CVE-2026-69591

CVE-2026-69591 is an out-of-bounds read vulnerability in Windows NTFS that allows an authorized attacker to disclose information over a network. The CVSS 3.1 score is 5.7 (Medium) , requiring network access, low privileges, and user interaction, with a high confidentiality impact but no integrity...

CVE-2026-69538

CVE-2026-69538 is an out-of-bounds read vulnerability in the Windows Spaceport.sys driver. An attacker with low local privileges can exploit this to execute code on the target system, leading to high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.8 – HIGH ). The attack v...

CVE-2026-69535

A numeric truncation error in the Windows Spaceport.sys driver allows an authorized local attacker with low privileges to escalate privileges, leading to full compromise of confidentiality, integrity, and availability. The vulnerability is rated CVSS 3.1 7.8 (High) with a local attack vector, low...

CVE-2026-69571

CVE-2026-69571 is a heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized local attacker to elevate privileges. The vulnerability is scored CVSS 3.1: 7.8 (HIGH) with a vector of local attack, low complexity, low privileges required, no user inte...

CVE-2026-69546

CVE-2026-69546 is a use-after-free vulnerability in Windows Active Directory Domain Services that allows an unauthorized attacker to achieve remote code execution over the network. The CVSS 3.1 score is 8.1 (High) with a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high attack comple...

CVE-2026-69536

CVE-2026-69536 is a use-after-free vulnerability in Windows Remote Desktop Services that allows an authorized attacker to achieve remote code execution over a network. The CVSS v3.1 score is 7.1 (HIGH) , with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating that while exploitation requ...

CVE-2026-69547

CVE-2026-69547 is a heap-based buffer overflow in Windows DHCP Server that allows an authorized attacker to execute code over a network. The Microsoft-assigned CVSS 3.1 score is 8.8 (HIGH) , reflecting a network attack vector, low attack complexity, low privileges required, and high impact to con...

CVE-2026-69599

Windows Remote Desktop Services contains a use-after-free vulnerability that allows an authorized attacker (low privileges required) to execute code over a network. The CVSS 3.1 score is 7.5 (HIGH) , with high attack complexity and no user interaction required, impacting confidentiality, integrit...

CVE-2026-69509

CVE-2026-69509 is a heap-based buffer overflow in the Windows Fax Service component of Microsoft Windows, allowing an authorized attacker with local access to escalate privileges . The vulnerability requires low privileges , low attack complexity , and no user interaction , resulting in a CVSS 3....

CVE-2026-69508

A stack-based buffer overflow in the Windows MIDI Service Module allows a locally authenticated attacker with low privileges to escalate privileges, achieving high impact across confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH ). No user interaction is required. The vulnerability ...

CVE-2026-69498

Windows Win32K contains a use-after-free vulnerability that allows an authorized local attacker to escalate privileges . The CVSS 3.1 score is 7.0 (High) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high attack complexity but low privileges required and no user interaction . T...

CVE-2026-69503

CVE-2026-69503 is a stack-based buffer overflow in the Windows USB Driver that allows an authorized attacker to elevate privileges over a network. The vulnerability carries a CVSS 3.1 base score of 8.0 (HIGH) with a network attack vector, low complexity, low required privileges, and required user...

CVE-2026-69512

CVE-2026-69512 is a heap-based buffer overflow in the Windows Spaceport.sys driver that allows an authorized attacker (low privileges) to elevate privileges over a network , with user interaction required. The flaw yields high impact to confidentiality, integrity, and availability, yielding a CVS...

CVE-2026-69497

Windows DHCP Server is vulnerable to a memory leak (missing release of memory after effective lifetime), allowing an authorized attacker with low privileges over the network to cause a denial of service . The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, ind...

CVE-2026-69511

CVE-2026-69511 is a heap-based buffer overflow in Microsoft Windows Media Foundation that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction but no prior privileges, with a CVSS 3.1 base score of 8.8 (HIGH) and high impact ...

CVE-2026-69488

A use-after-free vulnerability in the Windows Device Association Service allows an authorized local attacker to escalate privileges . The CVSS 3.1 score is 7.0 (HIGH) , with a local attack vector, high complexity, low required privileges, and no user interaction, yielding high impact on confident...

