Security Warnings — Week: 2025-W50

gpu: host1x: Fix race in syncpt alloc/free

2025-12-09 CVE-2025-68732

mediumMicrosoft MSRC 2025-W50

Heap buffer overflow in array_merge()

2025-12-09 CVE-2025-14178

mediumMicrosoft MSRC 2025-W50

hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()

2025-12-09 CVE-2025-40243

mediumMicrosoft MSRC 2025-W50

hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()

2025-12-09 CVE-2025-40244

criticalMicrosoft MSRC 2025-W50

HID: uclogic: Correct devm device reference for hidinput input_dev name

2025-12-09 CVE-2023-54207

highMicrosoft MSRC 2025-W50

iio: accel: bmc150: Fix irq assumption regression

2025-12-09 CVE-2025-68330

mediumMicrosoft MSRC 2025-W50

ima: Handle error code returned by ima_filter_rule_match()

2025-12-09 CVE-2025-68740

mediumMicrosoft MSRC 2025-W50

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

2025-12-09 CVE-2025-61727

mediumMicrosoft MSRC 2025-W50

In GnuPG through 2.4.8, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For Extende

2025-12-09 CVE-2025-68973

highMicrosoft MSRC 2025-W50

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed materi

2025-12-09 CVE-2025-68972

mediumMicrosoft MSRC 2025-W50

In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional exec

2025-12-09 CVE-2025-48637

highMicrosoft MSRC 2025-W50

In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a vic

2025-12-09 CVE-2025-67897

mediumMicrosoft MSRC 2025-W50

Information Leak of Memory in getimagesize

2025-12-09 CVE-2025-14177

lowMicrosoft MSRC 2025-W50

Input: cros_ec_keyb - fix an invalid memory access

2025-12-09 CVE-2025-40263

mediumMicrosoft MSRC 2025-W50

Input: imx_sc_key - fix memory corruption on unload

2025-12-09 CVE-2025-40262

criticalMicrosoft MSRC 2025-W50

Input: pegasus-notetaker - fix potential out-of-bounds access

2025-12-09 CVE-2025-68217

mediumMicrosoft MSRC 2025-W50

io_uring/zctx: check chained notif contexts

2025-12-09 CVE-2025-68317

mediumMicrosoft MSRC 2025-W50

iomap: allocate s_dio_done_wq for async reads as well

2025-12-09 CVE-2025-68357

mediumMicrosoft MSRC 2025-W50

iommufd: Don't overflow during division for dirty tracking

2025-12-09 CVE-2025-40293

mediumMicrosoft MSRC 2025-W50

jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted

2025-12-09 CVE-2025-68337

mediumMicrosoft MSRC 2025-W50

jfs: Verify inode mode when loading from disk

2025-12-09 CVE-2025-40312

highMicrosoft MSRC 2025-W50

ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

2025-12-09 CVE-2025-68211

mediumMicrosoft MSRC 2025-W50

ksmbd: ipc: fix use-after-free in ipc_msg_send_request

2025-12-09 CVE-2025-68263

mediumMicrosoft MSRC 2025-W50

KVM: arm64: Check the untrusted offset in FF-A memory share

2025-12-09 CVE-2025-40266

highMicrosoft MSRC 2025-W50

KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

2025-12-09 CVE-2025-68259

mediumMicrosoft MSRC 2025-W50

landlock: Fix handling of disconnected directories

2025-12-09 CVE-2025-68736

mediumMicrosoft MSRC 2025-W50

libceph: fix potential use-after-free in have_mon_and_osd_map()

2025-12-09 CVE-2025-68285

highMicrosoft MSRC 2025-W50

libceph: prevent potential out-of-bounds writes in handle_auth_session_key()

2025-12-09 CVE-2025-68284

highMicrosoft MSRC 2025-W50

libceph: replace BUG_ON with bounds check for map->max_osd

2025-12-09 CVE-2025-68283

highMicrosoft MSRC 2025-W50

libcoap Stack-Based Buffer Overflow in Address Resolution DoS or Potential RCE

2025-12-09 CVE-2025-34468

criticalMicrosoft MSRC 2025-W50

LIBPNG has an out-of-bounds read in png_image_read_composite

2025-12-09 CVE-2025-66293

highMicrosoft MSRC 2025-W50

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elli

2025-12-09 CVE-2025-69277

mediumMicrosoft MSRC 2025-W50

Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)

2025-12-09 CVE-2025-14523

highMicrosoft MSRC 2025-W50

locking/spinlock/debug: Fix data-race in do_raw_write_lock

2025-12-09 CVE-2025-68336

mediumMicrosoft MSRC 2025-W50

macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse

2025-12-09 CVE-2025-68367

highMicrosoft MSRC 2025-W50

MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability

2025-12-09 CVE-2025-13699

highMicrosoft MSRC 2025-W50

md: fix rcu protection in md_wakeup_thread

2025-12-09 CVE-2025-68374

mediumMicrosoft MSRC 2025-W50

media: nxp: imx8-isi: Fix streaming cleanup on release

2025-12-09 CVE-2025-68175

mediumMicrosoft MSRC 2025-W50

Microsoft Access Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62552

highMicrosoft MSRC 2025-W50

Microsoft Brokering File System Elevation of Privilege Vulnerability

2025-12-09 CVE-2025-62469

highMicrosoft MSRC 2025-W50

Microsoft Brokering File System Elevation of Privilege Vulnerability

2025-12-09 CVE-2025-62569

highMicrosoft MSRC 2025-W50

Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability

2025-12-09 CVE-2025-62223

mediumMicrosoft MSRC 2025-W50

Microsoft Edge (Chromium-based) Spoofing Vulnerability

2025-12-09 CVE-2025-65046

lowMicrosoft MSRC 2025-W50

Microsoft Excel Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62553

highMicrosoft MSRC 2025-W50

Microsoft Excel Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62556

highMicrosoft MSRC 2025-W50

Microsoft Excel Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62560

highMicrosoft MSRC 2025-W50

Microsoft Excel Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62561

highMicrosoft MSRC 2025-W50

Microsoft Excel Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62563

highMicrosoft MSRC 2025-W50

Microsoft Excel Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62564

highMicrosoft MSRC 2025-W50

Microsoft Exchange Server Elevation of Privilege Vulnerability

2025-12-09 CVE-2025-64666

highMicrosoft MSRC 2025-W50

Microsoft Exchange Server Spoofing Vulnerability

2025-12-09 CVE-2025-64667

mediumMicrosoft MSRC 2025-W50

Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

2025-12-09 CVE-2025-62455

highMicrosoft MSRC 2025-W50

Microsoft Office Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62554

highMicrosoft MSRC 2025-W50

Microsoft Office Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62557

highMicrosoft MSRC 2025-W50

Microsoft Outlook Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62562

highMicrosoft MSRC 2025-W50

Microsoft Partner Center Elevation of Privilege Vulnerability

2025-12-09 CVE-2025-65041

criticalMicrosoft MSRC 2025-W50

Microsoft Purview eDiscovery Remote Code Execution Vulnerability

2025-12-09 CVE-2025-64676

highMicrosoft MSRC 2025-W50

Microsoft SharePoint Server Spoofing Vulnerability

2025-12-09 CVE-2025-64672

highMicrosoft MSRC 2025-W50

Microsoft Windows Use After Free Vulnerability

2025-12-09 CVE-2025-62221

highMicrosoft CVE 2025-W50

Microsoft Word Remote Code Execution Vulnerability

2025-12-09 CVE-2025-62555

highMicrosoft MSRC 2025-W50