Jongseong Kim

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server 2016 CU23 Microsoft Exchange Server 2019 CU14 Microsoft Exchange Server 2019 CU15 Microsoft Exchange Server SE **Description** Microsoft Exchange Server contains a Server-Side Request Forgery (SSRF) flaw, which occurs when a server fails to properly validate requests. This allows an authorized mailbox user to force the server to make HTTP requests to internal networks, enabling internal network reconnaissance and the disclosure of sensitive information from internal HTTP services. The issue stems from the fact that intranet address validation is gated on the `isBposUser` variable, which is always `false` for on-premises installations, causing them to skip the security check entirely. Exploitation is achieved via a SOAP request to the EWS InstallApp endpoint using a crafted `ManifestUrl` parameter. **Recommendations** Update Microsoft Exchange Server 2016 CU23 to the June 2026 SU. Update Microsoft Exchange Server 2019 CU14 to the June 2026 SU. Update Microsoft Exchange Server 2019 CU15 to the June 2026 SU. Update Microsoft Exchange Server SE to the June 2026 SU.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server (affected versions not specified) **Description** Microsoft Exchange Server contains a server-side request forgery (SSRF) issue, which occurs when a server fails to properly validate requests. This allows an authorized attacker to perform spoofing over a network. Additionally, incorrect input neutralization during the generation of web pages may lead to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, further enabling identity spoofing. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Kernel (affected versions not specified) **Description** A heap-based buffer overflow in the Windows Kernel allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when a program writes more data to a heap-allocated memory block than it can hold, potentially leading to memory corruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Search Component (affected versions not specified) **Description** A use after free issue in the Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Kernel (affected versions not specified) **Description** A stack-based buffer overflow in the Windows Kernel allows an authorized attacker to elevate privileges locally. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows versions (affected versions not specified) **Description** A use-after-free issue exists in the Broadcast DVR component. Exploitation of this issue could allow an authorized attacker to elevate privileges locally. The issue involves improper memory management within the Broadcast DVR service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Management Services (affected versions not specified) **Description** A flaw exists in Windows Management Services that could allow an authorized attacker to elevate privileges locally due to a race condition during concurrent execution using a shared resource with improper synchronization. This issue allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Capability Access Management Service (camsvc) (affected versions not specified) **Description** An out-of-bounds read exists in the Capability Access Management Service (camsvc). A local attacker who is authorized can exploit this to disclose information. The issue allows attackers to obtain sensitive information and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Bluetooth Service (affected versions not specified) Description: A use-after-free issue exists in the Windows Bluetooth Service that could allow an authorized attacker to gain elevated privileges locally. This issue allows attackers to affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows versions (affected versions not specified) Description: A use after free issue exists in Windows PrintWorkflowUserSvc, potentially allowing an authorized attacker to gain elevated privileges locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to a null pointer dereference in Windows Drivers, allowing an unauthorized attacker to elevate privileges locally. This could potentially affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Digital Media (affected versions not specified) Description: The issue is related to a use after free condition in Windows Digital Media, allowing an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Digital Media (affected versions not specified) Description: The issue is related to a use after free condition in Windows Digital Media, allowing an authorized attacker to elevate privileges locally. This elevation-of-privilege vulnerability enables attackers to affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Virtual Hard Drive (affected versions not specified) Description: The issue is related to a stack-based buffer overflow that allows an authorized attacker to elevate privileges locally. This elevation-of-privilege vulnerability can be exploited by attackers to affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Resilient File System (ReFS) Deduplication Service (affected versions not specified) Description: The issue is related to an elevation of privilege vulnerability in the Windows Resilient File System (ReFS) Deduplication Service. It is caused by a memory reuse error. Exploitation of this issue may allow an attacker to elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Resilient File System (ReFS) Deduplication Service (affected versions not specified) Description: The issue is related to an elevation of privilege vulnerability in the Windows Resilient File System (ReFS) Deduplication Service. It is caused by a memory reuse error, which can be exploited to allow an attacker to elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iPadOS versions prior to 17.7.4 macOS Ventura versions prior to 13.7.3 macOS Sonoma versions prior to 14.7.3 visionOS versions prior to 2.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 macOS Sequoia versions prior to 15.3 watchOS versions prior to 11.3 tvOS versions prior to 18.3 **Description** The issue was addressed with improved memory handling. Processing an image may lead to a denial-of-service. The vulnerability is related to incorrect cleanup or release of resources in the Image Handler component of the operating systems. **Recommendations** For iPadOS versions prior to 17.7.4, update to iPadOS 17.7.4 or later. For macOS Ventura versions prior to 13.7.3, update to macOS Ventura 13.7.3 or later. For macOS Sonoma versions prior to 14.7.3, update to macOS Sonoma 14.7.3 or later. For visionOS versions prior to 2.3, update to visionOS 2.3 or later. For iOS versions prior to 18.3, update to iOS 18.3 or later. For iPadOS versions prior to 18.3, update to iPadOS 18.3 or later. For macOS Sequoia versions prior to 15.3, update to macOS Sequoia 15.3 or later. For watchOS versions prior to 11.3, update to watchOS 11.3 or later. For tvOS versions prior to 18.3, update to tvOS 18.3 or later.

**Name of the Vulnerable Software and Affected Versions** Windows PrintWorkflowUserSvc (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in the Windows PrintWorkflowUserSvc service, which is caused by insufficient input validation. This vulnerability can be exploited by attackers to gain elevated access to the system, potentially affecting a large number of Internet users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows PrintWorkflowUserSvc (affected versions not specified) **Description** The issue is related to an elevation-of-privilege vulnerability in the Windows PrintWorkflowUserSvc service. This vulnerability is caused by insufficient input validation, which can be exploited by an attacker to gain elevated privileges on the system. There is no information available about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows PrintWorkflowUserSvc (affected versions not specified) Description: The issue is related to an elevation of privilege vulnerability in the Windows PrintWorkflowUserSvc. It is associated with the use of memory after it has been freed. Exploitation of this issue may allow an attacker to elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.