SB2026101402 - Multiple vulnerabilities in Microsoft Windows

Description

This security bulletin contains information about 623 vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2026-100200)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Update Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

2) Heap-based buffer overflow (CVE-ID: CVE-2026-100201)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Client License Service when exploited locally. A local user can exploit the overflow to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

3) Use-after-free (CVE-ID: CVE-2026-100202)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Message Queuing Queue Manager when processing messages received over the network. A remote attacker can send a specially crafted message to execute arbitrary code.

Exploitation requires the target system to be running the Windows Message Queuing (MSMQ) service.

4) Heap-based buffer overflow (CVE-ID: CVE-2026-100203)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Update Service when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires specific conditions, such as particular protocol settings or configurations. The advisory does not identify the exact conditions required.

5) Use-after-free (CVE-ID: CVE-2026-100209)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when opening a malicious Office file. A remote attacker can send a malicious Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

6) Heap-based buffer overflow (CVE-ID: CVE-2026-100210)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

7) Use-after-free (CVE-ID: CVE-2026-100211)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

8) Use-after-free (CVE-ID: CVE-2026-100212)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

9) Heap-based buffer overflow (CVE-ID: CVE-2026-100215)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Graphics Component when processing specially crafted documents or embedded OpenType fonts. A remote attacker can convince a user to open a specially crafted document or visit a webpage containing specially crafted embedded OpenType fonts to execute arbitrary code.

Execution occurs in the context of the authenticated local user.

10) Stack-based buffer overflow (CVE-ID: CVE-2026-100216)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a stack-based buffer overflow in Windows Storage when the component is exploited locally. A local user can exploit the stack-based buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures. Successful exploitation is not guaranteed.

11) Improper privilege management (CVE-ID: CVE-2026-100217)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to improper privilege management in Windows Group Policy when used locally. A local user can exploit the privilege management flaw locally to gain SYSTEM privileges.

12) Use-after-free (CVE-ID: CVE-2026-100218)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Gateway Service when processing network packets. A remote attacker can send a specially crafted packet to the affected service over the network to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.

13) Use-after-free (CVE-ID: CVE-2026-100219)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft QUIC when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

14) Heap-based buffer overflow (CVE-ID: CVE-2026-100220)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Windows Media Video Decoder when processing a specially crafted media file. A remote attacker can convince a user to open the crafted file to execute arbitrary code.

15) Heap-based buffer overflow (CVE-ID: CVE-2026-100222)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Network Policy Server (NPS) when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

16) Heap-based buffer overflow (CVE-ID: CVE-2026-100225)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Storage when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

17) Untrusted Pointer Dereference (CVE-ID: CVE-2026-102186)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to untrusted pointer dereference in Windows Network File System when dereferencing an untrusted pointer. A local user can exploit this flaw locally to disclose certain kernel memory content.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

18) Use of uninitialized resource (CVE-ID: CVE-2026-102187)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to use of an uninitialized resource in Windows Kernel when resources are used before initialization. A local user can exploit this weakness locally to disclose uninitialized heap memory from a privileged process.

19) Untrusted Pointer Dereference (CVE-ID: CVE-2026-102188)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in Windows Storage Port Driver when dereferencing an untrusted pointer. An attacker with physical access can carry out a physical attack to escalate privileges to SYSTEM.

20) Heap-based buffer overflow (CVE-ID: CVE-2026-102189)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Storage when used locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment and system configuration.

21) Heap-based buffer overflow (CVE-ID: CVE-2026-102191)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Storage when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on environmental factors, system configuration, and the presence of additional security measures. Successful exploitation is not guaranteed.

22) Integer underflow (CVE-ID: CVE-2026-102192)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer underflow in Windows Failover Cluster when accessed over a network. A remote attacker can trigger the integer underflow over the network to cause a denial of service.

23) Use-after-free (CVE-ID: CVE-2026-102193)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when a race condition occurs. A local user can exploit the use-after-free condition locally to escalate privileges to SYSTEM.

24) Use-after-free (CVE-ID: CVE-2026-102194)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Graphics Kernel when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

25) Use-after-free (CVE-ID: CVE-2026-102195)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

26) Use-after-free (CVE-ID: CVE-2026-102196)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when exploited locally. A local user can exploit the use-after-free flaw to escalate privileges to SYSTEM.

27) Use-after-free (CVE-ID: CVE-2026-102197)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

28) Out-of-bounds read (CVE-ID: CVE-2026-102198)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Remote Desktop Protocol when communicating over a network. A remote user can read heap memory from a privileged process running on the server to disclose sensitive information.

Successful exploitation requires a deep understanding of the system and is not guaranteed; it depends on factors that may include the environment, system configuration, and additional security measures.

29) Stack-based buffer overflow (CVE-ID: CVE-2026-102199)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in Microsoft Windows Codecs Library when exploited over a network. A remote attacker can trigger the buffer overflow over a network to cause a denial of service.

User interaction is required for exploitation.

30) Use-after-free (CVE-ID: CVE-2026-102201)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Windows Media Foundation when used locally. A local user can exploit the use-after-free locally to escalate privileges to SYSTEM.

31) Link following (CVE-ID: CVE-2026-102202)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Windows Container Isolation FS Filter Driver (unionfs.sys) when accessing files. A local user can exploit the link-resolution weakness locally to escalate privileges to SYSTEM.

32) Type Confusion (CVE-ID: CVE-2026-102203)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on a client system.

The vulnerability exists due to type confusion in RPC Runtime when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

33) Heap-based buffer overflow (CVE-ID: CVE-2026-102205)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) when the driver is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

34) Heap-based buffer overflow (CVE-ID: CVE-2026-102206)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Portable Device MTP Driver when subjected to a physical attack. An attacker with physical access can exploit the buffer overflow through physical access to the system to escalate privileges to SYSTEM.

35) Race condition (CVE-ID: CVE-2026-102207)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization in Windows Kernel when shared resources are accessed concurrently. A local user can win a race condition to escalate privileges to SYSTEM.

36) Use-after-free (CVE-ID: CVE-2026-102208)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when exploitation occurs locally. A local user can exploit this memory error to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

37) Heap-based buffer overflow (CVE-ID: CVE-2026-102209)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Graphics Component when exploited locally. A local user can exploit the overflow to gain SYSTEM privileges.

Successful exploitation requires a deep understanding of the system and is not guaranteed. Success may depend on the environment, system configuration, and the presence of additional security measures.

38) Heap-based buffer overflow (CVE-ID: CVE-2026-102210)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Text Shaping when processing network packets sent to an affected service. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

No user interaction is required.

39) Use-after-free (CVE-ID: CVE-2026-102211)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Virtualization-Based Security (VBS) Enclave when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

40) Use-after-free (CVE-ID: CVE-2026-102214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code on the Hyper-V host operating system.

The vulnerability exists due to use-after-free in Windows Hyper-V when running applications in a Hyper-V guest. A local user can run a specially crafted application in the guest to execute arbitrary code on the Hyper-V host operating system.

41) Heap-based buffer overflow (CVE-ID: CVE-2026-102215)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) when used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

42) Type Confusion (CVE-ID: CVE-2026-102216)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to type confusion in Windows StateRepository API when accessing a resource using an incompatible type. A local user can exploit the type confusion locally to escalate privileges to SYSTEM.

43) Improper Resolution of Path Equivalence (CVE-ID: CVE-2026-102217)

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges and execute code.

The vulnerability exists due to improper resolution of path equivalence in WebDAV when handling network requests. A remote user can send a specially crafted request to an affected service to escalate privileges and execute code.

Code executes in the security context of the affected IIS application pool.

44) Heap-based buffer overflow (CVE-ID: CVE-2026-102218)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) when exploited locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

45) Use-after-free (CVE-ID: CVE-2026-102220)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows VHD miniport driver when the driver is used locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

46) Improper Check for Certificate Revocation (CVE-ID: CVE-2026-102221)

CWE-ID: CWE-299 - Improper Check for Certificate Revocation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to bypass Secure Boot.

The vulnerability exists due to improper checking of certificate revocation in Windows Secure Boot when checking certificate revocation. A local privileged user can exploit this weakness locally to bypass Secure Boot.

47) Out-of-bounds read (CVE-ID: CVE-2026-102225)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in Windows Text Shaping when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

48) Heap-based buffer overflow (CVE-ID: CVE-2026-102227)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to a heap-based buffer overflow in Windows Resilient File System (ReFS) when operating locally. A local user can exploit the buffer overflow to execute arbitrary code locally.

49) Heap-based buffer overflow (CVE-ID: CVE-2026-102849)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Access when opening a specially crafted file. A remote attacker can trick a victim into opening such a file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

50) Heap-based buffer overflow (CVE-ID: CVE-2026-102850)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Office Access when processing specially crafted files. A remote attacker can trick a victim into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

51) Heap-based buffer overflow (CVE-ID: CVE-2026-102855)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Visio when processing specially crafted files. A remote attacker can trick a victim into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

52) Heap-based buffer overflow (CVE-ID: CVE-2026-102856)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Visio when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector.

53) Heap-based buffer overflow (CVE-ID: CVE-2026-102857)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Visio when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

54) Out-of-bounds read (CVE-ID: CVE-2026-102867)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Word when displaying content in the preview pane. A remote attacker can exploit the preview pane attack vector to read small portions of heap memory.

User interaction is required.

55) Type Confusion (CVE-ID: CVE-2026-102869)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges by executing code with the privileges of the affected process.

The vulnerability exists due to type confusion in the Portable PDB processing functionality of .NET and Visual Studio when processing specially crafted files. A remote attacker can convince a user or service to process a specially crafted Portable PDB file to escalate privileges by executing code with the privileges of the affected process.

56) Code Injection (CVE-ID: CVE-2026-102870)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in a developer's context.

The vulnerability exists due to improper control of code generation in ASP.NET Core when processing attacker-supplied data during a Blazor WebAssembly debugging session. A remote attacker can supply specially crafted data to an application being debugged to execute arbitrary code in a developer's context.

Exploitation requires a developer to evaluate an affected object.

57) Out-of-bounds read (CVE-ID: CVE-2026-103553)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows Partition Management Driver when exploited locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

58) Use-after-free (CVE-ID: CVE-2026-103554)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

59) Heap-based buffer overflow (CVE-ID: CVE-2026-103555)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver when the driver is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

60) Deadlock (CVE-ID: CVE-2026-103558)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to deadlock in Windows Routing and Remote Access Service (RRAS) when handling network traffic. A remote attacker can trigger the deadlock over a network to cause a denial of service.

61) Missing Authorization (CVE-ID: CVE-2026-103560)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to tamper with DNS Server.

The vulnerability exists due to missing authorization in DNS Server when accessing the component locally. A local user can exploit missing authorization checks to tamper with DNS Server.

62) Use-after-free (CVE-ID: CVE-2026-103565)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when the service is used locally. A local user can win a race condition to gain SYSTEM privileges.

63) Buffer over-read (CVE-ID: CVE-2026-103567)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read small portions of heap memory.

The vulnerability exists due to a buffer over-read in Windows Broadcast DVR User Service when the service is accessed locally. A local user can exploit the buffer over-read to read small portions of heap memory.

64) Race condition (CVE-ID: CVE-2026-103568)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges from a low integrity level to a medium integrity level.

The vulnerability exists due to improper synchronization of shared resources in Windows Credential Providers when concurrently accessing shared resources. A local user can win a race condition to escalate privileges from a low integrity level to a medium integrity level.

Exploitation can originate within an AppContainer sandbox.

65) Out-of-bounds read (CVE-ID: CVE-2026-103569)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose remote heap memory.

The vulnerability exists due to an out-of-bounds read in Windows IKE Extension when handling network communications. A remote attacker can exploit the vulnerability over the network to disclose remote heap memory.

66) Code Injection (CVE-ID: CVE-2026-103572)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in Visual Studio Tools for Applications and SQL Server Management Studio when processing malicious prompts. A remote attacker can deliver a malicious prompt over the network that coerces backend components or integrated tools into running unintended commands to execute arbitrary code.

Exploitation requires a user to interact with Copilot.

67) Use-after-free (CVE-ID: CVE-2026-103575)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code.

68) Open redirect (CVE-ID: CVE-2026-103576)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to impersonate another user and access sensitive information.

The vulnerability exists due to URL redirection to an untrusted site ('open redirect') in Active Directory Federation Services (AD FS) when redirecting users to websites. A remote attacker can exploit the open redirect over a network to impersonate another user and access sensitive information.

Exploitation requires user interaction. The information accessible through impersonation depends on the victim user's permission levels.

69) Insecure Default Variable Initialization (CVE-ID: CVE-2026-103577)

CWE-ID: CWE-453 - Insecure Default Variable Initialization

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication and obtain a successful login.

The vulnerability exists due to insecure default variable initialization in Microsoft QUIC when handling authentication over a network. A remote attacker can attempt a remote login to bypass authentication and obtain a successful login.

No user interaction is required. Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

70) Untrusted Pointer Dereference (CVE-ID: CVE-2026-103578)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in Windows Kernel when handling untrusted pointers during a physical attack. An attacker with physical access can carry out a physical attack to escalate privileges to SYSTEM.

71) Heap-based buffer overflow (CVE-ID: CVE-2026-105003)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the HID class driver when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

72) Out-of-bounds read (CVE-ID: CVE-2026-105004)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows Overlay Filter when used locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

73) Out-of-bounds write (CVE-ID: CVE-2026-105005)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Windows Schannel when processing network packets. A remote attacker can send a specially crafted packet to an affected service to execute arbitrary code.

Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition. No user interaction is required.

74) Use-after-free (CVE-ID: CVE-2026-105006)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.4 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the HID class driver when a physical attack targets the driver. An attacker with physical access can exploit the use-after-free through a physical attack to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

75) Out-of-bounds read (CVE-ID: CVE-2026-105007)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to missing buffer-length validation in ndis.sys within the Network Driver Interface Specification (NDIS) when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code.

76) Input validation error (CVE-ID: CVE-2026-105008)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to impersonate another user, access information permitted by that user's permissions, and execute code on the target system.

The vulnerability exists due to an unspecified weakness in Windows Schannel when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to impersonate another user, access information permitted by that user's permissions, and execute code on the target system.

No user interaction is required. Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition; success depends on environmental and system configuration factors.

77) Incorrect default permissions (CVE-ID: CVE-2026-105009)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to incorrect default permissions in Windows Server Update Service when accessed locally. A local user can exploit these permissions by winning a race condition to escalate privileges to SYSTEM.

Successful exploitation requires additional actions beforehand to prepare the target environment. User interaction is required.

78) Use-after-free (CVE-ID: CVE-2026-105010)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges to SYSTEM and execute code on the target system.

The vulnerability exists due to use-after-free in Microsoft Windows Search Component when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to escalate privileges to SYSTEM and execute code on the target system.

No user interaction is required.

79) Heap-based buffer overflow (CVE-ID: CVE-2026-105016)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft QUIC when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code on the target system.

No user interaction is required.

