38 matches found
CVE-2023-21674
First in-the-wild 0-day of 2023 🔥 CVE-2023-21674 is a vulnerability in Windows Advanced Local Procedure Call ALPC that could lead to a browser sandbox escape and allow attackers to gain SYSTEM privileges discovered by Avast kd !analyze -v Bugcheck Analysis PAGEFAULTINNONPAGEDAREA 50 Invalid syste...
CVE-2026-85866
Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally...
CVE-2026-85866
This vulnerability exists in Windows ALPC , where the exposure of sensitive system information to an unauthorized control sphere allows an authorized attacker to disclose information locally . The root cause is associated with CWE-497 . The base CVSS 3.1 score is 4.7 (Medium) , reflecting a high ...
CVE-2026-85866: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally...
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560 , said...
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligne...
September Microsoft Patch Tuesday
September Microsoft Patch Tuesday. A total of 973 vulnerabilities were addressed - more than twice as many as in August. Seven products had 20 or more vulnerabilities fixed: Windows Biometric Service 64, Microsoft SQL Server 54, Windows DHCP Server 36, Microsoft Office Word 35, Windows NTFS 29,...
Patch Tuesday - September 2026
Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch...
CVE-2026-85880
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally...
CVE-2026-69874
Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally...
CVE-2026-69834
Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally...
EUVD-2026-73637
Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally...
CVE-2026-69874
CVE-2026-69874 is a local privilege escalation vulnerability in Windows ALPC (Advanced Local Procedure Call) caused by an untrusted pointer dereference . An authorized attacker with local high-privilege access can exploit this to elevate privileges further. The vulnerability carries a CVSS 3.1 sc...
EUVD-2026-73580
Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally...
CVE-2026-69834
CVE-2026-69834 is a use-after-free vulnerability in Windows ALPC (Advanced Local Procedure Call) that allows an authorized local attacker to elevate privileges . The attack requires local access , high complexity , and low privileges , with no user interaction needed. The CVSS v3.1 base score is ...
EUVD-2026-73365
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally...
CVE-2026-85880
CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC (Advanced Local Procedure Call) that enables a locally authorized attacker to escalate privileges with full impact on confidentiality, integrity, and availability (CVSS 7.8 HIGH). CISA added this CVE to the Known Exploited Vulnerabili...
Windows ALPC Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally...