SB20260812226 - Multiple vulnerabilities in Microsoft Windows

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260812226

SB20260812226 - Multiple vulnerabilities in Microsoft Windows

Published: August 12, 2026

Security Bulletin ID SB20260812226
CSH Severity
High
Patch available
YES
Number of vulnerabilities 142
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 10% Medium 10% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 142 vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: CVE-2026-50472)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows LUAFV when handling local operations. A local user can trigger the flaw to escalate privileges.

Successful exploitation requires winning a race condition and could result in SYSTEM privileges.


2) Command injection (CVE-ID: CVE-2026-49179)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to command injection in the NSPI RPC interface in Windows Active Directory Domain Services when handling crafted inputs from a client connection to a malicious server. A remote attacker can provide crafted inputs to execute arbitrary code.


3) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-6727)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to observable timing discrepancy in TPM 2.0 RSA OAEP secret decryption when modifying the encrypted secret and observing precise decryption timing. A remote attacker can perform repeated crafted decryption attempts and measure timing differences to disclose sensitive information.

Exploitation requires the ability to modify the stored encrypted secret and to accurately observe precise timing across many decryption attempts in order to infer the original secret.


4) Integer overflow (CVE-ID: CVE-2026-59127)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to integer overflow or wraparound in Windows Installer when processing installer operations locally. A local user can trigger the flaw to elevate privileges.

Successful exploitation could result in SYSTEM privileges.


5) Observable discrepancy (CVE-ID: CVE-2026-59130)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a side-channel weakness in AMD Zen when decrypting persisted encrypted secrets using specific old cryptography and Windows APIs. A local user can modify an encrypted secret and observe precise decryption timing across many attempts to disclose sensitive information.

Exploitation requires targeting an application that persists encrypted secrets and relies on specific old cryptography and Windows APIs.


6) Weak Authentication (CVE-ID: CVE-2026-59135)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to weak authentication in Microsoft Windows Search Component when handling local access to search functionality. A local user can access the component with insufficient authentication checks to disclose sensitive information.

The disclosed information includes file path information from the file system.


7) Heap-based buffer overflow (CVE-ID: CVE-2026-59134)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Remote Desktop Client when handling Remote Desktop Protocol content over a network. A remote attacker can send specially crafted protocol data to execute arbitrary code.

User interaction is required, and successful exploitation depends on specific protocol settings or configurations being in place.


8) Use-after-free (CVE-ID: CVE-2026-61348)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Ancillary Function Driver for WinSock when handling local system calls. A local user can trigger a race condition to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


9) Buffer over-read (CVE-ID: CVE-2026-61350)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to buffer over-read in Windows NTFS when parsing crafted NTFS data. An attacker with physical access can supply crafted input to disclose sensitive information.

Successful exploitation can leak one byte of kernel memory.


10) Missing Authentication for Critical Function (CVE-ID: CVE-2026-61356)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to missing authentication for critical function in Windows Remote Desktop Services when invoking a critical function locally. A local user can access the vulnerable functionality to elevate privileges.

Successful exploitation could grant SYSTEM privileges.


11) Missing Authentication for Critical Function (CVE-ID: CVE-2026-61367)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to missing authentication for critical function in Windows Remote Desktop Services when invoking a critical function locally. A local user can access the vulnerable function without proper authentication to elevate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


12) Incorrect authorization (CVE-ID: CVE-2026-61925)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to incorrect authorization in Windows Installer when performing local actions through the installer service. A local user can exploit the authorization flaw to elevate privileges.

Successful exploitation could result in SYSTEM privileges.


13) Cleartext storage of sensitive information (CVE-ID: CVE-2026-61928)

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to perform tampering.

The vulnerability exists due to cleartext storage of sensitive information in Windows Hello when storing sensitive information locally. A local user can access improperly protected data to perform tampering.

This could allow unauthorized modifications to protected system data and alter system state or configuration beyond normal privileges.


14) Heap-based buffer overflow (CVE-ID: CVE-2026-62692)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Remote Desktop Services when handling local input. A local user can trigger the overflow to escalate privileges.

Successful exploitation could grant SYSTEM privileges.


