CVE-2026-88110

A heap-based buffer overflow exists in the Windows Graphics Kernel . This vulnerability allows an authorized attacker to achieve local privilege elevation . No specific versions, root causes, or remediation details are provided in the documents. Exploitation details are not present.

CVE-2026-88109

A use after free vulnerability exists in Microsoft Office Click-To-Run , which could allow an authorized attacker to achieve local privilege escalation . The vulnerability is assigned a High base severity score of 7.8. No specific exploit links or remediation details are provided in the documents...

CVE-2026-88127

A Use after free vulnerability in the Windows SMB Server allows an authorized attacker to perform a local privilege escalation . The vulnerability is associated with CWE-416 and carries a High base severity score of 7.0. Remediation is available via an official fix provided by Microsoft. No speci...

CVE-2026-88105

A use after free vulnerability in the Windows Broadcast DVR User Service allows an authorized attacker to achieve local privilege escalation . This flaw is characterized by a HIGH base severity score of 7.8 (CVSS v3.1). Remediation is available via an official fix provided by Microsoft.

CVE-2026-88103

A Use after free vulnerability exists in the Windows Broadcast DVR User Service . This flaw allows an authorized attacker to achieve local privilege elevation . The CVSS 3.1 score for this vulnerability is 7.0 (High) , with a local attack vector and high complexity. No specific exploit informatio...

CVE-2026-87702

A vulnerability in Windows Resource Management (MRM) involving an integer overflow or wraparound allows an authorized attacker to achieve local privilege elevation . The vulnerability is characterized by a high base severity score of 7.8. No specific patch versions, workarounds, or exploit detail...

CVE-2026-87715

A Use after free vulnerability exists in Windows Installer , which could allow an authorized attacker to achieve local privilege escalation . The vulnerability is classified as HIGH severity (CVSS 3.1 score of 7.0). No specific exploit details or in-the-wild exploitation information are provided ...

CVE-2026-88072

A vulnerability in Windows Host Guardian Service involves improper access control that allows an authorized attacker to achieve local privilege escalation . The root cause is associated with CWE-59 (Improper Link Resolution Before File Access). The impact includes high levels of confidentiality, ...

CVE-2026-87698

A Windows Remote Access Service Infrastructure component is vulnerable to an out-of-bounds read (CWE-125). This flaw allows an authorized attacker to perform a local information disclosure on the affected system. The CVSS 3.1 score is 5.5, reflecting a medium severity with a local attack vector a...

CVE-2026-85884

The Windows Health and Optimized Experiences Service is vulnerable to a privilege escalation flaw due to missing authentication for a critical function (CWE-306). An authorized attacker can exploit this to elevate privileges locally on the affected system. While the CVSS 3.1 score is 7.8 (High) ,...

CVE-2026-87699

A heap-based buffer overflow exists in Winlogon , which allows an authorized attacker to achieve local privilege elevation . The vulnerability is associated with CWE-122 . Official remediation is available via Microsoft updates.

CVE-2026-87693

A use after free vulnerability exists in Windows Installer that allows an authorized attacker to achieve local privilege escalation . The vulnerability is characterized by a high base severity score of 7.0 and impacts confidentiality, integrity, and availability. No specific exploit links or deta...

CVE-2026-87694

A Use after free vulnerability in Windows Installer allows an authorized attacker to achieve local privilege elevation . The vulnerability is classified with a High base severity (CVSS 3.1 score of 7.8). While the technical root cause is identified as a use after free, specific file paths or func...

CVE-2026-87700

A Use after free vulnerability exists in Windows Installer , which may allow an authorized attacker to achieve local privilege escalation . The vulnerability is associated with CWE-416 . While specific affected versions or detailed root causes are not provided in the documents, a remediation leve...

CVE-2026-85941

A race condition exists in Windows Installer due to concurrent execution using a shared resource with improper synchronization. This vulnerability allows an authorized attacker to achieve local privilege elevation . The impact includes high levels of confidentiality, integrity, and availability. ...

CVE-2026-85943

A Time-of-check time-of-use (TOCTOU) race condition exists in the Reliable Multicast Transport Driver (RMCAST) . This vulnerability allows an authorized attacker to achieve local privilege elevation . While the specific affected versions are not detailed in the provided documents, the vulnerabili...

CVE-2026-87709

A vulnerability exists in the Windows Host Guardian Service due to improper access control . This flaw allows an authorized attacker to perform tampering locally . The vulnerability is associated with CWE-250 (Execution with Unnecessary Privileges) . While the technical root cause is not detailed...

CVE-2026-83925

A vulnerability exists in the Windows Kernel involving the use of uninitialized resource (CWE-908). This flaw allows an authorized attacker to perform a local information disclosure (CWE-497). The vulnerability has a Medium base severity score of 4.7, requiring local access and high complexity to...

CVE-2026-85879

A Time-of-check time-of-use (TOCTOU) race condition exists in the Windows Subsystem for Linux . This vulnerability allows an authorized attacker to achieve local privilege elevation . The impact includes high levels of confidentiality, integrity, and availability. Official fixes are available; ho...

CVE-2026-83933

The Windows Update Orchestrator Service is vulnerable to an improper link resolution before file access (link following) vulnerability. This flaw allows an authorized attacker to perform a local information disclosure . No specific software versions, exploit links, or remediation steps are provid...