Microsoft Security Response Center

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Capability Consent Manager (camsvc service) allows an unauthorized attacker to elevate privileges locally.

**According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?** Successful exploitation of this vulnerability requires an attacker to invest time in repeated exploitation attempts through sending constant or intermittent data.

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.

**What actions do customers need to take to protect themselves from this vulnerability?** Customers who have disabled Automatic Extension Upgrades or would like to upgrade an extension immediately must manually update their Azure Monitor Agent to the latest version. For more information on how to perform a manual update, see Manage Azure Monitor Agent.

Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Microsoft Graphics Component allows an authorized attacker to execute code locally.