patches are currently documented.

CVE-2026-100763 is a vulnerability in the Graphics: WebGPU component of Microsoft software version 4.0 caused by incorrect boundary conditions. The issue relates to improper handling of memory boundaries, classified under CWE-119. No CVSS score or detailed impact information is provided. No patch or remediation details are available from the vendor at this time.

CVE-2026-12289 is a privilege escalation vulnerability in the Graphics: WebRender component of Microsoft software version 4.0. The vulnerability is publicly known but lacks detailed technical or impact information. No CVSS score or exploit in the wild has been reported.

CVE-2026-84142 is a vulnerability related to internally found bugs fixed in Thunderbird 155. The advisory references Microsoft Security Response Center and Microsoft product version 4.0 as affected. No detailed technical description or impact information is provided beyond the CWE-119 classification, which indicates a potential buffer-related issue.

CVE-2026-92036 is a vulnerability in the Microsoft Networking HTTP component caused by incorrect boundary conditions. The issue is identified as a CWE-119 type, which typically relates to buffer errors. No CVSS score or detailed impact information is provided. The affected version is Microsoft product version 4.0.

A denial-of-service vulnerability exists due to an integer overflow in the Graphics: WebGPU component of Microsoft software version 4.0. The flaw could potentially cause the affected component to crash or become unresponsive.

CVE-2026-4716 is a vulnerability in the JavaScript Engine component of Microsoft software version 4.0 involving incorrect boundary conditions and uninitialized memory. The issue is identified as CWE-908. No CVSS score or detailed impact information is provided, and no patch or exploit is currently known.

CVE-2026-100762 is a use-after-free vulnerability in the DOM Content Processes component of Microsoft software version 4.0. This flaw could allow a sandbox escape, potentially enabling an attacker to break out of restricted execution environments.

An integer overflow vulnerability exists in the Graphics: ImageLib component of Microsoft software version 4.0. The issue is identified as CWE-190. No CVSS score or detailed impact information is provided, and there is no indication of active exploitation or available patches.

CVE-2026-4715 is a vulnerability involving uninitialized memory in the Graphics: Canvas2D component of Microsoft software version 4.0. The flaw relates to improper memory handling that could potentially lead to security issues. No CVSS score or detailed impact information is provided. No known exploits or patches are currently documented.

A vulnerability identified as CVE-2026-92035 affects Microsoft software version 4.0. It involves a sandbox escape caused by incorrect boundary conditions in the Graphics component. This flaw could potentially allow an attacker to break out of a restricted execution environment.

CVE-2026-6772 is a vulnerability in the Libraries component of Microsoft software version 4.0 involving incorrect boundary conditions. The issue is categorized under CWE-754, which relates to improper handling of boundary conditions. No CVSS score or detailed impact information is provided, and there are no known exploits in the wild. No patch or remediation details are available from the vendor.