https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 09:28:26 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-12067 <p>Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.</p> <p>The vulnerability spans multiple handler pathways in the RPC-based native message protocol:</p> <p>* Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.  * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception. * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.</p> <p>In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.</p> <p>Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.</p> <p>The vulnerability spans multiple handler pathways in the RPC-based native message protocol:</p> <p>* Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.  * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception. * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.</p> <p>In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.</p> https://db.gcve.eu/vuln/fkie_cve-2026-12067 https://db.gcve.eu/vuln/ghsa-fpp4-5g35-6qq3 <p>Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.</p> <p>The vulnerability spans multiple handler pathways in the RPC-based native message protocol:</p> <p>* Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.  * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception. * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.</p> <p>In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.</p> <p>Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.</p> <p>The vulnerability spans multiple handler pathways in the RPC-based native message protocol:</p> <p>* Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.  * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception. * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.</p> <p>In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.</p> https://db.gcve.eu/vuln/ghsa-fpp4-5g35-6qq3