Hungtt28

This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the processing of XFA templates due to the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process.

The issue is related to a use-after-free vulnerability in the `resetForm` method, which can be exploited by remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists due to the lack of validation of an object's existence before performing operations on it, allowing an attacker to execute code in the context of the current process.

This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of form Annotation objects within AcroForms, resulting from the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process.

A type confusion issue exists, which could lead to arbitrary code execution if successfully exploited. This allows attackers to execute arbitrary code.

The issue is an out-of-bounds read vulnerability that could lead to information disclosure if successfully exploited. It allows attackers to obtain sensitive information.

This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the processing of XFA Template objects due to the lack of proper validation of user-supplied data, resulting in a write past the end of an allocated structure. An attacker can leverage this to execute code in the context of the current process.

An issue exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. This can lead to an elevation of privilege. Additionally, a denial-of-service condition can be triggered, affecting the system. The issue may involve a child window NULL pointer dereference, potentially allowing privilege escalation.

The issue is caused by a buffer overflow in memory, allowing a remote attacker to execute arbitrary code using a specially crafted web page. This could corrupt memory, enabling the attacker to execute code in the context of the current user. If the user has administrative rights, the attacker could gain control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

The issue arises from the Microsoft Windows Kernel Mode Driver's failure to properly handle objects in memory, allowing an elevation of privilege. This can be exploited by attackers to affect the system.

The issue is related to incorrect handling of objects in memory by the Microsoft Edge JavaScript scripting engine. This could allow a remote attacker to corrupt memory, potentially executing arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the affected system, install programs, view, change or delete data, or create new accounts with full user rights.