15) Missing Authorization (CVE-ID: CVE-2026-61936)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to bypass a security feature.

The vulnerability exists due to missing authorization in Windows Defender Firewall Service when handling access to a sensitive debugging interface. A local user can access the restricted interface to bypass a security feature.

The issue can let a standard authenticated user access debugging functionality intended only for administrators.


16) Use-after-free (CVE-ID: CVE-2026-61939)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Winlogon when handling local logon operations. A local user can win a race condition to escalate privileges.

Successful exploitation requires winning a race condition. An attacker who successfully exploits the issue could gain SYSTEM privileges.


17) Heap-based buffer overflow (CVE-ID: CVE-2026-62695)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Storage when handling local operations. A local user can trigger the vulnerable condition to escalate privileges.

Successful exploitation could lead to SYSTEM privileges.


18) Heap-based buffer overflow (CVE-ID: CVE-2026-62688)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows MIDI Service Module when handling crafted local input. A local user can trigger the overflow to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


19) Race condition (CVE-ID: CVE-2026-62690)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications when handling concurrent operations on a shared resource. A local user can trigger a race condition to escalate privileges.

Successful exploitation requires winning a race condition and may lead to SYSTEM privileges.


20) Race condition (CVE-ID: CVE-2026-62693)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to concurrent execution using shared resource with improper synchronization ('race condition') in Windows MIDI Service Module when executing concurrently on a shared resource. A local user can win a race condition to escalate privileges.

Successful exploitation requires winning a race condition and may result in SYSTEM privileges.


21) Heap-based buffer overflow (CVE-ID: CVE-2026-62712)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Win32K when handling local operations. A local user can trigger the flaw to elevate privileges.

Successful exploitation could result in SYSTEM privileges.


22) Heap-based buffer overflow (CVE-ID: CVE-2026-62719)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Message Queuing when processing local requests. A local user can trigger the flaw to escalate privileges.

Successful exploitation could grant SYSTEM privileges.


23) Buffer over-read (CVE-ID: CVE-2026-62746)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to buffer over-read in Windows Win32K when processing crafted local input. A local user can trigger the over-read to disclose sensitive information.

Successful exploitation could leak one byte of kernel memory.


24) Heap-based buffer overflow (CVE-ID: CVE-2026-62747)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Device Association Service when processing local input. A local user can trigger the overflow to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


25) Partial String Comparison (CVE-ID: CVE-2026-62750)

CWE-ID: CWE-187 - Partial String Comparison

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify protected system data.

The vulnerability exists due to partial string comparison in Windows HTTP Protocol Stack when handling network requests over an adjacent network. A remote attacker can send a specially crafted request to modify protected system data.

This could allow alteration of system state or configuration beyond normal privileges.


26) Heap-based buffer overflow (CVE-ID: CVE-2026-62754)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Kerberos when handling local Kerberos operations. A local user can trigger the overflow to elevate privileges.

Successful exploitation could result in SYSTEM privileges.


27) Heap-based buffer overflow (CVE-ID: CVE-2026-62783)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Remote Access Connection Manager when handling local operations. A local user can trigger the heap-based buffer overflow to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


28) Heap-based buffer overflow (CVE-ID: CVE-2026-62758)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Remote Access Connection Manager when handling local operations. A local user can trigger the flaw to escalate privileges.

Successful exploitation could grant SYSTEM privileges.


29) Double free (CVE-ID: CVE-2026-62766)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to double free in Windows Kerberos when handling local Kerberos operations. A local user can win a race condition to escalate privileges.

Successful exploitation requires winning a race condition and may result in SYSTEM privileges.


30) Use-after-free (CVE-ID: CVE-2026-62773)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Kerberos when handling local authentication operations. A local user can trigger a race condition to escalate privileges.

Successful exploitation requires winning a race condition and may result in SYSTEM privileges.


31) Heap-based buffer overflow (CVE-ID: CVE-2026-62772)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) when handling local operations. A local user can trigger the flaw to escalate privileges.

Successful exploitation could allow an attacker to gain SYSTEM privileges.


