SB2026101415 - Multiple vulnerabilities in Microsoft Windows

Description

This security bulletin contains information about 553 vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2026-83771)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Camera Frame Server Monitor when accessed over an adjacent network. A remote attacker on the local network can trigger the use-after-free to gain SYSTEM privileges.

2) Heap-based buffer overflow (CVE-ID: CVE-2026-83782)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute code on the target system.

The vulnerability exists due to a heap-based buffer overflow in Windows Shell when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute code on the target system.

No user interaction is required.

3) Heap-based buffer overflow (CVE-ID: CVE-2026-83783)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Management Instrumentation when the component is exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

4) Absolute Path Traversal (CVE-ID: CVE-2026-83784)

CWE-ID: CWE-36 - Absolute Path Traversal

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges to SYSTEM.

The vulnerability exists due to absolute path traversal in Windows Encrypting File System (EFS) when accessed over a network. A remote user can exploit the path traversal over the network to escalate privileges to SYSTEM.

5) Use-after-free (CVE-ID: CVE-2026-83785)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows COM+ Event System Service when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

6) Information Exposure Through an Error Message (CVE-ID: CVE-2026-83786)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to generation of error messages containing sensitive information in Windows NTFS when handling errors. A local user can exploit this error-message disclosure locally to disclose certain kernel memory content.

Successful exploitation requires a deep understanding of the system and is not guaranteed; success may depend on the environment, system configuration, and additional security measures.

7) Insufficient verification of data authenticity (CVE-ID: CVE-2026-83787)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a server response to omit an address that should be assigned.

The vulnerability exists due to insufficient verification of data authenticity in Windows DHCP Server when validating DHCPv6 address assignments. A local user can bypass DHCPv6 address-assignment validation to cause a server response to omit an address that should be assigned.

8) Buffer over-read (CVE-ID: CVE-2026-83788)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to read portions of heap memory.

The vulnerability exists due to a buffer over-read in Windows RNDIS (rndismp6.sys) when subjected to a physical attack. An attacker with physical access to system can exploit the buffer over-read to read portions of heap memory.

9) Heap-based buffer overflow (CVE-ID: CVE-2026-83789)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows SMB Client when handling network communications. A remote attacker can exploit the overflow over a network to escalate privileges to SYSTEM.

User interaction is required for exploitation.

10) Use-after-free (CVE-ID: CVE-2026-83790)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Hello when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

11) Unverified Ownership (CVE-ID: CVE-2026-83791)

CWE-ID: CWE-283 - Unverified Ownership

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper authorization in Windows Virtual Input when used locally. A local user can exploit the authorization weakness to escalate privileges to SYSTEM.

12) Incorrect authorization (CVE-ID: CVE-2026-83792)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to incorrect authorization in Windows Device Install Service when performing local operations. A local user can exploit the service's authorization flaw to escalate privileges to SYSTEM.

13) Link following (CVE-ID: CVE-2026-83793)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Windows Update Orchestrator Service when accessing files. A local user can exploit link following to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

14) Out-of-bounds read (CVE-ID: CVE-2026-83794)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Windows Portable Device MTP Driver when accessed locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

15) Heap-based buffer overflow (CVE-ID: CVE-2026-83795)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in Windows IKE Extension when handling network traffic. A remote attacker can send network traffic to the affected component to cause a denial of service.

16) Use-after-free (CVE-ID: CVE-2026-83796)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Kernel when exploited locally. A local user can exploit this memory-safety flaw to escalate privileges to SYSTEM.

17) Out-of-bounds read (CVE-ID: CVE-2026-83797)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on an affected client system.

The vulnerability exists due to an out-of-bounds read in Windows Partition Management Driver when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it to execute arbitrary code on the client system.

18) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-83798)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform spoofing locally.

The vulnerability exists due to improper verification of cryptographic signatures in Windows Update Stack when verifying cryptographic signatures. A local user can exploit the signature verification flaw locally to perform spoofing.

19) Untrusted Pointer Dereference (CVE-ID: CVE-2026-83826)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges from a low integrity level to a medium integrity level.

The vulnerability exists due to untrusted pointer dereference in Windows Error Reporting when handling pointers. A local user can exploit this condition locally to escalate privileges from a low integrity level to a medium integrity level.

20) Heap-based buffer overflow (CVE-ID: CVE-2026-83827)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Bluetooth Port Driver when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

21) Heap-based buffer overflow (CVE-ID: CVE-2026-83828)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows MIDI Service Module when used locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

22) Heap-based buffer overflow (CVE-ID: CVE-2026-83829)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Microsoft Windows Search Component when accessed locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

23) Heap-based buffer overflow (CVE-ID: CVE-2026-83830)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows COM+ Event System Service when exploited locally. A local user can trigger the buffer overflow to escalate privileges to SYSTEM.

24) Out-of-bounds read (CVE-ID: CVE-2026-83832)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows Spaceport.sys when accessed locally. A local user can exploit this weakness to escalate privileges to SYSTEM.

25) Heap-based buffer overflow (CVE-ID: CVE-2026-83833)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to heap-based buffer overflow in the Windows kernel when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

26) Use-after-free (CVE-ID: CVE-2026-83834)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Kernel-Mode Drivers when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

27) Buffer over-read (CVE-ID: CVE-2026-83835)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a buffer over-read in the Windows Common Log File System Driver when reading memory. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

28) Heap-based buffer overflow (CVE-ID: CVE-2026-83836)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Event Tracing when code is executed on the local machine. A remote attacker can trigger the overflow locally to execute arbitrary code.

Exploitation requires user interaction.

29) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-83837)

CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper access control in Windows Kernel-Mode Drivers when accessing driver functionality locally. A local user can exploit this access control weakness to escalate privileges to SYSTEM.

30) Integer underflow (CVE-ID: CVE-2026-83838)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user on the local network to gain SYSTEM privileges.

The vulnerability exists due to integer underflow in the Windows Bluetooth A2DP driver when accessing the driver over an adjacent network. A remote user on the local network can exploit the integer underflow to gain SYSTEM privileges.

31) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-83839)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Hyper-V when checking and subsequently using a resource. A local user can win the race condition to escalate privileges to SYSTEM.

32) Weak Authentication (CVE-ID: CVE-2026-83840)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to weak authentication in Windows Error Reporting when used locally. A local user can exploit the authentication weakness to escalate privileges to SYSTEM.

33) Race condition (CVE-ID: CVE-2026-83841)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization in Windows Win32K when concurrently accessing a shared resource. A local user can win a race condition to escalate privileges to SYSTEM.

34) Double free (CVE-ID: CVE-2026-83842)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a double free in Windows TCP/IP when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

35) Out-of-bounds read (CVE-ID: CVE-2026-83843)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Windows Internet Key Exchange (IKE) Protocol when handling network traffic. A remote attacker can send network traffic to cause a denial of service.

36) Improper privilege management (CVE-ID: CVE-2026-83845)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or modify another package's cookies.

The vulnerability exists due to improper privilege management in Windows Internet (wininet.dll) when handling local requests. A local user can send a local request claiming the identity of another package belonging to the same user to read or modify that package's cookies.

Exploitation requires running code in a low-integrity AppContainer. No additional user interaction is required.

37) Use-after-free (CVE-ID: CVE-2026-83846)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Connected Devices Platform Service (Cdpsvc) when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

38) Heap-based buffer overflow (CVE-ID: CVE-2026-83847)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Account when exploited locally. A local user can trigger the buffer overflow to escalate privileges to SYSTEM.

39) Untrusted Pointer Dereference (CVE-ID: CVE-2026-83848)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in Windows COM+ Event System Service when dereferencing untrusted pointers. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

40) Out-of-bounds read (CVE-ID: CVE-2026-83849)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Hello when used locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

41) Heap-based buffer overflow (CVE-ID: CVE-2026-83850)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Microsoft Windows Search Component when the component is used locally. A local user can exploit the buffer overflow locally to escalate privileges to SYSTEM.

42) Heap-based buffer overflow (CVE-ID: CVE-2026-83851)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges and execute arbitrary code on an affected client system.

The vulnerability exists due to a heap-based buffer overflow in Windows Partition Management Driver when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it to escalate privileges and execute arbitrary code on an affected client system.

43) Use-after-free (CVE-ID: CVE-2026-83852)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Bind Filter Driver when handling local operations. A local user can exploit the use-after-free flaw to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

44) Use-after-free (CVE-ID: CVE-2026-83853)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Hello when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

45) Missing Authentication for Critical Function (CVE-ID: CVE-2026-83854)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper access control in Windows Notification when accessing toast notifications. A local user can view another user's toast notification content to disclose sensitive information.

The other user must be signed in to the same system.

46) Integer underflow (CVE-ID: CVE-2026-83855)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer underflow in Windows WLAN Service when processing network traffic. A remote attacker can trigger the integer underflow over a network to cause a denial of service.

47) Out-of-bounds read (CVE-ID: CVE-2026-83856)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in Windows Event Logging Service when handling network communications. A remote attacker can exploit the service over a network to execute arbitrary code.

User interaction is required. Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

48) Use-after-free (CVE-ID: CVE-2026-83857)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Universal Disk Format File System Driver (UDFS) when the driver is used locally. A local user can exploit the driver locally to escalate privileges to SYSTEM.

49) Use-after-free (CVE-ID: CVE-2026-83859)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows NTFS when performing local operations. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

50) Stack-based buffer overflow (CVE-ID: CVE-2026-83860)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in Windows GDI when accessed over a network. A remote attacker can trigger the overflow over a network to cause a denial of service.

51) Heap-based buffer overflow (CVE-ID: CVE-2026-83861)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Remote Desktop Protocol when the component is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

52) Use-after-free (CVE-ID: CVE-2026-83862)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Network Load Balancing when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

53) Heap-based buffer overflow (CVE-ID: CVE-2026-83863)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Servicing Stack Updates when the component is used locally. A local user can exploit this buffer overflow to escalate privileges to SYSTEM.

54) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-83864)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose file content.

The vulnerability exists due to improper access control in Windows NTFS when accessing local files. A local user can exploit the access control weakness to disclose file content.

55) Relative Path Traversal (CVE-ID: CVE-2026-83865)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to tamper with data locally.

The vulnerability exists due to relative path traversal in Windows Internet (wininet.dll) when handling relative paths. A local user can exploit the path traversal locally to tamper with data.

Successful exploitation requires winning a race condition.

56) Use-after-free (CVE-ID: CVE-2026-83866)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Win32K when a race condition occurs. A local user can win the race condition and exploit the use-after-free locally to escalate privileges to SYSTEM.

57) Heap-based buffer overflow (CVE-ID: CVE-2026-83867)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Push Notifications when the component is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

58) Race condition (CVE-ID: CVE-2026-83868)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization in Microsoft Bluetooth Driver when concurrent operations access a shared resource. A local user can win a race condition to escalate privileges to SYSTEM.

59) Integer underflow (CVE-ID: CVE-2026-83869)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer underflow in the DNS Server service when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code on the target system.

No user interaction is required.

60) Out-of-bounds read (CVE-ID: CVE-2026-83870)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Aggregated Data Platform Service when accessing heap memory. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

61) Heap-based buffer overflow (CVE-ID: CVE-2026-83871)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to heap-based buffer overflow in OpenSSH for Windows when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

62) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-83872)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to incorrect conversion between numeric types in Windows TCP/IP when converting numeric values. A local user can exploit the numeric conversion error locally to escalate privileges to SYSTEM.

63) Relative Path Traversal (CVE-ID: CVE-2026-83873)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to relative path traversal in Windows Shell when handling relative paths. A local user can exploit the path traversal locally to escalate privileges to SYSTEM.

64) Heap-based buffer overflow (CVE-ID: CVE-2026-83874)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Event Tracing when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

65) Out-of-bounds read (CVE-ID: CVE-2026-83875)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the HID Parser Library when used locally. A local user can read kernel memory from a user mode process to disclose sensitive information.

66) Use-after-free (CVE-ID: CVE-2026-83876)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Shell when exploited locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

67) Integer overflow (CVE-ID: CVE-2026-83877)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in the HID Parser Library when performing integer calculations. A local user can exploit the overflow locally to escalate privileges to SYSTEM.

68) Race condition (CVE-ID: CVE-2026-83879)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of shared resources in Windows Overlay Filter when accessing shared resources concurrently. A local user can win a race condition to escalate privileges to SYSTEM.

69) Heap-based buffer overflow (CVE-ID: CVE-2026-83881)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows exFAT File System when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

70) Heap-based buffer overflow (CVE-ID: CVE-2026-83882)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Kernel when the kernel is used locally. A local user can trigger the buffer overflow to escalate privileges to SYSTEM.

71) Use-after-free (CVE-ID: CVE-2026-83883)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Win32K when the component is used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

72) Out-of-bounds read (CVE-ID: CVE-2026-83884)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the HID Parser Library when used locally. A local user can read kernel memory from a user mode process to disclose sensitive information.

73) Inadequate Encryption Strength (CVE-ID: CVE-2026-83885)

CWE-ID: CWE-326 - Inadequate Encryption Strength

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform spoofing.

The vulnerability exists due to inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave when using the enclave locally. A local user can exploit the encryption weakness locally to perform spoofing.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

74) Use-after-free (CVE-ID: CVE-2026-83886)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Update Orchestrator Service when operating locally. A local user can win a race condition to escalate privileges to SYSTEM.

75) Out-of-bounds read (CVE-ID: CVE-2026-83887)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in HID Parser Library when used locally. A local user can read beyond memory boundaries to disclose sensitive information from a privileged process's uninitialized heap memory.

76) Buffer over-read (CVE-ID: CVE-2026-83888)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive kernel memory.

The vulnerability exists due to a buffer over-read in the Windows CD-ROM Driver when reading memory buffers. A remote attacker can read kernel-space memory from a user-mode process to disclose sensitive kernel memory.

