Summary
ABB is aware of public reports of vulnerabilities in third-party components (PHP and NTFS-3G) included in the product versions listed as affected in the advisory.
An attacker who successfully exploited these vulnerabilities may insert and run arbitrary code on affected products.
No active exploitations of the vulnerabilities have been reported to ABB by the time of writing this document. ABB will inform affected customers if this changes.
Vulnerabilities 10
-
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026 -
High 8.4
In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that a…
-
High 8.1
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows a…
-
High 7.8
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap…
-
High 7.7
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an…
-
High 7.4
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an at…
-
High 7.4
In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-3g/se…
-
High 7.1
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corr…
-
High 7.1
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to…
Revision history
-
#1
Initial version.
References
-
ABB CYBERSECURITY ADVISORY - PDF Version
https://search.abb.com/library/Download.aspx?DocumentID=4TLB000837&LanguageCode=en&DocumentPartId=&Action=Launch