PT-2026-41712 · Microsoft · Edge

CVE-2026-45495 · Published 2026-05-15 · Updated 2026-06-22

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Edge versions prior to 148.0.3967.70

Description A remote code execution issue exists in Microsoft Edge (Chromium-based) due to improper input validation within the browser's rendering pipeline and JavaScript engine. Specifically, the flaw involves directory traversal in the handling of feedback logs. An unauthenticated attacker can exploit this by enticing a user to visit a maliciously crafted webpage, leading to memory corruption, such as a buffer overflow, which allows the execution of arbitrary code with the privileges of the browser process. This issue can be combined with weak origin validation and cross-origin script injection to bypass the browser sandbox.

Recommendations Update to version 148.0.3967.70.

Fix

DoS

RCE

Buffer Overflow

Code Injection

Weakness Enumeration

CWE-35

CWE-20

CWE-119

CWE-94

Related Identifiers

BDU:2026-09757

CVE-2026-45495

ZDI-26-331

Affected Products

Edge

References · 15

• https://bdu.fstec.ru/vul/2026-09757 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45495 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-331 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45495 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45495 · Security Note
• https://twitter.com/The_Cyber_News/status/2062775094943068202 · Twitter Post
• https://t.me/CVEtracker/54155 · Telegram Post
• https://twitter.com/proofofpatch/status/2063639803862593709 · Twitter Post
• https://twitter.com/Maxprotectsoc/status/2062779159915741423 · Twitter Post
• https://twitter.com/threadlinqs/status/2063530333560004892 · Twitter Post
• https://twitter.com/UpwindMDR/status/2056642024997040545 · Twitter Post
• https://twitter.com/threadlinqs/status/2063529973793624350 · Twitter Post
• https://twitter.com/Tank23x0/status/2069163266434310581 · Twitter Post
• https://reddit.com/r/u_Opsec_Charlie/comments/1tyiegl/microsoft_edge_vulnerability_allows_remote · Reddit Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-45495 · Note