User interaction is required for exploitation.

77) Release of invalid pointer or reference (CVE-ID: CVE-2026-83889)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to release of an invalid pointer or reference in Windows DNS Server when handling requests. A remote user can send a specially crafted request to execute arbitrary code on the server.

User interaction is not required.

78) Out-of-bounds read (CVE-ID: CVE-2026-83892)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the HID Parser Library when accessed locally from a user-mode process. A local user can read kernel memory beyond the intended bounds to disclose sensitive information.

79) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-83893)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive file path information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service when accessing the service locally. A local user can access exposed file system information to disclose sensitive file path information.

80) Heap-based buffer overflow (CVE-ID: CVE-2026-83895)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Win32 Kernel Subsystem when the subsystem is targeted through a physical attack. An attacker with physical access to system can exploit the overflow through physical access to escalate privileges to SYSTEM.

81) Heap-based buffer overflow (CVE-ID: CVE-2026-83896)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Direct Composition when used locally. A local user can exploit the overflow to escalate privileges to SYSTEM.

82) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-83897)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in the Windows Win32 Kernel Subsystem when a race condition occurs. A local user can win the race condition to disclose sensitive information from uninitialized heap memory in a privileged process.

83) Out-of-bounds read (CVE-ID: CVE-2026-83898)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to an out-of-bounds read in HID Parser Library when accessed locally. A local user can exploit the out-of-bounds read to disclose certain kernel memory content.

84) Race condition (CVE-ID: CVE-2026-83899)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to improper privilege management in Windows Installer when managing local privileges. A local user can win a race condition to gain SYSTEM privileges.

85) Use-after-free (CVE-ID: CVE-2026-83900)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a use-after-free in Windows Bind Filter Driver when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

86) Use-after-free (CVE-ID: CVE-2026-83901)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when the subsystem is used locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

Successful exploitation requires specific conditions, such as particular protocol settings or configurations, to be in place.

87) Heap-based buffer overflow (CVE-ID: CVE-2026-83902)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Direct Composition when the component is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

88) Heap-based buffer overflow (CVE-ID: CVE-2026-83903)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Direct Composition when used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

89) Out-of-bounds read (CVE-ID: CVE-2026-83904)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in HID Parser Library when accessing heap memory. A local user can read uninitialized heap memory from a privileged process to disclose sensitive information.

90) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-83905)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Shell when the shell is used locally. A local user can view heap memory from a privileged process running on the server to disclose sensitive information.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

91) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-83906)

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information through spoofing.

The vulnerability exists due to incorrect implementation of an authentication algorithm in Windows Shell when performing authentication over a network. A remote attacker can exploit the incorrectly implemented authentication algorithm to disclose sensitive information through spoofing.

Exploitation requires user interaction.

92) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-83907)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Hello when system information is made accessible locally. A local user can view heap memory from a privileged process running on the server to disclose sensitive information.

93) Release of invalid pointer or reference (CVE-ID: CVE-2026-83908)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to release of an invalid pointer or reference in RPC Runtime when releasing pointers or references. A local user can exploit the invalid release locally to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and may depend on the environment, system configuration, and additional security measures.

94) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-83909)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in the Windows Win32 Kernel Subsystem when a race condition occurs. A local user can win the race condition to disclose uninitialized heap memory from a privileged process.

95) Out-of-bounds write (CVE-ID: CVE-2026-83910)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in RPC Runtime when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

96) Heap-based buffer overflow (CVE-ID: CVE-2026-83911)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Storage when a local user wins a race condition. A local user can exploit the overflow to escalate privileges to SYSTEM.

97) Use-after-free (CVE-ID: CVE-2026-83912)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Direct Composition when the component is used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

98) Use-after-free (CVE-ID: CVE-2026-83913)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Kernel when the kernel is used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

99) Use-after-free (CVE-ID: CVE-2026-83914)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft XML when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required. Successful exploitation requires a deep understanding of the target system and depends on environmental conditions, system configuration, and the presence of additional security measures.

100) Use-after-free (CVE-ID: CVE-2026-83915)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Diagnostic Policy Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

101) Double free (CVE-ID: CVE-2026-83916)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute code locally.

The vulnerability exists due to double free in Windows Error Reporting when a race condition occurs. A local user can win the race condition to execute code locally.

User interaction is not required.

102) Use-after-free (CVE-ID: CVE-2026-83917)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows ALPC when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

103) Integer overflow (CVE-ID: CVE-2026-83918)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in the Windows kernel when performing local operations. A local user can trigger the integer overflow or wraparound to escalate privileges to SYSTEM.

104) Heap-based buffer overflow (CVE-ID: CVE-2026-83919)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute code locally.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Internet Messaging API when the API is used locally. A local user can trigger the overflow to execute code locally.

105) Heap-based buffer overflow (CVE-ID: CVE-2026-83920)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Search Component when the component is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

106) Heap-based buffer overflow (CVE-ID: CVE-2026-83921)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Search Component when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

Successful exploitation requires specific conditions, such as particular protocol settings or configurations, which the advisory does not identify.

107) Use-after-free (CVE-ID: CVE-2026-83922)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Direct Composition when used locally. A local user can exploit this condition to escalate privileges to SYSTEM.

108) Relative Path Traversal (CVE-ID: CVE-2026-83923)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the client system.

The vulnerability exists due to relative path traversal in the OpenSSH for Windows client when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

109) Use-after-free (CVE-ID: CVE-2026-83924)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows kernel when exploited locally. A local user can exploit the memory management flaw to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

110) Use of uninitialized resource (CVE-ID: CVE-2026-83925)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in the Windows kernel when accessing uninitialized memory. A local user can win a race condition and read uninitialized memory from the kernel or another user-mode process to disclose sensitive information.

111) Improper Certificate Validation (CVE-ID: CVE-2026-83926)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to bypass Windows biometric authentication.

The vulnerability exists due to improper certificate validation in Windows Hello when determining whether a biometric device is trusted. A local privileged user can use a malicious biometric device to falsely present biometric data to bypass Windows biometric authentication.

112) Link following (CVE-ID: CVE-2026-83927)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Windows Registry when resolving links for file access. A local user can exploit link following locally to escalate privileges to SYSTEM.

113) Out-of-bounds write (CVE-ID: CVE-2026-83928)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to an out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) when handling network requests. A remote user can send a specially crafted request to an affected service over the network to execute arbitrary code on the target system.

114) Out-of-bounds write (CVE-ID: CVE-2026-83929)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Windows GDI when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

115) Use-after-free (CVE-ID: CVE-2026-83930)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Update Orchestrator Service when a race condition is triggered. A local user can win the race condition to gain SYSTEM privileges.

116) Heap-based buffer overflow (CVE-ID: CVE-2026-83931)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to a heap-based buffer overflow in Windows Hyper-V when exploited locally. A local user can exploit the overflow to execute arbitrary code locally.

Successful exploitation requires winning a race condition.

117) Heap-based buffer overflow (CVE-ID: CVE-2026-83932)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Group Policy when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

118) Link following (CVE-ID: CVE-2026-83933)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose file contents.

The vulnerability exists due to improper link resolution before file access in Windows Update Orchestrator Service when accessing files locally. A local user can abuse link following to disclose file contents.

119) Stack-based buffer overflow (CVE-ID: CVE-2026-83934)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in Windows GDI+ when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

120) Heap-based buffer overflow (CVE-ID: CVE-2026-83935)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft XML when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

121) Out-of-bounds read (CVE-ID: CVE-2026-84007)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to an out-of-bounds read in Remote Desktop Gateway Service when handling network interactions. A remote user can interact with the service over a network to disclose heap memory from a privileged process running on the server.

122) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-84008)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in .NET when handling network input. A remote attacker can trigger the affected functionality over a network to cause a denial of service.

123) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-84009)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform local tampering.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows Projected File System when performing local file system operations. A local user can win the race condition to perform local tampering.

124) Incorrect authorization (CVE-ID: CVE-2026-84011)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass network security protections based on fully qualified domain names (FQDNs).

The vulnerability exists due to incorrect authorization in Windows SMB Client when handling network connections subject to domain-based security rules. A local user can exploit the authorization flaw locally to bypass network security protections based on fully qualified domain names.

125) Double free (CVE-ID: CVE-2026-84012)

CWE-ID: CWE-415 - Double Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a double free in Remote Desktop Gateway Service when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.

126) Use-after-free (CVE-ID: CVE-2026-84013)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Telephony Server when accessed locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

127) Heap-based buffer overflow (CVE-ID: CVE-2026-84014)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Device Association Service when a race condition occurs. A local user can win the race condition and exploit the buffer overflow to escalate privileges to SYSTEM.

128) Heap-based buffer overflow (CVE-ID: CVE-2026-84015)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

129) Out-of-bounds write (CVE-ID: CVE-2026-84016)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds write in Windows EAPHost Service when accessed locally. A local user can trigger the out-of-bounds write to escalate privileges to SYSTEM.

130) NULL pointer dereference (CVE-ID: CVE-2026-84017)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in Windows Routing and Remote Access Service (RRAS) when handling network traffic. A remote attacker can trigger the null pointer dereference over the network to cause a denial of service.

131) Use-after-free (CVE-ID: CVE-2026-84018)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Print Spooler Components when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

132) Use-after-free (CVE-ID: CVE-2026-84019)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Advanced Rasterization Platform when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

133) Use-after-free (CVE-ID: CVE-2026-84020)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Routing and Remote Access Service (RRAS) when the service is accessed locally. A local user can win a race condition to escalate privileges to SYSTEM.

134) Heap-based buffer overflow (CVE-ID: CVE-2026-85318)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Servicing Stack Updates when used locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

135) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-85319)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) when handling network interactions. A remote attacker can trigger unrestricted resource allocation over the network to cause a denial of service.

136) Use of uninitialized resource (CVE-ID: CVE-2026-85320)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in Windows Print Spooler Components when accessing resources that have not been initialized. A local user can exploit this issue locally to disclose uninitialized heap memory from a privileged process.

137) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-85321)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) when handling network requests. A remote attacker can trigger resource allocation over the network to cause a denial of service.

138) Use of uninitialized resource (CVE-ID: CVE-2026-85322)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to use of an uninitialized resource in Windows Routing and Remote Access Service (RRAS) when communicating over a network. A remote attacker can exploit the uninitialized resource over a network to disclose uninitialized heap memory from a privileged process.

139) Weak Authentication (CVE-ID: CVE-2026-85323)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform spoofing.

The vulnerability exists due to weak authentication in Network Device Enrollment Service (NDES) when handling network interactions. A remote user can exploit the weak authentication over a network to perform spoofing.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

140) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-85324)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with an excessive size value in Active Directory Federation Services (AD FS) when handling network traffic. A remote attacker can trigger an excessively large memory allocation over the network to cause a denial of service.

141) Heap-based buffer overflow (CVE-ID: CVE-2026-85327)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Print Spooler Components when accessed locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

142) Weak Authentication (CVE-ID: CVE-2026-85328)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to weak authentication in Windows Projected File System when accessed locally. A local user can win a race condition to escalate privileges to SYSTEM.

143) Race condition (CVE-ID: CVE-2026-85329)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper synchronization of shared resources in Microsoft Account when executing operations concurrently. A local user can win a race condition to escalate privileges.

144) Out-of-bounds read (CVE-ID: CVE-2026-85331)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to read heap memory from a privileged process running on the server.

The vulnerability exists due to an out-of-bounds read in Windows Device Association Service when accessed over a network. A remote user can exploit the out-of-bounds read to read heap memory from a privileged process running on the server.

145) Use-after-free (CVE-ID: CVE-2026-85332)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Device Association Service when the service is accessed locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

146) Race condition (CVE-ID: CVE-2026-85333)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of concurrent access to shared resources in Windows Performance Monitor when shared resources are accessed concurrently. A local user can win a race condition to escalate privileges to SYSTEM.

User interaction is required for successful exploitation.

147) Out-of-bounds read (CVE-ID: CVE-2026-85334)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Message Queuing Queue Manager when accessed over a network. A remote attacker can read uninitialized heap memory from a privileged process to disclose sensitive information.

148) Out-of-bounds read (CVE-ID: CVE-2026-85336)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Device Association Service when accessing process memory. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

149) Out-of-bounds read (CVE-ID: CVE-2026-85337)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Remote Desktop Client when communicating over a network. A remote attacker can read heap memory from a privileged process running on the server to disclose sensitive information.

User interaction is required for exploitation.

150) Out-of-bounds read (CVE-ID: CVE-2026-85338)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Microsoft Graphics Component when the component is used locally. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

151) Heap-based buffer overflow (CVE-ID: CVE-2026-85339)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the client system.

The vulnerability exists due to a heap-based buffer overflow and integer underflow in Windows Routing and Remote Access Service (RRAS) when processing server responses on an affected client. A remote attacker can host a malicious server and convince a user to connect to it from the affected client to execute arbitrary code on the client system.

152) Heap-based buffer overflow (CVE-ID: CVE-2026-85341)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow in Windows USB Video Driver when exploited locally. A local user can exploit this flaw to gain SYSTEM privileges.

153) Use-after-free (CVE-ID: CVE-2026-85342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Device Association Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

154) Link following (CVE-ID: CVE-2026-85343)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Windows Hyper-V when accessing files. A local user can exploit link following locally to escalate privileges to SYSTEM.

155) Use-after-free (CVE-ID: CVE-2026-85352)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Device Association Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

156) Out-of-bounds read (CVE-ID: CVE-2026-85353)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Print Spooler Components when handling network communications. A remote attacker can read heap memory from a privileged process running on the server to disclose sensitive information.

157) Use-after-free (CVE-ID: CVE-2026-85354)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Error Reporting when the component is used locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

158) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-85355)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to inclusion of functionality from an untrusted control sphere in the Windows Common Log File System Driver when incorporating untrusted functionality. A local user can win a race condition to escalate privileges to SYSTEM.

