SB20261110348 - Multiple vulnerabilities in Microsoft Windows
Published: November 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 24 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-105504)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges and execute code with SYSTEM permissions.
The vulnerability exists due to use-after-free in the Windows kernel when handling objects in memory. A local user can run a specially crafted application to execute code with elevated permissions.
Successful exploitation requires winning a race condition.
2) Link following (CVE-ID: CVE-2026-105520)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to escalate privileges to SYSTEM.
The vulnerability exists due to improper link resolution before file access in Windows DNS when accessing files through links. A remote privileged user can exploit incorrect link resolution over the network to gain SYSTEM privileges.
3) Use-after-free (CVE-ID: CVE-2026-105518)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on an affected client system.
The vulnerability exists due to use-after-free in Windows iSCSI when processing a malicious server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.
4) Buffer over-read (CVE-ID: CVE-2026-105515)
CWE-ID: CWE-126 - Buffer over-read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service in Windows Message Queuing.
The vulnerability exists due to a buffer over-read in Windows Message Queuing when processing network requests. A remote attacker can send a specially crafted request that causes a read beyond the bounds of a buffer to cause a denial of service.
5) Release of invalid pointer or reference (CVE-ID: CVE-2026-105513)
CWE-ID: CWE-763 - Release of invalid pointer or reference
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code with SYSTEM privileges.
The vulnerability exists due to release of an invalid pointer or reference in the Windows Kernel when handling objects in memory. A local user can run a specially crafted application to execute code with elevated permissions.
Successful exploitation requires winning a race condition.
6) Integer underflow (CVE-ID: CVE-2026-105512)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer underflow in Microsoft QUIC when processing network traffic. A remote attacker can send specially crafted network traffic to trigger the underflow and cause a denial of service.
7) Race condition (CVE-ID: CVE-2026-105511)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to SYSTEM.
The vulnerability exists due to improper synchronization of shared resources in Windows Point-to-Point Protocol over Ethernet (PPPoE) when concurrent operations access a shared resource. A local user can win a race condition to gain SYSTEM privileges.
8) Use-after-free (CVE-ID: CVE-2026-105510)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to SYSTEM.
The vulnerability exists due to use-after-free in Windows Secure Socket Tunneling Protocol (SSTP) when accessing memory after it has been freed. A local user can exploit this memory-lifetime error to gain SYSTEM privileges.
Successful exploitation requires winning a race condition.
9) Use-after-free (CVE-ID: CVE-2026-105509)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to SYSTEM.
The vulnerability exists due to use-after-free in Windows Resilient File System (ReFS) when a race condition occurs. A local user can exploit access to freed memory to gain SYSTEM privileges.
10) Heap-based buffer overflow (CVE-ID: CVE-2026-105507)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code with SYSTEM privileges.
The vulnerability exists due to improper input sanitization in Windows Installer when processing input that influences library loading. A local user can supply crafted input to trigger insecure library loading and execute arbitrary code with SYSTEM privileges.
11) Buffer over-read (CVE-ID: CVE-2026-105506)
CWE-ID: CWE-126 - Buffer over-read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose potentially sensitive information from heap memory.
The vulnerability exists due to a buffer over-read in Windows Shell when accessing memory beyond a buffer boundary. A local user can trigger the over-read through local exploitation requiring user interaction to potentially read small portions of heap memory.
12) Relative Path Traversal (CVE-ID: CVE-2026-105505)
CWE-ID: CWE-23 - Relative Path Traversal
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the affected system.
The vulnerability exists due to relative path traversal in Microsoft Input Method Editor (IME) when resolving relative file paths. A local user can manipulate relative paths to access locations outside the intended directory and escalate privileges.
13) Use-after-free (CVE-ID: CVE-2026-100223)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escape a sandbox and elevate privileges to SYSTEM on an affected system.
The vulnerability exists due to use-after-free in Windows NTFS when sandboxed processes create reparse points targeting inaccessible files. A local user can log on to the system and run a specially crafted application to escape the sandbox and gain SYSTEM privileges.
14) Heap-based buffer overflow (CVE-ID: CVE-2026-105503)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to a heap-based buffer overflow in Windows Management Instrumentation when processing input. A local user can trigger heap memory corruption locally to execute code in the security context of the NT AUTHORITYNetwork Service account.
15) Incorrect authorization (CVE-ID: CVE-2026-105501)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to SYSTEM.
The vulnerability exists due to incorrect authorization in Windows Installer when authorizing local installer operations. A local user can exploit incorrect authorization checks to gain SYSTEM privileges.
16) Out-of-bounds read (CVE-ID: CVE-2026-105492)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in Microsoft Remote Registry Service when handling network requests. A remote user can send specially crafted requests to trigger a read beyond valid memory boundaries and cause a denial of service.
17) Out-of-bounds read (CVE-ID: CVE-2026-105028)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the affected system.
The vulnerability exists due to an out-of-bounds read in Windows Win32K when handling local operations. A local user can trigger a read beyond the bounds of a memory buffer to escalate privileges.
18) Use-after-free (CVE-ID: CVE-2026-105024)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to SYSTEM.
The vulnerability exists due to use-after-free in Windows Storage Spaces Controller when accessing previously freed memory. A local user can exploit this invalid memory access to gain SYSTEM privileges.
Successful exploitation requires a specific target-system configuration and knowledge of that configuration.
19) Heap-based buffer overflow (CVE-ID: CVE-2026-105018)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a user with physical access to system to escalate privileges to SYSTEM.
The vulnerability exists due to a heap-based buffer overflow in Windows Partition Management Driver when processing input during a physical attack. A user with physical access to system can trigger heap memory corruption to escalate privileges to SYSTEM.
20) Race condition (CVE-ID: CVE-2026-105017)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to SYSTEM.
The vulnerability exists due to improper synchronization of shared resources in Windows Volume Shadow Copy when executing concurrent operations. A local user can win a race condition to gain SYSTEM privileges.
21) Double free (CVE-ID: CVE-2026-103571)
CWE-ID: CWE-415 - Double Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to SYSTEM and run processes in an elevated context.
The vulnerability exists due to a double free in the Windows Cryptography Next Generation (CNG) Key Isolation service when managing memory. A local user can run a specially crafted application after gaining execution on the victim system to elevate privileges to SYSTEM.
Successful exploitation requires winning a race condition.
22) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: CVE-2026-102868)
CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive system information.
The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Shell when handling calls from lower-integrity processes. A local user can obtain the address of a medium-integrity process to disclose sensitive system information.
23) Inadequate Encryption Strength (CVE-ID: CVE-2026-102219)
CWE-ID: CWE-326 - Inadequate Encryption Strength
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code with SYSTEM privileges on an affected device.
The vulnerability exists due to inadequate encryption strength in Windows Modern Device Management (MDM) when processing management responses received over the network. A remote attacker can modify an affected device’s MDM network traffic from a machine-in-the-middle position and provide a specially crafted signed management response to execute arbitrary code with SYSTEM privileges.
24) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-102200)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to tamper with data locally.
The vulnerability exists due to a time-of-check time-of-use race condition in Windows NTFS when a resource is checked and subsequently used. A local user can win the race by changing resource state between the check and its use to tamper with data.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105504
- https://support.microsoft.com/help/5131291
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105520
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105518
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105515
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105513
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105512
- https://support.microsoft.com/help/5131090
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105511
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105510
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105509
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105507
- https://support.microsoft.com/help/5131085
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105506
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105505
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-100223
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105503
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105501
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105492
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105028
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105024
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105018
- https://support.microsoft.com/help/5131087
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105017
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-103571
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102868
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102219
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102200