CVE-2026-40398 Windows Remote Desktop Services Elevation of Privilege Vulnerability

...

CVE-2026-40398

CVE-2026-40398 is a heap-based buffer overflow in Windows Remote Desktop Services that allows an authenticated attacker to perform local privilege escalation. The description across sources consistently identifies a local, authenticated exploit path with a high impact (C/H/I/A: High) and a CVSS v...

CVE-2026-40398 Windows Remote Desktop Services Elevation of Privilege Vulnerability

...

CVE-2026-34336

Buffer over-read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally...

CVE-2026-34336 Windows DWM Core Library Elevation of Privilege Vulnerability

...

CVE-2026-34336 Windows DWM Core Library Elevation of Privilege Vulnerability

...

CVE-2026-41614 M365 Copilot for Desktop Spoofing Vulnerability

...

CVE-2026-41614

CVE-2026-41614 concerns M365 Copilot for Desktop where improper access control enables a local attacker to spoof identities. The available documents identify the affected software (M365 Copilot for Desktop) and the impact as local spoofing due to insufficient access permissions, but do not provid...

CVE-2026-40374

CVE-2026-40374 concerns Exposure of sensitive information to an unauthorized actor in Power Automate Desktop. The connected documents indicate an information disclosure vulnerability affecting Power Automate Desktop, with a CVSS v3.1 base score of 6.5 (NETWORK, LOW attack complexity, PRIVILEGES R...

CVE-2026-40374 Microsoft Power Automate Desktop Information Disclosure Vulnerability

...

CVE-2026-40374 Microsoft Power Automate Desktop Information Disclosure Vulnerability

...

CVE-2026-35419 Windows DWM Core Library Information Disclosure Vulnerability

...

CVE-2026-35419

CVE-2026-35419 describes an out-of-bounds read in Windows DWM Core Library that can disclose information locally by an authorized user. The available sources identify the vulnerability as a local-attack vector with low privileges required and no user interaction, resulting in a high confidentiali...

May 12, 2026—KB5087544 (OS Builds 19045.7291 and 19044.7291)

None None...

May 12, 2026—KB5087538 (OS Build 17763.8755)

None None...

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally...

May 12, 2026—Hotpatch KB5087424 (OS Build 20348.5074)

None None...

May 12, 2026—KB5087537 (OS Build 14393.9140)

None None...

M365 Copilot for Desktop Spoofing Vulnerability

Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally...

Microsoft Power Automate Desktop Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network...