32) Heap-based buffer overflow (CVE-ID: CVE-2026-62785)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol when processing a server response. A remote attacker can host a malicious server and convince a user to connect to it to execute arbitrary code.

User interaction is required to connect to a malicious server.


33) Missing Authentication for Critical Function (CVE-ID: CVE-2026-62777)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to missing authentication for critical function in Windows License Manager when invoking a critical function locally. A local user can invoke the exposed function to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


34) Use-after-free (CVE-ID: CVE-2026-62779)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to use-after-free in Windows Schannel when handling local requests. A local user can trigger the flaw to elevate privileges.

Successful exploitation could result in SYSTEM privileges.


35) Heap-based buffer overflow (CVE-ID: CVE-2026-62784)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) when handling a specially crafted request over the network. A remote user can send a specially crafted request to execute arbitrary code.


36) Untrusted Pointer Dereference (CVE-ID: CVE-2026-62798)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to untrusted pointer dereference in Windows Win32K when handling crafted local input. A local user can trigger the dereference to disclose sensitive information.

Successful exploitation can leak one byte of kernel memory.


37) Use-after-free (CVE-ID: CVE-2026-62795)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows LDAP - Lightweight Directory Access Protocol when processing a server response after a user connects to a malicious server. A remote attacker can host a malicious server and return a specially crafted response to execute arbitrary code.

User interaction is required to initiate the connection to the malicious server from an affected client.


38) Out-of-bounds read (CVE-ID: CVE-2026-62796)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Windows NTFS when processing file system data. A local user can trigger the flaw to disclose sensitive information.

Successful exploitation can leak one byte of kernel memory.


39) Heap-based buffer overflow (CVE-ID: CVE-2026-62797)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows NTFS when handling local file system operations. A local user can trigger the flaw to escalate privileges.

Successful exploitation could grant SYSTEM privileges.


40) Use-after-free (CVE-ID: CVE-2026-62815)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft QUIC when handling specially crafted network packets. A remote attacker can send a specially crafted packet to execute arbitrary code.


41) Heap-based buffer overflow (CVE-ID: CVE-2026-62816)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) when handling specially crafted network packets over an adjacent network. A remote attacker can send a specially crafted packet to execute arbitrary code.

No authentication or user interaction is required.


42) Use-after-free (CVE-ID: CVE-2026-62818)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to use-after-free in Active Directory Certificate Services (AD CS) when handling a specially crafted request over the network. A remote user can send a specially crafted request to execute arbitrary code.


43) Use-after-free (CVE-ID: CVE-2026-62819)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Routing and Remote Access Service (RRAS) when handling specially crafted network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.


44) Out-of-bounds read (CVE-ID: CVE-2026-62876)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to out-of-bounds read in Windows Win32K when handling local Win32K operations. A local user can trigger the out-of-bounds read to escalate privileges.

Successful exploitation could allow acquisition of SYSTEM privileges.


45) Stack-based buffer overflow (CVE-ID: CVE-2026-62877)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to stack-based buffer overflow in Windows Win32K when handling local crafted input. A local user can trigger the flaw to elevate privileges.

Successful exploitation could grant SYSTEM privileges.


46) Double free (CVE-ID: CVE-2026-62889)

CWE-ID: CWE-415 - Double Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to double free in Windows Secure Socket Tunneling Protocol (SSTP) when handling specially crafted network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

Successful exploitation requires winning a race condition.


47) Heap-based buffer overflow (CVE-ID: CVE-2026-62890)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Windows GDI+ when processing crafted input locally. A local user can trigger the flaw to execute arbitrary code.

Successful exploitation could result in SYSTEM privileges.


48) Use-after-free (CVE-ID: CVE-2026-62892)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Capability Access Management Service (camsvc) when handling local requests. A local user can trigger a race condition to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


49) Use-after-free (CVE-ID: CVE-2026-62893)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Deployment Services TFTP Server when handling specially crafted network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.


50) Race condition (CVE-ID: CVE-2026-62908)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine when performing concurrent local operations. A local user can win a race condition to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


51) Out-of-bounds read (CVE-ID: CVE-2026-65662)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Windows GDI when processing a specially crafted Enhanced Metafile (EMF). A local user can provide a specially crafted EMF to disclose sensitive information.

The disclosed data is limited to small portions of adjacent memory from the affected application at the time the file is processed.


52) Heap-based buffer overflow (CVE-ID: CVE-2026-65671)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Remote Access API when handling local API calls. A local user can trigger the overflow to escalate privileges.

Successful exploitation could allow access to SYSTEM privileges.


53) Heap-based buffer overflow (CVE-ID: CVE-2026-65672)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Remote Access API when handling local API calls. A local user can trigger the flaw to elevate privileges.

Successful exploitation could lead to SYSTEM privileges.


54) Use-after-free (CVE-ID: CVE-2026-65678)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Win32K when handling a specific operation that triggers a memory allocation failure. A local user can trigger the use-after-free condition to escalate privileges.

Successful exploitation could grant SYSTEM privileges.


55) Out-of-bounds read (CVE-ID: CVE-2026-65784)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Windows NTFS when processing file system data locally. A local user can trigger the vulnerable code path to disclose sensitive information.

A small amount of kernel memory may be leaked back to the attacker.


56) Heap-based buffer overflow (CVE-ID: CVE-2026-65786)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to heap-based buffer overflow in Desktop Window Manager when handling local input. A local user can trigger the overflow to elevate privileges.

Successful exploitation could lead to SYSTEM privileges.


57) Heap-based buffer overflow (CVE-ID: CVE-2026-65787)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Desktop Window Manager when handling local operations. A local user can trigger the heap-based buffer overflow to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


58) Use-after-free (CVE-ID: CVE-2026-65788)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Desktop Window Manager when handling window manager operations. A local user can win a race condition to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


59) Heap-based buffer overflow (CVE-ID: CVE-2026-65814)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Storage Port Driver when handling local input. A local user can trigger the overflow to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


60) Heap-based buffer overflow (CVE-ID: CVE-2026-66799)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Key Guard when handling local operations. A local user can trigger the overflow to escalate privileges.

Successful exploitation could grant Virtual Trust Level 1 (VTL1) privileges.


61) Buffer over-read (CVE-ID: CVE-2026-68819)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to buffer over-read in Windows Network File System when handling network requests. A remote attacker can send a specially crafted request to cause a denial of service.


62) Use-after-free (CVE-ID: CVE-2026-70307)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Ancillary Function Driver for WinSock when handling local requests. A local user can trigger a race condition to escalate privileges.

Successful exploitation could grant SYSTEM privileges.


63) Heap-based buffer overflow (CVE-ID: CVE-2026-70304)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows DNS when processing local input. A local privileged user can trigger the overflow to escalate privileges.

Successful exploitation could lead to SYSTEM privileges.


64) Heap-based buffer overflow (CVE-ID: CVE-2026-70330)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows DNS when handling local input. A local privileged user can trigger the overflow to escalate privileges.

Successful exploitation could lead to SYSTEM privileges.


65) Race condition (CVE-ID: CVE-2026-61352)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client when handling remote desktop connections. A remote attacker can win a race condition during network-based interaction to execute arbitrary code.

User interaction is required.


66) Use-after-free (CVE-ID: CVE-2026-65783)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Autopilot when handling local operations. A local user can trigger a race condition to escalate privileges.

Successful exploitation requires winning a race condition and may result in SYSTEM privileges.


67) Improper access control (CVE-ID: CVE-2026-66804)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to improper access control in Windows Cross Device Service when handling local access to the service. A local user can exploit the access control weakness to elevate privileges.

Successful exploitation could result in SYSTEM privileges.


68) Stack-based buffer overflow (CVE-ID: CVE-2026-70344)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to stack-based buffer overflow in Windows Installer when processing local installer operations. A local user can trigger the flaw to escalate privileges.

Successful exploitation could grant SYSTEM privileges.


69) Heap-based buffer overflow (CVE-ID: CVE-2026-70345)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Installer when processing local installer operations. A local user can trigger the vulnerable functionality to elevate privileges.

Successful exploitation could grant SYSTEM privileges.


