Andrew Fasano

A heap-based buffer overflow in the Windows Kernel allows an authorized local attacker to elevate their privileges. A buffer overflow occurs when a program writes more data to a memory block (the buffer) than it is allocated to hold, potentially overwriting adjacent memory.

A heap buffer overflow exists in the DNS cache when processing DNS responses. The `extract name()` function can be abused because the software expands certain characters into longer escape sequences without ensuring the cache buffer is sized to hold the expanded result. Specifically, an unsafe `strcpy()` in the `really insert()` function within `src/cache.c` copies attacker-controlled name strings without bounds validation, overflowing a 1,025-byte bigname cache buffer. An attacker can exploit this by using a malicious upstream DNS server and crafted CNAME chains to corrupt memory, potentially leading to remote code execution, DNS cache poisoning to redirect lookups to attacker-controlled IP addresses, or a denial of service (DoS).

A specially crafted JSON message can cause a heap overflow in the PubSub JSON decoder before authentication. This can lead to a process crash and memory corruption. The issue occurs in builds with PubSub and JSON enabled.

Exim software contains a flaw that allows for remote heap corruption. Further details about this issue will be disclosed on 2025-12-18.

The issue is related to improper control of code generation, allowing remote authenticated users to execute arbitrary code via a crafted HTTP request parameter. This can also lead to bypassing sandbox mechanisms or causing a denial of service through a specially crafted parameter in an HTTP request.