Edge type confusion hits CVSS 9.0, Parsec hands out SYSTEM for free

A type confusion bug in the Chromium engine powering Microsoft Edge lets an attacker run arbitrary code over the network. No authentication is needed. A user just has to visit a malicious page or be redirected to one, and the attacker gets code execution in the browser process.

Affected estate

Anyone managing Microsoft Edge deployments on desktops or endpoints

How to check

Open Edge, go to edge://settings/help to see the current version. Cross-reference against the Microsoft Security Response Center advisory for the patched build number.

Included because

unauthenticated; network-exploitable; CVSS 9.0; extremely common product

Action

Push the latest Edge stable update through your update management tool.

Why it matters

Unauthenticated network-based code execution in a browser used across most Windows fleets. CVSS 9.0.

Source

Microsoft Security Response Center

A race condition (TOCTOU) in Microsoft Edge for Android lets an attacker execute code over the network without authentication. The attacker needs to win a timing race, which adds some complexity, but successful exploitation gives them code execution on the device.

Affected estate

Anyone managing Android fleets where Microsoft Edge is deployed, including BYOD environments using Edge as a managed browser

How to check

Check the installed Edge version on managed Android devices through your MDM console or Google Play managed app inventory.

Included because

unauthenticated; network-exploitable; CVSS 7.5; widely deployed mobile browser

Action

Push the latest Edge for Android update through your MDM or flag it for user self-update.

Why it matters

Network-based code execution on mobile devices. Race condition adds complexity but CVSS 7.5 still warrants prompt action.

Source

Microsoft Security Response Center

This is a missing authentication bug in a hobbyist open-source PHP restaurant website template. The /admin/ajax_files endpoint is wide open to unauthenticated remote access. The exploit is already public. That said, this is not a commercial product. It's a GitHub project with no versioning and no vendor response.

Affected estate

Anyone who deployed the jairiidriss/restaurant-website-php-mysql GitHub project in a production or internet-facing environment

How to check

Search your web roots for the project's file structure or check git logs for the repository name. Look for exposed /admin/ajax_files paths.

Included because

unauthenticated; internet-facing; public exploit; low likelihood of presence in enterprise environments

Action

Block unauthenticated access to /admin/ajax_files at the web server or reverse proxy level. Consider pulling this project from production entirely.

Why it matters

Unauthenticated admin access with a public exploit, but this is an obscure open-source project unlikely to be in most environments.

GIMP's Paint Shop Pro (.psp) file parser has a heap buffer overflow. An attacker can craft a malicious PSP image that, when opened by a user, gives the attacker code execution or crashes GIMP. This requires user interaction: someone has to open the file. Low bit-depth images trigger the bad buffer size calculation.

Affected estate

Anyone running GIMP on workstations, especially in environments where users open image files from external or untrusted sources

How to check

Run 'gimp --version' or check the About dialog. Confirm whether the installed version includes the PSP parser fix per the GIMP release notes.

Included because

code execution via crafted file; CVSS 7.3; user interaction required; common open-source tool

Action

Update GIMP to the latest release. If a fix isn't available yet, block .psp file types at your email gateway and web proxy.

Why it matters

Opening a crafted image file gives an attacker code execution on the workstation. User interaction is required but social engineering with image files is straightforward.