CVE-2026-118274

MediumCVSS 4.3/10Last modified Nov 3, 2026

Description

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e. To fix this issue, it is recommended to deploy a patch.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400CWE-404

Affected software

VendorProductVersions
a2ui-projecta2ui0.10.0; 0.10.1; 0.10.2; 0.10.3; 0.10.4; 0.10.5; 0.10.6

References

Timeline

Published
Oct 28, 2026
Last modified
Nov 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1182755.3A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_cCVE-2026-1182763.5A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderersCVE-2026-1182778.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182788.8Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182798.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-118285.9IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of serCVE-2026-1182807.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182838.8Stack-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182887.0Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.CVE-2026-118296.5IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests.CVE-2026-1182928.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1182938.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118274: Medium severity, CVSS 4.3 | Vulnix