CVE-2026-110051
Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVSS
6.5
Média
EPSS
1.1%
p65
KEV
—
Exploit Today
20
0-100
Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-681 · CWE-822
1.1%EPSS · 30 dias1.1%
2026-11-112026-11-13
Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1280844.8 MÉD—
——0sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Database#prepare, bound String or Blob values through Statement#bind_param, and String or Blob results from Ruby-defined SQL functions and aggregates through Database#create_function and Database#create_aggregate. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger can wrap the length so SQLite processes only a prefix. A truncated SQL string can drop trailing clauses such as a WHERE condition, while a truncated bound value matters only when the application validated the full value before binding it. Exploitation requires the application and server to accept and retain the unusually large attacker-controlled string. If a dropped SQL clause contained a bind placeholder, binding raises SQLite3::RangeException instead of running the query. This issue is fixed in version 2.10.2.2dCVE-2026-910077.8 ALT1.4%
——0The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the prop argument before copying union charger_propval across the user/kernel boundary. Two members of that union are function pointers — status_notification (CHARGER_PROP_STATUS_NOTIFICATION) and online_notification (CHARGER_PROP_ONLINE_NOTIFICATION), declared in include/zephyr/drivers/charger.h — and z_vrfy_charger_set_prop() forwarded the caller-supplied union verbatim to the driver's set_property callback for any property. z_vrfy_charger_get_prop() had the mirror defect and copied the stored kernel callback address back out to user memory.
With CONFIG_USERSPACE enabled, any user-mode thread that has been granted a charger device object could call charger_set_prop() with CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION and an arbitrary pointer value. Drivers that implement these properties — drivers/charger/charger_max20335.c, drivers/charger/charger_pf1550.c and drivers/charger/charger_bq2518x.c — store the pointer in device data and later invoke it from their interrupt work handlers, which run in supervisor mode, on any charger state change such as a cable plug/unplug.
The result is a control-flow hijack at kernel privilege from an unprivileged thread, defeating the isolation that CONFIG_USERSPACE is meant to provide; the read path additionally disclosed a kernel code address to user mode, and clearing a notifier installed by a supervisor thread let user mode suppress charger notifications. Supervisor-mode callers of charger_set_prop()/charger_get_prop() are unaffected.
The fix makes both verifiers reject the two notifier properties outright — including when the supplied callback is NULL, since the notifiers are device state — and adds a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT so that new properties force a re-review of the union's user-mode safety.3dCVE-2026-961687.0 ALT17.6%
——5Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.4dCVE-2026-961527.8 ALT24.2%
——7Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.4dCVE-2026-961397.0 ALT17.6%
——5Untrusted pointer dereference in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.4dCVE-2026-961247.0 ALT17.6%
——5Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.4d