Security Warnings — Week: 2026-W03

http/2 Implementierungen: Schwachstelle ermöglicht Denial of Service

2026-01-15 CVE-2023-44487

highBSI 2026-W03

Intel OpenBMC Firmware: Mehrere Schwachstellen

2026-01-14 CVE-2023-31189

mediumBSI 2026-W03

Intel Thunderbolt Controller Firmware: Schwachstelle ermöglicht Denial of Service

2026-01-14 CVE-2023-28396

mediumBSI 2026-W03

ACPICA: Avoid walking the Namespace if start_node is NULL

2026-01-13 CVE-2025-71118

mediumMicrosoft MSRC 2026-W03

ALSA: firewire-motu: add bounds check in put_user loop for DSP events

2026-01-13 CVE-2025-68753

highMicrosoft MSRC 2026-W03

ALSA: usb-mixer: us16x08: validate meter packet indices

2026-01-13 CVE-2025-68783

mediumMicrosoft MSRC 2026-W03

Angular: Schwachstelle ermöglicht Denial of Service

2026-01-13 CVE-2024-21490

mediumRed Hat 2026-W03

ASoC: stm32: sai: fix OF node leak on probe

2026-01-13 CVE-2025-71081

highMicrosoft MSRC 2026-W03

Avahi has a reachable assertion in avahi_wide_area_scan_cache

2026-01-13 CVE-2025-68276

mediumMicrosoft MSRC 2026-W03

Avahi has a reachable assertion in lookup_multicast_callback

2026-01-13 CVE-2025-68468

mediumMicrosoft MSRC 2026-W03

Avahi has a reachable assertion in lookup_start

2026-01-13 CVE-2025-68471

mediumMicrosoft MSRC 2026-W03

Azure Connected Machine Agent Elevation of Privilege Vulnerability

2026-01-13 CVE-2026-21224

highMicrosoft MSRC 2026-W03

Azure Core shared client library for Python Remote Code Execution Vulnerability

2026-01-13 CVE-2026-21226

highMicrosoft MSRC 2026-W03

Azure Data Explorer Information Disclosure Vulnerability

2026-01-13 CVE-2026-21524

highMicrosoft MSRC 2026-W03

Azure Logic Apps Elevation of Privilege Vulnerability

2026-01-13 CVE-2026-21227

highMicrosoft MSRC 2026-W03

backlight: led-bl: Add devlink to supplier LEDs

2026-01-13 CVE-2025-68758

mediumMicrosoft MSRC 2026-W03

bearer token leak on cross-protocol redirect

2026-01-13 CVE-2025-14524

mediumMicrosoft MSRC 2026-W03

block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock

2026-01-13 CVE-2025-68756

highMicrosoft MSRC 2026-W03

Bluetooth: btusb: revert use of devm_kzalloc in btusb

2026-01-13 CVE-2025-71082

highMicrosoft MSRC 2026-W03

broken TLS options for threaded LDAPS

2026-01-13 CVE-2025-14017

mediumMicrosoft MSRC 2026-W03

btrfs: always detect conflicting inodes when logging inode refs

2026-01-13 CVE-2025-71183

mediumMicrosoft MSRC 2026-W03

btrfs: don't log conflicting inode if it's a dir moved in the current transaction

2026-01-13 CVE-2025-68778

mediumMicrosoft MSRC 2026-W03

btrfs: fix NULL dereference on root when tracing inode eviction

2026-01-13 CVE-2025-71184

mediumMicrosoft MSRC 2026-W03

caif: fix integer underflow in cffrml_receive()

2026-01-13 CVE-2025-68799

mediumMicrosoft MSRC 2026-W03

Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

2026-01-13 CVE-2026-20815

highMicrosoft MSRC 2026-W03

Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

2026-01-13 CVE-2026-20830

highMicrosoft MSRC 2026-W03

Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

2026-01-13 CVE-2026-21221

highMicrosoft MSRC 2026-W03

Capability Access Management Service (camsvc) Information Disclosure Vulnerability

2026-01-13 CVE-2026-20835

mediumMicrosoft MSRC 2026-W03

Capability Access Management Service (camsvc) Information Disclosure Vulnerability