70) Stack-based buffer overflow (CVE-ID: CVE-2026-70346)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to stack-based buffer overflow in Windows Installer when processing local operations. A local user can trigger the flaw to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


71) Heap-based buffer overflow (CVE-ID: CVE-2026-70347)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Installer when handling local installation operations. A local user can trigger the vulnerable functionality to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


72) Link following (CVE-ID: CVE-2026-70348)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper link resolution before file access ('link following') in Windows Management Services when accessing files. A local user can leverage crafted link targets to cause a denial of service.


73) Link following (CVE-ID: CVE-2026-72971)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to modify files.

The vulnerability exists due to improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) when accessing files through links. A local user can create a link to a target file to modify files.


74) Missing Authentication for Critical Function (CVE-ID: CVE-2026-42976)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to missing authentication for a critical function in the Windows RPC API when invoking the Remote Access Management service/API RPC server. A local user can call a critical function without proper authentication to escalate privileges.

Successful exploitation could grant SYSTEM privileges.


75) Type Confusion (CVE-ID: CVE-2026-6726)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to spoof a trusted platform module identity.

The vulnerability exists due to access of resource using incompatible type in the TPM 2.0 reference implementation when reusing object slots. A local privileged user can trigger improper object-slot reuse to spoof a trusted platform module identity.

The issue affects the vTPM scenario.


76) Use-after-free (CVE-ID: CVE-2026-59125)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to use-after-free in Virtual Hard Disk (VHD) Miniport Driver when handling local operations. A local user can trigger a race condition to elevate privileges.

Successful exploitation requires winning a race condition and may result in SYSTEM privileges.


77) Observable discrepancy (CVE-ID: CVE-2026-59131)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a cryptographic side-channel weakness in AMD Zen when decrypting attacker-modified encrypted secrets using specific old cryptography and Windows APIs. A local user can modify a stored encrypted secret and observe precise decryption timing across many attempts to disclose sensitive information.

Exploitation requires the ability to persist encrypted secrets and relies on repeated decryption attempts to infer the original secret.


78) Use-after-free (CVE-ID: CVE-2026-61349)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Work Folder Service when handling local operations. A local user can trigger the use-after-free condition to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


79) Heap-based buffer overflow (CVE-ID: CVE-2026-61363)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Remote Desktop Client when handling remote desktop protocol content. A remote attacker can send specially crafted network data to execute arbitrary code.

User interaction is required, and successful exploitation depends on specific protocol settings or configurations.


80) Heap-based buffer overflow (CVE-ID: CVE-2026-61359)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Storage when handling local operations. A local user can trigger the vulnerable component to escalate privileges.

Successful exploitation could allow acquisition of SYSTEM privileges.


81) Heap-based buffer overflow (CVE-ID: CVE-2026-61355)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Sensor Data Service when handling sensor data service operations. A local user can trigger a heap-based buffer overflow to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


82) Missing Authentication for Critical Function (CVE-ID: CVE-2026-61364)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to missing authentication for critical function in Windows Remote Desktop Services when invoking a critical function locally. A local user can trigger the vulnerable functionality to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


83) Missing Authentication for Critical Function (CVE-ID: CVE-2026-61365)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to missing authentication for critical function in Windows Remote Desktop Services when invoking a critical function locally. A local user can invoke the vulnerable function to elevate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


84) Use-after-free (CVE-ID: CVE-2026-61357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Application Information Services when handling local requests. A local user can trigger the flaw to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


85) Link following (CVE-ID: CVE-2026-61358)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to improper link resolution before file access ('link following') in Windows Accessibility Infrastructure (ATBroker.exe) when accessing files through links. A local user can create a crafted link to elevate privileges.

Successful exploitation could grant SYSTEM privileges.


86) Untrusted Pointer Dereference (CVE-ID: CVE-2026-61360)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to untrusted pointer dereference in Windows GDI when processing crafted local input. A local user can trigger the vulnerable code path to disclose sensitive information.

A successful exploit could leak one byte of kernel memory.


87) Use-after-free (CVE-ID: CVE-2026-61938)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Installer when handling local installer operations. A local user can win a race condition to escalate privileges.