159) Out-of-bounds read (CVE-ID: CVE-2026-85356)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows Volume Manager Extension Driver when exploited locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

160) Race condition (CVE-ID: CVE-2026-85357)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of shared resources in Windows Phone Service when executing concurrent operations. A local user can win a race condition to escalate privileges to SYSTEM.

161) Heap-based buffer overflow (CVE-ID: CVE-2026-85358)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Installer when used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

162) Code Injection (CVE-ID: CVE-2026-85359)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper control of code generation in Windows Performance Monitor when generating code locally. A local user can inject code to escalate privileges to SYSTEM.

163) Use-after-free (CVE-ID: CVE-2026-85361)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when used locally. A local user can exploit the flaw by winning a race condition to escalate privileges to SYSTEM.

164) Release of invalid pointer or reference (CVE-ID: CVE-2026-85362)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to release of an invalid pointer or reference in Windows Management Instrumentation when releasing pointers or references. A local user can win a race condition to escalate privileges to SYSTEM.

165) Integer overflow (CVE-ID: CVE-2026-85363)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain SYSTEM privileges.

The vulnerability exists due to integer overflow or wraparound in .NET Framework when the framework is accessed over a network. A remote attacker can exploit this weakness to gain SYSTEM privileges.

User interaction is required for successful exploitation.

166) Use-after-free (CVE-ID: CVE-2026-85364)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when previously freed memory is accessed. A local user can exploit this memory management flaw locally to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

167) Heap-based buffer overflow (CVE-ID: CVE-2026-85365)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Servicing Stack Updates when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

168) Heap-based buffer overflow (CVE-ID: CVE-2026-85366)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Installer when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

169) Use-after-free (CVE-ID: CVE-2026-85367)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Cash Drawer Protocol Provider when the component is used locally. A local user can win a race condition to escalate privileges to SYSTEM.

170) Heap-based buffer overflow (CVE-ID: CVE-2026-85368)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows TCP/IP when the component is exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

171) Out-of-bounds read (CVE-ID: CVE-2026-85369)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to escalate privileges to SYSTEM and execute arbitrary code on the Hyper-V host operating system.

The vulnerability exists due to an out-of-bounds read in Windows Hyper-V when processing vSMB packet data. A local privileged user can run a specially crafted application on a Hyper-V guest to escalate privileges to SYSTEM and execute arbitrary code on the Hyper-V host operating system.

172) Use-after-free (CVE-ID: CVE-2026-85370)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges and create or delete files in the security context of the NT AUTHORITYLOCAL SERVICE account.

The vulnerability exists due to use-after-free in WebDAV when a race condition is triggered. A local user can win the race condition to escalate privileges and create or delete files in the security context of the NT AUTHORITYLOCAL SERVICE account.

173) Use-after-free (CVE-ID: CVE-2026-85371)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Network Policy Server (NPS) when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.

174) Use-after-free (CVE-ID: CVE-2026-85372)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows kernel when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

175) Heap-based buffer overflow (CVE-ID: CVE-2026-85373)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host when used locally. A local user can exploit the buffer overflow to gain SYSTEM privileges.

176) Out-of-bounds read (CVE-ID: CVE-2026-85374)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Installer when accessing process memory locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

177) Use-after-free (CVE-ID: CVE-2026-85375)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Universal Plug and Play (UPnP) Device Host when exploited locally. A local user can exploit the memory-safety flaw to gain SYSTEM privileges.

178) Weak Authentication (CVE-ID: CVE-2026-85376)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to weak authentication in Windows Print Spooler Components when authenticating local access. A local user can exploit the weak authentication to escalate privileges from a low integrity level to a medium integrity level.

179) Type Confusion (CVE-ID: CVE-2026-85377)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to type confusion in Windows CD-ROM Driver when accessing resources using incompatible types. A local user can exploit the type confusion locally to escalate privileges to SYSTEM.

180) Use-after-free (CVE-ID: CVE-2026-85790)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to use-after-free in Microsoft QUIC when handling network communications. A remote attacker can exploit the flaw over a network to disclose heap memory from a privileged process running on the server.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

181) Heap-based buffer overflow (CVE-ID: CVE-2026-85791)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Encrypting File System (EFS) when operating locally. A local user can exploit the overflow to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

182) Use-after-free (CVE-ID: CVE-2026-85792)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Routing and Remote Access Service (RRAS) when processing network packets. A remote attacker can send a specially crafted packet to an affected service to execute arbitrary code.

No user interaction is required.

183) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-85793)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service when accessing system information locally. A local user can exploit this information exposure to disclose certain kernel memory content.

184) Out-of-bounds read (CVE-ID: CVE-2026-85794)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to an out-of-bounds read in Windows Routing and Remote Access Service (RRAS) when reading memory. A local user can exploit the out-of-bounds read locally to disclose uninitialized heap memory from a privileged process.

185) Use-after-free (CVE-ID: CVE-2026-85795)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Text Services Framework when used locally. A local user can exploit this memory-safety flaw to escalate privileges to SYSTEM.

186) Stack-based buffer overflow (CVE-ID: CVE-2026-85796)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to numeric truncation and a stack-based buffer overflow in Windows Installer when used locally. A local user can exploit the vulnerability locally to escalate privileges to SYSTEM.

187) Out-of-bounds read (CVE-ID: CVE-2026-85797)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows GDI when accessed over a network. A remote attacker can read heap memory from a privileged process running on the server to disclose sensitive information.

User interaction is required for exploitation.

188) Heap-based buffer overflow (CVE-ID: CVE-2026-85798)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Distributed File System (DFS) when handling network traffic. A remote privileged user can exploit the overflow over a network to execute arbitrary code.

189) Use-after-free (CVE-ID: CVE-2026-85799)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free in Network Policy Server (NPS) when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code on the target system.

Successful exploitation requires winning a race condition. No user interaction is required.

190) Heap-based buffer overflow (CVE-ID: CVE-2026-85800)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Error Reporting when the component is used locally. A local user can exploit this buffer overflow to escalate privileges to SYSTEM.

191) Use-after-free (CVE-ID: CVE-2026-85802)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when a race condition occurs. A local user can win the race condition to gain SYSTEM privileges.

192) Use-after-free (CVE-ID: CVE-2026-85803)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Camera Frame Server Monitor when a race condition is triggered. A local user can win the race condition to escalate privileges to SYSTEM.

193) Use-after-free (CVE-ID: CVE-2026-85804)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to elevate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when the subsystem is used locally. A local user can trigger the use-after-free to elevate privileges to SYSTEM.

194) Improperly implemented security check for standard (CVE-ID: CVE-2026-85805)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass Windows Defender Application Control and PowerShell Constrained Language Mode restrictions.

The vulnerability exists due to an improperly implemented security check for a standard in Windows PowerShell when enforcing restrictions on untrusted code. A remote attacker can exploit the security check over a network to bypass these restrictions and run untrusted code with capabilities those protections are designed to block.

User interaction is required.

195) Stack-based buffer overflow (CVE-ID: CVE-2026-85806)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer underflow and a stack-based buffer overflow in Network Policy Server (NPS) when processing network packets. A remote attacker can send a specially crafted packet to the affected service over the network to execute arbitrary code.

No user interaction is required.

196) Integer overflow (CVE-ID: CVE-2026-85807)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to integer overflow or wraparound in the Windows USB Video Driver when performing integer arithmetic. A local user can exploit the vulnerability locally to gain SYSTEM privileges.

197) Out-of-bounds read (CVE-ID: CVE-2026-85808)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Windows Routing and Remote Access Service (RRAS) when handling network traffic. A remote attacker can interact with the service over a network to cause a denial of service.

198) Heap-based buffer overflow (CVE-ID: CVE-2026-85809)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) when processing network packets. A remote attacker can send a specially crafted packet to the affected service over the network to execute arbitrary code.

No user interaction is required.

199) Use-after-free (CVE-ID: CVE-2026-85810)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Telephony Server when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

200) Use-after-free (CVE-ID: CVE-2026-85811)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to execute arbitrary code.

The vulnerability exists due to use-after-free in Network Policy Server (NPS) when accessed over an adjacent network. A remote attacker on the local network can exploit this flaw to execute arbitrary code.

Successful exploitation requires winning a race condition.

201) Files or Directories Accessible to External Parties (CVE-ID: CVE-2026-85812)

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose information.

The vulnerability exists due to files or directories being accessible to external parties in Windows Bind Filter Driver when accessing local files or directories. A local user can access exposed files or directories to disclose information.

The exposed information is limited to a small amount of internal system data, such as an internal identifier value, and does not include user content or personal data.

202) Heap-based buffer overflow (CVE-ID: CVE-2026-85814)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Media Foundation when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

203) Out-of-bounds read (CVE-ID: CVE-2026-85815)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Device Association Service when reading memory. A local user can exploit the flaw locally to disclose uninitialized heap memory from a privileged process.

204) Out-of-bounds read (CVE-ID: CVE-2026-85816)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user on the local network to disclose certain kernel memory content.

The vulnerability exists due to an out-of-bounds read in Windows Wi-Fi Driver when communicating over an adjacent network. A remote user on the local network can exploit the driver over that network to disclose certain kernel memory content.

User interaction is not required.

205) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-85817)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the client system.

The vulnerability exists due to reliance on untrusted inputs in a security decision in Windows PowerShell when processing a server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

206) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-85818)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to impersonate a trusted client.

The vulnerability exists due to improper verification of cryptographic signatures in Windows Schannel when handling concurrent resumed TLS connections. A remote attacker can win a race condition and substitute a trusted client certificate without proving possession of its private key to impersonate a trusted client.

User interaction is not required.

207) Use-after-free (CVE-ID: CVE-2026-85820)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Universal Disk Format File System Driver (UDFS) when used locally. A local user can exploit this memory-handling flaw to escalate privileges to SYSTEM.

208) Out-of-bounds read (CVE-ID: CVE-2026-85821)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Windows Universal Disk Format File System Driver (UDFS) when accessing memory. A remote user can read heap memory from a privileged process running on the server or small portions of uninitialized kernel stack memory to disclose sensitive information.

209) Heap-based buffer overflow (CVE-ID: CVE-2026-85822)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows exFAT File System when handling local file system operations. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

210) Use-after-free (CVE-ID: CVE-2026-85823)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Composite Image File System when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

211) Use-after-free (CVE-ID: CVE-2026-85824)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Composite Image File System when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

212) Use-after-free (CVE-ID: CVE-2026-85825)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Universal Disk Format File System Driver (UDFS) when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

213) Out-of-bounds write (CVE-ID: CVE-2026-85826)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to an out-of-bounds write in Windows Fast FAT Driver when exploited locally. A local user can trigger an out-of-bounds write to gain SYSTEM privileges.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

214) Heap-based buffer overflow (CVE-ID: CVE-2026-85827)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in WebDAV when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

215) Heap-based buffer overflow (CVE-ID: CVE-2026-85828)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow in WebDAV when a race condition is won during local exploitation. A local user can exploit the buffer overflow to gain SYSTEM privileges.

216) Double free (CVE-ID: CVE-2026-85829)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a double free in Windows Wired AutoConfig Service when managing memory. A local user can trigger the double free locally to escalate privileges to SYSTEM.

217) Out-of-bounds read (CVE-ID: CVE-2026-85830)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Installer when reading process memory. A local user can exploit the out-of-bounds read to disclose uninitialized heap memory from a privileged process.

218) Heap-based buffer overflow (CVE-ID: CVE-2026-85831)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a heap-based buffer overflow in Windows Biometric Service when the service is exploited locally. A local user can exploit this flaw to disclose heap memory from a privileged process running on the server.

219) Heap-based buffer overflow (CVE-ID: CVE-2026-85832)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

220) Use-after-free (CVE-ID: CVE-2026-85833)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Modern Device Management (MDM) when exploited locally. A local user can exploit the use-after-free condition to gain SYSTEM privileges.

221) Heap-based buffer overflow (CVE-ID: CVE-2026-85834)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows TCP/IP when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

222) Buffer over-read (CVE-ID: CVE-2026-85835)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized heap memory from a privileged process.

The vulnerability exists due to a buffer over-read in Servicing Stack Updates when reading memory. A local user can trigger the buffer over-read locally to disclose uninitialized heap memory from a privileged process.

223) Use-after-free (CVE-ID: CVE-2026-85836)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in the Windows kernel when accessing previously freed memory. A local user can exploit this memory-handling flaw to gain SYSTEM privileges.

224) Out-of-bounds read (CVE-ID: CVE-2026-85837)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to an out-of-bounds read in the Windows kernel when exploited locally. A local user can exploit this out-of-bounds read to gain SYSTEM privileges.

225) Files or Directories Accessible to External Parties (CVE-ID: CVE-2026-85840)

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose file content.

The vulnerability exists due to exposure of files or directories to external parties in Windows Event Viewer when accessing files or directories over a network. A remote user can access exposed files to disclose file content.

226) Use-after-free (CVE-ID: CVE-2026-85841)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows DHCP Server when handling network activity. A remote privileged user can exploit the use-after-free over the network to execute arbitrary code.

Successful exploitation requires winning a race condition.

227) Format string error (CVE-ID: CVE-2026-85842)

CWE-ID: CWE-134 - Use of Externally-Controlled Format String

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use of an externally controlled format string in Windows Image Acquisition when processing format strings. A local user can control a format string to escalate privileges to SYSTEM.

228) Use of uninitialized resource (CVE-ID: CVE-2026-85843)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use of an uninitialized resource in Windows Background Intelligent Transfer Service (BITS) when using a resource that has not been initialized. A local user can exploit this resource locally to escalate privileges to SYSTEM.

