Submit finding

All findings

CVE-2026-69325 high

MSRC credits Codex Security collaboration on JScript remote code execution

Microsoft directly credits Hung Nguyen of Calif.io in collaboration with OpenAI Codex Security on a JScript heap-buffer-overflow RCE.

Bug class
Heap buffer overflow leading to remote code execution
Affected codebase
Microsoft Windows JScript
Credited system
OpenAI Aardvark / Codex Security
Disclosed
September 8, 2026
Attribution
Direct source attribution
Severity
high
Source status: Microsoft's September 2026 CVRF acknowledgement explicitly names OpenAI Codex Security in the accepted CVE credit.

Summary

CVE-2026-69325 is an 8.1-rated JScript heap buffer overflow. Microsoft says an attacker can use it for remote code execution and directly credits Hung Nguyen of Calif.io in collaboration with OpenAI Codex Security.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.