CVE & CISA-KEV Catalog

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may result in denial of service, privilege escalation, or full compromise of the client LPAR kernel.

Published 2026-08-20

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improper validation of an attacker-controlled pointer.

Published 2026-08-20

The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer (K_SYSCALL_MEMORY_WRITE) and passed the two struct device * arguments, src_dev and dst_dev, directly into the implementation without any object validation — unlike every sibling flash syscall, which guards its device pointer with K_SYSCALL_DRIVER_FLASH. A user-mode thread fully controls the values of src_dev/dst_dev and the contents of its own address space. The implementation z_impl_flash_copy() dereferences these pointers and calls through their driver-API function tables (e.g. api->get_parameters(dst_dev), flash_read(src_dev, ...)

Published 2026-08-17

The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation z_impl_z_log_msg_static_create() without performing any of the mandatory K_SYSCALL_* checks. Because z_log_msg_static_create() is declared __syscall, under CONFIG_USERSPACE any unprivileged user-mode thread can invoke it directly with fully attacker-controlled arguments. The kernel-mode handler dereferences each of these untrusted values: frontend_runtime_filtering() reads through the source pointer as a struct log_source_dynamic_data, cbprintf_package_copy() reads desc.package_len bytes from the package pointer, and z_log_msg_finalize() performs a memc

Published 2026-08-14

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Published 2026-08-11

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

Published 2026-08-11

Untrusted pointer dereference in Windows Win32K allows an authorized attacker to disclose information locally.

Published 2026-08-11

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Published 2026-08-11

Untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose information locally.

Published 2026-08-11

Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation. Refer to the ' Security Update for ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and Armoury Crate Security Bulletin ' section on the ASUS Security Advisory for more information.

Published 2026-08-11

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.

Published 2026-08-07

Untrusted pointer dereference in the render_bin_output function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes subsequent elements to be read from a misaligned offset and dereferenced as a pointer.

Published 2026-08-07

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Published 2026-08-06

Memory Corruption while processing IOCTL device driver requests with invalid arguments.

Published 2026-08-04

Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Published 2026-07-22

Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests to the driver, bypassing OS-enforced memory protections. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

Published 2026-07-15

Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published 2026-07-14

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Published 2026-07-14

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Published 2026-07-14

Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.

Published 2026-07-14

Untrusted pointer dereference in Windows Domain Controller allows an unauthorized attacker to deny service over a network.

Published 2026-07-14

Untrusted pointer dereference in Windows DirectX allows an authorized attacker to execute code locally.

Published 2026-07-14

Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

Published 2026-07-14

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

Published 2026-07-14

Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

Published 2026-07-11

There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution. Successful exploitation requires an attacker to supply a specially crafted Moniker protobuf message. This affects NI grpc-device 2.17.0 and prior versions.

Published 2026-06-19

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

Published 2026-06-09

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Published 2026-06-09

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Published 2026-06-09

Use after free in Windows Network Controller (NC) Host Agent allows an authorized attacker to deny service locally.

Published 2026-06-09

IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service.

Published 2026-05-26

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Published 2026-05-20

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory, potentially resulting in loss of confidentiality or availability.

Published 2026-05-13

Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before version 1.13 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Published 2026-05-12

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Published 2026-05-12

Memory corruption when another driver calls an IOCTL with invalid input/output buffer.

Published 2026-05-04

Memory corruption when processing camera sensor input/output control codes with invalid output buffers.

Published 2026-05-04

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

Published 2026-04-14

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Published 2026-04-14

Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

Published 2026-04-14

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

Published 2026-04-14

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

Published 2026-04-14

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

Published 2026-04-14

Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

Published 2026-04-14

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

Published 2026-04-14

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

Published 2026-03-10

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Published 2026-03-10

Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memory space allowing an attacker to infer the contents of the kernel memory leading to potential information disclosure.

Published 2026-02-10

Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Published 2026-02-10

Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Published 2026-02-10