CVE-2026-97381

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the...

CVE-2026-97381 Legacy Update ActiveX control accepts unauthorized hosting origins

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the...

CVE-2026-97381 Legacy Update ActiveX control accepts unauthorized hosting origins

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the...

CVE-2026-97381

Legacy Update versions 1.12.0 through 1.13.1 are vulnerable to an origin validation error in the IsPermitted method of its ActiveX control. Due to a logic flaw, hostnames not on the permitted list fail to trigger an E_ACCESSDENIED error, causing the method to incorrectly return S_OK. An attacker ...

Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

CVE-2026-97815

Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network...

CVE-2026-97798

Improper neutralization of argument delimiters in a command 'argument injection' in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-96234

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-88132

Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network...

CVE-2026-85800

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-85354

Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-83916

Double free in Windows Error Reporting allows an authorized attacker to execute code locally...

CVE-2026-83840

Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-83758

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally...

CVE-2026-83750

Time-of-check time-of-use toctou race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-83748

Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network...

CVE-2026-83747

Out-of-bounds read in Windows Error Reporting allows an authorized attacker to disclose information locally...

CVE-2026-83715

Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally...

CVE-2026-83693

Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network...

CVE-2026-83689

Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally...