deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-25226
Published: 2025-04-08
Description: Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-framework-sql-injection-vulnerability-in-quotenamestr-method-of-database-package.html
CVE: CVE-2025-25227
Published: 2025-04-08
Description: Insufficient state checks lead to a vector that allows to bypass 2FA checks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-mfa-authentication-bypass.html
CVE: CVE-2025-27082
Published: 2025-04-08
Description: Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying host operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04845en_us&docLocale=en_US
CVE: CVE-2025-27083
Published: 2025-04-08
Description: Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04845en_us&docLocale=en_US
CVE: CVE-2025-27084
Published: 2025-04-08
Description: A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04845en_us&docLocale=en_US
CVE: CVE-2025-27085
Published: 2025-04-08
Description: Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04845en_us&docLocale=en_US
CVE: CVE-2025-27441
Published: 2025-04-08
Description: Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352, CWE-79
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25013
CVE: CVE-2025-27442
Published: 2025-04-08
Description: Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352, CWE-79
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25013
CVE: CVE-2025-27443
Published: 2025-04-08
Description: Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.
CVSS Score: 2.8 (LOW)
CWE: CWE-1188
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25014
CVE: CVE-2025-30670
Published: 2025-04-08
Description: Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25015
CVE: CVE-2025-30671
Published: 2025-04-08
Description: Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25015
CVE: CVE-2025-32117
Published: 2025-04-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/widgetize-pages-light/vulnerability/wordpress-widgetize-pages-light-plugin-3-0-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-32164
Published: 2025-04-08
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows Retrieve Embedded Sensitive Data.This issue affects m1.DownloadList: from n/a through <= 0.24.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/m1downloadlist/vulnerability/wordpress-m1-downloadlist-plugin-0-21-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-32211
Published: 2025-04-08
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/broadstreet/vulnerability/wordpress-broadstreet-plugin-1-51-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32279
Published: 2025-04-08
Description: Missing Authorization vulnerability in Shahjada Live Forms liveforms.This issue affects Live Forms: from n/a through <= 4.8.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/liveforms/vulnerability/wordpress-live-forms-plugin-4-8-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-21174
Published: 2025-04-08
Description: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21174
CVE: CVE-2025-21191
Published: 2025-04-08
Description: Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21191
CVE: CVE-2025-21197
Published: 2025-04-08
Description: Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21197
CVE: CVE-2025-21203
Published: 2025-04-08
Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21203
CVE: CVE-2025-21204
Published: 2025-04-08
Description: Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21204; https://www.vicarius.io/vsociety/posts/cve-2025-21204-privilege-elevation-vulnerability-in-microsoft-windows-update-stack-detection-script; https://www.vicarius.io/vsociety/posts/cve-2025-21204-privilege-elevation-vulnerability-in-microsoft-windows-update-stack-mitigation-script
CVE: CVE-2025-21205
Published: 2025-04-08
Description: Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21205
CVE: CVE-2025-21221
Published: 2025-04-08
Description: Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21221
CVE: CVE-2025-21222
Published: 2025-04-08
Description: Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21222
CVE: CVE-2025-24058
Published: 2025-04-08
Description: Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24058
CVE: CVE-2025-24060
Published: 2025-04-08
Description: Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24060
CVE: CVE-2025-24062
Published: 2025-04-08
Description: Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24062
CVE: CVE-2025-24073
Published: 2025-04-08
Description: Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24073
CVE: CVE-2025-24074
Published: 2025-04-08
Description: Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24074
CVE: CVE-2025-25002
Published: 2025-04-08
Description: Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25002
CVE: CVE-2025-26628
Published: 2025-04-08
Description: Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-522
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26628
CVE: CVE-2025-26635
Published: 2025-04-08
Description: Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1390
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26635
CVE: CVE-2025-26637
Published: 2025-04-08
Description: Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26637; http://seclists.org/fulldisclosure/2026/Feb/15
CVE: CVE-2025-26639
Published: 2025-04-08
Description: Integer overflow or wraparound in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26639
CVE: CVE-2025-26640
Published: 2025-04-08
Description: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-415, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26640
CVE: CVE-2025-26641
Published: 2025-04-08
Description: Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26641
CVE: CVE-2025-26642
Published: 2025-04-08
Description: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26642
CVE: CVE-2025-26644
Published: 2025-04-08
Description: Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to perform spoofing locally.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-1039
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26644
CVE: CVE-2025-26647
Published: 2025-04-08
Description: Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26647
CVE: CVE-2025-26648
Published: 2025-04-08
Description: Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26648
CVE: CVE-2025-26649
Published: 2025-04-08
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26649
CVE: CVE-2025-26651
Published: 2025-04-08
Description: Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-749
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26651
CVE: CVE-2025-26652
Published: 2025-04-08
Description: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26652
CVE: CVE-2025-26663
Published: 2025-04-08
Description: Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26663
CVE: CVE-2025-26664
Published: 2025-04-08
Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26664
CVE: CVE-2025-26665
Published: 2025-04-08
Description: Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26665
CVE: CVE-2025-26666
Published: 2025-04-08
Description: Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26666
CVE: CVE-2025-26667
Published: 2025-04-08
Description: Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26667
CVE: CVE-2025-26668
Published: 2025-04-08
Description: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26668
CVE: CVE-2025-26669
Published: 2025-04-08
Description: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26669
CVE: CVE-2025-26670
Published: 2025-04-08
Description: Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26670
CVE: CVE-2025-26671
Published: 2025-04-08
Description: Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26671
CVE: CVE-2025-26672
Published: 2025-04-08
Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26672
CVE: CVE-2025-26673
Published: 2025-04-08
Description: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26673
CVE: CVE-2025-26674
Published: 2025-04-08
Description: Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26674
CVE: CVE-2025-26675
Published: 2025-04-08
Description: Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26675
CVE: CVE-2025-26676
Published: 2025-04-08
Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26676
CVE: CVE-2025-26678
Published: 2025-04-08
Description: Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26678
CVE: CVE-2025-26679
Published: 2025-04-08
Description: Use after free in RPC Endpoint Mapper Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26679
CVE: CVE-2025-26680
Published: 2025-04-08
Description: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26680
CVE: CVE-2025-26681
Published: 2025-04-08
Description: Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26681
CVE: CVE-2025-26682
Published: 2025-04-08
Description: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26682
CVE: CVE-2025-26686
Published: 2025-04-08
Description: Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26686
CVE: CVE-2025-26687
Published: 2025-04-08
Description: Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26687
CVE: CVE-2025-26688
Published: 2025-04-08
Description: Stack-based buffer overflow in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26688
CVE: CVE-2025-27182
Published: 2025-04-08
Description: After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb25-23.html
CVE: CVE-2025-27183
Published: 2025-04-08
Description: After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb25-23.html
CVE: CVE-2025-27184
Published: 2025-04-08
Description: After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb25-23.html
CVE: CVE-2025-27185
Published: 2025-04-08
Description: After Effects versions 25.1, 24.6.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/after_effects/apsb25-23.html
CVE: CVE-2025-27186
Published: 2025-04-08
Description: After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb25-23.html