80) Heap-based buffer overflow (CVE-ID: CVE-2026-105591)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Office Access when processing a malicious Office file. A remote attacker can send a malicious Office file to a victim and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

81) Heap-based buffer overflow (CVE-ID: CVE-2026-105592)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Access when opening a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

82) Heap-based buffer overflow (CVE-ID: CVE-2026-105593)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Office Access when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

83) Out-of-bounds read (CVE-ID: CVE-2026-105595)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Access when processing a malicious Office file. A remote attacker can send a user a malicious Office file and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

84) Heap-based buffer overflow (CVE-ID: CVE-2026-105596)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Access when processing a malicious Office file. A remote attacker can send a specially crafted Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

85) Heap-based buffer overflow (CVE-ID: CVE-2026-105597)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Office Access when opening a malicious Office file. A remote attacker can send a malicious Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

86) Heap-based buffer overflow (CVE-ID: CVE-2026-105598)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Access when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

87) Heap-based buffer overflow (CVE-ID: CVE-2026-105599)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office PowerPoint when processing a malicious Office file. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

88) Heap-based buffer overflow (CVE-ID: CVE-2026-105714)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Office Access when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is not an attack vector. Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

89) Integer overflow (CVE-ID: CVE-2026-105715)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in Microsoft Office Word when processing a malicious Office file. A remote attacker can send a specially crafted Office file and convince the victim to open it to execute arbitrary code.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

90) Heap-based buffer overflow (CVE-ID: CVE-2026-105716)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Access when processing specially crafted Office files. A remote attacker can send a malicious Office file to a user and convince them to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

91) Heap-based buffer overflow (CVE-ID: CVE-2026-105717)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Access when processing Office files. A remote attacker can send a specially crafted Office file and convince a user to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

92) Out-of-bounds read (CVE-ID: CVE-2026-105718)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing malicious Office files. A remote attacker can send a malicious Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

93) Use-after-free (CVE-ID: CVE-2026-105722)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

User interaction is not required.

94) Untrusted Pointer Dereference (CVE-ID: CVE-2026-105723)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to untrusted pointer dereference in Windows Distributed File System (DFS) when accessed over a network. A remote attacker can trigger an untrusted pointer dereference over the network to cause a denial of service.

95) Improper access control (CVE-ID: CVE-2026-105733)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code on the Hyper-V host operating system.

The vulnerability exists due to improper access control in Windows Hyper-V when running applications on a guest virtual machine. A local user can run a specially crafted application on the guest to execute arbitrary code on the Hyper-V host operating system.

In the nested virtualization scenario described by the advisory, the host is itself a guest virtual machine.

96) Out-of-bounds read (CVE-ID: CVE-2026-108127)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DNS Server when accessed over a network. A remote user can exploit the out-of-bounds read to disclose sensitive information, including heap memory from a privileged process running on the server.

97) Out-of-bounds read (CVE-ID: CVE-2026-108128)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DNS Server when accessed over a network. A remote user can access heap memory from a privileged process running on the server to disclose sensitive information.

98) Out-of-bounds read (CVE-ID: CVE-2026-108129)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DNS Server when accessed over a network. A remote user can read heap memory from a privileged process running on the server to disclose sensitive information.

99) Heap-based buffer overflow (CVE-ID: CVE-2026-108130)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

100) Input validation error (CVE-ID: CVE-2026-108131)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to an unspecified weakness in Active Directory Federation Services (AD FS) when the service is accessed over a network. A remote attacker can exploit the issue over a network to perform spoofing.

101) Double free (CVE-ID: CVE-2026-108132)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to double free in Windows Kerberos when a race condition is triggered locally. A local user can win the race condition to escalate privileges to SYSTEM.

102) Release of invalid pointer or reference (CVE-ID: CVE-2026-108133)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to release of an invalid pointer or reference in Windows Modern Device Management (MDM) when releasing pointers or references. A local user can exploit the invalid pointer or reference release to escalate privileges to SYSTEM.

103) Use-after-free (CVE-ID: CVE-2026-108134)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Autopilot when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM privileges.

104) Link following (CVE-ID: CVE-2026-108135)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Windows Backup Engine when accessing files. A local user can win a race condition to escalate privileges to SYSTEM.

105) Use-after-free (CVE-ID: CVE-2026-108136)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Microsoft Windows Search Component when accessed locally. A local user can exploit the component locally to escalate privileges to SYSTEM.

106) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-108396)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Modern Device Management (MDM) when a resource is checked and subsequently used. A local user can win a race condition to escalate privileges to SYSTEM.

107) Untrusted search path (CVE-ID: CVE-2026-108398)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Windows Defender Application Control (WDAC) enforcement and execute code within a protected process.

The vulnerability exists due to an untrusted search path in .NET Framework when loading assemblies into a protected process. A local user can place a specially crafted .NET assembly on the affected system and register it for loading by a protected process to bypass Windows Defender Application Control (WDAC) enforcement and execute code within a protected process.

User interaction is not required.

108) Heap-based buffer overflow (CVE-ID: CVE-2026-108399)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to escalate privileges on the host system beyond the guest virtual machine boundary.

The vulnerability exists due to a heap-based buffer overflow in Windows Hyper-V when operating locally. A local privileged user can exploit the overflow to escalate privileges on the host system beyond the guest virtual machine boundary.

User interaction is required. Successful exploitation requires a deep understanding of the system and may depend on the environment, system configuration, and additional security measures.

109) Out-of-bounds write (CVE-ID: CVE-2026-108457)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Microsoft Windows PDF when automatically processing PDF content. A remote attacker can send a specially crafted email attachment to an affected system to execute arbitrary code.

No user interaction is required. Successful exploitation requires a deep understanding of the target system and depends on environmental and configuration factors.

110) Use-after-free (CVE-ID: CVE-2026-108458)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when processing a specially crafted file opened by a user. A remote attacker can trick the victim into opening a specially crafted file to execute arbitrary code.

111) Use-after-free (CVE-ID: CVE-2026-108460)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Message Queuing when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.

112) Use-after-free (CVE-ID: CVE-2026-108461)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when operating locally. A local user can exploit the use-after-free flaw to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

113) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-108462)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory addresses.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Kernel when kernel information is accessed locally. A local user can exploit this exposure to disclose kernel memory addresses.

114) Improper Resolution of Path Equivalence (CVE-ID: CVE-2026-108463)

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass SmartScreen's source reputation checks.

The vulnerability exists due to improper resolution of path equivalence in Windows SmartScreen when evaluating application installations initiated from specially crafted links. A remote attacker can convince a user to install an application from a specially crafted link to bypass SmartScreen's source reputation checks.

115) Use-after-free (CVE-ID: CVE-2026-108464)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Software Protection Platform (SPP) when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges.

The elevated security context is that of the NT AUTHORITYNetwork Service account.

116) Use-after-free (CVE-ID: CVE-2026-108465)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Update Delivery Optimization when a race condition occurs. A local user can win the race condition to escalate privileges.

The resulting code execution occurs in the security context of the NT AUTHORITYNetwork Service account.

117) Out-of-bounds read (CVE-ID: CVE-2026-108466)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Windows Kernel when exploitation occurs over a network. A remote attacker can exploit the out-of-bounds read over a network to cause a denial of service.

Successful exploitation requires user interaction.

118) Heap-based buffer overflow (CVE-ID: CVE-2026-108467)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code on an affected server.

The vulnerability exists due to a heap-based buffer overflow in Microsoft PostScript Printer Driver when handling network requests. A remote user can send a specially crafted request to execute arbitrary code on an affected server.

User interaction is not required.

119) Use-after-free (CVE-ID: CVE-2026-108468)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

120) Untrusted Pointer Dereference (CVE-ID: CVE-2026-108471)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges, disclose enclave data, or execute code within the target enclave.

The vulnerability exists due to untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave when handling malicious report requests. A local user can run a specially crafted application that submits a malicious report request to an affected enclave to escalate privileges, disclose enclave data, or execute code within the target enclave.

121) Heap-based buffer overflow (CVE-ID: CVE-2026-109453)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

122) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-49785)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass UEFI Secure Boot.

The vulnerability exists due to improper resource shutdown or release in Windows UEFI when booting a device. A local user can exploit this flaw locally to bypass UEFI Secure Boot.

The security feature protects the early boot process, before the operating system's protections are active.

123) Uncontrolled Recursion (CVE-ID: CVE-2026-58280)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in .NET when handling network interactions. A remote attacker can trigger uncontrolled recursion over the network to cause a denial of service.

124) Use-after-free (CVE-ID: CVE-2026-61931)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Perception Simulation Service when exploited locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

125) Link following (CVE-ID: CVE-2026-62687)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose file path information.

The vulnerability exists due to improper link resolution before file access in Windows Backup Engine when accessing files locally. A local user can exploit link following to disclose file path information.

126) Missing Authentication for Critical Function (CVE-ID: CVE-2026-62879)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform tampering.

The vulnerability exists due to missing authentication for a critical function in Windows SmartScreen when a critical function is accessed locally. A local user can access the critical function without authentication to perform tampering.

Exploitation does not require user interaction.

127) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-66822)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information, including credentials.

The vulnerability exists due to insertion of sensitive information into sent data in .NET when sending data over a network. A remote attacker can access exposed data to disclose sensitive information, including credentials.

Successful exploitation requires specific protocol settings or configurations to be in place.

128) Heap-based buffer overflow (CVE-ID: CVE-2026-68836)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows kernel32.dll when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

129) Heap-based buffer overflow (CVE-ID: CVE-2026-69326)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Graphic Fonts when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

130) Use-after-free (CVE-ID: CVE-2026-69387)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Error Reporting when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

131) Use-after-free (CVE-ID: CVE-2026-69452)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Enterprise App Management when accessing the component over a network. A remote user can exploit the use-after-free to escalate privileges to SYSTEM.

User interaction is required. Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

132) Out-of-bounds read (CVE-ID: CVE-2026-69454)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service when accessed over a network. A remote attacker can read portions of heap memory from a privileged process running on the server to disclose sensitive information.

133) Heap-based buffer overflow (CVE-ID: CVE-2026-69471)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Installer when operating locally. A local user can exploit the flaw to escalate privileges to SYSTEM.

134) Out-of-bounds read (CVE-ID: CVE-2026-69506)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Key Storage Provider when used locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

135) Out-of-bounds read (CVE-ID: CVE-2026-69577)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service when handling network communications. A remote attacker can read heap memory from a privileged process running on the server to disclose sensitive information.

136) Use-after-free (CVE-ID: CVE-2026-69596)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Program Compatibility Assistant Service when the service is accessed locally. A local user can win a race condition to escalate privileges to SYSTEM.

137) Heap-based buffer overflow (CVE-ID: CVE-2026-69633)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Update when operating locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

138) Heap-based buffer overflow (CVE-ID: CVE-2026-69634)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows iSCSI when handling network calls to endpoints. A remote attacker can call arbitrary endpoints over a network to execute arbitrary code.

139) Heap-based buffer overflow (CVE-ID: CVE-2026-69635)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to escalate privileges to Local Service.

The vulnerability exists due to a heap-based buffer overflow in Windows Installer when physically accessing the system. An attacker with physical access can exploit the vulnerability through a physical attack to escalate privileges to Local Service.

Exploitation requires an existing Medium Integrity Level context.

140) Heap-based buffer overflow (CVE-ID: CVE-2026-69639)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Libarchive when handling network calls to endpoints. A remote attacker can call arbitrary endpoints over the network to execute arbitrary code.

141) Incorrect authorization (CVE-ID: CVE-2026-69640)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass Kerberos service ticketing access control checks.

The vulnerability exists due to incorrect authorization in Windows Key Distribution Center when performing user access control checks for Kerberos service ticketing. A remote user can exploit the authorization flaw over a network to bypass Kerberos service ticketing access control checks.

Successful exploitation requires specific protocol settings or configurations to be in place. No user interaction is required.

142) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-69644)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI when accessing system information locally. A local user can view heap memory from a privileged process running on the server to disclose sensitive information.

143) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-69650)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper verification of cryptographic signatures in Windows Key Distribution Center when verifying cryptographic signatures. A local user can exploit the signature verification flaw locally to escalate privileges to SYSTEM.

144) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-69651)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in .NET when handling network input. A remote attacker can exploit the affected algorithm over a network to cause a denial of service.

145) Link following (CVE-ID: CVE-2026-69673)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Windows Update when accessing files through links. A local user can exploit this link-following weakness to escalate privileges to SYSTEM.

146) Out-of-bounds read (CVE-ID: CVE-2026-69675)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory.

The vulnerability exists due to an out-of-bounds read in Windows Network File System when reading memory. A local user can exploit the out-of-bounds read locally to disclose uninitialized heap memory.

147) Out-of-bounds write (CVE-ID: CVE-2026-69705)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Windows iSCSI when handling network endpoint calls. A remote attacker can call arbitrary endpoints over the network to execute arbitrary code.

148) Command injection (CVE-ID: CVE-2026-69718)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to improper neutralization of special elements used in a command in Windows Update when processing commands. A local user can inject commands to gain SYSTEM privileges.

149) Out-of-bounds read (CVE-ID: CVE-2026-69721)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows iSCSI when accessing the component locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

150) Untrusted search path (CVE-ID: CVE-2026-69733)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an untrusted search path in Windows Update when resolving search paths. A local user can exploit the untrusted search path locally to escalate privileges to SYSTEM.

151) Race condition (CVE-ID: CVE-2026-69736)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of shared resources in Windows Credential Manager when concurrent operations access a shared resource. A local user can exploit the race condition to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and is not guaranteed; it depends on factors that may include the environment, system configuration, and additional security measures.

152) Use-after-free (CVE-ID: CVE-2026-69743)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Program Compatibility Assistant Service when a race condition occurs. A local user can exploit the use-after-free by winning the race condition to escalate privileges to SYSTEM.

153) Use-after-free (CVE-ID: CVE-2026-69763)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Storage when the component is used locally. A local user can exploit the use-after-free to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

154) Use-after-free (CVE-ID: CVE-2026-69765)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the client system.

The vulnerability exists due to use-after-free in Windows Storport Miniport Driver when processing responses from a malicious server. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

155) Use-after-free (CVE-ID: CVE-2026-69766)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Storage when a race condition is won during local exploitation. A local user can exploit this condition to escalate privileges to SYSTEM.

156) External Control of File Name or Path (CVE-ID: CVE-2026-69783)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to external control of file names or paths in Windows Update when handling externally controlled file names or paths. A local user can control a file name or path to escalate privileges to SYSTEM.

157) NULL pointer dereference (CVE-ID: CVE-2026-69795)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a null pointer dereference in Windows Clipboard Server when exploited locally. A local user can win a race condition to escalate privileges.

The privilege transition is from a Low Integrity Level in a sandboxed execution environment to a Medium Integrity Level.

158) Use-after-free (CVE-ID: CVE-2026-69798)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Wired AutoConfig Service when accessed locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

159) Weak Authentication (CVE-ID: CVE-2026-69802)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to weak authentication in Network Device Enrollment Service (NDES) when accessed over a network. A remote attacker can exploit the weak authentication to execute arbitrary code.

Successful exploitation is complex and time-consuming, requiring significant effort and precise conditions.

160) Race condition (CVE-ID: CVE-2026-69830)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper synchronization of concurrent access to a shared resource (a race condition) in Windows DHCP Server when handling network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

No user interaction is required.

161) Use-after-free (CVE-ID: CVE-2026-69840)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Certificates when the component is used locally. A local user can win a race condition to escalate privileges.

The affected privilege boundary is from Low Integrity Level in a sandboxed execution environment to Medium Integrity Level.

162) Untrusted Pointer Dereference (CVE-ID: CVE-2026-69850)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to untrusted pointer dereference in Windows Certificates when dereferencing an untrusted pointer. A local user can exploit the pointer dereference locally to escalate privileges.

The privilege transition is from a low integrity level in a sandboxed execution environment to a medium integrity level.

163) Use-after-free (CVE-ID: CVE-2026-69856)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Storage when a race condition is won. A local user can exploit this condition locally to escalate privileges to SYSTEM.

No user interaction is required.

164) Out-of-bounds read (CVE-ID: CVE-2026-69867)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in SQLite when used locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

165) Type Confusion (CVE-ID: CVE-2026-69880)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to type confusion in Desktop Window Manager when accessing a resource using an incompatible type. A local user can exploit this weakness locally to escalate privileges to SYSTEM.

166) Untrusted search path (CVE-ID: CVE-2026-69882)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to an untrusted search path in Windows Update when resolving search paths. A local user can exploit the untrusted search path locally to gain SYSTEM privileges.

