CVE-2026-60140
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.
Risk Assessment
The risk includes potential leakage of sensitive data and system downtime, which may impact business continuity and information security.
Recommendation
It is recommended to immediately update the Productivity Suite to the latest patched version and restrict local system access to trusted users only.
Other vulnerabilities in Productivity Suite
See all- CVE-2026-61378Medium
A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.
- CVE-2026-60073Medium
An out-of-bounds read vulnerability in Productivity Suite allows a physical attacker to control the length of data sent to a USB device, potentially causing a system crash or disclosure of kernel memory.
- CVE-2026-57896Medium
An out-of-bounds read vulnerability in Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.
- CVE-2026-61389High
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
- CVE-2026-60063High
An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.
Original NVD description (English source)
An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.