CVE-2026-83586

The Windows Resilient File System (ReFS) Deduplication Service is vulnerable to weak authentication (CWE-1390), which allows an authorized attacker to perform a local privilege elevation . The impact includes high risks to confidentiality, integrity, and availability. An official fix is available...

CVE-2026-83769

A Use after free vulnerability exists in OpenSSH for Windows , which allows an authorized attacker to achieve local privilege escalation . The vulnerability is classified with a CVSS 3.1 base score of 7.8 , indicating a high severity. No specific exploit details or in-the-wild exploitation record...

CVE-2026-83911

A heap-based buffer overflow exists in Windows Storage which can be leveraged by an authorized attacker to achieve local privilege elevation . The vulnerability is classified as High severity with a CVSS 3.1 score of 7.0. No specific exploit details or in-the-wild exploitation information are pro...

CVE-2026-83906

The Windows Shell is susceptible to a vulnerability due to an incorrect implementation of authentication algorithm . This flaw allows an unauthorized attacker to perform spoofing over a network . The CVSS 3.1 score is 6.5 (Medium) , with a high impact on confidentiality. Remediation is available ...

CVE-2026-83912

A Use after free vulnerability in Windows Direct Composition allows an authorized attacker to achieve local privilege elevation . The vulnerability is associated with CWE-416 . While the impact involves high levels of confidentiality, integrity, and availability, specific technical details regard...

CVE-2026-83871

A Heap-based buffer overflow exists in OpenSSH for Windows , which allows an authorized attacker to achieve local privilege elevation . The vulnerability involves a Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) and a Heap-based Buffer Overflow (CWE-122). The CVSS 3.1 base score is 7...

CVE-2026-83886

A Use after free vulnerability exists in the Windows Update Orchestrator Service . This flaw allows an authorized attacker to achieve local privilege elevation . While the specific technical root cause is not detailed in the provided documents, the impact includes high levels of confidentiality, ...

CVE-2026-70163

The OpenSSH for Windows software is vulnerable to a Denial of Service (DoS) attack due to the allocation of resources without limits or throttling . An unauthorized attacker can exploit this flaw over a network to disrupt service. The vulnerability is associated with CWE-770 . Remediation is avai...

CVE-2026-70286

A heap-based buffer overflow exists in the Windows Win32K - GRFX component. This vulnerability allows an authorized attacker to achieve local privilege elevation . No specific exploit details or in-the-wild exploitation instances are provided in the documents. Remediation is indicated as an offic...

CVE-2026-70222

A Relative path traversal vulnerability exists in Windows Shell . This flaw allows an authorized attacker to achieve local privilege elevation . The vulnerability is associated with CWE-23 . No specific exploit information or specific internal component details are provided in the documentation.

CVE-2026-70241

A Use after free vulnerability exists in Windows Kerberos that allows an authorized attacker to achieve local privilege escalation . The impact includes high levels of confidentiality, integrity, and availability. No specific exploit details or in-the-wild exploitation information are provided in...

CVE-2026-70299

The Windows Bind Filter Driver contains an improper access control vulnerability (CWE-863) that allows an authorized attacker to perform a local privilege escalation . The vulnerability has a High base severity score of 8.8. No specific exploit code or details regarding the underlying root cause ...

CVE-2026-70243

A Use after free vulnerability exists in the Windows Kernel , which may allow an authorized attacker to achieve local privilege escalation . The vulnerability is characterized by a high base severity score of 7.0. No specific exploit details, affected versions, or remediation steps are provided i...

CVE-2026-70248

A null pointer dereference vulnerability exists in Windows Hyper-V . This flaw allows an authorized attacker to perform a local denial of service (DoS) attack. No specific versions or exploit links are provided in the documents, but the vulnerability has an official fix available.

CVE-2026-70089

A heap-based buffer overflow vulnerability exists in the Windows GDI component. This flaw could allow an unauthorized attacker to achieve remote code execution over a network. The vulnerability is characterized by a HIGH base severity score of 8.8. No specific exploit details or patch versions ar...

CVE-2026-70275

A vulnerability exists in the Windows CD-ROM File System Driver due to an untrusted pointer dereference . This flaw could allow an unauthorized attacker to achieve remote code execution over a network. The vulnerability has a CVSS 3.1 base score of 8.8 (High) . No specific exploitations or in-the...

CVE-2026-83909

The Windows Win32 Kernel Subsystem is affected by an information disclosure vulnerability. An authorized attacker can exploit this flaw to disclose sensitive system information locally. This vulnerability is associated with CWE-497 (Exposure of Sensitive System Information to an Unauthorized Cont...

CVE-2026-70151

A Use after free vulnerability exists in Windows Direct Composition . This flaw allows an authorized attacker to achieve local privilege elevation . While the root cause is identified as a memory management issue, the provided documents do not specify the exact component, file, or version affecte...

CVE-2026-83893

The Windows Clipboard User Service is vulnerable to an information disclosure flaw (CWE-497) that allows an authorized attacker to disclose sensitive system information locally. The vulnerability is caused by exposure to an unauthorized control sphere. Remediation is available via an official fix...

CVE-2026-70086

A use after free vulnerability exists in the Microsoft Windows Search Component . This flaw allows an authorized attacker to achieve local privilege escalation . The vulnerability is confirmed with a CVSS 3.1 base score of 7.0 . Remediation is available via an official fix provided by Microsoft.