CVE-2025-40139
in smc_clc_prfx_set(). vulnerability
MSRC advisory June 28, 2026
Alert details
- Source feed
- Microsoft MSRC
- CVE ID
- CVE-2025-40139
- Affected products
- in smc_clc_prfx_set(). · in in smc_clc_prfx_set(). · in
What happened
Information published.
What it means for your business
in smc_clc_prfx_set(). vulnerability (CVE-2025-40139) was added to Microsoft’s security update guidance. Information published. If you need help checking exposure, call (864) 335-9223.
Sources
Related briefs
sshd in OpenSSH before 10.4 vulnerability
In In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. (CVE-2026-59999) was added to Microsoft’s security update guidance. Information published. PremierePC tracks MSRC advisories for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
libexpat before 2.8.2 vulnerability
In In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. (CVE-2026-56132) was added to Microsoft’s security update guidance. Information published. PremierePC tracks MSRC advisories for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
libinput before 1.30.4 and 1.31.x before 1.31.3 vulnerability
In In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution (CVE-2026-50292) was added to Microsoft’s security update guidance. Information published. PremierePC tracks MSRC advisories for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
KDE KCoreAddons before 6.25 vulnerability
In In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection. (CVE-2026-41526) was added to Microsoft’s security update guidance. Information published. PremierePC tracks MSRC advisories for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
- Vendor:KDE
- Product:In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.