PT-2026-41712 · Microsoft · Edge

Published 2026-05-15 · Updated 2026-05-19 · CVE-2026-45495

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Edge (Chromium-based) versions prior to 148.0.3967.70

Description An improper input validation flaw within the browser's rendering pipeline and JavaScript engine allows an unauthenticated attacker to execute arbitrary code with the privileges of the browser process. This is achieved by enticing a user to visit a maliciously crafted webpage, which leads to memory corruption, such as a buffer overflow (a condition where a program writes more data to a block of memory than it can hold, potentially overwriting adjacent memory).

Recommendations Update to version 148.0.3967.70.

Fix

RCE

Buffer Overflow

Code Injection

Weakness Enumeration

CWE-20

CWE-119

CWE-94

CWE-35

Related Identifiers

CVE-2026-45495

Affected Products

Edge

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-45495 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45495 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45495 · Vendor Advisory
• https://twitter.com/UpwindMDR/status/2056642024997040545 · Twitter Post
• https://t.me/CVEtracker/54155 · Telegram Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-45495 · Note