167) Use-after-free (CVE-ID: CVE-2026-69883)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows iSCSI when handling calls to network endpoints. A remote attacker can call arbitrary endpoints over the network to execute arbitrary code.

168) Buffer over-read (CVE-ID: CVE-2026-69884)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a buffer over-read in Windows GDI when reading buffers. A local user can exploit the buffer over-read locally to escalate privileges to SYSTEM.

169) Heap-based buffer overflow (CVE-ID: CVE-2026-69886)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Imaging Component when handling network endpoint calls. A remote attacker can call arbitrary endpoints over a network to execute arbitrary code.

170) Heap-based buffer overflow (CVE-ID: CVE-2026-69898)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Kernel when exploited locally. A local user can trigger the heap-based buffer overflow to escalate privileges to SYSTEM.

171) Untrusted Pointer Dereference (CVE-ID: CVE-2026-69902)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to execute code locally.

The vulnerability exists due to untrusted pointer dereference in Windows NTFS when dereferencing an untrusted pointer. A local privileged user can exploit this pointer dereference locally to execute code locally.

172) Missing Authorization (CVE-ID: CVE-2026-69905)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to alter system state or configuration beyond their normal privileges.

The vulnerability exists due to missing authorization in Windows AppX Deployment Service when accessing protected system data locally. A local user can make unauthorized modifications to protected system data to alter system state or configuration beyond their normal privileges.

173) Heap-based buffer overflow (CVE-ID: CVE-2026-69909)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Microsoft COM for Windows when the component is used locally. A local user can trigger the heap-based buffer overflow to escalate privileges to SYSTEM.

174) Use-after-free (CVE-ID: CVE-2026-69913)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows TCP/IP when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.

175) Out-of-bounds read (CVE-ID: CVE-2026-69914)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows AppX Deployment Service when reading memory locally. A local user can exploit the out-of-bounds read to disclose heap memory from a privileged process running on the server.

176) Use-after-free (CVE-ID: CVE-2026-69915)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows NTFS when a race condition occurs during local exploitation. A local user can exploit the race condition to escalate privileges to SYSTEM.

177) Integer overflow (CVE-ID: CVE-2026-69916)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in Windows NTFS when the component is used locally. A local user can exploit this vulnerability locally to escalate privileges to SYSTEM.

178) Heap-based buffer overflow (CVE-ID: CVE-2026-69918)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Core Messaging when the component is used locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

179) Out-of-bounds read (CVE-ID: CVE-2026-69919)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose initialized or uninitialized memory in the process heap.

The vulnerability exists due to an out-of-bounds read in Windows Cryptographic Services when accessing process heap memory. A local user can read memory beyond its intended bounds to disclose initialized or uninitialized memory in the process heap.

180) Insecure DLL loading (CVE-ID: CVE-2026-69923)

CWE-ID: CWE-427 - Uncontrolled Search Path Element

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an uncontrolled search path element in Windows AI when resolving search paths locally. A local user can exploit the uncontrolled search path element to escalate privileges to SYSTEM.

181) Type Confusion (CVE-ID: CVE-2026-69926)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to type confusion in Desktop Window Manager when accessing a resource using an incompatible type. A local user can exploit the vulnerability locally to escalate privileges to SYSTEM.

182) Race condition (CVE-ID: CVE-2026-69931)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of a shared resource in Windows Storage when executing concurrent operations. A local user can win a race condition to escalate privileges to SYSTEM.

183) Integer overflow (CVE-ID: CVE-2026-69934)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to integer overflow or wraparound in Windows Spaceport.sys when exploited locally. A local user can exploit the integer overflow or wraparound to gain SYSTEM privileges.

184) Use-after-free (CVE-ID: CVE-2026-69935)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Storage when a race condition occurs. A local user can exploit the use-after-free condition by winning the race condition to escalate privileges to SYSTEM.

No user interaction is required.

185) Out-of-bounds read (CVE-ID: CVE-2026-69940)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Windows Client for NFS when communicating over a network. A remote attacker can trigger the out-of-bounds read over the network to read small portions of heap memory.

User interaction is required for exploitation.

186) Buffer over-read (CVE-ID: CVE-2026-69942)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to a buffer over-read in Windows Overlay Filter when operating locally. A local user can exploit the buffer over-read to execute arbitrary code locally.

187) Missing Authorization (CVE-ID: CVE-2026-69945)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to missing authorization in Windows AppX Deployment Extensions when used locally. A local user can exploit the authorization gap to escalate privileges.

The attack can originate from a low-privilege AppContainer execution environment.

188) Heap-based buffer overflow (CVE-ID: CVE-2026-69947)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Overlay Filter when the component is targeted through physical access. An attacker with physical access can exploit the buffer overflow through a physical attack to execute arbitrary code.

189) Heap-based buffer overflow (CVE-ID: CVE-2026-69949)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Client for NFS when used locally. A local user can exploit the buffer overflow locally to escalate privileges to SYSTEM.

190) Buffer over-read (CVE-ID: CVE-2026-69950)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a buffer over-read in Windows Overlay Filter when reading buffer contents. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

191) Out-of-bounds read (CVE-ID: CVE-2026-69952)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows Overlay Filter when used locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

192) Buffer over-read (CVE-ID: CVE-2026-69953)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a buffer over-read in Windows Overlay Filter when the component is used locally. A local user can exploit the vulnerability locally to escalate privileges to SYSTEM.

193) Buffer over-read (CVE-ID: CVE-2026-69954)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to a buffer over-read in Windows Overlay Filter when accessed locally. A local user can exploit the buffer over-read to disclose one byte of kernel memory.

194) Out-of-bounds read (CVE-ID: CVE-2026-69955)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose information.

The vulnerability exists due to an out-of-bounds read in Windows Client for NFS when communicating over a network. A remote attacker can read small portions of heap memory to disclose information.

User interaction is required for exploitation.

195) Integer overflow (CVE-ID: CVE-2026-69957)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in Windows Overlay Filter when used locally. A local user can exploit the integer overflow locally to escalate privileges to SYSTEM.

196) Heap-based buffer overflow (CVE-ID: CVE-2026-69958)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Overlay Filter when subjected to a physical attack. An attacker with physical access can exploit the buffer overflow to execute arbitrary code.

197) Out-of-bounds read (CVE-ID: CVE-2026-69959)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to an out-of-bounds read in Windows Overlay Filter when the component is used locally. A local user can exploit the out-of-bounds read to execute arbitrary code locally.

198) Heap-based buffer overflow (CVE-ID: CVE-2026-69963)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Kernel Streaming Service Driver when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

199) Use-after-free (CVE-ID: CVE-2026-69964)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Kernel Streaming Service Driver when performing a specific operation that triggers a memory allocation failure. A local user can trigger this operation locally to escalate privileges to SYSTEM.

Exploitation requires knowledge of the specific operation that triggers the failure.

200) Integer overflow (CVE-ID: CVE-2026-69966)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in the Kernel Streaming Service driver when the service is used locally. A local user can exploit the overflow locally to escalate privileges to SYSTEM.

201) Out-of-bounds read (CVE-ID: CVE-2026-69967)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to an out-of-bounds read in Windows Overlay Filter when accessed locally. A local user can trigger the out-of-bounds read to disclose one byte of kernel memory.

202) Relative Path Traversal (CVE-ID: CVE-2026-69968)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify protected system data without authorization.

The vulnerability exists due to relative path traversal in Windows Libarchive when handling relative paths. A remote attacker can exploit this flaw over a network to modify protected system data without authorization.

User interaction is required for exploitation.

203) Link following (CVE-ID: CVE-2026-69969)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose file path information.

The vulnerability exists due to improper link resolution before file access in Windows AppX Deployment Service when accessing files locally. A local user can exploit link following to disclose file path information.

Successful exploitation requires winning a race condition.

204) Heap-based buffer overflow (CVE-ID: CVE-2026-69970)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Kernel Streaming Service Driver when a race condition is won. A local user can exploit the buffer overflow locally to escalate privileges to SYSTEM.

205) Incorrect authorization (CVE-ID: CVE-2026-69971)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in Windows Kernel-Mode Drivers when authorizing local access. A local user can exploit the authorization flaw locally to disclose sensitive information.

206) Path traversal (CVE-ID: CVE-2026-69973)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to make unauthorized modifications to protected system data.

The vulnerability exists due to path traversal in Windows Libarchive when handling pathnames intended to be restricted to a directory. A remote attacker can exploit path traversal over a network to make unauthorized modifications to protected system data.

User interaction is required for exploitation.

207) Out-of-bounds read (CVE-ID: CVE-2026-69974)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to an out-of-bounds read in Desktop Window Manager when reading memory locally. A local user can win a race condition to disclose one byte of kernel memory.

208) Use-after-free (CVE-ID: CVE-2026-69976)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when communicating over a network. A remote attacker can exploit this memory safety flaw to execute arbitrary code.

Successful exploitation requires winning a race condition and user interaction.

209) Use-after-free (CVE-ID: CVE-2026-69977)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Quality Windows Audio/Video Experience (QWAVE) service when a race condition is won. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

210) NULL pointer dereference (CVE-ID: CVE-2026-69978)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in Windows VMSwitch when accessed locally. A local user can trigger the null pointer dereference to cause a denial of service.

Exploitation does not require user interaction.

211) Improper Protection of Alternate Path (CVE-ID: CVE-2026-69979)

CWE-ID: CWE-424 - Improper Protection of Alternate Path

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass a security feature.

The vulnerability exists due to improper protection of an alternate path in Windows AppX Deployment Service when the service is accessed locally. A local user can exploit the improperly protected alternate path to bypass a security feature.

212) Weak Authentication (CVE-ID: CVE-2026-69982)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security feature.

The vulnerability exists due to weak authentication in Active Directory Federation Services (AD FS) when handling authentication over a network. A remote attacker can exploit the authentication weakness to bypass a security feature.

Successful exploitation is complex and time-consuming, requiring significant effort and precise conditions.

213) Use-after-free (CVE-ID: CVE-2026-69984)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when communicating over a network. A remote attacker can exploit the memory safety flaw over a network to execute arbitrary code.

Successful exploitation requires winning a race condition. User interaction is required.

214) Heap-based buffer overflow (CVE-ID: CVE-2026-69985)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Libarchive when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

215) Use-after-free (CVE-ID: CVE-2026-69986)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when communicating over a network. A remote attacker can exploit this flaw over a network to execute arbitrary code.

Successful exploitation requires winning a race condition. User interaction is required.

216) Use-after-free (CVE-ID: CVE-2026-69987)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when communicating over a network. A remote attacker can trigger the use-after-free over a network to execute arbitrary code.

Successful exploitation requires winning a race condition and user interaction.

217) Use-after-free (CVE-ID: CVE-2026-69988)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when communicating over a network. A remote attacker can exploit the use-after-free over a network to execute arbitrary code.

Successful exploitation requires winning a race condition. User interaction is required.

218) Use-after-free (CVE-ID: CVE-2026-69991)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when operating over a network. A remote attacker can trigger the use-after-free over a network to execute arbitrary code.

Successful exploitation requires winning a race condition and user interaction.

219) Use-after-free (CVE-ID: CVE-2026-69992)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Remote Desktop Services when handling network communication. A remote attacker can exploit the use-after-free over a network to execute arbitrary code.

Successful exploitation requires winning a race condition. User interaction is required.

220) Use-after-free (CVE-ID: CVE-2026-69994)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when handling network interactions. A remote attacker can exploit the use-after-free over a network to execute arbitrary code.

Successful exploitation requires winning a race condition. User interaction is required.

221) Use-after-free (CVE-ID: CVE-2026-69995)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when communicating over a network. A remote attacker can exploit the memory error to execute arbitrary code.

Successful exploitation requires winning a race condition and user interaction.

222) Use-after-free (CVE-ID: CVE-2026-69996)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when communicating over a network. A remote attacker can exploit the vulnerability over the network to execute arbitrary code.

Exploitation requires user interaction.

223) Use-after-free (CVE-ID: CVE-2026-69997)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when handling network communications. A remote attacker can exploit the use-after-free over the network to execute arbitrary code.

Successful exploitation requires winning a race condition. User interaction is required.

224) Use-after-free (CVE-ID: CVE-2026-69998)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when handling network communications. A remote attacker can win a race condition to execute arbitrary code.

User interaction is required for successful exploitation.

225) Out-of-bounds read (CVE-ID: CVE-2026-69999)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Update when accessed locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

226) Use-after-free (CVE-ID: CVE-2026-70004)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when communicating over a network. A remote attacker can exploit the use-after-free over the network to execute arbitrary code.

Successful exploitation requires winning a race condition and user interaction.

227) Weak Authentication (CVE-ID: CVE-2026-70005)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security feature.

The vulnerability exists due to weak authentication in Active Directory Federation Services (AD FS) when authenticating over a network. A remote attacker can exploit the weak authentication to bypass a security feature.

Successful exploitation is complex and time-consuming, requiring significant effort and precise conditions.

228) Use-after-free (CVE-ID: CVE-2026-70006)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when handling network communication. A remote attacker can exploit the flaw over a network to execute arbitrary code.

Successful exploitation requires winning a race condition and user interaction.

229) Out-of-bounds write (CVE-ID: CVE-2026-70007)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in .NET Framework when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

230) Integer overflow (CVE-ID: CVE-2026-70008)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in Windows IP Over USB Service when the service operates locally. A local user can exploit this weakness locally to escalate privileges to SYSTEM.

231) Heap-based buffer overflow (CVE-ID: CVE-2026-70010)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows NTFS when exploited locally. A local user can exploit the overflow to escalate privileges to SYSTEM.

232) Out-of-bounds read (CVE-ID: CVE-2026-70011)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows IP Over USB Service when accessing the service locally. A local user can read small portions of heap memory to disclose sensitive information.

233) Use-after-free (CVE-ID: CVE-2026-70012)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the Remote Desktop Client when communicating over a network. A remote attacker can exploit this flaw to execute arbitrary code.

Successful exploitation requires winning a race condition. User interaction is required.

234) Use-after-free (CVE-ID: CVE-2026-70013)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows iSCSI when handling network endpoint calls. A remote attacker can call arbitrary endpoints over the network to execute arbitrary code.

Successful exploitation requires winning a race condition.

235) Use-after-free (CVE-ID: CVE-2026-70014)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Cryptographic Services when accessed over a network. A remote user can exploit the memory corruption over a network to execute arbitrary code.

Successful exploitation requires winning a race condition.

236) Use-after-free (CVE-ID: CVE-2026-70015)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Local Security Authority Subsystem Service (LSASS) when operating locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

No user interaction is required.

237) Type Confusion (CVE-ID: CVE-2026-70017)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory.

The vulnerability exists due to type confusion in Windows Secure Kernel Mode when accessing a resource using an incompatible type. A local user can exploit the type confusion locally to disclose uninitialized heap memory.

238) Use-after-free (CVE-ID: CVE-2026-70021)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Direct Composition when previously freed memory is accessed. A local user can exploit the use-after-free locally to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

239) Use-after-free (CVE-ID: CVE-2026-70023)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Hyper-V when freed memory is used. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

240) Stack-based buffer overflow (CVE-ID: CVE-2026-70024)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Windows Internet Information Services when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

241) Use-after-free (CVE-ID: CVE-2026-70025)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in Windows Netlogon when used over a network. A remote user can trigger the use-after-free to cause a denial of service.

Exploitation does not require user interaction.

242) Use-after-free (CVE-ID: CVE-2026-70026)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Secure Kernel Mode when a race condition is won. A local user can exploit this condition locally to escalate privileges to SYSTEM.

No user interaction is required.

