Base de CVEs

CVE-2026-7406 Alta · 7.8 CWE-822 06/08/2026

BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVE-2026-19023 Média · 6.8 CWE-822 05/08/2026

HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.

CVE-2026-24083 Alta · 7.8 CWE-822 04/08/2026

Untrusted Pointer Dereference in Automotive Security

Memory Corruption while processing IOCTL device driver requests with invalid arguments.

CVE-2026-64286 Alta · 8.2 CWE-822 25/07/2026

KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxt_to_vcpu() expects a guest context to have a NULL __hyp_running_vcpu, which is only ever set on the host context, so that it resolves the vCPU via container_of(). While this is generally the case, flush_hyp_vcpu() copies the context verbatim and does not enforce this, so a value provided by the host is dereferenced at EL2 (host -> EL2). Fix by clearing __hyp_running_vcpu after the copy.

CVE-2026-63924 Crítica · 9.8 CWE-822 19/07/2026

ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up.

CVE-2026-15029 Alta · 8.4 CWE-822 14/07/2026

Untrusted Pointer Dereference em Asus System Control Interface v3

Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests to the driver, bypassing OS-enforced memory protections. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

CVE-2026-48340 Alta · 7.8 CWE-822 14/07/2026

Bridge | Untrusted Pointer Dereference (CWE-822)

Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-55138 Média · 5.5 CWE-822 14/07/2026

Microsoft Excel Information Disclosure Vulnerability

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2026-55136 Alta · 7.8 CWE-822 14/07/2026

Microsoft Excel Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-50479 Alta · 7.8 CWE-822 14/07/2026

Windows USB Hub Driver Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-50441 Alta · 7.8 CWE-822 14/07/2026

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

CVE-2026-50424 Alta · 7.5 CWE-822 14/07/2026

Windows Domain Controller Denial of Service Vulnerability

Untrusted pointer dereference in Windows Domain Controller allows an unauthorized attacker to deny service over a network.

CVE-2026-50382 Alta · 8.8 CWE-822 14/07/2026

DirectX Graphics Kernel Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows DirectX allows an authorized attacker to execute code locally.

CVE-2026-48580 Média · 5.5 CWE-822 14/07/2026

Microsoft Excel Information Disclosure Vulnerability

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2026-58596 Alta · 8.3 CWE-822 12/07/2026

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-48137 Crítica · 9.8 CWE-822 19/06/2026

NI grpc-device: desreferência de ponteiro não confiável (CVE-2026-48137)

Há uma vulnerabilidade de desreferência de ponteiro não confiável na API de streaming sideband do NI grpc-device que pode permitir que um atacante cause uma desreferência arbitrária de memória, potencialmente resultando em execução remota de código. A exploração bem-sucedida requer que o atacante forneça uma mensagem protobuf Moniker especialmente elaborada. Isso afeta o NI grpc-device 2.17.0 e versões anteriores.

CVE-2026-45643 Alta · 7.8 CWE-822 09/06/2026

Microsoft Word Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-45471 Alta · 7.8 CWE-822 09/06/2026

Microsoft Word Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-8835 Alta · 7.3 CWE-822 26/05/2026

IBM HTTP Server is affected by multiple vulnerabilities

IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.

CVE-2025-62627 Alta · 7.2 CWE-822 13/05/2026

Untrusted Pointer Dereference em AMD ESXi 8.x and ESXi 9.x hosts using AMD-Pensando DPU products

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory, potentially resulting in loss of confidentiality or availability.

CVE-2026-40369 Alta · 7.8 CWE-822 12/05/2026

Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-40367 Alta · 8.4 CWE-822 12/05/2026

Microsoft Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-20738 Alta · 8.5 CWE-822 12/05/2026

Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before…

Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before version 1.13 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVE-2026-43067 Crítica · 9.8 CWE-822 05/05/2026

ext4: handle wraparound when searching for blocks for indirect mapped blocks

In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks for indirect mapped blocks Commit 4865c768b563 ("ext4: always allocate blocks only from groups inode can use") restricts what blocks will be allocated for indirect block based files to block numbers that fit within 32-bit block numbers. However, when using a review bot running on the latest Gemini LLM to check this commit when backporting into an LTS based kernel, it raised this concern: If ac->ac_g_ex.fe_group is >= ngroups (for instance, if the goal group was populated via stream allocation from s_mb_last_groups), then start will be >= ngroups. Does this allow allocating blocks beyond the 32-bit limit for indirect block mapped files? The commit message mentions that ext4_mb_scan_groups_linear() takes care to not select unsupported groups. However, its loop uses group = *start, and the very first iteration will call ext4_mb_scan_group() with this unsupported group because next_linear_group() is only called at the end of the iteration. After reviewing the code paths involved and considering the LLM review, I determined that this can happen when there is a file system where some files/directories are extent-mapped and others are indirect-block mapped. To address this, add a safety clamp in ext4_mb_scan_groups().

CVE-2026-33120 Alta · 8.8 CWE-822 14/04/2026

Microsoft SQL Server Remote Code Execution Vulnerability

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.