Memory corruption vulnerability in Microsoft Edge; MilesightVPN and router could be taken over
Summary: Cisco Talos published 40 vulnerability advisories since the start of July, including a memory corruption flaw in the Adobe Acrobat PDF engine used by Microsoft Edge (TALOS-2023-1747/CVE-2023-36887) that affects Edge versions 112.0.1722.58 and 114.0.1776.0 Canary and can be triggered by opening a crafted PDF, causing a type confusion that allows writes to arbitrary memory. Talos also released 22 advisories on Milesight products, nine scoring above 8 on CVSS across 69 CVEs, after Milesight did not respond during the 90-day disclosure period.
What's compelling: A crafted PDF opened in Edge was enough to reach arbitrary memory writes, and Microsoft's patch landed July 13 - so any endpoint still on the affected builds is exposed to a file that looks routine. On the Milesight side, 69 CVEs with no vendor fix mean the UR32L router and MilesightVPN can be chained into full compromise with nothing to patch against.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-27390CVE-2023-31194CVE-2023-36887
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026