Successful exploitation could allow access to SYSTEM privileges.


88) Numeric Truncation Error (CVE-ID: CVE-2026-62698)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to numeric truncation error in Microsoft Digest Authentication when handling authentication operations locally. A local user can exploit the truncation flaw to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


89) Heap-based buffer overflow (CVE-ID: CVE-2026-62700)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows NTFS when processing crafted local operations. A local user can trigger the flaw to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


90) Use of uninitialized resource (CVE-ID: CVE-2026-62709)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in Windows GDI+ when processing graphics content. A local user can trigger the vulnerable functionality to disclose sensitive information.

Successful exploitation could disclose uninitialized heap memory.


91) Heap-based buffer overflow (CVE-ID: CVE-2026-62710)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Device Association Service when handling local input. A local user can trigger the overflow to elevate privileges.

Successful exploitation could grant SYSTEM privileges.


92) Use-after-free (CVE-ID: CVE-2026-62711)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Win32K when processing local operations. A local user can trigger the use-after-free condition to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


93) Heap-based buffer overflow (CVE-ID: CVE-2026-62717)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Message Queuing when processing local input. A local user can trigger the heap-based buffer overflow to elevate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


94) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-62721)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to insufficient granularity of access control in User-Mode Power Service (UMPS) when handling local requests. A local user can exploit the access control weakness to elevate privileges.

Successful exploitation could allow escalation to SYSTEM privileges.


95) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-62728)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to time-of-check time-of-use race condition in Windows Common Log File System Driver when handling local operations. A local user can win a race condition to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


96) Out-of-bounds read (CVE-ID: CVE-2026-62733)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to out-of-bounds read in Windows Win32K when handling crafted local operations. A local user can trigger the flaw to elevate privileges.

Successful exploitation could allow escalation to SYSTEM privileges.


97) Out-of-bounds read (CVE-ID: CVE-2026-62743)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Windows Win32K when processing crafted local input. A local user can trigger the out-of-bounds read to disclose sensitive information.

Successful exploitation could leak one byte of kernel memory.


98) Buffer over-read (CVE-ID: CVE-2026-62730)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to buffer over-read in Windows Wired AutoConfig Service when parsing input. A local user can trigger the service to read beyond an intended buffer boundary to disclose sensitive information.

An attacker who successfully exploits the issue could view heap memory from a privileged process running on the server.


99) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-62757)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass a security feature.

The vulnerability exists due to improper verification of cryptographic signature in Windows Schannel when handling certificate validation during the account enrollment process. A remote attacker can send crafted network traffic to bypass a security feature.

User interaction is required, and successful exploitation can bypass certificate validation during account enrollment. Specific protocol settings or configurations must be in place for exploitation to succeed.


100) Integer overflow (CVE-ID: CVE-2026-62751)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to integer overflow or wraparound in Windows Projected File System when handling local operations. A local user can trigger the integer overflow to elevate privileges.

Successful exploitation could result in SYSTEM privileges.


101) Heap-based buffer overflow (CVE-ID: CVE-2026-62752)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Kerberos when processing local Kerberos operations. A local user can trigger the overflow to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


102) Numeric Truncation Error (CVE-ID: CVE-2026-62769)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to numeric truncation error in Windows DNS when processing crafted local input. A local privileged user can trigger the flaw to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


103) Stack-based buffer overflow (CVE-ID: CVE-2026-62768)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to stack-based buffer overflow in Windows Installer when handling local installer operations. A local user can trigger the overflow to escalate privileges.

Successful exploitation could allow acquisition of SYSTEM privileges.


104) Heap-based buffer overflow (CVE-ID: CVE-2026-62770)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Shell when handling local input. A local user can trigger the overflow to escalate privileges.

Successful exploitation could grant SYSTEM privileges.


105) Incorrect authorization (CVE-ID: CVE-2026-62775)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) when handling local file system access. A local user can access file path information to disclose sensitive information.

The disclosed information includes unauthorized access to file system path information.


106) Heap-based buffer overflow (CVE-ID: CVE-2026-62799)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows SMB Client when handling SMB operations locally. A local user can trigger the overflow to elevate privileges.

