CVE-2010-3970
HighSummary
W funkcji CreateSizedDIBSECTION w bibliotece shimgvw.dll występuje przepełnienie bufora na stosie, które dotyczy systemów Windows XP SP2 i SP3, Server 2003 SP2, Vista SP1 i SP2 oraz Server 2008 Gold i SP2. Atakujący zdalnie mogą wykonać dowolny kod poprzez spreparowany plik .MIC lub nieokreślony dokument Office zawierający bitmapę miniatury z ujemną wartością biClrUsed.
Risk Assessment
Podatność ta umożliwia zdalnym atakującym przejęcie kontroli nad systemem, co może prowadzić do poważnych konsekwencji dla bezpieczeństwa organizacji. Wykorzystanie tej luki może skutkować utratą danych lub nieautoryzowanym dostępem do systemów.
Recommendation
Zaleca się aktualizację systemów operacyjnych do najnowszych wersji oraz zastosowanie odpowiednich poprawek bezpieczeństwa. Należy również ograniczyć otwieranie nieznanych lub podejrzanych plików, szczególnie tych związanych z grafiką i dokumentami Office.
Related vulnerabilities
- CVE-2026-76461CriticalActively exploited
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway is due to insufficient validation in the parsing logic. An unauthenticated remote attacker could send a crafted email containing malicious SQL statements, potentially leading to execution of arbitrary SQL statements and command execution with root privileges on the underlying operating system.
- CVE-2026-76443Critical
The vulnerabilities tracked by CVE-2026-76443 relate to improper neutralization issues grouped under CWE Pillar CWE-707 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-76441Critical
The vulnerabilities tracked by CVE-2026-76441 relate to improper access control issues grouped under CWE Pillar CWE-284 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-76440Critical
The vulnerabilities tracked by CVE-2026-76440 relate to path traversal issues grouped under CWE Pillar CWE-23 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-20353Critical
The vulnerabilities tracked by CVE-2026-20353 relate to improper control of a resource through its lifetime grouped under CWE Pillar CWE-664 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
- CVE-2026-61534Critical
In the Yayson library for serializing and reading JSON API data in JavaScript, prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables. A document whose type is __proto__ causes model-cache writes to modify Object.prototype, with the attacker controlling the polluted property name through id and its value through attributes. This can result in process-wide prototype pollution, causing denial of service and logic corruption.
- CVE-2026-57145Critical
In PraisonAI, a multi-agent teams system, prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read or overwrite files.
- CVE-2026-57131Critical
In PraisonAI, a multi-agent teams system, prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs.
- CVE-2026-82435Critical
In Apache Storm before 3.1.0, a vulnerability exists: the Netty decoder is installed before authentication and processes frames without verification, allowing an unauthenticated attacker to allocate large buffers and potentially cause memory pressure on workers.
- CVE-2026-90961Critical
The LdapAuth and LinOTPAuth plugins in MISP contain an authentication bypass vulnerability. Missing input validation allows empty or non-string credentials to reach authentication logic, leading to unauthenticated LDAP binds (RFC 4513) or acceptance of empty passwords. This can allow an attacker to impersonate any known user without a password.
Original NVD description (English source)
Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor (aka graphics rendering engine) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted .MIC or unspecified Office document containing a thumbnail bitmap with a negative biClrUsed value, as reported by Moti and Xu Hao, aka "Windows Shell Graphics Processing Overrun Vulnerability."