243) Heap-based buffer overflow (CVE-ID: CVE-2026-70027)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Subsystem for Linux when used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

244) Heap-based buffer overflow (CVE-ID: CVE-2026-70031)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in Windows iSCSI when handling network traffic. A remote attacker can trigger the vulnerability over a network to cause a denial of service.

245) Memory leak (CVE-ID: CVE-2026-70033)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after its effective lifetime in the Remote Desktop Gateway Service when handling network traffic. A remote attacker can interact with the service over a network to cause a denial of service.

246) Deserialization of Untrusted Data (CVE-ID: CVE-2026-70035)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in .NET Framework when processing attacker-supplied files. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

247) Use-after-free (CVE-ID: CVE-2026-70038)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows iSCSI when handling network endpoint calls. A remote attacker can call arbitrary endpoints over a network to execute arbitrary code.

Successful exploitation requires winning a race condition.

248) Buffer over-read (CVE-ID: CVE-2026-70041)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose a small amount of kernel memory.

The vulnerability exists due to a buffer over-read in Windows CD-ROM Driver when accessing memory buffers. A local user can exploit the buffer over-read locally to disclose a small amount of kernel memory.

249) Out-of-bounds read (CVE-ID: CVE-2026-70044)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose information.

The vulnerability exists due to an out-of-bounds read in Microsoft Windows Media Foundation when reading memory locally. A remote attacker can read small portions of heap memory to disclose information.

Exploitation requires user interaction.

250) Use-after-free (CVE-ID: CVE-2026-70045)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Work Folders when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

251) Heap-based buffer overflow (CVE-ID: CVE-2026-70048)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Resilient File System (ReFS) when exploited locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

252) Type Confusion (CVE-ID: CVE-2026-70051)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to type confusion in Windows SmartScreen when accessing resources using incompatible types. A local user can exploit the type confusion locally to escalate privileges.

The affected privilege boundary is between low and medium integrity levels.

253) Integer overflow (CVE-ID: CVE-2026-70052)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to integer overflow or wraparound in Windows PowerShell when executing locally. A local user can trigger the integer overflow or wraparound to execute arbitrary code locally.

254) Heap-based buffer overflow (CVE-ID: CVE-2026-70054)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows NetBIOS when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

255) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-70055)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services when accessed locally. A local user can exploit this information exposure to disclose one byte of kernel memory.

256) Use-after-free (CVE-ID: CVE-2026-70056)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Update Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

257) Incorrect authorization (CVE-ID: CVE-2026-70057)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass IPsec execution policy enforcement.

The vulnerability exists due to incorrect authorization in Windows Routing and Remote Access Service (RRAS) when applying IPsec policies. A local user can exploit the authorization flaw locally to bypass IPsec execution policy enforcement.

258) Out-of-bounds write (CVE-ID: CVE-2026-70058)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in Windows DHCP Server when handling network traffic. A remote attacker can exploit the flaw over a network to cause a denial of service.

259) Heap-based buffer overflow (CVE-ID: CVE-2026-70059)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows OLE when used locally. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

260) Heap-based buffer overflow (CVE-ID: CVE-2026-70060)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Win32 Kernel Subsystem when the subsystem is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

261) Double free (CVE-ID: CVE-2026-70062)

CWE-ID: CWE-415 - Double Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a double free in Windows Libarchive when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required. Successful exploitation requires a deep understanding of the system and may depend on the environment, system configuration, and additional security measures.

262) Out-of-bounds read (CVE-ID: CVE-2026-70063)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to an out-of-bounds read in the Windows kernel when a race condition occurs during local exploitation. A local user can win the race condition to disclose one byte of kernel memory.

263) Integer underflow (CVE-ID: CVE-2026-70064)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer underflow in Windows Kerberos when exploited locally. A local user can exploit the integer underflow to escalate privileges to SYSTEM.

264) Use-after-free (CVE-ID: CVE-2026-70066)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows DHCP Server when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

265) Heap-based buffer overflow (CVE-ID: CVE-2026-70068)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute code with SYSTEM privileges.

The vulnerability exists due to heap-based buffer overflow in Windows Client-Side Caching (CSC) Service when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute code with SYSTEM privileges.

266) Stack-based buffer overflow (CVE-ID: CVE-2026-70069)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code on the server.

The vulnerability exists due to a stack-based buffer overflow in Windows DHCP Server when handling network requests. A remote user can send a specially crafted request to execute arbitrary code on the server.

User interaction is not required.

267) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-70071)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform tampering locally.

The vulnerability exists due to improper verification of cryptographic signatures in DNS Server when verifying cryptographic signatures. A local user can exploit the signature verification flaw to perform tampering locally.

268) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-70072)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Windows Netlogon when allocating resources for network operations. A remote user can exploit unrestricted resource allocation over the network to cause a denial of service.

269) Out-of-bounds read (CVE-ID: CVE-2026-70074)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to an out-of-bounds read in Windows DNS when accessed locally. A local user can exploit the out-of-bounds read to disclose one byte of kernel memory.

270) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-70075)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to bypass the Windows Key Storage Provider security feature.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Virtualization-Based Security (VBS) Enclave when performing security checks. A local privileged user can exploit the race condition locally to bypass the Windows Key Storage Provider security feature.

The Windows Key Storage Provider issues key certificates for trust in attestation scenarios.

271) Use-after-free (CVE-ID: CVE-2026-70076)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when exploited locally. A local user can exploit this memory safety flaw to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

272) Use-after-free (CVE-ID: CVE-2026-70077)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to use-after-free in the Windows Kernel when exploited locally. A local user can win a race condition to disclose one byte of kernel memory.

273) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-70079)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper enforcement of behavioral workflow in Windows DNS when handling network traffic. A remote attacker can exploit the workflow enforcement weakness over a network to cause a denial of service.

No user interaction is required.

274) Uncaught Exception (CVE-ID: CVE-2026-70082)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in Windows DNS when handling network traffic. A remote attacker can trigger the exception over the network to cause a denial of service.

275) Incorrect authorization (CVE-ID: CVE-2026-70083)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to tamper with DNS Server.

The vulnerability exists due to incorrect authorization in DNS Server when performing local operations. A local user can exploit the authorization weakness locally to tamper with DNS Server.

276) Path traversal (CVE-ID: CVE-2026-70084)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper limitation of pathnames to a restricted directory in Windows Projected File System when accessing the file system locally. A local user can read files without authorization to disclose sensitive information.

277) Missing Authorization (CVE-ID: CVE-2026-70085)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to tamper with DNS Server.

The vulnerability exists due to missing authorization in DNS Server when performing local operations. A local user can perform unauthorized local operations to tamper with DNS Server.

278) Use-after-free (CVE-ID: CVE-2026-70086)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Windows Search Component when exploiting a race condition locally. A local user can win the race condition to escalate privileges to SYSTEM.

279) Incorrect authorization (CVE-ID: CVE-2026-70087)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass access checks for RPC procedures restricted to privileged accounts.

The vulnerability exists due to incorrect authorization in DNS Server when handling local RPC calls. A local user can invoke restricted RPC procedures to bypass access checks for RPC procedures restricted to privileged accounts.

280) Heap-based buffer overflow (CVE-ID: CVE-2026-70089)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows GDI when exploitation occurs over a network. A remote attacker can exploit this flaw over a network to execute arbitrary code.

User interaction is required.

281) Use of uninitialized resource (CVE-ID: CVE-2026-70090)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to use of an uninitialized resource in Windows Netlogon when using resources that have not been initialized. A local user can exploit the uninitialized resource locally to disclose uninitialized heap memory from a privileged process.

282) Heap-based buffer overflow (CVE-ID: CVE-2026-70092)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow in Microsoft PostScript Printer Driver when exploited locally. A remote attacker can trigger the heap-based buffer overflow to gain SYSTEM privileges.

User interaction is required.

283) Heap-based buffer overflow (CVE-ID: CVE-2026-70093)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Rich Text Edit Control when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

284) Heap-based buffer overflow (CVE-ID: CVE-2026-70095)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows iSCSI when handling network communications. A remote attacker can trigger the overflow over a network to execute arbitrary code.

User interaction is required. Successful exploitation is complex and time-consuming, requiring significant effort and precise conditions.

285) Heap-based buffer overflow (CVE-ID: CVE-2026-70096)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Rich Text Edit Control when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

286) Race condition (CVE-ID: CVE-2026-70097)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform spoofing locally.

The vulnerability exists due to improper synchronization of shared resources in Windows Virtualization-Based Security (VBS) Enclave when executing concurrently. A local user can win a race condition to perform spoofing locally.

287) Use-after-free (CVE-ID: CVE-2026-70102)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Spaceport.sys when exploited locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

288) Heap-based buffer overflow (CVE-ID: CVE-2026-70103)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Error Reporting when the component is used locally. A local user can trigger the buffer overflow to escalate privileges to SYSTEM.

289) Untrusted Pointer Dereference (CVE-ID: CVE-2026-70104)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in the Windows Win32 Kernel Subsystem when dereferencing untrusted pointers. A local user can exploit the vulnerability locally to escalate privileges to SYSTEM.

290) Heap-based buffer overflow (CVE-ID: CVE-2026-70106)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Kernel when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

291) Heap-based buffer overflow (CVE-ID: CVE-2026-70108)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Win32 Kernel Subsystem when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

292) Heap-based buffer overflow (CVE-ID: CVE-2026-70109)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Microsoft PostScript Printer Driver when exploited locally. A remote attacker can exploit the buffer overflow locally to escalate privileges to SYSTEM.

User interaction is required for exploitation.

293) Stack-based buffer overflow (CVE-ID: CVE-2026-70110)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain SYSTEM privileges.

The vulnerability exists due to a stack-based buffer overflow in Microsoft PostScript Printer Driver when the driver is used locally. A remote attacker can exploit the buffer overflow to gain SYSTEM privileges.

User interaction is required.

294) Untrusted Pointer Dereference (CVE-ID: CVE-2026-70111)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in Windows Kernel when dereferencing an untrusted pointer during network-based exploitation. A remote attacker can manipulate system components to trigger a specific condition over a network to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and is not guaranteed. Success may depend on the environment, system configuration, and the presence of additional security measures.

295) Heap-based buffer overflow (CVE-ID: CVE-2026-70112)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to a heap-based buffer overflow in Windows Spaceport.sys when accessed locally. A local user can exploit the buffer overflow to execute arbitrary code locally.

296) Integer overflow (CVE-ID: CVE-2026-70113)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in Windows Client for NFS when performing local operations. A local user can exploit the integer overflow or wraparound locally to escalate privileges to SYSTEM.

297) Heap-based buffer overflow (CVE-ID: CVE-2026-70114)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Kernel when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

298) Use-after-free (CVE-ID: CVE-2026-70115)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Microsoft Windows Search Component when accessing previously freed memory. A local user can win a race condition to escalate privileges to SYSTEM.

299) Stack-based buffer overflow (CVE-ID: CVE-2026-70116)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 4.1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to bypass a security feature.

The vulnerability exists due to a stack-based buffer overflow in Windows Resilient File System (ReFS) when the system is subjected to a physical attack. An attacker with physical access can exploit the buffer overflow through physical access to bypass a security feature.

Successful exploitation is complex and time-consuming, requiring significant effort and precise conditions.

300) Heap-based buffer overflow (CVE-ID: CVE-2026-70117)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Win32 Kernel Subsystem when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

301) Use-after-free (CVE-ID: CVE-2026-70118)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Audio Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

302) Out-of-bounds read (CVE-ID: CVE-2026-70119)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Windows DNS when handling network input. A remote user can exploit the out-of-bounds read over a network to cause a denial of service.

303) Heap-based buffer overflow (CVE-ID: CVE-2026-70121)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Kernel when exploited locally. A local user can exploit the overflow to escalate privileges to SYSTEM.

304) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-70122)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Broadcast DVR User Service when the service is accessed locally. A local user can exploit the race condition to escalate privileges.

The privilege transition is from a low integrity level in a contained (sandboxed) execution environment to a medium integrity level.

305) Numeric Truncation Error (CVE-ID: CVE-2026-70123)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a numeric truncation error in Microsoft Graphics Component when used locally. A local user can exploit the numeric truncation error to escalate privileges to SYSTEM.

306) Out-of-bounds read (CVE-ID: CVE-2026-70126)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in the Windows Bluetooth Port Driver when communicating over an adjacent network. A remote attacker can exploit the out-of-bounds read over the adjacent network to execute arbitrary code.

User interaction is required. Successful exploitation is complex and time-consuming, requiring significant effort and precise conditions.

307) Use-after-free (CVE-ID: CVE-2026-70127)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the DNS Server service when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.

308) Out-of-bounds read (CVE-ID: CVE-2026-70128)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in HID Parser Library when accessing memory locally. A local user can read kernel memory from a user-mode process to disclose sensitive information.

309) Heap-based buffer overflow (CVE-ID: CVE-2026-70131)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Media Foundation when the component is used locally. A remote attacker can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

User interaction is required for exploitation.

310) Heap-based buffer overflow (CVE-ID: CVE-2026-70132)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Portable Device File System Driver when exploited locally. A local user can trigger the heap-based buffer overflow to escalate privileges to SYSTEM.

311) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-70133)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Windows SMB Server when handling network requests. A remote attacker can trigger resource allocation over the network to cause a denial of service.

312) Use-after-free (CVE-ID: CVE-2026-70134)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Event Tracing when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

313) Out-of-bounds read (CVE-ID: CVE-2026-70135)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Remote POS Driver when accessed locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

314) Use-after-free (CVE-ID: CVE-2026-70136)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Windows Search Component when operating locally. A local user can exploit the use-after-free to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

315) Missing Authentication for Critical Function (CVE-ID: CVE-2026-70137)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read small portions of heap memory.

The vulnerability exists due to improper access control in Windows Remote Access Connection Manager when accessing the component locally. A local user can exploit the access control weakness to read small portions of heap memory.

316) Heap-based buffer overflow (CVE-ID: CVE-2026-70138)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges from Medium Integrity Level to Local Service.

The vulnerability exists due to a heap-based buffer overflow in Windows OLE when exploited locally. A local user can exploit the buffer overflow to escalate privileges.

User interaction is not required.

317) Heap-based buffer overflow (CVE-ID: CVE-2026-70139)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Update Service when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

318) Use-after-free (CVE-ID: CVE-2026-70140)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Audio Service when a race condition occurs. A local user can win the race condition and exploit the use-after-free to escalate privileges to SYSTEM.

No user interaction is required.

319) Out-of-bounds read (CVE-ID: CVE-2026-70141)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Windows Search Component when reading memory locally. A local user can exploit the out-of-bounds read to disclose sensitive information.

The exposed information includes heap memory from a privileged process running on the server.

320) Untrusted search path (CVE-ID: CVE-2026-70142)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an untrusted search path in Windows Update Service when resolving search paths. A local user can exploit the untrusted search path to escalate privileges to SYSTEM.

321) Heap-based buffer overflow (CVE-ID: CVE-2026-70143)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to a heap-based buffer overflow in Windows Network File System when the component is used locally. A local user can exploit the buffer overflow to execute arbitrary code locally.

322) Use-after-free (CVE-ID: CVE-2026-70144)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when a race condition is won during local exploitation. A local user can exploit the use-after-free to escalate privileges to SYSTEM.

323) Heap-based buffer overflow (CVE-ID: CVE-2026-70147)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft PostScript Printer Driver when processing print jobs. A remote attacker can send a specially crafted print job to an affected print service over the network to execute arbitrary code.

User interaction is not required.

324) Improper Authorization (CVE-ID: CVE-2026-70148)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper authorization in Windows Broadcast DVR User Service when accessing capture metadata. A local user can access Broadcast DVR capture metadata belonging to another process to disclose sensitive information.

The accessible metadata belongs to another process in the same user session.