2026-01-13 CVE-2026-20851

mediumMicrosoft MSRC 2026-W03

char: applicom: fix NULL pointer dereference in ac_ioctl

2026-01-13 CVE-2025-68797

mediumMicrosoft MSRC 2026-W03

clk: samsung: exynos-clkout: Assign .num before accessing .hws

2026-01-13 CVE-2025-71143

highMicrosoft MSRC 2026-W03

Copilot Studio Information Disclosure Vulnerability

2026-01-13 CVE-2026-21520

highMicrosoft MSRC 2026-W03

CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages

2026-01-13 CVE-2025-68151

highMicrosoft MSRC 2026-W03

Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium

2026-01-13 CVE-2025-15444

highMicrosoft MSRC 2026-W03

crypto: af_alg - zero initialize memory allocated via sock_kmalloc

2026-01-13 CVE-2025-71113

mediumMicrosoft MSRC 2026-W03

crypto: seqiv - Do not use req->iv after crypto_aead_encrypt

2026-01-13 CVE-2025-71131

mediumMicrosoft MSRC 2026-W03

crypto: starfive - Correctly handle return of sg_nents_for_len

2026-01-13 CVE-2025-68763

mediumMicrosoft MSRC 2026-W03

CVE-2025-13151

2026-01-13 CVE-2025-13151

lowMicrosoft MSRC 2026-W03

Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata

2026-01-13 CVE-2026-0897

highMicrosoft MSRC 2026-W03

Desktop Window Manager Elevation of Privilege Vulnerability

2026-01-13 CVE-2026-20871

highMicrosoft MSRC 2026-W03

Desktop Window Manager Information Disclosure Vulnerability

2026-01-13 CVE-2026-20805

mediumMicrosoft MSRC 2026-W03

DirectX Graphics Kernel Elevation of Privilege Vulnerability

2026-01-13 CVE-2026-20814

highMicrosoft MSRC 2026-W03

DirectX Graphics Kernel Elevation of Privilege Vulnerability

2026-01-13 CVE-2026-20836

highMicrosoft MSRC 2026-W03

dm-verity: disable recursive forward error correction

2026-01-13 CVE-2025-71161

mediumMicrosoft MSRC 2026-W03

dmaengine: idxd: fix device leaks on compat bind and unbind

2026-01-13 CVE-2025-71163

mediumMicrosoft MSRC 2026-W03

dmaengine: tegra-adma: Fix use-after-free

2026-01-13 CVE-2025-71162

highMicrosoft MSRC 2026-W03

drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer

2026-01-13 CVE-2025-71130

highMicrosoft MSRC 2026-W03

drm/msm/dpu: Add missing NULL pointer check for pingpong interface

2026-01-13 CVE-2025-71138

mediumMicrosoft MSRC 2026-W03

drm/ttm: Avoid NULL pointer deref for evicted BOs

2026-01-13 CVE-2025-71083

mediumMicrosoft MSRC 2026-W03

drm/vgem-fence: Fix potential deadlock on release

2026-01-13 CVE-2025-68757

mediumMicrosoft MSRC 2026-W03

dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

2026-01-13 CVE-2026-23004

mediumMicrosoft MSRC 2026-W03

Dynamic Root of Trust for Measurement (DRTM) Information Disclosure Vulnerability

2026-01-13 CVE-2026-20962

mediumMicrosoft MSRC 2026-W03

e1000: fix OOB in e1000_tbi_should_accept()

2026-01-13 CVE-2025-71093

highMicrosoft MSRC 2026-W03

ethtool: Avoid overflowing userspace buffer on stats query

2026-01-13 CVE-2025-68795

highMicrosoft MSRC 2026-W03

f2fs: ensure node page reads complete before f2fs_put_super() finishes

2026-01-13 CVE-2025-71107

mediumMicrosoft MSRC 2026-W03

f2fs: fix return value of f2fs_recover_fsync_data()

2026-01-13 CVE-2025-68769

mediumMicrosoft MSRC 2026-W03

f2fs: fix to avoid potential deadlock

2026-01-13 CVE-2025-71065

mediumMicrosoft MSRC 2026-W03

f2fs: fix to avoid updating compression context during writeback

2026-01-13 CVE-2025-68772

mediumMicrosoft MSRC 2026-W03

f2fs: fix to avoid updating zero-sized extent in extent cache

2026-01-13 CVE-2025-68796

mediumMicrosoft MSRC 2026-W03

f2fs: invalidate dentry cache on failed whiteout creation

2026-01-13 CVE-2025-71069

mediumMicrosoft MSRC 2026-W03