CVE-2026-85842
Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
CVSS
7.8
Alta
EPSS
0.3%
p24
KEV
—
Exploit Today
7
0-100
Publicado: 13 de out. de 2026 · Última mod.: 29 de out. de 2026 · CWE-134
0.3%EPSS · 30 dias0.3%
2026-10-142026-11-06
Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1200596.8 MÉD17.9%
——5For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements. A column name that contains format directives makes the driver read unrelated memory, which can crash the application or copy client memory into query text sent to the server. The name can come from a server not trusted under current SSL settings, or from any database user who can create a table that the application reads with an updatable cursor. Versions before psqlODBC 18.00.0006 are affected.4dCVE-2026-63201—37.7%
——11Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.4dCVE-2026-454528.3 ALT19.0%
——6Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.21dCVE-2026-1020628.1 ALT35.2%
——11An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.23dCVE-2026-1019668.2 ALT37.1%
——11A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.23dCVE-2026-1019658.8 ALT49.0%
——15An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.23d