325) Heap-based buffer overflow (CVE-ID: CVE-2026-70149)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute code with SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow and an integer overflow in the Windows Client Side Caching driver (csc.sys) when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute code with SYSTEM privileges.

326) Use-after-free (CVE-ID: CVE-2026-70150)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Windows Search Component when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

327) Use-after-free (CVE-ID: CVE-2026-70151)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Direct Composition when used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

No user interaction is required.

328) Heap-based buffer overflow (CVE-ID: CVE-2026-70153)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft PostScript Printer Driver when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

329) Memory leak (CVE-ID: CVE-2026-70155)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after its effective lifetime in Windows DNS when handling network traffic. A remote attacker can trigger a memory leak over a network to cause a denial of service.

330) Use-after-free (CVE-ID: CVE-2026-70156)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Microsoft Windows Search Component when the component is accessed locally. A local user can win a race condition to escalate privileges to SYSTEM.

331) Heap-based buffer overflow (CVE-ID: CVE-2026-70157)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows System Information Console when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

332) Double free (CVE-ID: CVE-2026-70158)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to double free in Windows Routing and Remote Access Service (RRAS) when accessed over a network. A remote user can exploit the double free to execute arbitrary code.

333) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-70159)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in ASP.NET Core when handling network requests. A remote attacker can trigger resource allocation over the network to cause a denial of service.

334) Use-after-free (CVE-ID: CVE-2026-70160)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Kernel when performing local exploitation. A local user can win a race condition and exploit the use-after-free to escalate privileges to SYSTEM.

335) Path traversal (CVE-ID: CVE-2026-70161)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to path traversal in .NET when handling pathnames. A local user can exploit the path traversal locally to escalate privileges.

User interaction is required for exploitation.

336) Asymmetric Resource Consumption (Amplification) (CVE-ID: CVE-2026-70162)

CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service against a .NET web application.

The vulnerability exists due to asymmetric resource consumption in Microsoft Common Object Runtime Library when handling web requests. A remote attacker can issue specially crafted requests to a .NET web application to cause a denial of service.

337) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-70163)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in OpenSSH for Windows when handling network interactions. A remote attacker can trigger resource allocation over the network to cause a denial of service.

338) Use-after-free (CVE-ID: CVE-2026-70164)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows TCP/IP when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

339) Link following (CVE-ID: CVE-2026-70165)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper link resolution before file access in .NET when accessing files. A local user can exploit a link-following race condition to escalate privileges.

Successful exploitation requires additional actions to prepare the target environment and user interaction.

340) Out-of-bounds read (CVE-ID: CVE-2026-70166)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Windows DNS when accessed over a network. A remote user can exploit this flaw over a network to cause a denial of service.

341) Type Confusion (CVE-ID: CVE-2026-70167)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to type confusion in DNS Server when accessing a resource using an incompatible type. A remote user can exploit the type confusion over a network to execute arbitrary code.

342) Use-after-free (CVE-ID: CVE-2026-70168)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Ancillary Function Driver for WinSock when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

343) Race condition (CVE-ID: CVE-2026-70169)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of shared resources in Windows Connected Devices Platform Service when concurrent operations access a shared resource. A local user can win a race condition to escalate privileges to SYSTEM.

344) Untrusted Pointer Dereference (CVE-ID: CVE-2026-70170)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to untrusted pointer dereference in Windows Kernel when handling network-based interactions. A remote user can exploit the vulnerability over a network to cause a denial of service.

345) Untrusted Pointer Dereference (CVE-ID: CVE-2026-70172)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in Windows NTFS when dereferencing untrusted pointers. A local user can exploit the pointer dereference locally to escalate privileges to SYSTEM.

346) Out-of-bounds read (CVE-ID: CVE-2026-70173)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Windows Search Component when accessing memory locally. A local user can read beyond the intended memory bounds to disclose one byte of kernel memory.

347) Improperly implemented security check for standard (CVE-ID: CVE-2026-70174)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an improperly implemented security check for a standard in .NET when handling a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

348) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: CVE-2026-70175)

CWE-ID: CWE-640 - Weak password recovery mechanism

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges and take over a targeted account.

The vulnerability exists due to a weak password recovery mechanism in ASP.NET Core when processing password reset requests. A remote attacker can submit a password reset request using a specially crafted email address that is treated as equivalent to another account to escalate privileges and take over a targeted account.

No user interaction is required. Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition.

349) Use-after-free (CVE-ID: CVE-2026-70176)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when the subsystem is used locally. A local user can exploit this memory error to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

350) Numeric Truncation Error (CVE-ID: CVE-2026-70177)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a numeric truncation error in Microsoft Windows Search Component when performing local operations. A local user can exploit the affected component locally to escalate privileges to SYSTEM.

351) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-70179)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to authentication bypass by spoofing in ASP.NET Core when authenticating users over a network. A remote user can bypass authentication through spoofing to escalate privileges.

Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition.

352) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-70181)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in ASP.NET Core when handling network traffic. A remote attacker can trigger unbounded resource allocation to cause a denial of service.

353) Race condition (CVE-ID: CVE-2026-70183)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper synchronization of a shared resource in ASP.NET Core when concurrently accessing the resource. A remote user can win a race condition to escalate privileges.

354) Improper Resolution of Path Equivalence (CVE-ID: CVE-2026-70184)

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper resolution of path equivalence in Windows Backup Engine when resolving paths. A local user can exploit the path equivalence resolution flaw locally to escalate privileges to SYSTEM.

355) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-70185)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute untrusted code with capabilities normally blocked by security restrictions.

The vulnerability exists due to protection mechanism failure in Windows PowerShell when enforcing restrictions on local code execution. A local user can bypass Windows Defender Application Control and PowerShell Constrained Language Mode restrictions to execute untrusted code with capabilities normally blocked by those protections.

356) Deadlock (CVE-ID: CVE-2026-70186)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a deadlock in ASP.NET Core when accessed over a network. A remote attacker can trigger the deadlock to cause a denial of service.

357) Use-after-free (CVE-ID: CVE-2026-70187)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Gateway Service when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

No user interaction is required. Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

358) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-70188)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication and access protected resources.

The vulnerability exists due to inconsistent interpretation of HTTP requests in ASP.NET Core when processing HTTP/2 requests. A remote attacker can send specially crafted HTTP/2 requests to bypass authentication and access protected resources.

No user interaction is required.

359) Link following (CVE-ID: CVE-2026-70190)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper link resolution before file access in .NET when accessing files. A local user can exploit link-following behavior to escalate privileges, gaining the ability to create, modify, or delete files in the security context of the NT AUTHORITYSYSTEM account.

User interaction is required for exploitation.

360) Improper Certificate Validation (CVE-ID: CVE-2026-70194)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certificate validation mechanisms.

The vulnerability exists due to improper certificate validation in .NET Framework when validating certificates supplied over a network. A remote attacker can provide arbitrary certificates that do not have proper signatures to bypass certificate validation mechanisms.

361) Use-after-free (CVE-ID: CVE-2026-70195)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to use-after-free in Windows Ancillary Function Driver for WinSock when accessing previously freed memory locally. A local user can exploit the use-after-free to disclose one byte of kernel memory.

Successful exploitation requires winning a race condition.

362) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-70196)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in ASP.NET Core when handling network traffic. A remote attacker can trigger inefficient processing over a network to cause a denial of service.

363) Out-of-bounds write (CVE-ID: CVE-2026-70197)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in .NET when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required. Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition.

364) Use-after-free (CVE-ID: CVE-2026-70198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Push Notifications when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

365) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-70199)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in the Windows kernel when accessed locally. A local user can exploit this exposure locally to disclose sensitive information.

The disclosed data is limited to one byte of kernel memory.

366) Out-of-bounds read (CVE-ID: CVE-2026-70201)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Windows DHCP Server when the flaw is exploited locally. A local user can trigger the out-of-bounds read to cause a denial of service.

367) Type Confusion (CVE-ID: CVE-2026-70205)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to type confusion in Windows Ancillary Function Driver for WinSock when accessing resources using incompatible types. A local user can win a race condition to escalate privileges to SYSTEM.

368) Out-of-bounds read (CVE-ID: CVE-2026-70206)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Word when the application is targeted over a network. A remote attacker can exploit the out-of-bounds read to read small portions of heap memory.

User interaction is required. The Preview Pane is not an attack vector.

369) Heap-based buffer overflow (CVE-ID: CVE-2026-70207)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Network Policy Server (NPS) when handling network traffic. A remote user can exploit the overflow over a network to execute arbitrary code.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

370) Out-of-bounds read (CVE-ID: CVE-2026-70208)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to an out-of-bounds read in Windows HTTP.sys when reading memory during local exploitation. A local user can exploit the out-of-bounds read to disclose certain kernel memory content.

371) Use-after-free (CVE-ID: CVE-2026-70209)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

Successful exploitation is complex and time-consuming, requiring significant effort and precise conditions. No user interaction is required.

372) Heap-based buffer overflow (CVE-ID: CVE-2026-70210)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows OLE DB when used over a network. A remote attacker can exploit the vulnerability over a network to escalate privileges to SYSTEM.

User interaction is required for exploitation.

373) Out-of-bounds read (CVE-ID: CVE-2026-70211)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to an out-of-bounds read in the Windows Win32 Kernel Subsystem when reading memory locally. A local user can exploit the out-of-bounds read to disclose one byte of kernel memory.

374) Improper restriction of communication channel to intended endpoints (CVE-ID: CVE-2026-70212)

CWE-ID: CWE-923 - Improper Restriction of Communication Channel to Intended Endpoints

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper restriction of communication channels to intended endpoints in Windows Security Center when communicating with endpoints. A local user can exploit the improperly restricted communication channel locally to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and is not guaranteed; it depends on factors that may include the environment, system configuration, and additional security measures.

375) Out-of-bounds read (CVE-ID: CVE-2026-70214)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when accessing heap memory. A remote attacker can read small portions of heap memory to disclose sensitive information.

User interaction is required. The Preview Pane is not an attack vector.

376) Use-after-free (CVE-ID: CVE-2026-70215)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office PowerPoint when processing malicious Office files. A remote attacker can send a malicious Office file to a victim and convince them to open it to execute arbitrary code.

The Preview Pane is also an attack vector.

377) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-70216)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform tampering locally.

The vulnerability exists due to insufficient granularity of access control in Windows Mobile Device Management when performing local operations. A local user can exploit the access control weakness to perform tampering locally.

378) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-70218)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to insufficient granularity of access control in Windows StateRepository API when accessing the API locally. A local user can exploit the insufficiently granular access controls to escalate privileges to SYSTEM.

379) Out-of-bounds read (CVE-ID: CVE-2026-70219)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose small portions of heap memory.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when exploited over a network. A remote attacker can trigger the out-of-bounds read to disclose small portions of heap memory.

Exploitation requires user interaction. The Preview Pane is not an attack vector.

380) Heap-based buffer overflow (CVE-ID: CVE-2026-70220)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code locally.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a malicious Office file. A remote attacker can send a malicious Office file and convince the victim to open it to execute arbitrary code locally.

The Preview Pane is not an attack vector for this vulnerability.

381) Relative Path Traversal (CVE-ID: CVE-2026-70222)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to relative path traversal in Windows Shell when handling relative paths. A local user can exploit relative path traversal locally to escalate privileges to SYSTEM.

382) Use-after-free (CVE-ID: CVE-2026-70223)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Console Driver when exploiting a local race condition. A local user can win the race condition to escalate privileges to SYSTEM.

383) Type Confusion (CVE-ID: CVE-2026-70225)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to type confusion in Windows Ancillary Function Driver for WinSock when accessing a resource using an incompatible type. A local user can exploit the type confusion locally to escalate privileges to SYSTEM.

384) Out-of-bounds read (CVE-ID: CVE-2026-70227)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Device Association Service when reading memory locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

385) Out-of-bounds read (CVE-ID: CVE-2026-70228)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to an out-of-bounds read in Desktop Window Manager when exploited locally. A local user can exploit the out-of-bounds read to gain SYSTEM privileges.

No user interaction is required.

386) Incorrect authorization (CVE-ID: CVE-2026-70229)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to incorrect authorization in Active Directory Domain Services when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

Exploitation requires particular network configurations and timing conditions and has only been observed in limited scenarios. No user interaction is required.

387) Use-after-free (CVE-ID: CVE-2026-70230)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Audio Service when exploitation occurs locally. A local user can win a race condition to escalate privileges to SYSTEM.

No user interaction is required.

388) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-70232)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in the Windows kernel when exploited locally. A local user can exploit this weakness to disclose one byte of kernel memory.

389) Heap-based buffer overflow (CVE-ID: CVE-2026-70233)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Common Log File System Driver when used locally. A local user can exploit the heap-based buffer overflow locally to escalate privileges to SYSTEM.

390) Buffer over-read (CVE-ID: CVE-2026-70234)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a buffer over-read in Desktop Window Manager when reading memory. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

391) Improper Authentication (CVE-ID: CVE-2026-70235)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform spoofing.

The vulnerability exists due to improper authentication in Windows Event Tracing when the component is accessed locally. A local user can exploit the authentication weakness to perform spoofing.

392) Use-after-free (CVE-ID: CVE-2026-70236)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

393) Use-after-free (CVE-ID: CVE-2026-70237)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Ancillary Function Driver for WinSock when a race condition is triggered during local exploitation. A local user can exploit the use-after-free to escalate privileges to SYSTEM.

394) Heap-based buffer overflow (CVE-ID: CVE-2026-70238)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Storage Spaces Controller when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

395) Use-after-free (CVE-ID: CVE-2026-70241)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Kerberos when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

396) Heap-based buffer overflow (CVE-ID: CVE-2026-70242)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Office Outlook when rendering email messages in the Reading Pane. A remote attacker can send a specially crafted email message to a target user to execute arbitrary code.

Exploitation does not require the recipient to open the message or click anything in it.

397) Use-after-free (CVE-ID: CVE-2026-70243)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Kernel when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

398) Out-of-bounds read (CVE-ID: CVE-2026-70244)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows DNS Server when handling network communications. A remote attacker can exploit the out-of-bounds read over a network to disclose sensitive information.

The disclosed information concerns kernel-space memory accessed from a user-mode process. User interaction is required.

399) Type Confusion (CVE-ID: CVE-2026-70245)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to type confusion in Windows Ancillary Function Driver for WinSock when accessing a resource using an incompatible type. A local user can exploit the type confusion locally to escalate privileges to SYSTEM.

400) Out-of-bounds read (CVE-ID: CVE-2026-70247)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute code locally.

The vulnerability exists due to an out-of-bounds read in Windows HTTP.sys when exploited locally. A local user can exploit the out-of-bounds read to execute code locally.

No user interaction is required.

401) NULL pointer dereference (CVE-ID: CVE-2026-70248)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in Windows Hyper-V when used locally. A local user can trigger the null pointer dereference to cause a denial of service.

402) Use-after-free (CVE-ID: CVE-2026-70249)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

403) Use-after-free (CVE-ID: CVE-2026-70250)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows DHCP Client when communicating over an adjacent network. A remote attacker can exploit this memory handling flaw over the adjacent network to execute arbitrary code.

No user interaction is required.

404) Use-after-free (CVE-ID: CVE-2026-70252)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Virtual Hard Disk (VHD) Miniport Driver when the driver is used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

405) Use-after-free (CVE-ID: CVE-2026-70253)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when a race condition is won. A local user can exploit this condition to escalate privileges to SYSTEM.

406) Out-of-bounds read (CVE-ID: CVE-2026-70254)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Excel when processing malicious Office files. A remote attacker can send a user a malicious Office file and convince them to open it to execute arbitrary code.

The Preview Pane is also an attack vector.

