CVE-2022-41128
Microsoft Windows Scripting Languages Remote Code Execution Vulnerability
CVSS
8.8
Alto
EPSS
24.6%
p98
KEV
SÍ
8 nov 2022
Exploit Today
79
0-100
Publicado: 9 nov 2022 · Última mod.: 10 ago 2026 · CWE-787
24.6%EPSS · 30 días24.6%
2026-09-182026-10-16
Producto
Microsoft / Windows
Vulnerabilidad
Microsoft Windows Scripting Languages Remote Code Execution Vulnerability
Añadido a KEV
8 nov 2022
Remediar antes de
9 dic 2022
Uso conocido en ransomware
No
Descripción resumida
Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.
Acción requerida
Apply updates per vendor instructions.
Notas
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128; https://nvd.nist.gov/vuln/detail/CVE-2022-41128
Windows Scripting Languages Remote Code Execution Vulnerability
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-890885.5 MED—
———A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).7hCVE-2026-890856.6 MED—
———A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.7hCVE-2026-1095888.8 ALT—
——0Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call.
To remediate this issue, users should upgrade to version V11.3.2 or later.10hCVE-2026-857469.9 CRÍ—
——0MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.12hCVE-2026-1026929.1 CRÍ—
——0RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.8hCVE-2026-1059587.5 ALT—
——0A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.11h