CVE-2026-97775
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVSS
8.8
High
EPSS
0.7%
p53
KEV
—
Exploit Today
16
0-100
Published: Oct 13, 2026 · Last modified: Oct 15, 2026 · CWE-400 · CWE-416
0.7%EPSS · 30 days0.7%
2026-10-142026-10-20
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-972067.5 HIG—
——0NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.1dCVE-2026-114111——
——0sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.1dCVE-2026-1141035.3 MED—
——0adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.1dCVE-2026-1140557.5 HIG—
——0vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.1dCVE-2026-1140426.5 MED—
——0FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.1dCVE-2026-934418.6 HIG—
——0IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.1d