Pierluigi Paganini December 13, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Chromium and Sierra Wireless AirLink ALEOS flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added [1, 2] Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the flaws added to the catalog:

• CVE-2025-14174 Google Chromium Out-of-Bounds Memory Access Vulnerability;
• CVE-2018-4063 Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability;

CVE-2025-14174 is an out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110. A remote attacker can exploit the flaw to perform out of bounds memory access via a crafted HTML page.

This week Google released security updates to fix three vulnerabilities in the Chrome browser, including this high-severity flaw that threat actors are already exploiting in real-world attacks.

“Google is aware that an exploit for 466192044 exists in the wild,” reads the advisory published by Google.

Google tracked the high-severity vulnerability as Chromium issue 466192044, but the IT giant did not share technical details about the bug. A related GitHub commit, however, reveals the bug lies in the ANGLE graphics library, specifically its Metal renderer, where buffer sizes were incorrectly calculated using pixelsDepthPitch, derived from GL_UNPACK_IMAGE_HEIGHT. Because this value may be smaller than the actual image height, it can cause buffer overflows, leading to memory corruption, crashes, or potentially arbitrary code execution.

CVE-2018-4063 is a remote code execution flaw in Sierra Wireless AirLink ES450 FW 4.9.3 that affects the upload.cgi component. An authenticated attacker can send a crafted HTTP request to upload and execute malicious code on the device’s web server.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by January 2nd, 2026.

**Follow me on Twitter: @securityaffairs and Facebook and **Mastodon

Pierluigi Paganini

(SecurityAffairs** – hacking, Microsoft Patch Tuesday)**