CVE-2026-88122

An out-of-bounds read vulnerability exists in the DNS Server , which allows an authorized attacker to perform a denial of service attack over a network. The vulnerability is associated with CWE-125 . While the documents confirm the impact and root cause, specific details regarding affected versio...

CVE-2026-88130

An out-of-bounds read vulnerability exists in the DNS Server , which allows an authorized attacker to perform a denial of service (DoS) over a network. The vulnerability is associated with CWE-125 . While the documents confirm the impact is a denial of service, no specific software versions, file...

CVE-2026-88125

An out-of-bounds read vulnerability exists in the DNS Server , which could allow an authorized attacker to trigger a denial of service over a network. The vulnerability is associated with CWE-125 . While an official fix is noted in the remediation level, specific affected versions and detailed ro...

CVE-2026-70158

The Windows Routing and Remote Access Service (RRAS) is vulnerable to Remote Code Execution (RCE) . This vulnerability is caused by a Double Free (CWE-415) condition, which could allow an attacker to gain unauthorized access to a victim's machine. The issue is rated as High severity with a CVSS 3...

CVE-2026-70227

An out-of-bounds read vulnerability exists in the Windows Device Association Service . This flaw allows an authorized attacker to perform a local information disclosure, potentially revealing sensitive data. No specific exploit code or in-the-wild exploitation details are provided in the document...

CVE-2026-70122

A Time-of-check time-of-use (TOCTOU) race condition exists in the Windows Broadcast DVR User Service . This vulnerability allows an authorized attacker to achieve local privilege escalation . The vulnerability is tracked under CWE-367 . Remediation is available via an official fix provided by Mic...

CVE-2026-70148

The Windows Broadcast DVR User Service is susceptible to an improper authorization vulnerability (CWE-441). This flaw allows an authorized attacker to perform a local information disclosure . The vulnerability has a CVSS 3.1 base score of 6.5 and is categorized as a MEDIUM severity issue. No spec...

CVE-2026-88133

The Windows Portable Device Enumerator Service is vulnerable to an improper authorization flaw. This vulnerability allows an authorized attacker to perform a local privilege escalation . The root cause is identified as CWE-59 (Improper Link Resolution Before File Access). Impact includes high lev...

CVE-2026-88152

A Use after free vulnerability in the Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to achieve local privilege elevation . The vulnerability is categorized under CWE-416 . While the documents confirm the technical nature of the flaw and its impact, no specif...

CVE-2026-88118

An integer overflow or wraparound vulnerability exists in the Windows Background Intelligent Transfer Service (BITS) . This flaw allows an authorized attacker to achieve local privilege elevation . The vulnerability is associated with CWE-190 (Integer Overflow or Wraparound) and CWE-122 (Heap-bas...

CVE-2026-88142

A use after free vulnerability exists in the Windows Background Intelligent Transfer Service (BITS) . This flaw allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is associated with CWE-122 (Heap-based Buffer Overflow) and carries a High severity ra...

CVE-2026-88121

A Use after free vulnerability in the Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is associated with CWE-416 and carries a CVSS 3.1 base score of 8.0 (High) . While the impact includes hi...

CVE-2026-88072

A vulnerability in Windows Host Guardian Service involves improper access control that allows an authorized attacker to achieve local privilege escalation . The root cause is associated with CWE-59 (Improper Link Resolution Before File Access). The impact includes high levels of confidentiality, ...

CVE-2026-88113

A Use after free vulnerability exists in the Windows Broadcast DVR User Service . This flaw allows an authorized attacker to achieve local privilege escalation . While the technical root cause is identified as a memory management issue, specific exploit details and in-the-wild exploitation inform...

CVE-2026-88103

A Use after free vulnerability exists in the Windows Broadcast DVR User Service . This flaw allows an authorized attacker to achieve local privilege elevation . The CVSS 3.1 score for this vulnerability is 7.0 (High) , with a local attack vector and high complexity. No specific exploit informatio...

CVE-2026-88079

A Null pointer dereference vulnerability exists in the Windows MIDI Service Module . This flaw allows an authorized attacker to achieve local privilege elevation . The vulnerability is assigned a CVSS 3.1 base score of 7.0 (High) . No specific exploit information or direct remediation steps are p...

CVE-2026-88105

A use after free vulnerability in the Windows Broadcast DVR User Service allows an authorized attacker to achieve local privilege escalation . This flaw is characterized by a HIGH base severity score of 7.8 (CVSS v3.1). Remediation is available via an official fix provided by Microsoft.

CVE-2026-87709

A vulnerability exists in the Windows Host Guardian Service due to improper access control . This flaw allows an authorized attacker to perform tampering locally . The vulnerability is associated with CWE-250 (Execution with Unnecessary Privileges) . While the technical root cause is not detailed...

CVE-2026-87698

A Windows Remote Access Service Infrastructure component is vulnerable to an out-of-bounds read (CWE-125). This flaw allows an authorized attacker to perform a local information disclosure on the affected system. The CVSS 3.1 score is 5.5, reflecting a medium severity with a local attack vector a...

CVE-2026-85884

The Windows Health and Optimized Experiences Service is vulnerable to a privilege escalation flaw due to missing authentication for a critical function (CWE-306). An authorized attacker can exploit this to elevate privileges locally on the affected system. While the CVSS 3.1 score is 7.8 (High) ,...