229) Use-after-free (CVE-ID: CVE-2026-85846)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Web Account Manager when the component is used locally. A local user can win a race condition to escalate privileges from a low integrity level to a medium integrity level.

230) Out-of-bounds read (CVE-ID: CVE-2026-85847)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Print Spooler Components when accessed over a network. A remote attacker can read heap memory from a privileged server process to disclose sensitive information.

Exploitation requires user interaction.

231) Heap-based buffer overflow (CVE-ID: CVE-2026-85848)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) when the service is used locally. A local user can exploit the buffer overflow locally to escalate privileges to SYSTEM.

232) Link following (CVE-ID: CVE-2026-85849)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Windows AppX Deployment Service when accessing files through links. A local user can exploit link following locally to escalate privileges to SYSTEM.

233) Release of invalid pointer or reference (CVE-ID: CVE-2026-85850)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to release of an invalid pointer or reference in the Windows Kernel when releasing a pointer or reference. A local user can exploit this flaw locally to gain SYSTEM privileges.

234) Use-after-free (CVE-ID: CVE-2026-85851)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows SmartScreen when exploited locally. A local user can exploit the use-after-free condition to escalate privileges from a low integrity level to a medium integrity level.

235) Out-of-bounds read (CVE-ID: CVE-2026-85852)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Management Instrumentation when reading memory locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

236) Out-of-bounds read (CVE-ID: CVE-2026-85853)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows DWM Core Library when a race condition is won. A local user can exploit this condition to escalate privileges to SYSTEM.

237) Use-after-free (CVE-ID: CVE-2026-85854)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows DWM Core Library when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

238) Use-after-free (CVE-ID: CVE-2026-85855)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows DWM Core Library when a race condition is triggered. A local user can win the race condition to escalate privileges to SYSTEM.

239) Heap-based buffer overflow (CVE-ID: CVE-2026-85856)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user on the local network to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Windows Internet Connection Sharing (ICS) when handling interactions over an adjacent network. A remote user on the local network can exploit the buffer overflow over that network to execute arbitrary code.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

240) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-85857)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to insertion of sensitive information into log files in Windows Kernel-Mode Drivers when recording information in log files. A local user can access the logged sensitive information to disclose certain kernel memory content.

241) Out-of-bounds read (CVE-ID: CVE-2026-85858)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in the Windows Win32 Kernel Subsystem when a race condition is triggered. A local user can win the race condition to escalate privileges to SYSTEM.

242) NULL pointer dereference (CVE-ID: CVE-2026-85859)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in Windows Message Queuing Queue Manager when handling network interactions. A remote user can trigger the null pointer dereference over a network to cause a denial of service.

243) Use-after-free (CVE-ID: CVE-2026-85860)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Message Queuing Queue Manager when the component is accessed locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

244) Use-after-free (CVE-ID: CVE-2026-85861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Clipboard User Service when operating locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

245) Use-after-free (CVE-ID: CVE-2026-85863)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges from a low integrity level to a medium integrity level.

The vulnerability exists due to use-after-free in Windows Clipboard User Service when a race condition occurs. A local user can win the race condition to escalate privileges from a low integrity level to a medium integrity level.

246) Improper privilege management (CVE-ID: CVE-2026-85864)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges from a low integrity level to a medium integrity level.

The vulnerability exists due to improper privilege management in Python when managing privileges locally. A local user can exploit the privilege management flaw to escalate privileges from a low integrity level to a medium integrity level.

247) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-85865)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass DHCPv6 address-assignment validation and cause a server response to omit an address that should be assigned.

The vulnerability exists due to improper authentication in Windows DHCP Server when validating DHCPv6 address assignments. A local user can exploit an alternate authentication path or channel locally to bypass DHCPv6 address-assignment validation and cause a server response to omit an address that should be assigned.

248) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-85866)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows ALPC when a race condition occurs. A local user can win the race condition to read heap memory from a privileged process running on the server.

249) Heap-based buffer overflow (CVE-ID: CVE-2026-85867)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Remote Access Connection Manager when exploited locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

250) Use-after-free (CVE-ID: CVE-2026-85868)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Common Log File System Driver when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

251) Heap-based buffer overflow (CVE-ID: CVE-2026-85869)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Microsoft Windows Search Component when accessed locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

252) Heap-based buffer overflow (CVE-ID: CVE-2026-85870)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Common Log File System Driver when the driver is used locally. A local user can exploit the buffer overflow locally to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

253) Heap-based buffer overflow (CVE-ID: CVE-2026-85871)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Kernel-Mode Drivers when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

254) Use-after-free (CVE-ID: CVE-2026-85872)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Storage VSP Driver when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

Exploitation can cross the security boundary between a low-privilege Hyper-V guest and the Hyper-V host environment.

255) Use-after-free (CVE-ID: CVE-2026-85874)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code locally.

The vulnerability exists due to use-after-free in Windows Message Queuing Queue Manager when accessed locally. A local user can exploit this memory management flaw to execute arbitrary code locally.

256) Missing Authentication for Critical Function (CVE-ID: CVE-2026-85884)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to missing authentication for a critical function in Windows Health and Optimized Experiences Service when the function is invoked locally. A local user can access the critical function without authentication to escalate privileges to SYSTEM.

257) Heap-based buffer overflow (CVE-ID: CVE-2026-85901)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Win32K - GRFX when the component is used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

258) Heap-based buffer overflow (CVE-ID: CVE-2026-85902)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Direct Composition when used locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

259) Untrusted Pointer Dereference (CVE-ID: CVE-2026-85903)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to untrusted pointer dereference in DNS Server when handling network input. A remote attacker can trigger the untrusted pointer dereference over a network to execute arbitrary code.

User interaction is required, as indicated by the published CVSS vector; the specific interaction is not described.

260) Race condition (CVE-ID: CVE-2026-85904)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper synchronization of a shared resource in Windows Device Association Service when executing concurrent operations. A local user can win a race condition to escalate privileges.

261) Heap-based buffer overflow (CVE-ID: CVE-2026-85905)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows UI Immersive Server when accessed locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation can cross an interactive session boundary by activating a component with elevated launch permissions from a different session than the one it normally runs in. This can affect resources belonging to another user's session, including in multi-user or Remote Desktop Services (RDS) deployments.

262) Use-after-free (CVE-ID: CVE-2026-85906)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Direct Composition when the component is used locally. A local user can exploit this memory-lifetime flaw to gain SYSTEM privileges.

263) Heap-based buffer overflow (CVE-ID: CVE-2026-85908)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Win32K - GRFX when accessed locally. A local user can trigger the buffer overflow to escalate privileges to SYSTEM.

264) Out-of-bounds read (CVE-ID: CVE-2026-85909)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Windows Universal Disk Format File System Driver (UDFS) when accessing memory. A local user can read kernel memory from a user mode process to disclose sensitive information.

265) Buffer over-read (CVE-ID: CVE-2026-85910)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to a buffer over-read in Windows StateRepository API when accessing the API locally. A local user can trigger the buffer over-read to disclose heap memory from a privileged process running on the server.

266) Use-after-free (CVE-ID: CVE-2026-85911)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows StateRepository API when the API is used locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

267) Race condition (CVE-ID: CVE-2026-85912)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of shared resources in Windows Clipboard User Service when executing concurrent operations. A local user can win a race condition to escalate privileges to SYSTEM.

268) Use-after-free (CVE-ID: CVE-2026-85914)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in Windows Embedded Mode Service when the service accesses freed memory. A local user can exploit the use-after-free condition to escalate privileges.

Successful exploitation requires winning a race condition.

269) Heap-based buffer overflow (CVE-ID: CVE-2026-85915)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows PCI Bus Driver when the driver is accessed locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

270) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2026-85916)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information locally.

The vulnerability exists due to exposure of private personal information to unauthorized actors in Azure Active Directory when handling work account sign-in access tokens. A remote attacker can access an exposed sign-in access token for a user's work account to disclose sensitive information locally.

271) Use-after-free (CVE-ID: CVE-2026-85918)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Universal Plug and Play (UPnP) Device Host when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

272) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-85920)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Windows BitLocker when performing local operations. A local user can win a race condition to gain SYSTEM privileges.

273) Use-after-free (CVE-ID: CVE-2026-85926)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Secure Socket Tunneling Protocol (SSTP) when handling network traffic. A remote attacker can trigger the use-after-free over a network to execute arbitrary code.

Exploitation requires particular network configurations and timing conditions and has only been observed in limited scenarios.

274) Heap-based buffer overflow (CVE-ID: CVE-2026-85927)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

275) Heap-based buffer overflow (CVE-ID: CVE-2026-85928)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Volume Manager Extension Driver when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

276) Use-after-free (CVE-ID: CVE-2026-85930)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Image Acquisition when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

277) Heap-based buffer overflow (CVE-ID: CVE-2026-85931)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Distributed File System (DFS) when handling network traffic. A remote user can exploit the buffer overflow over the network to execute arbitrary code.

278) Use-after-free (CVE-ID: CVE-2026-85933)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Print Spooler Components when the components are accessed locally. A local user can exploit this memory-handling flaw to escalate privileges to SYSTEM.

No user interaction is required.

279) Use-after-free (CVE-ID: CVE-2026-85934)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows AppX Deployment Service when a local race condition is triggered. A local user can win the race condition to escalate privileges to SYSTEM.

280) Buffer over-read (CVE-ID: CVE-2026-85935)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to a buffer over-read in Windows USB Driver when the driver is accessed locally. A local user can exploit the buffer over-read to disclose certain kernel memory content.

281) Double free (CVE-ID: CVE-2026-85936)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a double free in Windows Shell when exploited over a network. A remote attacker can trigger the double-free condition to execute arbitrary code.

User interaction is required for successful exploitation.

282) Missing Authorization (CVE-ID: CVE-2026-85938)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to missing authorization in Windows Broadcast DVR User Service when capturing screenshots across user-session boundaries. A local user can capture screenshots of another user's session to disclose sensitive information.

283) Weak Authentication (CVE-ID: CVE-2026-85939)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass a security feature.

The vulnerability exists due to weak authentication in Windows Kernel when handling authentication over a network. A remote user can exploit the authentication weakness to bypass a security feature.

Exploitation depends on a target environment configuration that could occur accidentally.

284) Race condition (CVE-ID: CVE-2026-85941)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of shared resources in Windows Installer when executing concurrent operations. A local user can win a race condition to escalate privileges to SYSTEM.

285) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-85943)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in Reliable Multicast Transport Driver (RMCAST) when a resource is checked and subsequently used. A local user can win the race condition to escalate privileges to SYSTEM.

286) Use-after-free (CVE-ID: CVE-2026-85945)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Kernel when accessing previously freed memory. A local user can exploit the vulnerability locally to escalate privileges to SYSTEM.

287) Use-after-free (CVE-ID: CVE-2026-87691)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Management Services when the component is used locally. A local user can exploit this flaw locally to gain SYSTEM privileges.

288) Use-after-free (CVE-ID: CVE-2026-87693)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

289) Use-after-free (CVE-ID: CVE-2026-87694)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when used locally. A local user can exploit this memory-handling flaw to escalate privileges to SYSTEM.

290) Deserialization of Untrusted Data (CVE-ID: CVE-2026-87697)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in .NET when processing an attacker-supplied file. A remote attacker can trick a user into opening a specially crafted file to execute arbitrary code.

291) Out-of-bounds read (CVE-ID: CVE-2026-87698)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Remote Access Service Infrastructure when reading memory. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

292) Heap-based buffer overflow (CVE-ID: CVE-2026-87699)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Winlogon when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

293) Use-after-free (CVE-ID: CVE-2026-87700)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when accessed locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

294) Integer overflow (CVE-ID: CVE-2026-87702)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in Windows Resource Management (MRM) when exploited locally. A local user can exploit the integer overflow to escalate privileges to SYSTEM.

295) Use-after-free (CVE-ID: CVE-2026-87704)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when exploited locally. A local user can exploit the memory management flaw to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

296) Improper Verification of Source of a Communication Channel (CVE-ID: CVE-2026-87705)

CWE-ID: CWE-940 - Improper Verification of Source of a Communication Channel

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to bypass a security feature and disclose sensitive information.

The vulnerability exists due to improper verification of the source of a communication channel in Windows Hyper-V when handling communications over an adjacent network. A remote attacker on the local network can exploit the communication-channel source verification weakness to bypass a security feature and disclose sensitive information.

The relevant virtualization security boundary is between guest virtual machines.

297) Use-after-free (CVE-ID: CVE-2026-87708)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when operating locally. A local user can win a race condition to escalate privileges to SYSTEM.

298) Execution with unnecessary privileges (CVE-ID: CVE-2026-87709)

CWE-ID: CWE-250 - Execution with Unnecessary Privileges

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to alter system state or configuration beyond their normal privileges.

The vulnerability exists due to improper access control in Windows Host Guardian Service when accessing protected system data locally. A local user can make unauthorized modifications to protected system data to alter system state or configuration beyond their normal privileges.

299) Race condition (CVE-ID: CVE-2026-87710)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper access control in Microsoft Local Security Authority Server (lsasrv) when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

300) Stack-based buffer overflow (CVE-ID: CVE-2026-87711)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a stack-based buffer overflow in Windows Installer when accessed locally. A local user can exploit the overflow to escalate privileges to SYSTEM.

301) Use-after-free (CVE-ID: CVE-2026-87712)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Quality of Service (QoS) Packet Scheduler when the component is used locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

302) Use-after-free (CVE-ID: CVE-2026-87713)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to escalate privileges.

The vulnerability exists due to use-after-free in Windows Bluetooth Port Driver when handling adjacent-network interactions. A remote attacker on the local network can win a race condition to escalate privileges.

303) Missing Authorization (CVE-ID: CVE-2026-87714)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass access-control checks and move or overwrite files in unauthorized locations.