Successful exploitation could result in SYSTEM privileges.


107) Use-after-free (CVE-ID: CVE-2026-62778)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to elevate privileges.

The vulnerability exists due to use-after-free in Windows DNS when handling network requests. A remote attacker can win a race condition with a specially crafted request to elevate privileges.

Successful exploitation could result in SYSTEM privileges.


108) Out-of-bounds read (CVE-ID: CVE-2026-62782)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Windows SMB Client when handling network SMB traffic. A remote attacker can send specially crafted SMB data to disclose sensitive information.

User interaction is required for exploitation. Successful exploitation could expose heap memory from a privileged process running on the server.


109) Heap-based buffer overflow (CVE-ID: CVE-2026-62781)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in RPC Runtime when handling specially crafted network packets sent to an affected service. A remote attacker can send a specially crafted packet to execute arbitrary code.

Specific protocol settings or configurations are required for successful exploitation.


110) Heap-based buffer overflow (CVE-ID: CVE-2026-62800)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Windows SMB Server when handling specially crafted requests over the network. A remote user can send a specially crafted request to execute arbitrary code.


111) Out-of-bounds read (CVE-ID: CVE-2026-62786)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Windows Win32K when processing local input. A local user can trigger the out-of-bounds read to disclose sensitive information.

An attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server.


112) Heap-based buffer overflow (CVE-ID: CVE-2026-62790)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Windows SMB Server when handling specially crafted requests over the network. A remote user can send a specially crafted request to execute arbitrary code.


113) Buffer over-read (CVE-ID: CVE-2026-62793)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to buffer over-read in Windows NTFS when processing local NTFS operations. A local user can trigger the over-read to disclose sensitive information.

Successful exploitation could expose heap memory from a privileged process running on the server.


114) Stack-based buffer overflow (CVE-ID: CVE-2026-62824)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in Remote Desktop Client when processing a server response after a user connects to a malicious server. A remote attacker can host a malicious server and convince a user to connect to it to execute arbitrary code.

User interaction is required.


115) Integer overflow (CVE-ID: CVE-2026-62822)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in Windows GDI+ when parsing a specially crafted file. A remote attacker can persuade a user to open a specially crafted file to execute arbitrary code.

User interaction is required to open a crafted file.


116) Link following (CVE-ID: CVE-2026-62832)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper link resolution before file access ('link following') in Windows User Profile Service when loading another user's registry hive. A local user can run a specially crafted application to escalate privileges.

User interaction is not required, and successful exploitation could allow access to or modification of another user's data.


117) Out-of-bounds read (CVE-ID: CVE-2026-62880)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to out-of-bounds read in Windows NTFS when processing local file system operations. A local user can trigger the out-of-bounds read to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


118) Numeric Truncation Error (CVE-ID: CVE-2026-62881)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to numeric truncation error in Windows DNS when handling local input. A local privileged user can trigger the truncation condition to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


119) Numeric Truncation Error (CVE-ID: CVE-2026-62883)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to numeric truncation error in Windows DNS when processing crafted local input. A local privileged user can trigger the flaw to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


120) Heap-based buffer overflow (CVE-ID: CVE-2026-62885)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Win32K when handling local crafted input. A local user can trigger the flaw to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


121) Out-of-bounds read (CVE-ID: CVE-2026-62887)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Windows NTFS when processing file system data. A local user can trigger the flaw to disclose sensitive information.

The disclosed information may include unauthorized read access to the file system.


122) NULL pointer dereference (CVE-ID: CVE-2026-65681)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in Windows iSCSI Target Service when handling network requests. A remote attacker can send a specially crafted request to cause a denial of service.


123) Heap-based buffer overflow (CVE-ID: CVE-2026-65679)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Windows iSCSI Target Service when handling network packets. A remote attacker can send a specially crafted packet to execute arbitrary code.

No authentication or user interaction is required.