407) Heap-based buffer overflow (CVE-ID: CVE-2026-70255)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Desktop Window Manager when the component is used locally. A local user can exploit the buffer overflow locally to escalate privileges to SYSTEM.

408) Heap-based buffer overflow (CVE-ID: CVE-2026-70256)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

409) Heap-based buffer overflow (CVE-ID: CVE-2026-70257)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when processing a specially crafted file. A remote attacker can trick a victim into opening a specially crafted file to execute arbitrary code.

410) Heap-based buffer overflow (CVE-ID: CVE-2026-70258)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Media Foundation when processing specially crafted files. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

411) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-70260)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper when accessing system information locally. A local user can view heap memory from a privileged process running on the server to disclose sensitive information.

412) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-70261)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper when accessed locally. A local user can view exposed heap memory from a privileged process running on the server to disclose sensitive information.

413) Heap-based buffer overflow (CVE-ID: CVE-2026-70262)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in WebDAV when handling network communication. A remote attacker can exploit the buffer overflow over a network to escalate privileges to SYSTEM.

User interaction is required for exploitation.

414) Out-of-bounds read (CVE-ID: CVE-2026-70263)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Word when accessing heap memory. A remote attacker can exploit this issue over a network to disclose sensitive information.

Exploitation requires user interaction. The disclosed information may include small portions of heap memory. The Preview Pane is not an attack vector.

415) Heap-based buffer overflow (CVE-ID: CVE-2026-70268)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing specially crafted files. A remote attacker can trick a victim into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector.

416) Heap-based buffer overflow (CVE-ID: CVE-2026-70269)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when handling content through the Preview Pane. A remote attacker can trigger the buffer overflow over a network to execute arbitrary code.

Successful exploitation requires a deep understanding of the system and the ability to manipulate its components to trigger a specific condition. Success depends on factors that may include the environment, system configuration, and additional security measures.

417) Untrusted Pointer Dereference (CVE-ID: CVE-2026-70270)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read kernel memory.

The vulnerability exists due to untrusted pointer dereference in Windows Container Isolation FS Filter Driver when dereferencing untrusted pointers. A local user can exploit this flaw locally to read kernel memory.

The kernel memory contents can be accessed from a user-mode process.

418) Use-after-free (CVE-ID: CVE-2026-70271)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

419) Use-after-free (CVE-ID: CVE-2026-70272)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

420) Use-after-free (CVE-ID: CVE-2026-70273)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when the subsystem is used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

421) Use-after-free (CVE-ID: CVE-2026-70274)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Bind Filter Driver when the driver is exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

422) Untrusted Pointer Dereference (CVE-ID: CVE-2026-70275)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to untrusted pointer dereference in the Windows CD-ROM Driver when dereferencing an untrusted pointer. A remote attacker can exploit the driver over a network to execute arbitrary code.

User interaction is required for exploitation.

423) Use-after-free (CVE-ID: CVE-2026-70276)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Office Click-To-Run when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

The Preview Pane is not an attack vector for this vulnerability.

424) Out-of-bounds read (CVE-ID: CVE-2026-70277)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Fast FAT Driver when reading memory locally. A remote attacker can read kernel memory from a user mode process to disclose sensitive information.

User interaction is required.

425) Heap-based buffer overflow (CVE-ID: CVE-2026-70278)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Media Foundation when used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

426) Incorrect authorization (CVE-ID: CVE-2026-70280)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to bypass Windows biometric authentication.

The vulnerability exists due to incorrect authorization in Windows Hello when determining whether a biometric device is trusted. A local privileged user can use a malicious biometric device that is incorrectly recognized as trusted to falsely present biometric data to bypass Windows biometric authentication.

427) Out-of-bounds read (CVE-ID: CVE-2026-70281)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Outlook when rendering content. A remote attacker can read small portions of heap memory to disclose information.

The Preview Pane is an attack vector.

428) Heap-based buffer overflow (CVE-ID: CVE-2026-70282)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Outlook when opening a specially crafted file. A remote attacker can trick a victim into opening a specially crafted file to execute arbitrary code.

429) Use of uninitialized resource (CVE-ID: CVE-2026-70284)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to use of an uninitialized resource in the Windows Win32 Kernel Subsystem when accessing an uninitialized resource. A local user can exploit this resource locally to disclose one byte of kernel memory.

430) Heap-based buffer overflow (CVE-ID: CVE-2026-70285)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Win32 Kernel Subsystem when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

431) Heap-based buffer overflow (CVE-ID: CVE-2026-70286)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Win32K - GRFX when exploited locally. A local user can exploit this buffer overflow to escalate privileges to SYSTEM.

432) Heap-based buffer overflow (CVE-ID: CVE-2026-70287)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector.

433) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-70288)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in the Windows Win32 Kernel Subsystem when performing local operations. A local user can exploit the race condition to disclose one byte of kernel memory.

434) Heap-based buffer overflow (CVE-ID: CVE-2026-70291)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Office Outlook when rendering email messages in the Reading Pane. A remote attacker can send a specially crafted email message to a target user to execute arbitrary code.

The Preview Pane is an attack vector. Exploitation does not require the recipient to open the message or click its contents, and no user interaction is required.

435) Out-of-bounds read (CVE-ID: CVE-2026-70292)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Windows Win32 Kernel Subsystem when reading kernel memory locally. A local user can exploit the out-of-bounds read to disclose sensitive information.

The disclosure is limited to one byte of kernel memory.

436) Use of uninitialized resource (CVE-ID: CVE-2026-70293)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to use of an uninitialized resource in the Windows Win32 Kernel Subsystem when accessing the resource locally. A local user can exploit the uninitialized resource to disclose one byte of kernel memory.

437) Out-of-bounds read (CVE-ID: CVE-2026-70294)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose one byte of kernel memory.

The vulnerability exists due to an out-of-bounds read in the Windows Win32 Kernel Subsystem when accessed locally. A local user can exploit the out-of-bounds read to disclose one byte of kernel memory.

438) Out-of-bounds read (CVE-ID: CVE-2026-70295)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Windows Win32 Kernel Subsystem when accessed locally. A local user can exploit the out-of-bounds read locally to disclose sensitive information.

439) Incorrect authorization (CVE-ID: CVE-2026-70299)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to incorrect authorization in Windows Bind Filter Driver when handling local access. A local user can exploit the driver's improper access control to escalate privileges to SYSTEM.

Exploitation can originate from a low-privilege AppContainer and cross its security boundary, enabling code execution or resource access at a higher integrity level.

440) Untrusted Pointer Dereference (CVE-ID: CVE-2026-70300)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to untrusted pointer dereference in Microsoft Office Word when processing WordPerfect documents. A remote attacker can send a specially crafted WordPerfect document with a linked graphics file to a target user to execute arbitrary code.

The vulnerability can be triggered when the document is processed in the Reading Pane without the user opening it. The Preview Pane is also an attack vector.

441) Heap-based buffer overflow (CVE-ID: CVE-2026-70301)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Office Word when processing specially crafted files. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector.

442) Heap-based buffer overflow (CVE-ID: CVE-2026-70302)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing specially crafted files. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

The Preview Pane is not an attack vector.

443) Out-of-bounds write (CVE-ID: CVE-2026-70303)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to an out-of-bounds write in Windows Kernel when exploited locally. A local user can exploit the out-of-bounds write to gain SYSTEM privileges.

444) NULL pointer dereference (CVE-ID: CVE-2026-70566)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a null pointer dereference in Windows Schannel when the component is used locally. A local user can exploit the null pointer dereference locally to escalate privileges to SYSTEM.

445) Missing Authentication for Critical Function (CVE-ID: CVE-2026-70580)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to intercept or alter security operations.

The vulnerability exists due to missing authentication for a critical function in Windows Credential Guard when the affected service restarts. A local user can cause the affected service to become unavailable and impersonate it when it restarts to intercept or alter security operations.

User interaction is not required.

446) Use-after-free (CVE-ID: CVE-2026-72934)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Program Compatibility Assistant Service when exploitation occurs locally. A local user can win a race condition and exploit the flaw to escalate privileges to SYSTEM.

447) Use-after-free (CVE-ID: CVE-2026-72955)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Application Compatibility Cache when the cache is used locally. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

448) Use-after-free (CVE-ID: CVE-2026-72968)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Program Compatibility Assistant Service when exploited locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

449) Use-after-free (CVE-ID: CVE-2026-72969)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Program Compatibility Assistant Service when exploitation occurs locally. A local user can win a race condition to escalate privileges to SYSTEM.

450) External Control of System or Configuration Setting (CVE-ID: CVE-2026-73027)

CWE-ID: CWE-15 - External Control of System or Configuration Setting

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to external control of system or configuration settings in Windows Setup Files Cleanup when handling system or configuration settings. A local user can control these settings to escalate privileges to SYSTEM.

451) Heap-based buffer overflow (CVE-ID: CVE-2026-77496)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Imaging Component when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

452) Heap-based buffer overflow (CVE-ID: CVE-2026-77902)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Excel when processing a specially crafted file. A remote attacker can trick a victim into opening the file to execute arbitrary code.

The Preview Pane is not an attack vector for this vulnerability.

453) Heap-based buffer overflow (CVE-ID: CVE-2026-78459)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Internet Information Services when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

454) Use of hard-coded credentials (CVE-ID: CVE-2026-81964)

CWE-ID: CWE-798 - Use of Hard-coded Credentials

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to register unauthorized provider state.

The vulnerability exists due to use of hard-coded credentials in Windows Update Orchestrator Service when validating provider registration. A local user can bypass provider-registration validation to register unauthorized provider state.

455) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-81969)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to insufficient granularity of access control in Windows Server Update Service when enforcing access controls for local operations. A local user can exploit these access control limitations to escalate privileges to SYSTEM.

456) Race condition (CVE-ID: CVE-2026-81971)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of shared resources in Windows NTFS when executing concurrent operations. A local user can win a race condition to escalate privileges to SYSTEM.

457) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-83499)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges and execute code in the security context of the NT AUTHORITYNetwork Service account.

The vulnerability exists due to insufficient granularity of access control in Windows Server Update Service when authorizing local access. A local user can exploit the insufficiently granular access controls to escalate privileges and execute code in the security context of the NT AUTHORITYNetwork Service account.

458) Open redirect (CVE-ID: CVE-2026-83500)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 6.8 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to bypass Secure Boot to run unauthorized code.

The vulnerability exists due to URL redirection to an untrusted site (open redirect) in Windows BitLocker when handling URL redirection. An attacker with physical access can exploit the open redirect through physical access to bypass Secure Boot to run unauthorized code.

459) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-83505)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Setup Files Cleanup when cleaning up setup files. A local user can win the race condition to escalate privileges to SYSTEM.

460) Untrusted search path (CVE-ID: CVE-2026-83506)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an untrusted search path in Servicing Stack Updates when resolving search paths locally. A local user can exploit the untrusted search path to escalate privileges to SYSTEM.

461) Link following (CVE-ID: CVE-2026-83507)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper link resolution before file access in Windows Update Orchestrator Service when accessing files locally. A local user can read files without authorization to disclose sensitive information.

No user interaction is required.

462) Out-of-bounds read (CVE-ID: CVE-2026-83508)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows NTFS when accessed locally. A local user can exploit the out-of-bounds read locally to escalate privileges to SYSTEM.

463) Untrusted search path (CVE-ID: CVE-2026-83509)

CWE-ID: CWE-426 - Untrusted Search Path

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an untrusted search path in Windows Setup Files Cleanup when performing setup file cleanup. A local user can exploit the untrusted search path locally to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

464) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-83510)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Setup Files Cleanup when cleaning up setup files. A local user can win the race condition to escalate privileges to SYSTEM.

465) Weak Authentication (CVE-ID: CVE-2026-83511)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to weak authentication in Active Directory Federation Services (AD FS) when authenticating over a network. A remote attacker can exploit the weak authentication to perform spoofing.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

466) Use-after-free (CVE-ID: CVE-2026-83513)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Universal Disk Format File System Driver (UDFS) when used locally. A local user can exploit the use-after-free to escalate privileges to SYSTEM.

467) Heap-based buffer overflow (CVE-ID: CVE-2026-83514)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Partition Management Driver when the driver is exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

468) Use of uninitialized resource (CVE-ID: CVE-2026-83515)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to use of an uninitialized resource in RPC Runtime when accessing uninitialized resources. A remote attacker can exploit this behavior over a network to disclose uninitialized heap memory from a privileged process.

User interaction is required.

469) Out-of-bounds read (CVE-ID: CVE-2026-83516)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) when accessed over a network. A remote attacker can trigger the out-of-bounds read over the network to cause a denial of service.

470) Heap-based buffer overflow (CVE-ID: CVE-2026-83517)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Media Foundation when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

471) Heap-based buffer overflow (CVE-ID: CVE-2026-83519)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Error Reporting when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

472) Deserialization of Untrusted Data (CVE-ID: CVE-2026-83520)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in .NET when processing data from a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

473) Out-of-bounds read (CVE-ID: CVE-2026-83521)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows IKE Extension when accessed over a network. A remote user can read heap memory from a privileged process running on the server to disclose sensitive information.

474) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-83522)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing and alter or disrupt a protected connection.

The vulnerability exists due to reliance on untrusted inputs in a security decision in Windows IKE Extension when processing network packets associated with an existing IKEv2 security association. A remote attacker can send a specially crafted packet that is processed without required integrity verification to perform spoofing and alter or disrupt a protected connection.

Exploitation requires obtaining the identifiers for an existing IKEv2 security association. Successful exploitation requires a deep understanding of the system and depends on environmental factors, system configuration, and additional security measures. User interaction is not required.

475) Heap-based buffer overflow (CVE-ID: CVE-2026-83523)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on a client system.

The vulnerability exists due to a heap-based buffer overflow in Windows Image Acquisition when processing a server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

476) Use-after-free (CVE-ID: CVE-2026-83564)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Windows Search Component when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

477) Buffer over-read (CVE-ID: CVE-2026-83565)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a buffer over-read in Windows Encrypting File System (EFS) when reading memory locally. A local user can exploit the buffer over-read to disclose sensitive information from the heap memory of a privileged process running on the server.

478) Use-after-free (CVE-ID: CVE-2026-83566)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Win32K - ICOMP when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

479) Out-of-bounds read (CVE-ID: CVE-2026-83567)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows NTFS when exploited locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

480) Missing Authorization (CVE-ID: CVE-2026-83568)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges and execute code in the security context of the NT AUTHORITYNetwork Service account.

The vulnerability exists due to missing authorization in Windows Kernel-Mode Drivers when accessing the drivers locally. A local user can exploit the missing authorization to escalate privileges and execute code in the security context of the NT AUTHORITYNetwork Service account.

481) Heap-based buffer overflow (CVE-ID: CVE-2026-83569)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in HID Parser Library when exploited locally. A local user can trigger the buffer overflow to escalate privileges to SYSTEM.

482) Use-after-free (CVE-ID: CVE-2026-83570)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Windows Search Component when accessing the component locally. A local user can exploit the use-after-free to escalate privileges to SYSTEM.

483) NULL pointer dereference (CVE-ID: CVE-2026-83571)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to a null pointer dereference in Windows Audio Service when the service is accessed locally. A local user can exploit the null pointer dereference to disclose heap memory from a privileged process running on the server.

484) Integer overflow (CVE-ID: CVE-2026-83573)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in the Windows kernel-mode driver when the driver is targeted through physical access. An attacker with physical access can exploit the integer overflow or wraparound through a physical attack to escalate privileges to SYSTEM.