The vulnerability exists due to missing authorization in the WebDAV service when handling file-operation requests over a network. A remote user can submit file-operation requests to bypass access-control checks and move or overwrite files in unauthorized locations.

304) Use-after-free (CVE-ID: CVE-2026-87715)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

305) Heap-based buffer overflow (CVE-ID: CVE-2026-87716)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in Windows Storage Spaces Controller when handling network traffic. A remote attacker can trigger the buffer overflow over a network to cause a denial of service.

306) Out-of-bounds read (CVE-ID: CVE-2026-88070)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows BitLocker when used locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

307) Double free (CVE-ID: CVE-2026-88071)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a double free in Windows Hyper-V when managing memory. A local user can exploit the double-free condition locally to escalate privileges to SYSTEM.

308) Link following (CVE-ID: CVE-2026-88072)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Windows Host Guardian Service when accessing files. A local user can abuse improper link handling locally to escalate privileges to SYSTEM.

309) Use-after-free (CVE-ID: CVE-2026-88073)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Graphics Kernel when the component is used locally. A local user can exploit this condition to gain SYSTEM privileges.

310) Integer overflow (CVE-ID: CVE-2026-88074)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave when the enclave is used locally. A local user can trigger the integer overflow to escalate privileges to SYSTEM.

311) NULL pointer dereference (CVE-ID: CVE-2026-88076)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a null pointer dereference in Windows Installer when used locally. A local user can exploit the null pointer dereference to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

312) NULL pointer dereference (CVE-ID: CVE-2026-88079)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a null pointer dereference in Windows MIDI Service Module when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

313) Use-after-free (CVE-ID: CVE-2026-88080)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when used locally. A local user can exploit the use-after-free to escalate privileges to SYSTEM.

314) Deserialization of Untrusted Data (CVE-ID: CVE-2026-88091)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to deserialization of untrusted data in Windows Management Instrumentation when processing serialized data. A local user can exploit the deserialization flaw locally to escalate privileges to SYSTEM.

315) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-88092)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to tamper with server-side HTTP request handling.

The vulnerability exists due to inconsistent interpretation of HTTP requests in ASP.NET Core when processing HTTP/1.1 requests forwarded through a reverse proxy. A remote attacker can send specially crafted requests that desynchronize request handling between the proxy and the server and inject an unintended request to tamper with server-side HTTP request handling.

User interaction is not required.

316) Heap-based buffer overflow (CVE-ID: CVE-2026-88093)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Desktop Window Manager when exploited locally. A local user can trigger the heap-based buffer overflow to escalate privileges to SYSTEM.

317) Race condition (CVE-ID: CVE-2026-88096)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization in Windows DCOM Server when shared resources are accessed concurrently. A local user can win a race condition to escalate privileges to SYSTEM.

318) Untrusted Pointer Dereference (CVE-ID: CVE-2026-88098)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in Windows Security Support Provider Interface when used locally. A local user can exploit the pointer dereference to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

319) Uncaught Exception (CVE-ID: CVE-2026-88099)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in Windows Failover Cluster when handling network traffic. A remote attacker can trigger the exception over the network to cause a denial of service.

320) Use-after-free (CVE-ID: CVE-2026-88100)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Storage Spaces Controller when used locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

321) Weak Authentication (CVE-ID: CVE-2026-88101)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to weak authentication in Microsoft Input Method Editor (IME) when used locally. A local user can exploit the authentication weakness to escalate privileges.

The privilege escalation crosses from a Low Integrity Level sandboxed execution environment to a Medium Integrity Level.

322) Use-after-free (CVE-ID: CVE-2026-88102)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free in Windows Failover Cluster when handling network packets. A remote attacker can send a specially crafted packet to an affected service to execute arbitrary code on the target system.

No user interaction is required.

323) Use-after-free (CVE-ID: CVE-2026-88103)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when accessed locally. A local user can win a race condition to escalate privileges to SYSTEM.

324) Use-after-free (CVE-ID: CVE-2026-88105)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when accessed locally. A local user can exploit the use-after-free flaw to escalate privileges to SYSTEM.

325) Use-after-free (CVE-ID: CVE-2026-88106)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Cloud Files Mini Filter Driver when a specific operation triggers a memory allocation failure. A local user can trigger this operation locally to escalate privileges to SYSTEM.

Exploitation requires knowledge of the specific operation that triggers the failure.

326) Use-after-free (CVE-ID: CVE-2026-88107)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Cloud Files Mini Filter Driver when a race condition occurs. A local user can win this race condition to escalate privileges to SYSTEM.

327) Heap-based buffer overflow (CVE-ID: CVE-2026-88110)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Graphics Kernel when exploited locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

328) Untrusted Pointer Dereference (CVE-ID: CVE-2026-88112)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on a client system.

The vulnerability exists due to untrusted pointer dereference in DNS Server when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

329) Use-after-free (CVE-ID: CVE-2026-88113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

330) Untrusted Pointer Dereference (CVE-ID: CVE-2026-88114)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on a client system.

The vulnerability exists due to untrusted pointer dereference in DNS Server when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

331) Out-of-bounds read (CVE-ID: CVE-2026-88115)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in Windows Server for NFS when handling network input. A remote attacker can exploit the out-of-bounds read over a network to execute arbitrary code.

User interaction is required, according to the published CVSS vector.

332) Untrusted Pointer Dereference (CVE-ID: CVE-2026-88116)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to untrusted pointer dereference in DNS Server when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code.

333) Use-after-free (CVE-ID: CVE-2026-88117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows DHCP Server when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.

334) Integer overflow (CVE-ID: CVE-2026-88118)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) when performing local operations. A local user can exploit the integer overflow to escalate privileges to SYSTEM.

335) Use-after-free (CVE-ID: CVE-2026-88119)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows DHCP Server when handling network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.

336) Use-after-free (CVE-ID: CVE-2026-88120)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows DHCP Server when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

Successful exploitation requires winning a race condition. No user interaction is required.

337) Use-after-free (CVE-ID: CVE-2026-88121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user on the local network to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Background Intelligent Transfer Service (BITS) when handling network interactions. A remote user on the local network can exploit the use-after-free over the local network to execute arbitrary code.

338) Out-of-bounds read (CVE-ID: CVE-2026-88122)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in DNS Server when handling network traffic. A remote user can trigger the out-of-bounds read over the network to cause a denial of service.

339) Out-of-bounds read (CVE-ID: CVE-2026-88123)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the DNS Server role when handling network interactions. A remote user can exploit the out-of-bounds read over a network to cause a denial of service.

340) Use-after-free (CVE-ID: CVE-2026-88124)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

341) Out-of-bounds read (CVE-ID: CVE-2026-88125)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in DNS Server when handling network requests. A remote user can send network requests to cause a denial of service.

342) Untrusted Pointer Dereference (CVE-ID: CVE-2026-88126)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in WebDAV when dereferencing an untrusted pointer. A local user can exploit this weakness locally to escalate privileges to SYSTEM.

343) Use-after-free (CVE-ID: CVE-2026-88127)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows SMB Server when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

344) Heap-based buffer overflow (CVE-ID: CVE-2026-88128)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows DWM Core Library when accessed locally. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

345) Out-of-bounds read (CVE-ID: CVE-2026-88129)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in DNS Server when handling network traffic. A remote user can trigger the out-of-bounds read over the network to cause a denial of service.

346) Out-of-bounds read (CVE-ID: CVE-2026-88130)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the DNS Server role when handling network traffic. A remote user can interact with the DNS Server over a network to cause a denial of service.

347) Incorrect authorization (CVE-ID: CVE-2026-88133)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper authorization in Windows Portable Device Enumerator Service when performing local service operations. A local user can exploit the service's authorization weakness to escalate privileges to SYSTEM.

348) Use-after-free (CVE-ID: CVE-2026-88134)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows kernel when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

349) Missing Authorization (CVE-ID: CVE-2026-88135)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to missing authorization in WebDAV when performing local operations. A local user can exploit the authorization weakness to escalate privileges to SYSTEM.

350) Improper Resolution of Path Equivalence (CVE-ID: CVE-2026-88136)

CWE-ID: CWE-41 - Improper Resolution of Path Equivalence

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper resolution of path equivalence in WebDAV when handling network requests. A remote user can send a specially crafted request to an affected service to execute arbitrary code.

351) Files or Directories Accessible to External Parties (CVE-ID: CVE-2026-88137)

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose file contents.

The vulnerability exists due to exposure of files or directories to external parties in WebDAV when handling network access to these resources. A remote user can access exposed files over the network to disclose file contents.

352) Use-after-free (CVE-ID: CVE-2026-88139)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Kernel when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

353) Out-of-bounds read (CVE-ID: CVE-2026-88140)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose information.

The vulnerability exists due to an out-of-bounds read in Windows Key Storage Provider when accessing the component locally. A local user can read small portions of heap memory to disclose information.

354) Use-after-free (CVE-ID: CVE-2026-88141)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows kernel when kernel memory is accessed after being freed. A local user can exploit this condition locally to escalate privileges to SYSTEM.

Successful exploitation requires winning a race condition.

355) Use-after-free (CVE-ID: CVE-2026-88142)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Background Intelligent Transfer Service (BITS) when handling network interactions. A remote user can exploit this memory safety flaw over a network to execute arbitrary code.

356) Heap-based buffer overflow (CVE-ID: CVE-2026-88143)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Storage Spaces Controller when exploited locally. A local privileged user can exploit this flaw to escalate privileges to SYSTEM.

357) Race condition (CVE-ID: CVE-2026-88146)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper synchronization of shared resources in Windows Background Intelligent Transfer Service (BITS) when shared resources are accessed concurrently. A local user can win a race condition to escalate privileges and execute code in the security context of the NT AUTHORITYNetwork Service account.

358) Heap-based buffer overflow (CVE-ID: CVE-2026-88147)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

359) Double free (CVE-ID: CVE-2026-88149)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a double free in Windows Ancillary Function Driver for WinSock when a race condition occurs. A local user can exploit the double-free condition locally to escalate privileges to SYSTEM.

360) Use-after-free (CVE-ID: CVE-2026-88152)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Background Intelligent Transfer Service (BITS) when used locally. A local user can exploit the service locally to escalate privileges to SYSTEM.

361) Heap-based buffer overflow (CVE-ID: CVE-2026-88157)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in OpenSSH for Windows when handling network communication. A remote attacker can exploit the buffer overflow over a network to execute arbitrary code.

Exploitation requires user interaction.

362) Out-of-bounds read (CVE-ID: CVE-2026-88158)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Digest Authentication when used locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

363) Use-after-free (CVE-ID: CVE-2026-88159)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Background Intelligent Transfer Service (BITS) when handling network interactions. A remote user can trigger the use-after-free over a network to execute arbitrary code.

364) Race condition (CVE-ID: CVE-2026-88160)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of shared resources in Microsoft Windows Search Component when accessing shared resources concurrently. A local user can win a race condition to escalate privileges to SYSTEM.

365) Use-after-free (CVE-ID: CVE-2026-88161)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Local Security Authority (LSA) when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

366) Incorrect authorization (CVE-ID: CVE-2026-88162)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify protected system data beyond their normal privileges.

The vulnerability exists due to incorrect authorization in Windows Encrypting File System (EFS) when accessing protected system data locally. A local user can make unauthorized modifications to protected system data to alter system state or configuration beyond their normal privileges.

367) Out-of-bounds write (CVE-ID: CVE-2026-88165)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in Active Directory Domain Services when handling network traffic. A remote user can trigger the out-of-bounds write over a network to execute arbitrary code.

368) Heap-based buffer overflow (CVE-ID: CVE-2026-88168)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Bind Filter Driver when used locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

369) Double free (CVE-ID: CVE-2026-88171)

CWE-ID: CWE-415 - Double Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a double free in Windows DHCP Server when handling network traffic. A remote attacker can trigger the double free over the network to execute arbitrary code.

Successful exploitation requires winning a race condition.

370) Use-after-free (CVE-ID: CVE-2026-88173)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows Background Intelligent Transfer Service (BITS) when accessed over a network. A remote attacker can exploit the memory error over a network to execute arbitrary code.

Successful exploitation requires winning a race condition.

371) Race condition (CVE-ID: CVE-2026-88174)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper synchronization of concurrent access to shared resources in Windows Deployment Services when handling concurrent operations over a network. A remote attacker can win a race condition to execute arbitrary code.

372) Out-of-bounds read (CVE-ID: CVE-2026-88177)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows DWM Core Library when the library is used locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

373) Out-of-bounds read (CVE-ID: CVE-2026-88179)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to an out-of-bounds read in Windows DWM Core Library when used locally. A local user can exploit the out-of-bounds read locally to gain SYSTEM privileges.

374) Out-of-bounds read (CVE-ID: CVE-2026-88180)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows DWM Core Library when used locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

375) Out-of-bounds read (CVE-ID: CVE-2026-88181)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows DWM Core Library when the library is used locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

376) Use-after-free (CVE-ID: CVE-2026-88182)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Windows Search Component when exploited locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

377) Out-of-bounds read (CVE-ID: CVE-2026-88188)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows DWM Core Library when the library is used locally. A local user can exploit this out-of-bounds read to escalate privileges to SYSTEM.

378) Out-of-bounds read (CVE-ID: CVE-2026-88189)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows DWM Core Library when exploited locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

379) Link following (CVE-ID: CVE-2026-88191)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in Microsoft Windows Search Component when accessing files through links. A local user can exploit link following locally to escalate privileges to SYSTEM.

380) Heap-based buffer overflow (CVE-ID: CVE-2026-88193)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to administrator.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Scripting Engine when the engine is used locally. A local user can exploit the heap-based buffer overflow to escalate privileges to administrator.

381) Out-of-bounds read (CVE-ID: CVE-2026-88194)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows DWM Core Library when used locally. A local user can exploit this memory access error to escalate privileges to SYSTEM.

