Microsoft, Adobe, Apple, and Foxit vulnerabilities

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed.

Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally.

When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is repeated after the form is reset. During this process, the application failed to adequately verify the validity of the form objects and their internal dictionary pointers, resulting in accessing internal members of invalid or improperly initialized fields. This led to an illegal pointer read, ultimately causing the application to crash.

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-80093 is a use-after-free memory-safety flaw (CWE-416) in the Windows Cloud Files Mini Filter Driver (cldflt.sys), the in-box kernel filesystem filter that backs cloud placeholder files via the Cloud Files API. An attacker who already holds valid low-privilege credentials on a host triggers the flaw through specific operations against cloud-files placeholders, causing the driver to reference freed kernel memory; the High attack-complexity rating indicates the required conditions do not line up trivially. A successful exploit elevates the attacker's privileges locally, granting full control of the affected machine with high impact to confidentiality, integrity, and availability — the flaw is not remotely exploitable on its own. Virtually every maintained Windows 10/11 and Windows Server deployment ships this driver, so any Windows host where untrusted users can run code is plausibly affected; the available data does not list specific affected builds, and fixes shipped in Microsoft's September 2026 Patch Tuesday. As of the data available there is no public PoC, the CVE is not in CISA KEV, and EPSS is low (0.3%, 28th percentile), indicating no confirmed exploitation in the wild; while the September 2026 release included two zero-days, whether this CVE is among them is not confirmed here.

Do: Apply Microsoft's September 2026 Windows cumulative security updates to all Windows 10/11 clients and Windows Servers, prioritizing multi-user hosts such as RDS/VDI servers, terminal servers, and shared workstations where local logon is common. Because exploitation requires valid local credentials, an interim mitigation is to restrict interactive logon, RDP, and local account creation to trusted users on unpatched hosts. After patching, verify on critical systems that the updated cldflt.sys file version from the September 2026 update is in place.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader where a specially crafted PDF can cause the application to access a released object during array processing, potentially leading to application crashes or arbitrary code execution. The vulnerability is based on CWE-416 and has a CVSS score of 7.8. It does not currently have a known public exploit or CISA KEV designation, indicating limited external impact and detection.

Do: Upgrade to the latest version of Foxit PDF Editor/Reader; enable strict sandboxing and memory protection; regularly audit and patch; monitor for unpatched installations.