Trail

A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

A heap buffer overflow occurs during the import of drawings in DXF format used by CAD software. The issue arises when importing a DXF polyline because the point count is truncated to a 16-bit value during buffer sizing, while the full count is used to fill the buffer. Consequently, polylines with a point count exceeding the 16-bit range are written past the end of the buffer.

A heap buffer overflow occurs during the import of documents in the OOXML (DOCX) format. The issue arises when replaying deferred parser events for a text box element, where a handler object is assumed to be of a specific type and written to according to that type's field layout. If the object is smaller than assumed, the write operation extends beyond the end of the memory allocation.

A heap use-after-free occurs during the import of blank-width characters within an ODF number format. This happens because a position value read from the document is not validated against the length of the format-code string, allowing a malformed number format to be processed against memory outside the intended string boundaries. Heap use-after-free is a memory corruption issue where a program continues to use a pointer after the memory it points to has been freed.

A heap buffer overflow occurs during the import of EMF+ graphics, which can be embedded in documents. Specifically, the issue arises when importing an EMF+ gradient brush. The software reads the number of gradient blend points from the file to calculate the allocation size; however, this multiplication can overflow. This results in the allocation of a buffer that is too small, which is then filled as if it were larger, leading to data being written past the end of the buffer.

A vulnerability in the GPU kernel allows it to read sensitive data from another GPU kernel, even from another user or application, through an optimized GPU memory region called local memory . This issue can be exploited to extract data from the local memory of a GPU, potentially revealing confidential information. The vulnerability, known as LeftoverLocals, is particularly concerning in multi-user systems where different users' handlers run on the same GPU. It can also be used in malicious software to track the activity of processes running on the GPU. The estimated number of potentially affected devices worldwide is not specified, but it is mentioned that the issue affects millions of devices, including iPhones, iPads, and Macs.