382) Untrusted Pointer Dereference (CVE-ID: CVE-2026-88219)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on a client system.

The vulnerability exists due to untrusted pointer dereference in RPC Runtime when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

The advisory also states that exploitation requires a user to open a specially crafted file supplied by the attacker.

383) Out-of-bounds read (CVE-ID: CVE-2026-88226)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to disclose certain kernel memory content.

The vulnerability exists due to an out-of-bounds read in Windows Storage Port Driver when accessed through a physical attack. An attacker with physical access to system can trigger an out-of-bounds read through physical access to disclose certain kernel memory content.

384) Improperly Controlled Sequential Memory Allocation (CVE-ID: CVE-2026-92707)

CWE-ID: CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improperly controlled sequential memory allocation in MessagePack-CSharp when handling network input. A remote attacker can trigger sequential memory allocations over a network to cause a denial of service.

385) Buffer over-read (CVE-ID: CVE-2026-95904)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a buffer over-read in Windows Event Logging Service when accessed locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

386) Double free (CVE-ID: CVE-2026-95943)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to double free in Connected Devices Platform Service (Cdpsvc) when memory is freed more than once. A local user can exploit the double-free condition to gain SYSTEM privileges.

Successful exploitation requires winning a race condition.

387) Heap-based buffer overflow (CVE-ID: CVE-2026-96071)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Windows Media when processing a specially crafted file. A remote attacker can trick a user into opening the file to execute arbitrary code.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

388) Heap-based buffer overflow (CVE-ID: CVE-2026-96096)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows Media Player when handling network endpoint calls. A remote attacker can call arbitrary endpoints from within the network to execute arbitrary code.

389) Use-after-free (CVE-ID: CVE-2026-96108)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Desktop Window Manager when the component is used locally. A local user can exploit this memory management flaw locally to escalate privileges to SYSTEM.

390) Heap-based buffer overflow (CVE-ID: CVE-2026-96113)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in DNS Server when processing network input. A remote attacker can send specially crafted network input to execute arbitrary code.

391) Out-of-bounds read (CVE-ID: CVE-2026-96118)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to an out-of-bounds read in Windows Graphics Kernel when accessed locally. A local user can exploit this memory read vulnerability to gain SYSTEM privileges.

392) Missing Authentication for Critical Function (CVE-ID: CVE-2026-96183)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to missing authentication for a critical function in Windows Health and Optimized Experiences Service when handling local access to diagnostic information. A local user can access diagnostic data collected by the service to disclose sensitive information.

The diagnostic data can include system configuration, application crash, performance, and kernel driver allocation data.

393) Deserialization of Untrusted Data (CVE-ID: CVE-2026-96186)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to deserialization of untrusted data in Microsoft Windows Media Foundation when processing untrusted serialized data. A local user can exploit the deserialization flaw locally to escalate privileges to SYSTEM.

394) Out-of-bounds read (CVE-ID: CVE-2026-96209)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges from a low integrity level to a medium integrity level.

The vulnerability exists due to an out-of-bounds read in Windows Network File System when accessed locally. A local user can exploit the out-of-bounds read to escalate privileges from a low integrity level to a medium integrity level.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

395) Race condition (CVE-ID: CVE-2026-96215)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization of shared resources in Windows Autopilot when accessing shared resources concurrently. A local user can win a race condition to escalate privileges to SYSTEM.

396) Use-after-free (CVE-ID: CVE-2026-96216)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Kernel when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

397) Heap-based buffer overflow (CVE-ID: CVE-2026-96217)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows NTFS when exploited locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

398) External Control of System or Configuration Setting (CVE-ID: CVE-2026-96218)

CWE-ID: CWE-15 - External Control of System or Configuration Setting

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to tamper with the Windows Update Stack.

The vulnerability exists due to improper access control in the Windows Update Stack when accessing the component locally. A local user can exploit the access control weakness to tamper with the Windows Update Stack.

399) Out-of-bounds write (CVE-ID: CVE-2026-96219)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute code on the target system.

The vulnerability exists due to an out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute code on the target system.

No user interaction is required.

400) Code Injection (CVE-ID: CVE-2026-96220)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper control of code generation in Windows Assigned Access when generating code. A local user can inject code locally to escalate privileges to SYSTEM.

401) Improper Certificate Validation (CVE-ID: CVE-2026-96222)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to improper certificate validation in Active Directory Federation Services (AD FS) when validating certificates during network communications. A remote attacker can exploit the certificate validation flaw over a network to perform spoofing.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

402) Use-after-free (CVE-ID: CVE-2026-96223)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Hyper-V when the component is exploited locally. A local user can exploit this memory-management flaw to escalate privileges to SYSTEM.

403) Out-of-bounds write (CVE-ID: CVE-2026-96224)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in .NET when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

404) Link following (CVE-ID: CVE-2026-96225)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to root.

The vulnerability exists due to improper link resolution before file access in .NET when accessing files through links. A local user can exploit link-following behavior to escalate privileges to root.

405) Permissive List of Allowed Inputs (CVE-ID: CVE-2026-96229)

CWE-ID: CWE-183 - Permissive List of Allowed Inputs

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a permissive list of allowed inputs in .NET when processing inputs over a network. A remote attacker can exploit the permissive input allowlist to disclose NetNTLMv2 hashes.

User interaction is required for exploitation.

406) Cross-site scripting (CVE-ID: CVE-2026-96230)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute code in the developer's context.

The vulnerability exists due to improper neutralization of input during web page generation (cross-site scripting) in ASP.NET Core when generating web pages. A remote attacker can host a specially crafted web page and convince a developer to visit it, causing the page to send requests to a vulnerable development server running on the developer's system, to execute code in the developer's context.

407) Link following (CVE-ID: CVE-2026-96231)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to root.

The vulnerability exists due to improper link resolution before file access in .NET when accessing files. A local user can exploit link following during local file access to escalate privileges to root.

408) Out-of-bounds read (CVE-ID: CVE-2026-96232)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose internal memory pointers.

The vulnerability exists due to an out-of-bounds read in .NET when handling network input. A remote attacker can exploit the out-of-bounds read over a network to disclose internal memory pointers.

409) Out-of-bounds write (CVE-ID: CVE-2026-96233)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in ASP.NET Core when handling network input. A remote attacker can interact with the affected component over a network to cause a denial of service.

410) Origin validation error (CVE-ID: CVE-2026-96234)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose credentials.

The vulnerability exists due to an origin validation error in .NET when validating origins during network interactions. A remote attacker can exploit this error over a network to disclose credentials.

Successful exploitation requires user interaction and additional actions to prepare the target environment.

411) Out-of-bounds write (CVE-ID: CVE-2026-96235)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in .NET when processing a specially crafted file. A remote attacker can trick a user into opening the crafted file to execute arbitrary code.

412) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-96236)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in ASP.NET Core when handling network requests. A remote attacker can send requests over a network to cause a denial of service.

413) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-96237)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to inclusion of functionality from an untrusted control sphere in .NET when incorporating functionality from an untrusted source. A remote attacker can exploit this untrusted functionality over a network to execute arbitrary code.

Successful exploitation requires additional actions to prepare the target environment and user interaction.

414) Origin validation error (CVE-ID: CVE-2026-96238)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass NuGet Package Source Mapping.

The vulnerability exists due to an origin validation error in NuGet Package Source Mapping in .NET when selecting packages from package sources. A remote attacker can cause content from an unauthorized package source to be selected and installed to bypass restrictions limiting packages to approved sources.

User interaction is required.

415) Link following (CVE-ID: CVE-2026-96243)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to improper link resolution before file access in Windows WalletService when accessing files. A local user can exploit link following locally to gain SYSTEM privileges.

416) Use-after-free (CVE-ID: CVE-2026-96244)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Internal System User Profile when the component is used locally. A local user can exploit the use-after-free condition locally to escalate privileges to SYSTEM.

417) Out-of-bounds read (CVE-ID: CVE-2026-96245)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Routing and Remote Access Service (RRAS) when handling network communications. A remote attacker can interact with the service over a network to disclose uninitialized heap memory from a privileged process.

418) Out-of-bounds read (CVE-ID: CVE-2026-96246)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to an out-of-bounds read in Network Policy Server (NPS) when handling network traffic. A remote attacker can exploit the flaw over a network to disclose heap memory from a privileged process running on the server.

419) Use of uninitialized resource (CVE-ID: CVE-2026-96247)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in Windows Kernel-Mode Drivers when accessing heap memory. A local user can exploit this condition locally to disclose uninitialized heap memory from a privileged process.

420) Stack-based buffer overflow (CVE-ID: CVE-2026-96248)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in Windows Host Guardian Service when handling network traffic. A remote attacker can trigger the overflow over a network to cause a denial of service.

421) Use-after-free (CVE-ID: CVE-2026-96249)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to elevate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Win32 Kernel Subsystem when accessed locally. A local user can exploit the flaw locally to elevate privileges to SYSTEM.

422) Use-after-free (CVE-ID: CVE-2026-96250)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows USB Print Driver when the driver is used locally. A local user can win a race condition to escalate privileges to SYSTEM.

423) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-96252)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to create an unauthorized session and obtain tokens.

The vulnerability exists due to improper verification of cryptographic signatures in Active Directory Federation Services (AD FS) when processing SAML responses. A remote attacker can relay a validly signed SAML response intended for a different endpoint to an affected AD FS endpoint to create an unauthorized session and obtain tokens.

No user interaction is required.

424) Use-after-free (CVE-ID: CVE-2026-96253)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows USB Print Driver when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

425) Use-after-free (CVE-ID: CVE-2026-96254)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows USB Print Driver when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

426) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-96300)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in RPC Endpoint Mapper Service when handling network requests. A remote attacker can trigger excessive resource consumption over the network to cause a denial of service.

427) Use-after-free (CVE-ID: CVE-2026-96301)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows USB Print Driver when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

428) Use-after-free (CVE-ID: CVE-2026-96302)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when a race condition is won. A local user can exploit the use-after-free locally to escalate privileges to SYSTEM.

User interaction is not required.

429) Use-after-free (CVE-ID: CVE-2026-96304)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows USB Print Driver when used locally. A local user can exploit this condition to gain SYSTEM privileges.

Successful exploitation requires winning a race condition.

430) Use-after-free (CVE-ID: CVE-2026-96305)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

431) Out-of-bounds read (CVE-ID: CVE-2026-96306)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows Sysmain Service when the service is used locally. A local user can exploit the out-of-bounds read to escalate privileges to SYSTEM.

432) Use-after-free (CVE-ID: CVE-2026-96307)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when a local race condition is triggered. A local user can win the race condition to escalate privileges to SYSTEM.

433) Use-after-free (CVE-ID: CVE-2026-96308)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Installer when used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

434) Use-after-free (CVE-ID: CVE-2026-96309)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Subsystem for Linux when accessed locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

435) Use-after-free (CVE-ID: CVE-2026-96310)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows USB Print Driver when a race condition is triggered. A local user can win the race condition to escalate privileges to SYSTEM.

436) Missing Authorization (CVE-ID: CVE-2026-96311)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform unauthorized modifications.

The vulnerability exists due to missing authorization in Windows Network List Service when handling local operations. A local user can exploit the missing authorization checks to perform unauthorized modifications.

437) Heap-based buffer overflow (CVE-ID: CVE-2026-96312)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Kernel when exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

438) Missing Authentication for Critical Function (CVE-ID: CVE-2026-96313)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to missing authentication for a critical function in Windows Push Notifications when performing critical operations. A local user can invoke the affected function without authentication to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

439) Out-of-bounds read (CVE-ID: CVE-2026-96314)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Audio Service when accessing memory locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

440) Missing Authorization (CVE-ID: CVE-2026-96315)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform unauthorized modifications.

The vulnerability exists due to missing authorization in Windows Overlay Filter when accessed locally. A local user can exploit the missing authorization checks to perform unauthorized modifications.

441) Missing Authorization (CVE-ID: CVE-2026-96316)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform unauthorized modifications.

The vulnerability exists due to missing authorization in Windows Routing and Remote Access Service (RRAS) when accessed locally. A local user can exploit the missing authorization checks to perform unauthorized modifications.

442) Use-after-free (CVE-ID: CVE-2026-96317)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Kernel when a race condition occurs during local exploitation. A local user can win the race condition to escalate privileges to SYSTEM.

443) Heap-based buffer overflow (CVE-ID: CVE-2026-96318)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Resume when exploited locally. A local user can exploit the flaw to escalate privileges to SYSTEM.

444) Use-after-free (CVE-ID: CVE-2026-96319)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows USB Print Driver when accessed locally. A local user can win a race condition to escalate privileges to SYSTEM.

445) Heap-based buffer overflow (CVE-ID: CVE-2026-96320)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Windows DHCP Server when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

No user interaction is required.

446) Out-of-bounds read (CVE-ID: CVE-2026-96321)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Remote Desktop Display Driver when accessing the driver locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

447) Use-after-free (CVE-ID: CVE-2026-96322)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Remote Desktop Protocol when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

448) Use-after-free (CVE-ID: CVE-2026-96323)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Update when a race condition occurs. A local user can win the race condition during local exploitation to gain SYSTEM privileges.

449) Use-after-free (CVE-ID: CVE-2026-96324)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Microsoft Windows Search Component when the component is used locally. A local user can exploit the component locally to escalate privileges to SYSTEM.

450) Missing Reference to Active Allocated Resource (CVE-ID: CVE-2026-96325)

CWE-ID: CWE-771 - Missing Reference to Active Allocated Resource

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a missing reference to an active allocated resource in Windows SMB Server when handling network traffic. A remote attacker can trigger the resource-reference flaw over the network to cause a denial of service.