124) Heap-based buffer overflow (CVE-ID: CVE-2026-65774)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Installer when handling local installation operations. A local user can trigger the vulnerable behavior to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


125) Use-after-free (CVE-ID: CVE-2026-65775)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to use-after-free in Windows Win32K when handling local operations. A local user can trigger the flaw to elevate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


126) Use-after-free (CVE-ID: CVE-2026-65776)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Win32K when handling crafted local operations. A local user can trigger a race condition to escalate privileges.

Successful exploitation requires winning a race condition. An attacker who successfully exploits the issue could gain SYSTEM privileges.


127) Inadequate Encryption Strength (CVE-ID: CVE-2026-65777)

CWE-ID: CWE-326 - Inadequate Encryption Strength

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass a security feature.

The vulnerability exists due to inadequate encryption strength in Windows Active Directory when validating cryptographic keys over a network. A remote user can use a weak key to bypass a cryptographic key validation policy to bypass a security feature.

Successful exploitation requires high attack complexity and depends on specific environmental and system configuration conditions.


128) Use-after-free (CVE-ID: CVE-2026-65779)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Autopilot when handling local operations. A local user can trigger a race condition to escalate privileges.

Successful exploitation could lead to SYSTEM privileges.


129) Double free (CVE-ID: CVE-2026-65780)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to double free in Windows Autopilot when winning a race condition during local exploitation. A local user can trigger the double free to escalate privileges.

Successful exploitation requires winning a race condition and could result in SYSTEM privileges.


130) Use-after-free (CVE-ID: CVE-2026-65778)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Autopilot when handling local operations. A local user can win a race condition to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


131) Use-after-free (CVE-ID: CVE-2026-65782)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Autopilot when handling local operations. A local user can win a race condition to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


132) Use-after-free (CVE-ID: CVE-2026-65781)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Autopilot when winning a race condition during local exploitation. A local user can trigger the race condition to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


133) Heap-based buffer overflow (CVE-ID: CVE-2026-65790)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Message Queuing when handling local requests. A local user can send crafted input to elevate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


134) Heap-based buffer overflow (CVE-ID: CVE-2026-65791)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Windows iSCSI Target Service when handling specially crafted network packets. A remote attacker can send a specially crafted packet to execute arbitrary code.

No authentication or user interaction is required.


135) Improper access control (CVE-ID: CVE-2026-65795)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to improper access control in Windows DNS when handling local operations. A local privileged user can exploit the flaw to escalate privileges.

Successful exploitation could allow the attacker to gain SYSTEM privileges.


136) Buffer over-read (CVE-ID: CVE-2026-65794)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to buffer over-read in Windows SMB Client when handling crafted SMB traffic over a network. A remote attacker can send crafted SMB data to disclose sensitive information.

User interaction is required for exploitation.


137) Numeric Truncation Error (CVE-ID: CVE-2026-65797)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to numeric truncation error in Windows DNS when processing crafted local input. A local privileged user can trigger the flaw to escalate privileges.

Successful exploitation could lead to SYSTEM privileges.


138) Integer overflow (CVE-ID: CVE-2026-65799)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to elevate privileges.

The vulnerability exists due to integer overflow or wraparound in Windows DNS when handling local operations. A local privileged user can trigger the flaw to elevate privileges.

Successful exploitation could grant SYSTEM privileges.


139) Numeric Truncation Error (CVE-ID: CVE-2026-65798)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to escalate privileges.

The vulnerability exists due to numeric truncation error in Windows DNS when processing local input. A local privileged user can trigger the numeric truncation condition to escalate privileges.

Successful exploitation could result in SYSTEM privileges.


140) Heap-based buffer overflow (CVE-ID: CVE-2026-65796)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in Windows iSCSI Target Service when handling network requests. A remote attacker can send specially crafted network traffic to cause a denial of service.


141) Origin validation error (CVE-ID: CVE-2026-56179)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to origin validation error in Windows Network Address Translation (NAT) when handling network traffic over an adjacent network. A remote attacker can send crafted network traffic to perform spoofing.


142) Out-of-bounds read (CVE-ID: CVE-2026-62738)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Windows Management Instrumentation when processing local requests. A local user can trigger the out-of-bounds read to disclose sensitive information.

Successful exploitation could expose heap memory from a privileged process running on the server.


Remediation

Install update from vendor's website.

References