CVE-2026-113771
Off-by-one error in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVSS
5.5
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-193
Not enough EPSS history yet.
Off-by-one error in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1187268.8 HIG—
——0Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.3hCVE-2026-1100466.5 MED—
——0Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.4hCVE-2026-61469——
——0Off-by-one error in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with an unauthenticated user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.5hCVE-2026-88708—6.8%
——2An
off-by-one error in certain ASUS Router firmware
allows
an unauthenticated nearby user to send a packet with a specific header
length, potentially overwriting memory and causing the
affected service to crash.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.3hCVE-2026-1252577.0 HIG3.6%
——1FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis enabled, causing idx to equal OPT_SIZE and overwrite adjacent heap memory.1dCVE-2026-123370—26.4%
——8compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.1d