485) Use-after-free (CVE-ID: CVE-2026-83574)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Microsoft Windows Search Component when exploited locally. A local user can exploit this memory-safety flaw to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

486) Use-after-free (CVE-ID: CVE-2026-83575)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Windows Search Component when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

487) Integer underflow (CVE-ID: CVE-2026-83578)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer underflow in Windows PowerShell when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

488) Heap-based buffer overflow (CVE-ID: CVE-2026-83579)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Smart Card when exploited locally. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

489) Heap-based buffer overflow (CVE-ID: CVE-2026-83580)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Client-Side Caching (CSC) Service when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

490) Use-after-free (CVE-ID: CVE-2026-83582)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to use-after-free in Windows Graphics Kernel when accessing freed memory. A local user can win a race condition to disclose heap memory from a privileged process running on the server.

491) Missing Authorization (CVE-ID: CVE-2026-83583)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to missing authorization in Windows Geotag Broker when accessed locally. A local user can exploit the authorization weakness to escalate privileges to SYSTEM.

User interaction is not required.

492) Use-after-free (CVE-ID: CVE-2026-83584)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Smart Card when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

493) Format string error (CVE-ID: CVE-2026-83585)

CWE-ID: CWE-134 - Use of Externally-Controlled Format String

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use of an externally controlled format string in Windows NTFS when processing externally controlled format strings. A local user can control a format string locally to escalate privileges to SYSTEM.

494) Weak Authentication (CVE-ID: CVE-2026-83586)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to weak authentication in Windows Resilient File System (ReFS) Deduplication Service when accessed locally. A local user can exploit the service's weak authentication to escalate privileges to SYSTEM.

495) Untrusted Pointer Dereference (CVE-ID: CVE-2026-83587)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in Windows Core Messaging when dereferencing untrusted pointers. A local user can exploit this weakness locally to escalate privileges to SYSTEM.

496) Heap-based buffer overflow (CVE-ID: CVE-2026-83588)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows USB Driver when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

497) Double free (CVE-ID: CVE-2026-83634)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to double free in Windows BitLocker when operating locally. A local user can trigger the double-free condition to gain SYSTEM privileges.

498) Out-of-bounds read (CVE-ID: CVE-2026-83635)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in DNS Server when handling network traffic. A remote attacker can trigger the out-of-bounds read over the network to cause a denial of service.

499) NULL pointer dereference (CVE-ID: CVE-2026-83636)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in Windows Hyper-V when performing local operations. A local user can trigger the null pointer dereference to cause a denial of service.

No user interaction is required.

500) Out-of-bounds read (CVE-ID: CVE-2026-83637)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows Kernel-Mode Drivers when exploited locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

501) Heap-based buffer overflow (CVE-ID: CVE-2026-83638)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow in Windows USB Driver when used locally. A local user can exploit the heap-based buffer overflow to gain SYSTEM privileges.

502) Heap-based buffer overflow (CVE-ID: CVE-2026-83639)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Sensor Data Service when exploited locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

503) Heap-based buffer overflow (CVE-ID: CVE-2026-83640)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute code locally.

The vulnerability exists due to a heap-based buffer overflow in Windows NTFS when used locally. A local user can exploit this flaw to execute code locally.

504) Heap-based buffer overflow (CVE-ID: CVE-2026-83641)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Media when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

505) Type Confusion (CVE-ID: CVE-2026-83642)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the client system.

The vulnerability exists due to type confusion in DNS Server when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

506) Stack-based buffer overflow (CVE-ID: CVE-2026-83643)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Windows Error Reporting when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

507) Use-after-free (CVE-ID: CVE-2026-83644)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Audio Service when the service is used locally. A local user can win a race condition to escalate privileges to SYSTEM.

508) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-83645)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) when allocating resources for network activity. A remote attacker can trigger unrestricted resource allocation over a network to cause a denial of service.

509) Open redirect (CVE-ID: CVE-2026-83646)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to perform spoofing.

The vulnerability exists due to URL redirection to an untrusted site (open redirect) in Active Directory Federation Services (AD FS) when handling network-based redirections. A remote privileged user can redirect users to an untrusted site to perform spoofing.

User interaction is required.

510) Out-of-bounds read (CVE-ID: CVE-2026-83647)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Active Directory Domain Services when handling network traffic. A remote attacker can trigger the out-of-bounds read over a network to cause a denial of service.

511) NULL pointer dereference (CVE-ID: CVE-2026-83648)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in Active Directory Domain Services when handling network interactions. A remote user can trigger the null pointer dereference over the network to cause a denial of service.

512) Out-of-bounds read (CVE-ID: CVE-2026-83649)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) when handling network interactions. A remote user can exploit the out-of-bounds read over a network to cause a denial of service.

No user interaction is required.

513) Heap-based buffer overflow (CVE-ID: CVE-2026-83650)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Media when the component is exploited locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

514) Out-of-bounds read (CVE-ID: CVE-2026-83651)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows GDI when reading memory. A remote attacker can exploit the issue over a network to disclose sensitive information.

The exposed information can include heap memory from a privileged process running on the server. User interaction is required.

515) Heap-based buffer overflow (CVE-ID: CVE-2026-83652)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows NTFS when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

516) Missing Authentication for Critical Function (CVE-ID: CVE-2026-83654)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to missing authentication for a critical function in Windows Modern Device Management (MDM) when invoking the function locally. A local user can invoke the function without authentication to escalate privileges to SYSTEM.

517) Out-of-bounds read (CVE-ID: CVE-2026-83655)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Network Policy Server (NPS) when handling network traffic. A remote attacker can trigger the out-of-bounds read over the network to cause a denial of service.

518) Missing Authentication for Critical Function (CVE-ID: CVE-2026-83656)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform local tampering.

The vulnerability exists due to missing authentication for a critical function in Windows Modern Device Management (MDM) when the function is invoked locally. A local user can exploit the missing authentication to perform local tampering.

Successful exploitation requires winning a race condition.

519) Weak Authentication (CVE-ID: CVE-2026-83657)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform tampering locally.

The vulnerability exists due to weak authentication in Windows Modern Device Management (MDM) when authenticating users locally. A local user can exploit weak authentication to perform tampering locally.

520) Missing Authorization (CVE-ID: CVE-2026-83658)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to missing authorization in Windows Error Reporting when accessing information locally. A local user can view heap memory from a privileged process running on the server to disclose sensitive information.

521) Link following (CVE-ID: CVE-2026-83659)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Windows User Profile Service when resolving links during file access. A local user can exploit link following locally to escalate privileges to SYSTEM.

522) Type Confusion (CVE-ID: CVE-2026-83664)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to type confusion in Windows Portable Device File System Driver when accessing a resource using an incompatible type. A local user can access heap memory from a privileged process running on the server to disclose sensitive information.

523) NULL pointer dereference (CVE-ID: CVE-2026-83665)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in Windows DHCP Server when handling network traffic. A remote attacker can trigger the null pointer dereference over the network to cause a denial of service.

No user interaction is required.

524) Race condition (CVE-ID: CVE-2026-83666)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of a shared resource in Active Directory Certificate Services (AD CS) when executing concurrent operations. A local user can win a race condition to escalate privileges to SYSTEM.

525) Out-of-bounds read (CVE-ID: CVE-2026-83667)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Active Directory Domain Services when handling network communications. A remote user can trigger the out-of-bounds read over the network to cause a denial of service.

526) Out-of-bounds read (CVE-ID: CVE-2026-83668)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows WLAN Service when accessed locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

527) Use of uninitialized resource (CVE-ID: CVE-2026-83669)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use of an uninitialized resource in Windows Error Reporting when operating locally. A local user can exploit the uninitialized resource to escalate privileges to SYSTEM.

528) Out-of-bounds read (CVE-ID: CVE-2026-83670)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to an out-of-bounds read in Function Discovery Service (fdwsd.dll) when handling network communications. A remote attacker can exploit the service over a network to disclose heap memory from a privileged process running on the server.

529) Out-of-bounds read (CVE-ID: CVE-2026-83671)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Hyper-V when reading memory locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

530) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-83672)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Installer when accessed locally. A local user can view heap memory from a privileged process running on the server to disclose sensitive information.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

531) Weak Authentication (CVE-ID: CVE-2026-83674)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to weak authentication in Active Directory Federation Services (AD FS) when handling authentication over a network. A remote attacker can exploit the weak authentication to perform spoofing.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

532) Use-after-free (CVE-ID: CVE-2026-83675)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Kernel when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

533) Integer underflow (CVE-ID: CVE-2026-83676)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer underflow in Windows Installer when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

534) Memory leak (CVE-ID: CVE-2026-83677)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after its effective lifetime in Windows DHCP Client when operating over a network. A remote attacker can exploit the memory-release flaw over the network to cause a denial of service.

535) Heap-based buffer overflow (CVE-ID: CVE-2026-83678)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows TCP/IP when being exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

536) Use-after-free (CVE-ID: CVE-2026-83679)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Defender Firewall Service when the service is used locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

537) Heap-based buffer overflow (CVE-ID: CVE-2026-83680)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Installer when the component is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and the presence of additional security measures.

538) Use-after-free (CVE-ID: CVE-2026-83682)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows TCP/IP when a race condition occurs. A local user can win the race condition during local exploitation to escalate privileges to SYSTEM.

539) Absolute Path Traversal (CVE-ID: CVE-2026-83683)

CWE-ID: CWE-36 - Absolute Path Traversal

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to absolute path traversal in Windows Encrypting File System (EFS) when accessing the file system over a network. A remote user can read files without authorization to disclose sensitive information.

540) Buffer over-read (CVE-ID: CVE-2026-83685)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a buffer over-read in Windows Internet Key Exchange (IKE) Extension when handling network communications. A remote user can interact with the extension over a network to cause a denial of service.

541) Out-of-bounds read (CVE-ID: CVE-2026-83686)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to an out-of-bounds read in Microsoft Windows Search Component when accessing memory locally. A local user can trigger an out-of-bounds read to disclose uninitialized heap memory from a privileged process.

542) Use-after-free (CVE-ID: CVE-2026-83687)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Connected User Experiences and Telemetry when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

543) Heap-based buffer overflow (CVE-ID: CVE-2026-83688)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the client system.

The vulnerability exists due to a heap-based buffer overflow in Remote Desktop Client when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

544) Use-after-free (CVE-ID: CVE-2026-83689)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Error Reporting when the component is used locally. A local user can exploit the use-after-free by winning a race condition to escalate privileges to SYSTEM.

No user interaction is required.

545) Use-after-free (CVE-ID: CVE-2026-83690)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Kernel when exploited locally. A local user can exploit the kernel vulnerability to escalate privileges to SYSTEM.

546) Heap-based buffer overflow (CVE-ID: CVE-2026-83691)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows DHCP Server when exploited locally. A local user can trigger the overflow to escalate privileges to SYSTEM.

547) Heap-based buffer overflow (CVE-ID: CVE-2026-83692)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Bind Filter Driver when the driver is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

548) Heap-based buffer overflow (CVE-ID: CVE-2026-83693)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Error Reporting when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

549) Out-of-bounds read (CVE-ID: CVE-2026-83694)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows Volume Manager Extension Driver when exploited locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

550) Use of uninitialized resource (CVE-ID: CVE-2026-83695)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to use of an uninitialized resource in Windows Event Logging Service when the service uses a resource that has not been initialized. A local user can exploit the service locally to disclose uninitialized heap memory from a privileged process.

551) Use-after-free (CVE-ID: CVE-2026-83696)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Cloud Files Mini Filter Driver when a race condition occurs during local exploitation. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

552) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-83697)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform tampering locally.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Modern Device Management (MDM) when performing local operations. A local user can win the race condition to perform tampering locally.

553) Heap-based buffer overflow (CVE-ID: CVE-2026-83698)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Client-Side Caching (CSC) Service when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Exploitation does not require user interaction.

554) Stack-based buffer overflow (CVE-ID: CVE-2026-83699)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a stack-based buffer overflow in Windows Client-Side Caching (CSC) Service when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

555) Use-after-free (CVE-ID: CVE-2026-83700)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Now Playing Session Manager when operating locally. A local user can exploit the vulnerable component locally to escalate privileges to SYSTEM.

556) Use-after-free (CVE-ID: CVE-2026-83701)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Now Playing Session Manager when the component is exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

User interaction is not required.

557) Use-after-free (CVE-ID: CVE-2026-83702)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

558) Out-of-bounds read (CVE-ID: CVE-2026-83703)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Windows Wi-Fi Driver when exposed to activity over an adjacent network. A remote attacker can exploit the driver over an adjacent network to cause a denial of service.

559) Link following (CVE-ID: CVE-2026-83704)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges from a low integrity level to a medium integrity level.

The vulnerability exists due to improper link resolution before file access in Microsoft Windows Search Component when accessing files through links. A local user can exploit link following during local file access to escalate privileges from a low integrity level to a medium integrity level.

560) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-83705)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys when accessed locally. A local user can access exposed uninitialized heap memory from a privileged process to disclose sensitive information.

561) Use-after-free (CVE-ID: CVE-2026-83707)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Event Tracing when used locally. A local user can exploit the use-after-free by winning a race condition to escalate privileges to SYSTEM.

562) Stack-based buffer overflow (CVE-ID: CVE-2026-83708)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a stack-based buffer overflow in Windows Installer when exploitation occurs locally. A local user can win a race condition to escalate privileges to SYSTEM.

No user interaction is required.

563) Heap-based buffer overflow (CVE-ID: CVE-2026-83709)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows NTLM when used locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

564) Use-after-free (CVE-ID: CVE-2026-83710)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Device Association Service when the service is used locally. A local user can exploit the use-after-free condition to escalate privileges.

Successful exploitation requires winning a race condition.

565) Out-of-bounds write (CVE-ID: CVE-2026-83712)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to an out-of-bounds write in Windows NTFS when used locally. A local user can exploit this memory corruption to execute arbitrary code locally.

566) Out-of-bounds read (CVE-ID: CVE-2026-83713)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) when accessing memory locally. A local user can read uninitialized heap memory from a privileged process to disclose sensitive information.

567) Use of uninitialized resource (CVE-ID: CVE-2026-83714)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to use of an uninitialized resource in Windows HTTP.sys when using uninitialized resources. A local user can exploit the flaw locally to disclose uninitialized heap memory from a privileged process.

568) Missing Authentication for Critical Function (CVE-ID: CVE-2026-83715)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform tampering.

The vulnerability exists due to missing authentication for a critical function in Windows Error Reporting when accessing the function locally. A local user can exploit the missing authentication to perform tampering.

569) Heap-based buffer overflow (CVE-ID: CVE-2026-83716)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code on the Hyper-V host.

The vulnerability exists due to a heap-based buffer overflow in Windows Hyper-V when processing networking requests through the VMswitch driver. A local user can send a specific series of networking requests to the driver to execute arbitrary code on the Hyper-V host.

570) Use-after-free (CVE-ID: CVE-2026-83717)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

571) Use-after-free (CVE-ID: CVE-2026-83718)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Installer when exploiting a local race condition. A local user can win the race condition to gain SYSTEM privileges.

572) Buffer over-read (CVE-ID: CVE-2026-83719)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a buffer over-read in Servicing Stack Updates when accessing memory locally. A local user can exploit the buffer over-read to disclose sensitive information.

The exposed information includes heap memory from a privileged process running on the server.

573) Use-after-free (CVE-ID: CVE-2026-83720)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Kerberos when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

574) Use-after-free (CVE-ID: CVE-2026-83721)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Win32K when exploited locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

575) Use-after-free (CVE-ID: CVE-2026-83722)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Local Security Authority Server (lsasrv) when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

576) Use of uninitialized resource (CVE-ID: CVE-2026-83723)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized stack memory.

The vulnerability exists due to use of an uninitialized resource in Windows Event Logging Service when accessed locally. A local user can exploit this weakness to disclose uninitialized stack memory.

No user interaction is required.