CVE-2026-69493

CVE-2026-69493 is a critical (CVSS 9.8) out-of-bounds read vulnerability in Windows Event Logging Service , as assigned by Microsoft . The flaw allows an unauthorized, network-based attacker to achieve remote code execution without user interaction, with high impact to confidentiality, integrity,...

CVE-2026-69578

CVE-2026-69578 is a numeric truncation error in the Windows Kernel that allows an authorized attacker with low privileges to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high attack complexit...

CVE-2026-69483

CVE-2026-69483 is an out-of-bounds read vulnerability in Windows Image Acquisition (WIA) that allows an authorized, local attacker to achieve information disclosure with high confidentiality impact . The CVSS 3.1 score is 4.7 (Medium) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, indica...

CVE-2026-69480

CVE-2026-69480 is a heap-based buffer overflow in the Windows Partition Management Driver that allows an authorized, low-privilege local attacker to escalate privileges. The CVSS v3.1 score is 7.8 (HIGH) , with a local attack vector, low complexity, and high impact on confidentiality, integrity, ...

CVE-2026-69561

CVE-2026-69561 is an out-of-bounds read vulnerability in the Windows CD-ROM Driver that allows an authorized attacker to achieve local privilege escalation . The flaw resides in how the driver reads memory beyond its allocated bounds, potentially allowing an attacker with local low-privilege acce...

CVE-2026-69478

CVE-2026-69478 is a heap-based buffer overflow in the Windows Device Association Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, resulting in high impact ...

CVE-2026-69482

Windows Error Reporting contains a local tampering vulnerability caused by the creation of a temporary file in a directory with insecure permissions , allowing an authorized attacker to tamper with data locally. The vulnerability is rated CVSS 7.1 (HIGH) with a vector of local attack, low complex...

CVE-2026-69474

This vulnerability is a use after free in Windows Overlay Filter that allows an authorized attacker to disclose information over a network. The CVSS 3.1 base score is 4.8 (MEDIUM) , requiring network access, high complexity, low privileges, and user interaction, with a high impact on confidential...

CVE-2026-69467

CVE-2026-69467 is a stack-based buffer overflow in the Microsoft Graphics Component that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 7.8 (HIGH) with a vector of local attack, low complexity, low privileges required, and high impact on confidentiality, integ...

CVE-2026-69460

CVE-2026-69460 is a use-after-free vulnerability in Windows Modern Device Management (MDM) that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) , with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating that exploitation requires a netw...

CVE-2026-69456

CVE-2026-69456 is a heap-based buffer overflow in Microsoft Windows Speech that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low-privileged local access with no user int...

CVE-2026-69459

CVE-2026-69459 is a heap-based buffer overflow in the Windows Power Dependency Coordinator that allows an authorized attacker to achieve local privilege escalation . The Microsoft CVSS v3.1 score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low-privilege access i...

CVE-2026-69462

CVE-2026-69462 is a heap-based buffer overflow in Windows Error Reporting that allows an authorized attacker to elevate privileges over a network . The vulnerability carries a CVSS 3.1 score of 8.0 (HIGH) with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , meaning exploitation requires low priv...

CVE-2026-69453

CVE-2026-69453 is a missing authorization vulnerability in the Microsoft Windows Search Component that allows an authenticated, low-privilege local attacker to perform tampering (integrity impact). The CVSS 3.1 base score is 5.5 (Medium) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indica...

CVE-2026-69445

CVE-2026-69445 is a local privilege escalation vulnerability in Windows Compressed Folder caused by an improper limitation of a pathname to a restricted directory (path traversal ). An authorized attacker with low privileges can exploit this locally without user interaction to achieve high impact...

CVE-2026-69444

CVE-2026-69444 is a heap-based buffer overflow in Microsoft Windows Speech that allows an authorized attacker to escalate privileges locally. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , with a local attack vector, low complexity, low privileges required, and high impact across conf...

CVE-2026-69466

CVE-2026-69466 is a Time-of-Check Time-of-Use (TOCTOU) race condition in the Windows Kernel that allows a low-privileged local attacker to elevate privileges . The vulnerability carries a CVSS 3.1 score of 7.0 (High) , with high impact to confidentiality, integrity, and availability, though explo...

CVE-2026-69434

A heap-based buffer overflow in Windows URL Moniker allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction (e.g., opening a malicious URL) but no prior authentication or privileges, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/...

