Critical vulnerabilities Week 2025-03-20

Critical Vulnerabilities pose a significant risk as they can be leveraged to carry out cyber attacks, install malware, steal sensitive data, or gain unauthorised access to systems. It's crucial for organisations and individuals to stay informed about the latest threats in order to assess their potential impact and take timely mitigating actions. If you need help with any of these, contact the HelpDesk for assistance. Cyber Security Services are also available.

Apple macOS MOV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (8.8)

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-24124.

Critical vulnerabilities Week 2025-03-20

Apple macOS MOV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (8.8)

Apple macOS ImageIO Pixel Conversion Out-Of-Bounds Read Information Disclosure Vulnerability (3.3)

Apple macOS WindowServer Denial-of-Service Vulnerability (3.3)

Apple macOS WindowServer Unchecked Input for Loop Condition Denial-of-Service Vulnerability (4.3)

Apple macOS MOV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (8.8)

Apple macOS ICC Profile Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (3.3)

Apple macOS libFontParser Glyph Mapping Out-Of-Bounds Read Information Disclosure Vulnerability (3.3)

Apple macOS ImageIO JPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (3.3)

Apple SceneKit Out-Of-Bounds Read Information Disclosure Vulnerability (3.3)

Autodesk AutoCAD MODEL File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD CATProduct File Parsing Uninitialized Variable Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD CATPART File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD MODEL File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD CATPRODUCT File Parsing Uninitialized Variable Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD CATProduct File Parsing Uninitialized Variable Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD MODEL File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD SLDPRT File Parsing Memory Corruption Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD MODEL File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD 3DM File Parsing Use-After-Free Remote Code Execution Vulnerability (7.8)

Autodesk AutoCAD SLDPRT File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (7.8)

Rockwell Automation Arena Simulation DOE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (7.8)

Progress Software Kemp LoadMaster mangle Stack-based Buffer Overflow Remote Code Execution Vulnerability (9.8)

Microsoft Windows MSC File Insufficient UI Warning Remote Code Execution Vulnerability (7)

Adobe Acrobat Reader DC AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability (7.8)

(0Day) Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability (7)

(0Day) NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability (7.8)

(0Day) NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability (7.8)

NVIDIA Riva Triton Inference Server Missing Authentication Vulnerability (7.3)

NVIDIA Riva gRPC API Missing Authentication for Critical Function Authentication Bypass Vulnerability (6.5)

X.Org Server ChangeWindowAttributes Use-After-Free Privilege Escalation Vulnerability (7.8)

X.Org Server XkbVModMaskText Stack-based Buffer Overflow Privilege Escalation Vulnerability (7.8)

X.Org Server XkbSizeKeySyms Heap-based Buffer Overflow Privilege Escalation Vulnerability (7.8)

X.Org Server XkbChangeTypesOfKey Heap-based Buffer Overflow Privilege Escalation Vulnerability (7.8)

X.Org Server CreatePointerBarrierClient Out-Of-Bounds Write Local Privilege Escalation Vulnerability (7.8)

X.Org Server compRedirectWindow Type Confusion Local Privilege Escalation Vulnerability (7.8)

X.Org Server PlayReleasedEvents Use-After-Free Local Privilege Escalation Vulnerability (7.8)

X.Org Server SyncInitTrigger Use-After-Free Local Privilege Escalation Vulnerability (7.8)

Adobe Acrobat Reader DC AcroForm Use of Uninitialized Variable Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (7.8)

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (7.8)

Siemens Simcenter Femap NEU File Parsing Memory Corruption Remote Code Execution Vulnerability (7.8)

PDF-XChange Editor RTF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (7.8)

NI G Web Development GWEBPROJECT File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability (7.8)

(0Day) (Pwn2Own) Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability (8.8)

(0Day) Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt CO File Parsing Buffer Overflow Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt VS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt VC6 File Parsing Type Confusion Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability (7.8)

(0Day) Ashlar-Vellum Cobalt VS File Parsing Use of Uninitialized Variable Remote Code Execution Vulnerability (7.8)

Ivanti Endpoint Manager Patch Unrestricted File Upload Remote Code Execution Vulnerability (7.8)

Autodesk Navisworks Freedom DWFX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (7.8)

Autodesk Navisworks Freedom DWFX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (7.8)

Trimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability (7.8)

SEW-EURODRIVE MOVITOOLS MotionStudio mticomp0 ICP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

Apache Pinot Improper Neutralization of Special Elements Authentication Bypass Vulnerability (9.8)

(Pwn2Own) HP LaserJet Pro MFP 3301fdw suidexec Command Injection Local Privilege Escalation Vulnerability (7.8)

(Pwn2Own) HP LaserJet Pro MFP 3301fdw PostScript File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (8.8)

(Pwn2Own) HP LaserJet Pro MFP 3301fdw PostScript File Parsing Type Confusion Remote Code Execution Vulnerability (8.8)

NI DAQExpress LVPROJECT File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability (7.8)

SolarWinds Platform TestWebsiteUrl Server-Side Request Forgery Information Disclosure Vulnerability (7.1)

(0Day) Delta Electronics ISPSoft CBDGL File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

(0Day) Delta Electronics ISPSoft DVP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

(0Day) Delta Electronics ISPSoft DVP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (7.8)

Linux Kernel ksmbd Session Setup Race Condition Remote Code Execution Vulnerability (9)

PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability (7.1)

Delta Electronics CNCSoft-G2 DPAX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (7.8)

PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability (7.1)

PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability (7.1)

Fortinet FortiWeb gui_upload_compress_act Command Injection Remote Code Execution Vulnerability (6.6)

Fortinet FortiWeb cgi_grpc_idl_file_post Command Injection Remote Code Execution Vulnerability (7.2)