Jann Horn

**Name of the Vulnerable Software and Affected Versions** ColdFusion versions 2025.9 ColdFusion versions 2023.20 and earlier **Description** An Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal, allows a security feature bypass. This issue enables an attacker to obtain limited read and write access to unauthorized files or directories located outside of the intended restrictions without requiring user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ColdFusion versions 2025.9 and earlier **Description** A reflected Cross-Site Scripting (XSS) issue allows an attacker to inject malicious scripts into a web page. This could lead to arbitrary code execution within the context of the current user. Successful exploitation requires user interaction, specifically that the victim opens a malicious link. **Recommendations** Update ColdFusion to a version later than 2025.9.

**Name of the Vulnerable Software and Affected Versions** Acrobat Reader versions 24.001.30365 through 26.001.21651 **Description** An out-of-bounds write issue exists where memory is written outside the intended boundary of a buffer. This could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically the opening of a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ColdFusion versions 2023.19 and earlier ColdFusion versions 2025.8 and earlier **Description** Improper Input Validation allows for arbitrary code execution in the context of the current user. This issue can be exploited without requiring any user interaction. **Recommendations** Update ColdFusion versions 2023.19 and earlier to a patched version. Update ColdFusion versions 2025.8 and earlier to a patched version.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Memory corruption occurs when processing display command line information. This issue is caused by the improper initialization of a variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A NULL dereference can occur in the USB-audio driver's Scarlett2 mixer quirk when processing a malformed USB descriptor. This happens because the `scarlett2 find fc interface()` function assumes an endpoint exists in the parsed interface without verification. **Recommendations** Apply the update that implements a sanity check for `bNumEndpoints` to skip invalid interfaces.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An out-of-bounds access exists in the `ceph handle auth reply()` function within libceph, triggered by a message of type 'CEPH MSG AUTH REPLY'. The issue occurs because the `payload len` field is stored as an integer; a value exceeding `INT MAX` causes an integer overflow, resulting in a negative value. This leads to the pointer address being decremented and subsequently accessed, as the `ceph decode need()` function only verifies that memory access does not exceed the allocation end address. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Framemaker versions prior to 2022.9 **Description** Improper Input Validation allows arbitrary file system read, which could enable an attacker to access sensitive files or data on the system. Exploitation requires user interaction, specifically that a victim opens a malicious file. **Recommendations** Update to a version newer than 2022.8.

**Name of the Vulnerable Software and Affected Versions** Adobe Framemaker versions 2022.8 and earlier **Description** An Untrusted Search Path issue exists where the application uses a search path to locate critical resources such as programs. An attacker could modify this search path to point to a malicious program, which the application would then execute, potentially allowing arbitrary code execution in the context of the current user. This exploitation does not require user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Framemaker versions 2022.8 and earlier **Description** An Access of Uninitialized Pointer issue exists, which could lead to memory exposure. This allows an attacker to disclose sensitive information, provided the victim opens a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Photoshop Desktop versions prior to 27.5 **Description** An out-of-bounds read occurs when parsing a crafted file, which can lead to a read past the end of an allocated memory structure. This issue allows an attacker to execute code within the context of the current user, provided the victim opens a malicious file. **Recommendations** Update to a version later than 27.4.

**Name of the Vulnerable Software and Affected Versions** ColdFusion versions 2023.18 and earlier ColdFusion versions 2025.6 and earlier **Description** An Uncontrolled Resource Consumption issue could lead to application denial-of-service. A high-privileged attacker can exhaust system resources, which reduces application speed. This exploitation does not require user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Framemaker versions prior to 2022.9 **Description** An out-of-bounds read occurs when parsing a crafted file, which can lead to a read past the end of an allocated memory structure. This issue allows an attacker to execute code within the context of the current user, provided the victim opens a malicious file. **Recommendations** Update to a version newer than 2022.8.

**Name of the Vulnerable Software and Affected Versions** Adobe Framemaker versions prior to 2022.9 **Description** An out-of-bounds write issue exists where the software writes data past the end of the intended buffer, which could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically requiring a victim to open a malicious file. **Recommendations** Update to a version newer than 2022.8.

**Name of the Vulnerable Software and Affected Versions** Adobe Connect versions 2025.3 and 12.10 and earlier **Description** An issue involving Deserialization of Untrusted Data allows for arbitrary code execution in the context of the current user. This flaw can be exploited without requiring any user interaction and results in a change of scope. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DNG SDK versions 1.7.1 2502 and earlier **Description** An out-of-bounds write issue exists where an attacker can corrupt memory, potentially leading to an application denial-of-service, causing the application to crash or become unresponsive. Exploitation requires user interaction, specifically requiring a victim to open a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** InDesign Desktop versions 20.5.2 and 21.2 and earlier **Description** A Heap-based Buffer Overflow (a condition where a program writes more data to a heap-allocated memory block than it can hold) could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically the opening of a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** InDesign Desktop versions 20.5.2 and 21.2 and earlier **Description** An out-of-bounds write occurs when a program writes data past the end of the intended buffer. This issue could result in arbitrary code execution in the context of the current user and requires user interaction, specifically the opening of a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Connect versions 2025.3 and 12.10 and earlier **Description** A reflected Cross-Site Scripting (XSS) issue exists where an attacker can convince a victim to visit a URL referencing a vulnerable page. This allows malicious JavaScript content to be executed within the context of the victim's browser. This issue involves a change in scope. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** InDesign Desktop versions 20.5.2 through 21.2 **Description** A Heap-based Buffer Overflow occurs when a program writes more data to a heap-allocated memory block than it can hold. This issue could result in arbitrary code execution in the context of the current user and requires user interaction, specifically the opening of a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.