CVE-2026-69440

CVE-2026-69440 is a Time-of-Check Time-of-Use (TOCTOU) race condition in the Windows MIDI Service Module that allows an authorized low-privilege attacker to achieve local privilege escalation . The vulnerability is scored CVSS 3.1: 7.0 (High) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H ,...

CVE-2026-69447

CVE-2026-69447 is a heap-based buffer overflow in the Windows Audio Service that allows an authorized local attacker to achieve privilege escalation . The vulnerability is rated CVSS 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it requires only low privileges and no us...

CVE-2026-69433

A heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to achieve local privilege escalation . The vulnerability is rated CVSS 3.1: 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, yielding high impact on confidentiality, integrity...

CVE-2026-69449

CVE-2026-69449 is a heap-based buffer overflow in Windows BitLocker that allows an authorized attacker to execute code locally. The CVSS 3.1 score is 6.7 (Medium) , reflecting a local attack vector with high privileges required and no user interaction , resulting in high impact on confidentiality...

CVE-2026-69430

CVE-2026-69430 is a use after free vulnerability in the Windows Embedded Mode Service that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 base score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating the attack requires local access ...

CVE-2026-69475

CVE-2026-69475 is an elevation of privilege vulnerability in Windows Remote Desktop Services , caused by an untrusted pointer dereference . An authorized local attacker with low privileges can exploit this with low complexity and no user interaction to gain high impact across confidentiality, int...

CVE-2026-69427

CVE-2026-69427 is an out-of-bounds read vulnerability in the Windows VOLSNAP.SYS driver (Volume Shadow Copy service). An authorized attacker can exploit it over a network to elevate privileges . The CVSS 3.1 base score is 8.0 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , indicatin...

CVE-2026-69425

CVE-2026-69425 is an improper link resolution before file access (link following) vulnerability in Windows NTFS . An authorized attacker with low privileges and high attack complexity can perform local tampering , resulting in high integrity impact with no confidentiality or availability impact (...

CVE-2026-69438

CVE-2026-69438 is a Remote Code Execution vulnerability in Microsoft JScript caused by an incorrect conversion between numeric types . An unauthorized attacker can exploit this over a network to execute code, with a CVSS 3.1 score of 8.1 (HIGH) — notably, high attack complexity is required but no...

CVE-2026-69422

CVE-2026-69422 is a use-after-free vulnerability in the Windows USB Video Driver that allows a locally authenticated attacker with low privileges to escalate privileges. The attack requires high complexity and no user interaction, with high impact on confidentiality, integrity, and availability, ...

CVE-2026-69424

CVE-2026-69424 is a heap-based buffer overflow in Windows Distributed File System (DFS) that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and no user interactio...

CVE-2026-69428

Windows LDAP (Lightweight Directory Access Protocol) is vulnerable to an out-of-bounds read that allows an unauthorized, network-based attacker to cause a denial of service , with a CVSS 3.1 base score of 7.5 (HIGH) . The vulnerability requires no privileges and no user interaction, though it imp...

CVE-2026-69407

CVE-2026-69407 is an integer overflow or wraparound vulnerability in the Microsoft Volume Manager Driver that allows an authorized attacker to escalate privileges locally . The vulnerability is rated CVSS 3.1 7.8 (HIGH) with a local attack vector, low complexity, low privileges required, and high...

CVE-2026-69416

CVE-2026-69416 is a buffer over-read in Windows DHCP Server that allows an authorized attacker with low privileges on an adjacent network to cause a denial of service , with high availability impact and no confidentiality or integrity impact (CVSS 3.1: 5.7 MEDIUM ). CISA assesses exploitation as ...

CVE-2026-69405

CVE-2026-69405 is a memory leak in Windows DHCP Server , specifically a missing release of memory after its effective lifetime. An attacker with low privileges on an adjacent network can trigger a denial of service by exhausting server resources. The CVSS 3.1 score is 5.7 (MEDIUM) with the vector...

CVE-2026-69398

CVE-2026-69398 is a local privilege escalation vulnerability in the Windows Bluetooth Service , caused by a race condition (concurrent execution using a shared resource with improper synchronization). An authorized local attacker with low privileges can exploit this to gain high confidentiality, ...