CVE-2026-48372
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).
Risk Assessment
An attacker can achieve code execution on the victim's machine with the current user's privileges, potentially leading to malware installation or data theft.
Recommendation
Avoid opening files from untrusted sources and update Format Plugins to the latest patched version.
Other vulnerabilities in Format Plugins
See all- CVE-2026-48292High
Format Plugins versions 1.1.2 and earlier are affected by a heap-based buffer overflow vulnerability that could allow arbitrary code execution in the context of the current user. User interaction is required – opening a malicious file.
- CVE-2026-48291High
Format Plugins versions 1.1.2 and earlier are affected by a heap-based buffer overflow vulnerability that could allow arbitrary code execution in the context of the current user. User interaction is required – opening a malicious file.
- CVE-2025-61845Medium
Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this to disclose sensitive information stored in memory, requiring user interaction to open a malicious file.
- CVE-2025-61844Medium
Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2025-61843Medium
Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2025-61842Medium
Format Plugins versions 1.1.1 and earlier are affected by a Use After Free vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2025-61841Medium
Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive memory information. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2025-61840Medium
Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2025-61839High
Format Plugins versions 1.1.1 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2025-61838High
Format Plugins versions 1.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.
Original NVD description (English source)
Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