451) Heap-based buffer overflow (CVE-ID: CVE-2026-96843)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a heap-based buffer overflow in WebDAV when used locally. A local user can exploit this flaw to escalate privileges and create or delete files in the security context of the NT AUTHORITYLOCAL SERVICE account.

452) Integer underflow (CVE-ID: CVE-2026-96844)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user on the local network to escalate privileges to SYSTEM.

The vulnerability exists due to integer underflow in Microsoft Bluetooth Driver when communicating over an adjacent network. A remote user on the local network can exploit the integer underflow to escalate privileges to SYSTEM.

453) Out-of-bounds read (CVE-ID: CVE-2026-96846)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to an out-of-bounds read in WebDAV when accessed locally. A local user can exploit this out-of-bounds read to disclose heap memory from a privileged process running on the server.

454) Untrusted Pointer Dereference (CVE-ID: CVE-2026-96847)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to untrusted pointer dereference in WebDAV when used locally. A local user can exploit the pointer dereference to escalate privileges and create or delete files in the security context of the NT AUTHORITYLOCAL SERVICE account.

455) Buffer over-read (CVE-ID: CVE-2026-96848)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to a buffer over-read in the Windows Win32 Kernel Subsystem when accessing kernel memory locally. A local user can trigger the buffer over-read to disclose certain kernel memory content.

456) Use of uninitialized resource (CVE-ID: CVE-2026-96849)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory content.

The vulnerability exists due to use of an uninitialized resource in Windows Kernel-Mode Drivers when using resources that have not been initialized. A local user can exploit this condition locally to disclose kernel memory content.

457) Use of uninitialized resource (CVE-ID: CVE-2026-96850)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in Windows Modern Device Management (MDM) when resources are used before initialization during local operation. A local user can view heap memory from a privileged process running on the server to disclose sensitive information.

458) Buffer over-read (CVE-ID: CVE-2026-96851)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information from the heap memory of a privileged process.

The vulnerability exists due to a buffer over-read in Windows Management Instrumentation when accessing the component locally. A local user can exploit the buffer over-read to disclose sensitive information from the heap memory of a privileged process running on the server.

459) Use-after-free (CVE-ID: CVE-2026-96852)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows TCP/IP when exploited locally. A local user can win a race condition to escalate privileges to SYSTEM.

460) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-96853)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in the Windows Win32 Kernel Subsystem when performing local operations. A local user can win a race condition to disclose certain kernel memory content.

461) Type Confusion (CVE-ID: CVE-2026-96854)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read heap memory from a privileged process running on the server.

The vulnerability exists due to type confusion in Windows Device Association Service when resources are accessed using incompatible types. A local user can exploit this type confusion locally to read heap memory from a privileged process running on the server.

462) Missing Authorization (CVE-ID: CVE-2026-96855)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to tamper with data locally.

The vulnerability exists due to missing authorization in Windows Modern Device Management (MDM) when accessed locally. A local user can exploit the missing authorization checks to tamper with data.

463) Heap-based buffer overflow (CVE-ID: CVE-2026-96856)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a heap-based buffer overflow in Windows Management Instrumentation when the component is exploited locally. A local user can trigger the heap-based buffer overflow to escalate privileges and execute code in the security context of the NT AUTHORITYNetwork Service account.

464) Files or Directories Accessible to External Parties (CVE-ID: CVE-2026-96857)

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to exposure of files or directories to external parties in Windows Projected File System when accessing the local file system. A local user can read files without authorization to disclose sensitive information.

465) Missing Authentication for Critical Function (CVE-ID: CVE-2026-96858)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform local tampering.

The vulnerability exists due to missing authentication for a critical function in Windows Security Account Manager when invoking the function locally. A local user can access the critical function without the required authentication to perform local tampering.

466) Out-of-bounds read (CVE-ID: CVE-2026-96859)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows Imaging Component when accessing memory locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

467) Out-of-bounds read (CVE-ID: CVE-2026-96860)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to an out-of-bounds read in Windows USB Print Driver when the driver is used locally. A local user can exploit the driver locally to disclose heap memory from a privileged process running on the server.

468) Out-of-bounds read (CVE-ID: CVE-2026-96861)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Network Device Enrollment Service (NDES) when handling network requests. A remote attacker can send network requests that trigger the out-of-bounds read to cause a denial of service.

469) Out-of-bounds read (CVE-ID: CVE-2026-96862)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows Spaceport.sys when accessed locally. A local user can exploit this out-of-bounds read to escalate privileges to SYSTEM.

470) Heap-based buffer overflow (CVE-ID: CVE-2026-96863)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to gain SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow in Windows Storage Port Driver when the driver is targeted through a physical attack. An attacker with physical access to system can exploit this flaw through physical access to gain SYSTEM privileges.

471) Double free (CVE-ID: CVE-2026-96864)

CWE-ID: CWE-415 - Double Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to double free in Microsoft Failover Cluster Virtual Driver when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code.

No user interaction is required.

472) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-96865)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode when operating locally. A local user can win a race condition to disclose certain kernel memory content.

473) Out-of-bounds read (CVE-ID: CVE-2026-96866)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in Network Device Enrollment Service (NDES) when handling network traffic. A remote attacker can send network traffic to the affected service to cause a denial of service.

474) Out-of-bounds read (CVE-ID: CVE-2026-96867)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute code locally.

The vulnerability exists due to an out-of-bounds read in Windows NTFS when used locally. A local user can exploit the out-of-bounds read to execute code locally.

475) Heap-based buffer overflow (CVE-ID: CVE-2026-96868)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows kernel when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

476) Heap-based buffer overflow (CVE-ID: CVE-2026-96909)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a heap-based buffer overflow in Windows BitLocker when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code on the target system.

No user interaction is required.

477) Untrusted Pointer Dereference (CVE-ID: CVE-2026-96910)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to untrusted pointer dereference in Microsoft Windows Search Component when dereferencing an untrusted pointer. A local user can exploit this flaw locally to disclose heap memory from a privileged process running on the server.

478) Link following (CVE-ID: CVE-2026-96911)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper link resolution before file access in the Microsoft Windows Search Component when accessing files. A local user can exploit link following during file access to escalate privileges to SYSTEM.

479) Use-after-free (CVE-ID: CVE-2026-96912)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Client License Service when the service is accessed locally. A local user can exploit the use-after-free locally to escalate privileges to SYSTEM.

480) Heap-based buffer overflow (CVE-ID: CVE-2026-96913)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows kernel when accessed locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

481) Integer overflow (CVE-ID: CVE-2026-96914)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave when used locally. A local user can exploit the integer overflow to escalate privileges to SYSTEM.

482) Integer overflow (CVE-ID: CVE-2026-96915)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to integer overflow or wraparound in Windows Kernel-Mode Drivers when performing integer arithmetic. A local user can exploit the integer overflow locally to escalate privileges to SYSTEM.

No user interaction is required.

483) Heap-based buffer overflow (CVE-ID: CVE-2026-96916)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows NTFS when exploited locally. A local user can exploit this buffer overflow to escalate privileges to SYSTEM.

No user interaction is required.

484) Heap-based buffer overflow (CVE-ID: CVE-2026-96917)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows PCI Bus Driver when operating locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

485) Incorrect authorization (CVE-ID: CVE-2026-96918)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to incorrect authorization in Windows NTFS when accessed locally. A local user can exploit the authorization weakness to escalate privileges to SYSTEM.

486) Use-after-free (CVE-ID: CVE-2026-96919)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

487) Heap-based buffer overflow (CVE-ID: CVE-2026-96920)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Program Compatibility Assistant Service when exploited locally. A local user can exploit the heap-based buffer overflow to escalate privileges to SYSTEM.

488) Type Confusion (CVE-ID: CVE-2026-96921)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to type confusion in Windows Message Queuing Queue Manager when accessing resources using incompatible types. A local user can exploit this weakness locally to disclose heap memory from a privileged process running on the server.

489) Use-after-free (CVE-ID: CVE-2026-96923)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Workstation Service when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

490) Untrusted Pointer Dereference (CVE-ID: CVE-2026-96924)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to an untrusted pointer dereference in Windows OLE when handling network packets. A remote attacker can send a specially crafted packet to an affected service to execute arbitrary code.

No user interaction is required.

491) Integer underflow (CVE-ID: CVE-2026-96925)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to integer underflow (wrap or wraparound) in Windows NTFS when accessed locally. A local user can exploit this flaw to disclose certain kernel memory content.

492) Missing Authorization (CVE-ID: CVE-2026-96926)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to tamper with DNS Server.

The vulnerability exists due to missing authorization in DNS Server when accessed locally. A local user can perform unauthorized operations to tamper with DNS Server.

493) Out-of-bounds read (CVE-ID: CVE-2026-96927)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Windows NTFS when accessing NTFS locally. A local user can read heap memory from a privileged process running on the server to disclose sensitive information.

494) Out-of-bounds read (CVE-ID: CVE-2026-96928)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to an out-of-bounds read in Windows NTFS when used locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

495) Heap-based buffer overflow (CVE-ID: CVE-2026-96929)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows Kernel when processing specially crafted security information. A local user can supply specially crafted security information to an affected system to escalate privileges to SYSTEM.

User interaction is not required.

496) Out-of-bounds read (CVE-ID: CVE-2026-96930)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the Windows Universal Disk Format File System Driver (UDFS) when used locally. A local user can exploit the out-of-bounds read to disclose sensitive information from the heap memory of a privileged process running on the server.

497) Untrusted Pointer Dereference (CVE-ID: CVE-2026-96931)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in Windows NTFS when dereferencing an untrusted pointer. A local user can exploit this weakness locally to escalate privileges to SYSTEM.

498) Race condition (CVE-ID: CVE-2026-96932)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization in Windows Embedded Mode Service when shared resources are accessed concurrently. A local user can win a race condition to escalate privileges to SYSTEM.

499) Untrusted Pointer Dereference (CVE-ID: CVE-2026-96933)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to untrusted pointer dereference in Windows COM+ Event System Service when the service dereferences an untrusted pointer. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

500) Use-after-free (CVE-ID: CVE-2026-96934)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Windows DHCP Server when processing network packets. A remote attacker can send a specially crafted packet to the affected service to execute arbitrary code.

No user interaction is required.

501) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-96935)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows NTFS when accessed locally. A local user can exploit this information exposure to disclose certain kernel memory content.

502) Use-after-free (CVE-ID: CVE-2026-96937)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Microsoft Windows Search Component when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

503) Heap-based buffer overflow (CVE-ID: CVE-2026-96938)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Distributed File System (DFS) when the component is exploited locally. A local privileged user can exploit the buffer overflow to escalate privileges to SYSTEM.

504) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-96939)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a time-of-check time-of-use race condition in Servicing Stack Updates when performing local servicing stack operations. A local user can win the race condition to escalate privileges to SYSTEM.

505) File And Directory Information Exposure (CVE-ID: CVE-2026-96944)

CWE-ID: CWE-538 - File And Directory Information Exposure

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information from the local file system.

The vulnerability exists due to insertion of sensitive information into externally accessible files or directories in Windows Storage when storing sensitive information. A local user can read the exposed information to disclose sensitive information from the local file system.

506) Uncaught Exception (CVE-ID: CVE-2026-96945)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in Windows Failover Cluster when handling network traffic. A remote attacker can trigger the exception over the network to cause a denial of service.

507) Use-after-free (CVE-ID: CVE-2026-96946)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Universal Disk Format File System Driver (UDFS) when exploited locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

508) Use-after-free (CVE-ID: CVE-2026-96947)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Universal Disk Format File System Driver (UDFS) when the driver is used locally. A local user can exploit the use-after-free condition to escalate privileges to SYSTEM.

509) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-96948)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose certain kernel memory content.

The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in the Windows Client Side Caching driver (csc.sys) when accessed locally. A local user can exploit this information exposure to disclose certain kernel memory content.

510) Use-after-free (CVE-ID: CVE-2026-96949)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Universal Disk Format File System Driver (UDFS) when a race condition occurs. A local user can win the race condition to escalate privileges to SYSTEM.

511) Use-after-free (CVE-ID: CVE-2026-96950)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in the Windows Universal Disk Format File System Driver (UDFS) when the driver is used locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

512) Heap-based buffer overflow (CVE-ID: CVE-2026-96952)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Media Foundation when processing a specially crafted media file. A remote attacker can convince a user to open the crafted file to execute arbitrary code.

513) NULL pointer dereference (CVE-ID: CVE-2026-96953)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute code locally.

The vulnerability exists due to a null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) when the driver is used locally. A local user can exploit this flaw to execute code locally.

514) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-96957)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass required NuGet package signature verification and execute untrusted package content.

The vulnerability exists due to improper verification of cryptographic signatures in .NET NuGet package signature verification when processing packages on affected Linux systems. A remote attacker can provide a specially crafted application that references an unsigned NuGet package to bypass required NuGet package signature verification and execute untrusted package content.

Exploitation requires a user to restore or run the application.

515) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-96958)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in .NET when handling network input. A remote attacker can send input over a network to cause a denial of service.

516) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-96959)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in .NET when handling network requests. A remote attacker can trigger excessive resource allocation over the network to cause a denial of service.

517) Asymmetric Resource Consumption (Amplification) (CVE-ID: CVE-2026-96960)

CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to asymmetric resource consumption (amplification) in .NET when handling network input. A remote attacker can trigger amplified resource consumption over a network to cause a denial of service.

518) Race condition (CVE-ID: CVE-2026-97787)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper synchronization in Windows Container Isolation FS Filter Driver (unionfs.sys) when accessing shared resources concurrently. A local user can win a race condition to escalate privileges to SYSTEM.

519) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2026-97788)

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information related to a user's or service's active session.

The vulnerability exists due to use of a weak encryption algorithm or cipher in Active Directory Federation Services (AD FS) when encrypting traffic sent over a network. A remote attacker can decrypt network traffic sent by the vulnerable component to disclose sensitive information related to a user's or service's active session.

