Cisco published a placeholder advisory for the React vuln CVE-2025-55182. They have not finished analyzing any of their products yet so impact has not been determined.
A hearty middle finger ( and not in the fun way ) to vendors who still use the passive aggressive language in their advisories like "$vulnerableVendor would like to thank $researcher for reporting this vulnerability under responsible disclosure." Especially when you see that it was left vulnerable for a year or two before customers were even made available. Seems pretty irresponsible to me when the fix would be pushed sooner with full disclosure, but what do I know?
Security product vulns are maddening but will also never not be funny to me.
> Heap-based Buffer Overflow, Out-of-bounds Write vulnerability in Avast Antivirus on MacOS of a crafted Mach-O file may allow Local Execution of Code or Denial of Service of antivirus protection.\nThis issue affects Antivirus: from 15.7 before 3.9.2025.
https://www.cve.org/CVERecord?id=CVE-2025-10101
