5122 matches found
VulnCheck KEV: CVE-2023-4346
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this...
CVE-2026-58543
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Print Driver allows an authorized attacker to elevate privileges with a physical attack...
CVE-2026-50668
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to elevate privileges with a physical attack...
CVE-2026-50299
Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack...
CVE-2026-49794
Out-of-bounds read in Windows USB Audio Class driver usbaudio.sys allows an unauthorized attacker to disclose information with a physical attack...
CVE-2026-50299
The CVE-2026-50299 entry describes an integer overflow/wraparound in Windows Storage Spaces Direct. Affected component: Storage Spaces Direct (Windows). Root cause: integer overflow allowing an unauthorized attacker to execute code. Impact: code execution with a physical attack vector; CVSS vecto...
CVE-2026-54132
CVE-2026-54132: Heap-based buffer overflow in the Windows Kernel can enable privilege escalation with physical access. Documents consistently describe an attacker who gains local, physical access to exploit the heap overflow to elevate privileges. The described impact is local elevation of privil...
CVE-2026-55000
CVE-2026-55000 affects the Windows USB Print Driver and is a use-after-free vulnerability that enables an unauthorized attacker to elevate privileges with physical access. CVSS 3.1: AV=P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 6.4, MEDIUM). Exploitation is described as physical access with no ...
Windows USB Print Driver Elevation of Privilege Vulnerability
Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack...
Universal Print Management Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Print Driver allows an authorized attacker to elevate privileges with a physical attack...
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to elevate privileges with a physical attack...
Windows USB Audio Class Driver Information Disclosure Vulnerability
Out-of-bounds read in Windows USB Audio Class driver usbaudio.sys allows an unauthorized attacker to disclose information with a physical attack...
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges with a physical attack...
Microsoft XML Security Feature Bypass Vulnerability
Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack...
PT-2026-58491
Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description A heap-based buffer overflow exists in the Windows NTFS file system. This issue allows an unauthorized attacker to elevate privileges through a physical attack, such as using a rogue USB...
PT-2026-58186
Name of the Vulnerable Software and Affected Versions Windows Spaceport.sys affected versions not specified Description An integer overflow or wraparound exists in the Spaceport.sys driver. This issue allows an unauthorized attacker with physical access to the system to elevate their privileges t...
PT-2026-58166
Name of the Vulnerable Software and Affected Versions Windows USB Audio Class driver usbaudio.sys affected versions not specified Description An out-of-bounds read in the usbaudio.sys driver allows an unauthorized attacker to disclose sensitive information through a physical attack. An...
CVE-2026-10663
In Zephyr's experimental USB host stack CONFIGUSBHOSTSTACK, usbhdevicedisconnect subsys/usb/host/usbhdevice.c freed the root usbdevice slab object without clearing the cached pointer ctx-root. The bus removal handler devremovedhandler subsys/usb/host/usbhcore.c decides what to tear down solely fr...
CVE-2026-10663
The vulnerability CVE-2026-10663 affects Zephyr’s experimental USB host stack (CONFIG_USB_HOST_STACK). freed root usb_device slab in usbh_device_disconnect() leaves ctx->root dangling; bus removal handler dev_removed_handler() uses ctx->root to decide teardown. Synthesis of DEV_REMOVED even...
CVE-2026-10663 Use-after-free / double-free of the root USB device in the experimental USB host stack
In Zephyr's experimental USB host stack CONFIGUSBHOSTSTACK, usbhdevicedisconnect subsys/usb/host/usbhdevice.c freed the root usbdevice slab object without clearing the cached pointer ctx-root. The bus removal handler devremovedhandler subsys/usb/host/usbhcore.c decides what to tear down solely fr...