Threats affecting pkg:generic/kimageformats

CVE-2026-92066 is a sandbox escape vulnerability in the Profile Backup component of Microsoft software version 4.0. The vulnerability has been published but lacks detailed technical information and a CVSS score. No known exploits in the wild or patch information are currently available.

A use-after-free vulnerability exists in the DOM Core & HTML component of Microsoft software version 4.0. This type of flaw involves accessing memory after it has been freed, which can lead to undefined behavior or potential security issues. No CVSS score or detailed impact information is provided.

An integer overflow vulnerability has been identified in the Widget: Win32 component of Microsoft software version 4.0. The vulnerability is cataloged as CVE-2026-8949 and is associated with CWE-190. No CVSS score or detailed impact information is provided, and there is no indication of known exploitation in the wild. No patch or remediation details are available at this time.

A sandbox escape vulnerability exists in the Widget: Win32 component of Microsoft software version 4.0 due to incorrect boundary conditions. This flaw could potentially allow an attacker to break out of the sandbox environment. No CVSS score or detailed impact information is provided.

A use-after-free vulnerability exists in the XSLT component of Microsoft software version 4.0. This vulnerability involves improper handling of memory, which could potentially lead to undefined behavior or security issues. No CVSS score or detailed impact information is provided.

CVE-2026-8948 is a vulnerability in Microsoft software version 4.0 involving a same-origin policy bypass in the DOM networking component. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. This bypass could potentially allow unauthorized access to resources across origins. No CVSS score or detailed impact information is provided, and there is no indication of active exploitation in the wild. No patch or remediation details are available at this time.

CVE-2026-123595 is a vulnerability in Hickory DNS version 4.0 that allows DNSSEC validation bypass via ancestor-delegation NSEC3 records. This flaw could undermine the integrity of DNSSEC validation, potentially allowing attackers to bypass security checks. No CVSS score or detailed impact information is provided.

A sandbox escape vulnerability exists in the Widget: Win32 component of Microsoft software version 4.0 due to incorrect boundary conditions. This flaw could allow an attacker to break out of the sandbox environment. No CVSS score or detailed impact information is provided.

CVE-2026-123580 is a vulnerability in Hickory-DNS versions before 0.26.2 that allows DNSSEC nonexistence proof forgery via NSEC3. This flaw affects version 4.0 of the Microsoft product referenced. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the provided data.

CVE-2026-100789 is a use-after-free vulnerability in the Graphics: Canvas2D component of Microsoft software version 4.0. The vulnerability is publicly known but lacks detailed technical or impact information and no CVSS score is provided.

CVE-2026-8947 is a use-after-free vulnerability in the DOM Bindings (WebIDL) component of Microsoft software version 4.0. This type of flaw involves accessing memory after it has been freed, which can lead to unpredictable behavior or potential exploitation. No CVSS score or detailed impact information is provided.

A privilege escalation vulnerability exists in the Session Restore component of Microsoft software version 4.0. This vulnerability could allow an attacker to gain elevated privileges. No CVSS score or detailed impact information is provided. No patch or remediation information is currently available.

CVE-2026-100788 is a vulnerability involving an invalid pointer in the JavaScript WebAssembly component of Microsoft software version 4.0. The description and details are minimal, with no CVSS score or public exploit information available. No patch or remediation details have been provided.

CVE-2026-8946 is a vulnerability in the Audio/Video: Web Codecs component of Microsoft software version 4.0. It involves incorrect boundary conditions, which is a type of memory safety issue classified under CWE-119. No CVSS score or detailed impact information is provided.

CVE-2026-123575 is a vulnerability in Hickory DNS versions before 0.26.2 involving memory exhaustion caused by incomplete DNS-over-HTTPS (DoH) request bodies. This flaw can lead to resource exhaustion on affected systems.

CVE-2026-92061 is a vulnerability in Microsoft Security's Process Sandboxing component caused by incorrect boundary conditions. The issue is identified as a CWE-119 type, which typically relates to improper restriction of operations within the bounds of a memory buffer. No CVSS score or detailed impact information is provided. The affected version is Microsoft product version 4.0.

CVE-2026-123574 is a denial of service vulnerability in Hickory DNS versions 0.24.0 through before 0.26.2 caused by issues in the zone file parser. The flaw allows an attacker to cause service disruption by exploiting improper input validation. No CVSS score or detailed impact metrics are provided. No patch or remediation information is available in the provided data.

CVE-2026-100787 is a vulnerability involving a sandbox escape in the XUL component of Microsoft software version 4.0. The vulnerability is publicly disclosed but lacks detailed technical or impact information, and no CVSS score is available.

CVE-2026-8945 is a sandbox escape vulnerability affecting Firefox and Firefox Focus for Android. The vulnerability is identified as CWE-693, which relates to protection mechanism failures. No CVSS score or detailed impact information is provided. There is no indication of known exploitation in the wild or available patches.

A use-after-free vulnerability has been identified in the Internationalization component of Microsoft software version 4.0. This type of flaw involves improper handling of memory, potentially leading to memory corruption.