CVE-2026-69714: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges over a network...

CVE-2026-69791: Use After Free

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69711: Use After Free

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

The vulnerability of the Windows Device Association Service on Windows operating systems allows a perpetrator to increase their privileges.

The vulnerability of the Windows Device Association Service on Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...

JLSEC-2026-1348 Wasmtime doesn't fully sandbox all the Windows device filenames

Impact Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so...

The vulnerability of the Windows Device Association Service in Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the Windows Device Association Service on Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...

CVE-2026-62747

Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-66802 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

...

EUVD-2026-56633

Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-62747 Windows Device Association Service Elevation of Privilege Vulnerability

...

Windows Device Association Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

PT-2026-70507

Name of the Vulnerable Software and Affected Versions Windows Device Association Service affected versions not specified Description A heap-based buffer overflow occurs in the Windows Device Association Service. This issue allows an authorized attacker to elevate privileges locally on the system....

CVE-2026-62710: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-62747: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

PT-2026-70473

Name of the Vulnerable Software and Affected Versions Windows Device Association Service affected versions not specified Description A heap-based buffer overflow occurs in the Windows Device Association Service. This issue allows an authorized attacker to elevate privileges locally on the system....

CVE-2026-66802: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...

CVE-2026-71331: Integer Overflow or Wraparound

Integer overflow or wraparound in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...

SUSE CVE-2026-24899

Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's multi-tenant JWKS endpoint but does not...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by improper handling of Windows device names due to Werkzeug

Summary Werkzeug is used by IBM Cloud Pak for Data System 1.0 as a WSGI web application library. CVE-2026-27199 affects Werkzeug's safejoin function, which fails to properly filter Windows device names when preceded by other path segments in multi-segment paths. This allows the sendfromdirectory...

PYSEC-2026-2044 Werkzeug safe_join() allows Windows special device names with compound extensions

Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extensio...