520) Use-after-free (CVE-ID: CVE-2026-97789)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Remote Desktop Client when handling an RDP session. A remote attacker can exploit the memory error over a network to execute arbitrary code.

Successful exploitation requires access to the user's machine and must occur within a certain time after the user initiates an RDP session.

521) Link following (CVE-ID: CVE-2026-97790)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to tamper with data.

The vulnerability exists due to improper link resolution before file access in Windows Container Isolation FS Filter Driver (unionfs.sys) when accessing files. A local user can exploit link following locally to tamper with data.

522) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-97792)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to incorrect permission assignment for critical resources in Windows Container Isolation FS Filter Driver (unionfs.sys) when accessed locally. A local user can exploit the driver's improper access control to gain SYSTEM privileges.

523) Missing Authentication for Critical Function (CVE-ID: CVE-2026-97793)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to missing authentication for a critical function in Windows Setup and Deployment when invoking critical functionality locally. A local user can exploit the missing authentication check to escalate privileges to SYSTEM.

Successful exploitation requires specific conditions, such as particular protocol settings or configurations, which the advisory does not identify.

524) Heap-based buffer overflow (CVE-ID: CVE-2026-97794)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to a heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) when accessed locally. A local user can exploit this flaw to gain SYSTEM privileges.

525) Argument injection (CVE-ID: CVE-2026-97798)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper neutralization of argument delimiters in a command in the Windows Error Reporting service when processing command arguments. A local user can inject command arguments to escalate privileges to SYSTEM.

526) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-97799)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to improper verification of cryptographic signatures in Windows Audio Service when verifying cryptographic signatures. A local user can exploit the signature verification flaw to escalate privileges to SYSTEM.

527) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-97800)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to incorrect permission assignment for a critical resource in Windows Mobile Broadband when the component is used locally. A local user can exploit the incorrectly assigned permissions to escalate privileges to SYSTEM.

528) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-97801)

CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform tampering.

The vulnerability exists due to improper validation of specified types of input in .NET Framework when processing input received over a network. A remote attacker can supply input that is improperly validated to perform tampering.

529) Heap-based buffer overflow (CVE-ID: CVE-2026-97803)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in the Windows kernel when handling local operations. A local user can exploit this flaw locally to escalate privileges to SYSTEM.

530) Heap-based buffer overflow (CVE-ID: CVE-2026-97804)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges and create or delete files in the security context of the NT AUTHORITYLOCAL SERVICE account.

The vulnerability exists due to a heap-based buffer overflow in the HID class driver when the driver is used locally. A local user can exploit this buffer overflow to escalate privileges and create or delete files in the security context of the NT AUTHORITYLOCAL SERVICE account.

531) Out-of-bounds read (CVE-ID: CVE-2026-97805)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an out-of-bounds read in Windows Partition Management Driver when handling network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code on the target system.

No user interaction is required.

532) Use-after-free (CVE-ID: CVE-2026-97806)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when the service is used locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

533) Use-after-free (CVE-ID: CVE-2026-97807)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when the service is used locally. A local user can exploit this memory management flaw to escalate privileges to SYSTEM.

534) Use-after-free (CVE-ID: CVE-2026-97808)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain SYSTEM privileges.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when a race condition occurs. A local user can win the race condition to gain SYSTEM privileges.

535) Use-after-free (CVE-ID: CVE-2026-97809)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to use-after-free in Windows Broadcast DVR User Service when the service is accessed locally. A local user can exploit this flaw to escalate privileges to SYSTEM.

536) Heap-based buffer overflow (CVE-ID: CVE-2026-97810)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) when the driver is exploited locally. A local user can exploit the buffer overflow to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors that may include the environment, system configuration, and additional security measures.

537) Double free (CVE-ID: CVE-2026-97811)

CWE-ID: CWE-415 - Double Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to double free in OpenSSH for Windows when the component is exploited locally. A local user can exploit the double-free condition to escalate privileges to SYSTEM.

538) Double free (CVE-ID: CVE-2026-97812)

CWE-ID: CWE-415 - Double Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to a double free in Windows Update Orchestrator Service when managing memory. A local user can trigger the double free locally to escalate privileges to SYSTEM.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

539) Heap-based buffer overflow (CVE-ID: CVE-2026-97813)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to a heap-based buffer overflow in Windows Hyper-V when accessed over a network. A remote user can exploit the overflow to disclose heap memory from a privileged process running on the server.

540) Heap-based buffer overflow (CVE-ID: CVE-2026-97814)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a heap-based buffer overflow in Windows Text Shaping when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code on the target system.

No user interaction is required.

541) Heap-based buffer overflow (CVE-ID: CVE-2026-97815)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a heap-based buffer overflow in Windows Error Reporting when processing network packets. A remote attacker can send a specially crafted packet to an affected service over the network to execute arbitrary code on the target system.

No user interaction is required.

542) Use-after-free (CVE-ID: CVE-2026-97816)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free in OpenSSH for Windows when processing network packets. A remote attacker can send a specially crafted packet to an affected service to execute arbitrary code on the target system.

No user interaction is required.

543) Heap-based buffer overflow (CVE-ID: CVE-2026-97817)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to a heap-based buffer overflow in DNS Server when handling network traffic. A remote user can exploit the overflow over a network to disclose sensitive information from the heap memory of a privileged process running on the server.

544) Out-of-bounds read (CVE-ID: CVE-2026-97819)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to an out-of-bounds read in DNS Server when accessed over a network. A remote user can exploit the out-of-bounds read to disclose heap memory from a privileged process running on the server.

545) Out-of-bounds read (CVE-ID: CVE-2026-97820)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DNS Server when handling network interactions. A remote user can exploit the out-of-bounds read over a network to disclose heap memory from a privileged process running on the server.

546) Out-of-bounds read (CVE-ID: CVE-2026-97821)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DNS Server when accessed over a network. A remote user can trigger the out-of-bounds read to disclose heap memory from a privileged process running on the server.

547) Out-of-bounds read (CVE-ID: CVE-2026-97822)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DNS Server when communicating over a network. A remote user can read heap memory from a privileged process running on the server to disclose sensitive information.

548) Out-of-bounds read (CVE-ID: CVE-2026-97823)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DNS Server when accessing the server over a network. A remote user can read heap memory from a privileged process running on the server to disclose sensitive information.

549) Out-of-bounds read (CVE-ID: CVE-2026-97824)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to an out-of-bounds read in DNS Server when handling network interactions. A remote user can exploit the out-of-bounds read over the network to disclose heap memory from a privileged process running on the server.

550) Out-of-bounds read (CVE-ID: CVE-2026-97825)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DNS Server when handling network interactions. A remote user can read heap memory from a privileged process running on the server to disclose sensitive information.

551) Out-of-bounds read (CVE-ID: CVE-2026-97826)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DNS Server when accessed over a network. A remote user can read heap memory from a privileged process running on the server to disclose sensitive information.

552) Out-of-bounds read (CVE-ID: CVE-2026-97827)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to an out-of-bounds read in DNS Server when handling network requests. A remote user can trigger the out-of-bounds read over a network to disclose heap memory from a privileged process running on the server.

553) Buffer over-read (CVE-ID: CVE-2026-97828)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose heap memory from a privileged process running on the server.

The vulnerability exists due to a buffer over-read in DNS Server when handling network communications. A remote user can exploit the buffer over-read over a network to disclose heap memory from a privileged process running on the server.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83771
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83782
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83783
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83784
• https://support.microsoft.com/help/5126651
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83785
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83786
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83787
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83788
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83789
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83790
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83791
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83792
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83793
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83794
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83795
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83796
• https://support.microsoft.com/help/5127648
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83797
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83798
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83826
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83827
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83828
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83829
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83830
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83832
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83833
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83834
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83835
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83836
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83837
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83838
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83839
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83840
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83841
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83842
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83843
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83845
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83846
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83847
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83848
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83849
• https://support.microsoft.com/help/5126657
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83850
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83851
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83852
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83853
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83854
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83855
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83856
• https://support.microsoft.com/help/5126655
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83857
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83859
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83860
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83861
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83862
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83863
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83864
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83865
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83866
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83867
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83868
• https://mylostchristmas.tistory.com/20
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83869
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83870
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83871
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83872
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83873
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83874
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83875
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83876
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83877
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83879
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83881
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83882
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83883
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83884
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83885
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83886
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83887
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83888
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83889
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83892
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83893
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83895
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83896
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83897
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83898
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83899
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83900
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83901
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83902
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83903
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83904
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83905
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83906
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83907
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83908
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83909
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83910
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83911
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83912
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83913
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83914
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83915
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83916
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83917
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83918
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83919
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83920
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83921
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83922
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83923
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83924
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83925
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83926
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83927
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83928
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83929
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83930
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83931
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83932
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83933
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83934
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83935
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84007
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84008
• https://www.nuget.org/packages/System.Security.Cryptography.Pkcs
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84009
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84011
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84012
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84013
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84014
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84015
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84016
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84017
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84018
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84019
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84020
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85318
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85319
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85320
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85321
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85322
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85323
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85324
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85327
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85328
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85329
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85331
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85332
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85333
• https://support.microsoft.com/help/5126835
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85334
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85336
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85337
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85338
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85339
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85341
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85342
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85343
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85352
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85353
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85354
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85355
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85356
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85357
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85358
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85359
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85361
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85362
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85363
• https://support.microsoft.com/help/5130036
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85364
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85365
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85366
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85367
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85368
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85369
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85370
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85371
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85372
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85373
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85374
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85375
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85376
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85377
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85790
• https://www.nuget.org/packages/Microsoft.Native.Quic.MsQuic.Schannel
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85791
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85792
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85793
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85794
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85795
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85796
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85797
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85798
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85799
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85800
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85802
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85803
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85804
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85805
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85806
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85807
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85808
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85809
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85810
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85811
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85812
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85814
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85815
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85816
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85817
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85818
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85820
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85821
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85822
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85823
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85824
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85825
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85826
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85827
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85828
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85829
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85830
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85831
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85832
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85833
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85834
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85835
• https://support.microsoft.com/help/5126646
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85836
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85837
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85840
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85841
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85842
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85843
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85846
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85847
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85848
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85849
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85850
• https://support.microsoft.com/help/5127646
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85851
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85852
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85853
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85854
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85855
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85856
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85857
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85858
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85859
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85860
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85861
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85863
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85864
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85865
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85866
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85867
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85868
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85869
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85870
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85871
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85872
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85874
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85884
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85901
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85902
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85903
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85904
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85905
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85906
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85908
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85909
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85910
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85911
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85912
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85914
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85915
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85916
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85918
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85920
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85926
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85927
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85928
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85930
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85931
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85933
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85934
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85935
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85936
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85938
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85939
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85941
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85943
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-85945
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87691
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87693
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87694
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87697
• https://support.microsoft.com/kb/5130036
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87698
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87699
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87700
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87702
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87704
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87705
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87708
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87709
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87710
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87711
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87712
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87713
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87714
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87715
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-87716
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88070
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88071
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88072
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88073
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88074
• https://support.microsoft.com/help/5126653
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88076
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88079
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88080
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88091
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88092
• https://support.microsoft.com/help/5130034
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88093
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88096
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88098
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88099
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88100
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88101
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88102
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88103
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88105
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88106
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88107
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88110
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88112
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88113
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88114
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88115
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88116
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88117
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88118
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88119
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88120
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88121
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88122
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88123
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88124
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88125
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88126
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88127
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88128
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88129
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88130
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88133
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88134
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88135
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88136
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88137
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88139
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88140
• https://support.microsoft.com/help/5126868
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88141
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88142
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88143
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88146
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88147
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88149
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88152
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88157
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88158
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88159
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88160
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88161
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88162
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88165
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88168
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88171
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88173
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88174
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88177
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88179
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88180
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88181
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88182
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88188
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88189
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88191
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88193
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88194
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88219
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88226
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-92707
• https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v3.1.9
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-95904
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-95943
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96071
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96096
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96108
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96113
• https://support.microsoft.com/help/5126836
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96118
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96183
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96186
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96209
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96215
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96216
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96217
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96218
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96219
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96220
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96222
• https://www.nuget.org/packages/System.Security.Cryptography.Xml
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96223
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96224
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96225
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96229
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96230
• https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96231
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96232
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96233
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96234
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96235
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96236
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96237
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96238
• https://support.microsoft.com/help/5130035
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96243
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96244
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96245
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96246
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96247
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96248
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96249
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96250
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96252
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96253
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96254
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96300
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96301
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96302
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96304
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96305
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96306
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96307
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96308
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96309
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96310
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96311
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96312
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96313
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96314
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96315
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96316
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96317
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96318
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96319
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96320
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96321
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96322
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96323
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96324
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96325
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96843
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96844
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96846
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96847
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96848
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96849
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96850
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96851
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96852
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96853
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96854
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96855
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96856
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96857
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96858
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96859
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96860
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96861
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96862
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96863
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96864
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96865
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96866
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96867
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96868
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96909
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96910
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96911
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96912
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96913
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96914
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96915
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96916
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96917
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96918
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96919
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96920
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96921
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96923
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96924
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96925
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96926
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96927
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96928
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96929
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96930
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96931
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96932
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96933
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96934
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96935
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96937
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96938
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96939
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96944
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96945
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96946
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96947
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96948
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96949
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96950
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96952
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96953
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96957
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96958
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96959
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96960
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97787
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97788
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97789
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97790
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97792
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97793
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97794
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97798
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97799
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97800
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97801
• https://support.microsoft.com/help/5127689
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97803
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97804
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97805
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97806
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97807
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97808
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97809
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97810
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97811
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97812
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97813
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97814
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97815
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97816
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97817
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97819
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97820
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97821
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97822
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97823
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97824
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97825
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97826
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97827
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97828