CVE-2024-21357
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVSS
8.1
High
EPSS
26.9%
p98
KEV
—
Exploit Today
29
0-100
Published: Feb 13, 2024 · Last modified: Aug 10, 2026 · CWE-843
26.9%EPSS · 30 days26.9%
2026-10-022026-10-29
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1190866.5 MED—
———Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary.
To remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected.4hCVE-2026-961877.4 HIG—
——0Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.10hCVE-2026-880905.4 MED—
——0Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.6hCVE-2026-1185108.8 HIG20.7%
——6A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.1dCVE-2026-627657.5 HIG38.1%
——11Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.10hCVE-2026-858988.8 HIG55.4%
——17Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.2d