Illustrator versions 30.2, 29.8.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
CVE-2026-25207 is a high-severity out-of-bounds write vulnerability in Samsung Open Source Escargot, identified as CWE-787. It affects a specific version of Escargot (commit 97e8115ab1110bc502b4b5e4a0c689a71520d335). This vulnerability can cause buffer overflow conditions leading to potential compromise of confidentiality, integrity, and availability. There is no vendor-provided patch or official remediation available at this time, and no known exploits have been reported in the wild.
CVE-2026-34863 is an out-of-bounds write vulnerability in the file system component of Huawei HarmonyOS versions 5.1.0 and 6.0.0. Successful exploitation may impact system availability. The vulnerability has a CVSS 3.1 base score of 6.7, indicating a medium severity level. There is no vendor-provided patch or official remediation guidance available at this time.
In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.
CVE-2026-5495 is a high-severity vulnerability in Labcenter Electronics Proteus version 8.17 SP5. It involves an out-of-bounds write during the parsing of PDSPRJ files, which can lead to remote code execution if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data, allowing an attacker to write beyond allocated memory and execute arbitrary code in the context of the current process. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-5494 is a high-severity vulnerability in Labcenter Electronics Proteus version 8.17 SP5 involving an out-of-bounds write during the parsing of PDSPRJ files. This flaw allows remote attackers to execute arbitrary code by tricking a user into opening a malicious file or visiting a malicious page. The vulnerability arises from improper validation of user-supplied data, leading to a buffer overflow condition. Exploitation requires user interaction. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-5493 is a high-severity vulnerability in Labcenter Electronics Proteus version 8.17 SP5 involving an out-of-bounds write during parsing of PDSPRJ files. This flaw allows remote attackers to execute arbitrary code by convincing a user to open a malicious file or visit a malicious page. The vulnerability arises from improper validation of user-supplied data, leading to a buffer overflow condition. Exploitation requires user interaction and results in code execution with the privileges of the current process.
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler=winch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.
Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging computations for the same address: one for the address to bounds-check and one for the address to load. This difference in address being operated on means that a guest module can pass a bounds check but then load a different address. Combined together this enables an arbitrary read/write primitive for guest WebAssembly when accesssing host memory. This is a sandbox escape as guests are able to read/write arbitrary host memory. This vulnerability has a few ingredients, all of which must be met, for this situation to occur and bypass the sandbox restrictions. This miscompiled shape of load only occurs on 64-bit WebAssembly linear memories, or when Config::wasm_memory64 is enabled. 32-bit WebAssembly is not affected. Spectre mitigations or signals-based-traps must be disabled. When spectre mitigations are enabled then the offending shape of load is not generated. When signals-based-traps are disabled then spectre mitigations are also automatically disabled. The specific bug in Cranelift is a miscompile of a load of the shape load(iadd(base, ishl(index, amt))) where amt is a constant. The amt value is masked incorrectly to test if it's a certain value, and this incorrect mask means that Cranelift can pattern-match this lowering rule during instruction selection erroneously, diverging from WebAssembly's and Cranelift's semantics. This incorrect lowering would, for example, load an address much further away than intended as the correct address's computation would have wrapped around to a smaller value insetad. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.
osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.12, A stack buffer overflow vulnerability exists in osslsigncode in several signature verification paths. During verification of a PKCS#7 signature, the code copies the digest value from a parsed SpcIndirectDataContent structure into a fixed-size stack buffer (mdbuf[EVP_MAX_MD_SIZE], 64 bytes) without validating that the source length fits within the destination buffer. This pattern is present in the verification handlers for PE, MSI, CAB, and script files. An attacker can craft a malicious signed file with an oversized digest field in SpcIndirectDataContent. When a user verifies such a file with osslsigncode verify, the unbounded memcpy can overflow the stack buffer and corrupt adjacent stack state. This vulnerability is fixed in 2.12.
CVE-2026-5747 is an out-of-bounds write vulnerability in the virtio PCI transport component of AWS Firecracker versions 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 architectures. A local guest user with root privileges could exploit this flaw to crash the Firecracker VMM process or potentially execute arbitrary code on the host. Exploitation to achieve code execution requires additional conditions such as a custom guest kernel or specific snapshot configurations. AWS has released fixed versions 1.14.4 and 1.15.1 and later to address this issue.
There is a memory corruption vulnerability due to an out-of-bounds write in ResFileFactory::InitResourceMgr() in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.
CVE-2026-32861 is a high-severity memory corruption vulnerability in NI LabVIEW affecting versions up to 26.1.0. It arises from an out-of-bounds write when loading a corrupted LVCLASS file, potentially allowing information disclosure or arbitrary code execution. Exploitation requires user interaction to open a maliciously crafted . lvclass file. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-32860 is a high-severity memory corruption vulnerability in NI LabVIEW affecting versions up to 26.1.0. It arises from an out-of-bounds write when loading a specially crafted corrupted LVLIB file. Exploitation requires user interaction to open the malicious file and may lead to information disclosure or arbitrary code execution. There is no confirmed patch or official remediation available yet. Users should exercise caution when opening LVLIB files from untrusted sources.
CVE-2026-20446 is an out-of-bounds write vulnerability in the secure boot component of MediaTek chipsets, specifically affecting the MT6813 version. The issue arises from an integer overflow that can lead to memory corruption. Exploitation requires local access with user-level privileges but does not require user interaction. The vulnerability can cause a local denial of service by crashing the device. A patch has been identified (Patch ID: ALPS09963054), but the current patch status is not confirmed from the available data.
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01088681; Issue ID: MSV-4460.