PeopleSoft takeover exploited in the wild, plus a 9.1 CMS forgery bug in OpenSSL

A heap-based buffer overflow in the RevoDetector.sys kernel driver (used by Revo Uninstaller 2.5.x and 2.6.x) lets a local attacker escalate privileges through a crafted IOCTL call. Exploit code is publicly available. The attacker needs local access first, so this is a privilege escalation path, not a remote entry point.

Affected estate

Anyone with Revo Uninstaller 2.5.x or 2.6.x installed on Windows workstations

How to check

Search your software inventory or run 'Get-WmiObject Win32_Product | Where-Object { $_.Name -like "*Revo*" }' to find installed versions. Confirm the driver version of RevoDetector.sys in System32\drivers.

Included because

public exploit available; local privilege escalation; kernel driver vulnerability

Action

Upgrade to Revo Uninstaller 2.7.0 or remove the software if it's not needed.

Why it matters

A public exploit exists for local privilege escalation through this kernel driver, giving attackers a quick path from user to SYSTEM.

A heap buffer overflow in SQLite's FTS5 full-text search engine (in the fts5ChunkIterate function) can be triggered when processing crafted FTS5 queries. This could lead to code execution in any application that embeds SQLite and allows user-supplied FTS5 queries. The fix landed in SQLite 3.53.2.

Affected estate

Anyone running SQLite before 3.53.2, including Azure Linux 3.0 users on the sqlite 3.44.0-3 package and any app that bundles an older SQLite with FTS5 enabled

How to check

Run 'sqlite3 --version' on your hosts. For Azure Linux, run 'tdnf list installed sqlite' to check the package version.

Included because

common embedded library; heap overflow with potential code execution; widely deployed

Action

Update to SQLite 3.53.2 or the latest patched Azure Linux package.

Why it matters

SQLite is embedded everywhere. If your app accepts user-driven FTS5 queries, this heap overflow is reachable and could lead to code execution.

Source

NVD

A flaw in CMS AuthEnvelopedData processing lets an attacker forge messages that appear valid. This affects OpenSSL, Node.js, QEMU, EDK2, and cloud-hypervisor on Azure Linux 3.0. With a CVSS of 9.1, a successful attack could break message authenticity and confidentiality for anything relying on CMS enveloped data.

Affected estate

Azure Linux 3.0 users running OpenSSL 3.3.5-5, Node.js 24.14.1-3, QEMU 9.1.0-7, EDK2 20240524-17, or cloud-hypervisor 51.1.56-1, plus anyone using OpenSSL builds with CMS AuthEnvelopedData support

How to check

Run 'openssl version' and 'tdnf list installed openssl nodejs qemu edk2 cloud-hypervisor' on Azure Linux hosts. Check for the specific vulnerable package versions listed above.

Included because

CVSS 9.1; affects core crypto library (OpenSSL); multiple dependent packages; message forgery risk

Action

Run 'tdnf update openssl nodejs qemu edk2 cloud-hypervisor' on Azure Linux 3.0 hosts. For other distros, update OpenSSL to the patched release.

Why it matters

Forged CMS messages can bypass authenticity checks, which undermines trust in signed or encrypted payloads across your infrastructure.

Source

NVD

Zoom Workplace on Android (before 7.0.4) and iOS (before 7.0.3) has an authorization bug in its custom URL scheme handler. An unauthenticated attacker on the network can trick a user into opening a crafted link, which escalates privileges within the Zoom app. This requires some user interaction (tapping a link), but no credentials are needed on the attacker's side.

Affected estate

Anyone with Zoom Workplace installed on managed Android or iOS devices, especially in BYOD or MDM-managed fleets

How to check

Query your MDM for Zoom Workplace app versions across managed devices, or check app version in Zoom > Settings > About on individual devices.

Included because

unauthenticated; network-accessible; CVSS 8.1; privilege escalation on mobile; widely deployed app

Action

Push Zoom Workplace 7.0.4 (Android) and 7.0.3 (iOS) or later through your MDM or app update policy.

Why it matters

An attacker on the same network can use a crafted URL to escalate privileges on a user's device through the Zoom app, no login required.

Source

Zoom Security Bulletin