577) Heap-based buffer overflow (CVE-ID: CVE-2026-83724)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Management Instrumentation when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

578) Heap-based buffer overflow (CVE-ID: CVE-2026-83725)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Search Component when processing a specially crafted file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

579) Use-after-free (CVE-ID: CVE-2026-83726)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows DWM Core Library when exploited locally. A local user can exploit the use-after-free flaw to escalate privileges to SYSTEM.

580) Buffer over-read (CVE-ID: CVE-2026-83727)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a buffer over-read in Windows Overlay Filter when accessed locally. A local user can exploit the buffer over-read locally to escalate privileges to SYSTEM.

581) Improper Validation of Syntactic Correctness of Input (CVE-ID: CVE-2026-83728)

CWE-ID: CWE-1286 - Improper Validation of Syntactic Correctness of Input

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass MAC-address spoofing protections and impersonate another network endpoint, potentially enabling interception, modification, or disruption of network traffic.

The vulnerability exists due to improper validation of syntactic correctness of input in the Windows Hyper-V Virtual Switch when processing network packets. A local user can send a specially crafted network packet through the virtual switch to bypass MAC-address spoofing protections and impersonate another network endpoint, potentially enabling interception, modification, or disruption of network traffic.

Exploitation requires running code in a Hyper-V guest. User interaction is not required.

582) Use-after-free (CVE-ID: CVE-2026-83732)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a use-after-free error in Windows Win32K when the component is used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

No user interaction is required.

583) Out-of-bounds read (CVE-ID: CVE-2026-83733)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Print Spooler Components when accessing memory locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

584) Release of invalid pointer or reference (CVE-ID: CVE-2026-83735)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to release of an invalid pointer or reference in Windows Kernel when releasing pointers or references. A local user can exploit this pointer or reference release locally to escalate privileges to SYSTEM.

No user interaction is required.

585) Heap-based buffer overflow (CVE-ID: CVE-2026-83736)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in Windows Kernel when exploited locally. A local user can trigger the heap-based buffer overflow to cause a denial of service.

586) Out-of-bounds read (CVE-ID: CVE-2026-83737)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows NTFS when reading memory locally. A local user can exploit this flaw to disclose sensitive information, including heap memory from a privileged process running on the server.

587) Use-after-free (CVE-ID: CVE-2026-83738)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Ancillary Function Driver for WinSock when the driver is used locally. A local user can exploit the use-after-free to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

588) Use-after-free (CVE-ID: CVE-2026-83739)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Bluetooth Service when the service is accessed over an adjacent network. A remote attacker can exploit the use-after-free to execute arbitrary code.

Successful exploitation requires winning a race condition.

589) Use-after-free (CVE-ID: CVE-2026-83740)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Hello when the component is used locally. A local user can win a race condition to escalate privileges to SYSTEM.

No user interaction is required.

590) Use-after-free (CVE-ID: CVE-2026-83741)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Internet Explorer when exploited locally. A local user can win a race condition to escalate privileges.

The privilege boundary involved is between low and medium integrity levels.

591) Out-of-bounds read (CVE-ID: CVE-2026-83747)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Error Reporting when reading memory locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

592) Heap-based buffer overflow (CVE-ID: CVE-2026-83748)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Error Reporting when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

593) Use-after-free (CVE-ID: CVE-2026-83749)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Overlay Filter when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

594) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-83750)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Error Reporting when performing error-reporting operations. A local user can win the race condition to escalate privileges to SYSTEM.

595) Use-after-free (CVE-ID: CVE-2026-83751)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows MIDI Service Module when accessing previously freed memory. A local user can win a race condition to escalate privileges to SYSTEM.

596) Use-after-free (CVE-ID: CVE-2026-83752)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when a race condition is won. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

597) Heap-based buffer overflow (CVE-ID: CVE-2026-83753)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Camera Frame Server Monitor when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

598) Heap-based buffer overflow (CVE-ID: CVE-2026-83754)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in OpenSSH for Windows when handling network communications. A remote attacker can exploit the overflow over a network to execute arbitrary code.

Exploitation requires user interaction and specific conditions, such as particular protocol settings or configurations. The advisory does not specify the required user interaction or exact configuration conditions.

599) Use of uninitialized resource (CVE-ID: CVE-2026-83755)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory addresses.

The vulnerability exists due to use of an uninitialized resource in Windows Win32K when accessing the component locally. A local user can exploit the uninitialized resource to disclose kernel memory addresses.

600) Use-after-free (CVE-ID: CVE-2026-83756)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when used locally. A local user can exploit the use-after-free condition to gain SYSTEM privileges.

601) Heap-based buffer overflow (CVE-ID: CVE-2026-83757)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Win32K when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

602) Heap-based buffer overflow (CVE-ID: CVE-2026-83758)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to a heap-based buffer overflow in Windows Error Reporting when the component is used locally. A local user can exploit the buffer overflow to execute arbitrary code locally.

603) Code Injection (CVE-ID: CVE-2026-83759)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute code on an affected server.

The vulnerability exists due to improper control of code generation in Windows Encrypting File System (EFS) when handling network requests. A remote user can send a specially crafted request to execute code on an affected server.

User interaction is not required.

604) Out-of-bounds read (CVE-ID: CVE-2026-83760)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to an out-of-bounds read in Microsoft Bluetooth Driver when accessing memory locally. A local user can trigger an out-of-bounds read to disclose certain kernel memory content.

605) Use-after-free (CVE-ID: CVE-2026-83761)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when the subsystem is exploited locally. A local user can exploit the use-after-free flaw to escalate privileges to SYSTEM.

606) Use-after-free (CVE-ID: CVE-2026-83762)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Win32K when the component is used locally. A local user can exploit this memory-management flaw to escalate privileges to SYSTEM.

607) Type Confusion (CVE-ID: CVE-2026-83763)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to type confusion in Windows Input System when accessing a resource using an incompatible type. A local user can exploit this issue locally to escalate privileges to SYSTEM.

No user interaction is required.

608) Incorrect authorization (CVE-ID: CVE-2026-83764)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in Windows Clipboard User Service when authorizing local access. A local user can obtain unauthorized read-only access to the local file system to disclose sensitive information.

609) Out-of-bounds read (CVE-ID: CVE-2026-83765)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows DWM Core Library when reading memory locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

610) Incorrect authorization (CVE-ID: CVE-2026-83766)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to bypass extended access control lists and other Windows security feature checks.

The vulnerability exists due to incorrect authorization in the Windows Hyper-V virtual machine switch when using virtual networking in Hyper-V Network Virtualization (HNV) over an adjacent network. A remote privileged user can exploit the authorization flaw to bypass extended access control lists and other Windows security feature checks.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

611) Stack-based buffer overflow (CVE-ID: CVE-2026-83767)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a stack-based buffer overflow in Windows Installer when used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

612) Heap-based buffer overflow (CVE-ID: CVE-2026-83768)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Kernel when exploited locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

613) Use-after-free (CVE-ID: CVE-2026-83769)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in OpenSSH for Windows when exploited locally. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

614) Heap-based buffer overflow (CVE-ID: CVE-2026-83770)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Text Shaping when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

615) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-83773)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module when accessing system information locally. A local user can read small portions of heap memory to disclose sensitive information.

616) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-83774)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in the Windows Win32 Kernel Subsystem when uninitialized heap memory from a privileged process is exposed. A local user can exploit the information exposure locally to disclose sensitive information.

Successful exploitation requires winning a race condition.

617) Race condition (CVE-ID: CVE-2026-83775)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of a shared resource in Windows Installer when accessing the resource concurrently. A local user can win a race condition to escalate privileges to SYSTEM.

618) Out-of-bounds read (CVE-ID: CVE-2026-83776)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Microsoft Bluetooth Driver when exploited through a physical attack. An attacker with physical access can exploit the driver through physical access to escalate privileges to SYSTEM.

619) Heap-based buffer overflow (CVE-ID: CVE-2026-83777)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow in Windows Bluetooth Service when accessed over an adjacent network. A remote attacker can exploit this flaw to gain SYSTEM privileges.

620) Heap-based buffer overflow (CVE-ID: CVE-2026-83778)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Internet Messaging API when processing specially crafted files. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

621) Heap-based buffer overflow (CVE-ID: CVE-2026-83779)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Installer when used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

622) Use-after-free (CVE-ID: CVE-2026-83780)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in the Windows CCFFilter Driver when processing network packets sent to an affected service. A remote attacker can send a specially crafted packet to the affected service over the network to execute arbitrary code.

No user interaction is required.

623) Improper Null Termination (CVE-ID: CVE-2026-83781)

CWE-ID: CWE-170 - Improper Null Termination

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper null termination in Windows Program Compatibility Assistant Service when used locally. A local user can exploit the service to escalate privileges to SYSTEM.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100200
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100201
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100202
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100203
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100209
• https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100210
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100211
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100212
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100215
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100216
• https://support.microsoft.com/help/5126651
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100217
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100218
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100219
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100220
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100222
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100225
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102186
• https://support.microsoft.com/help/5126868
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102187
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102188
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102189
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102191
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102192
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102193
• https://support.microsoft.com/help/5127648
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102194
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102195
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102196
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102197
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102198
• https://support.microsoft.com/help/5126835
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102199
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102201
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102202
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102203
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102205
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102206
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102207
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102208
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102209
• https://support.microsoft.com/help/5127646
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102210
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102211
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102214
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102215
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102216
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102217
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102218
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102220
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102221
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102225
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102227
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102849
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102850
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102855
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102856
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102857
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102867
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102869
• https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102870
• https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103553
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103554
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103555
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103558
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103560
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103565
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103567
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103568
• https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103569
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103572
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103575
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103576
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103577
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103578
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105003
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105004
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105005
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105006
• https://support.microsoft.com/help/5126646
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105007
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105008
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105009
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105010
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105016
• https://support.microsoft.com/help/5126655
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105591
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105592
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105593
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105595
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105596
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105597
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105598
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105599
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105714
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105715
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105716
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105717
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105718
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105722
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105723
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105733
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108127
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108128
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108129
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108130
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108131
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108132
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108133
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108134
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108135
• https://support.microsoft.com/help/5126657
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108136
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108396
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108398
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108399
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108457
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108458
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108460
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108461
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108462
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108463
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108464
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108465
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108466
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108467
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108468
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108471
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109453
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-49785
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58280
• https://support.microsoft.com/help/5130035
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-61931
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-62687
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-62879
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-66822
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68836
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69326
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69387
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69452
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69454
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69471
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69506
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69577
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69596
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69633
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69634
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69635
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69639
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69640
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69644
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69650
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69651
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69673
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69675
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69705
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69718
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69721
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69733
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69736
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69743
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69763
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69765
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69766
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69783
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69795
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69798
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69802
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69830
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69840
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69850
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69856
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69867
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69880
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69882
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69883
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69884
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69886
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69898
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69902
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69905
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69909
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69913
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69914
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69915
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69916
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69918
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69919
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69923
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69926
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69931
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69934
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69935
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69940
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69942
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69945
• https://docs.microsoft.com/windows/win32/secauthz/appcontainer-isolation
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69947
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69949
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69950
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69952
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69953
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69954
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69955
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69957
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69958
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69959
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69963
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69964
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69966
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69967
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69968
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69969
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69970
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69971
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69973
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69974
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69976
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69977
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69978
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69979
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69982
• https://support.microsoft.com/help/5126836
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69984
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69985
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69986
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69987
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69988
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69991
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69992
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69994
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69995
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69996
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69997
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69998
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69999
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70004
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70005
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70006
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70007
• https://support.microsoft.com/help/5127660
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70008
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70010
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70011
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70012
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70013
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70014
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70015
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70017
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70021
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70023
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70024
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70025
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70026
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70027
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70031
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70033
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70035
• https://support.microsoft.com/help/5130036
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70038
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70041
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70044
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70045
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70048
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70051
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70052
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70054
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70055
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70056
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70057
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70058
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70059
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70060
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70062
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70063
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70064
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70066
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70068
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70069
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70071
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70072
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70074
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70075
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70076
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70077
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70079
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70082
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70083
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70084
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70085
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70086
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70087
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70089
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70090
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70092
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70093
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70095
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70096
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70097
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70102
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70103
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70104
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70106
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70108
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70109
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70110
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70111
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70112
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70113
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70114
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70115
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70116
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70117
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70118
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70119
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70121
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70122
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70123
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70126
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70127
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70128
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70131
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70132
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70133
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70134
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70135
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70136
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70137
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70138
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70139
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70140
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70141
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70142
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70143
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70144
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70147
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70148
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70149
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70150
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70151
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70153
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70155
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70156
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70157
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70158
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70159
• https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.Common
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70160
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70161
• https://dotnet.microsoft.com/download/dotnet/10.0
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70162
• https://www.nuget.org/packages/System.Security.Cryptography.Pkcs
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70163
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70164
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70165
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70166
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70167
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70168
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70169
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70170
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70172
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70173
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70174
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70175
• https://support.microsoft.com/help/5130034
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70176
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70177
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70179
• https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.Negotiate
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70181
• https://support.microsoft.com/kb/5130036
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70183
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70184
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70185
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70186
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70187
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70188
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70190
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70194
• https://dotnet.microsoft.com/download/dotnet/11.0
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70195
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70196
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70197
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70198
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70199
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70201
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70205
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70206
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70207
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70208
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70209
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70210
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70211
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70212
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70214
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70215
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70216
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70218
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70219
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70220
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70222
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70223
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70225
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70227
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70228
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70229
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70230
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70232
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70233
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70234
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70235
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70236
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70237
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70238
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70241
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70242
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70243
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70244
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70245
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70247
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70248
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70249
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70250
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70252
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70253
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70254
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70255
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70256
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70257
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70258
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70260
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70261
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70262
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70263
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70268
• https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70269
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70270
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70271
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70272
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70273
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70274
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70275
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70276
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70277
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70278
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70280
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70281
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70282
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70284
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70285
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70286
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70287
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70288
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70291
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70292
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70293
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70294
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70295
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70299
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70300
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70301
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70302
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70303
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70566
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70580
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-72934
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-72955
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-72968
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-72969
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-73027
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-77496
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-77902
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-78459
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81964
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81969
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81971
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83499
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83500
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83505
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83506
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83507
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83508
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83509
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83510
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83511
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83513
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83514
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83515
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83516
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83517
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83519
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83520
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83521
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83522
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83523
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83564
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83565
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83566
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83567
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83568
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83569
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83570
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83571
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83573
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83574
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83575
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83578
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83579
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83580
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83582
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83583
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83584
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83585
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83586
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83587
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83588
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83634
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83635
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83636
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83637
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83638
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83639
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83640
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83641
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83642
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83643
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83644
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83645
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83646
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83647
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83648
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83649
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83650
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83651
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83652
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83654
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83655
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83656
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83657
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83658
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83659
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83664
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83665
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83666
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83667
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83668
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83669
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83670
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83671
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83672
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83674
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83675
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83676
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83677
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83678
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83679
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83680
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83682
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83683
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83685
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83686
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83687
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83688
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83689
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83690
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83691
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83692
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83693
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83694
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83695
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83696
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83697
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83698
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83699
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83700
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83701
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83702
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83703
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83704
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83705
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83707
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83708
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83709
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83710
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83712
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83713
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83714
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83715
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83716
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83717
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83718
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83719
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83720
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83721
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83722
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83723
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83724
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83725
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83726
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83727
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83728
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83732
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83733
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83735
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83736
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83737
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83738
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83739
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83740
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83741
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83747
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83748
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83749
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83750
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83751
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83752
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83753
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83754
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83755
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83756
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83757
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83758
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83759
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83760
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83761
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83762
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83763
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83764
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83765
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83766
• https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v-virtual-switch/create-security-policies-with-extended-port-access-control-lists
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83767
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83768
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83769
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83770
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83773
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83774
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83775
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83776
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83777
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83778
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83779
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83780
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83781