2187 matches found
CVE-2026-50489
CVE-2026-50489 is a heap-based buffer overflow in Windows Win32K that allows an authorized, locally authenticated attacker to escalate privileges. The root cause is a memory corruption in the Win32K subsystem that leads to code execution with SYSTEM rights. The CVE entry is supported by multiple ...
CVE-2026-50496
CVE-2026-50496 is an out-of-bounds read vulnerability in Windows Network Policy Server SNMP that allows an unauthenticated attacker to disclose information over the network. Affects the SNMP component of Windows NPS; impact is information disclosure with a CVSS v3.1 base score of 7.5 (Network att...
CVE-2026-62740
CVE-2026-62740 describes a vulnerability in the Windows Imaging Component where an uninitialized resource can lead to local information disclosure by an authorized attacker. The issue is reported with a CVSS v3.1 base score of 5.5 (Medium), vector: Local, low attack complexity, and low privileges...
CVE-2025-49687
Technical details about CVE-2025-49687 (affected products, root cause, impact, fixes) are not provided in the supplied documents. Monitor for updates and advisories.
CVE-2025-49726
CVE-2025-49726 is a Windows vulnerability described as a use-after-free in Windows Notification that allows an authenticated local attacker to escalate privileges. The initial document provides a high-level impact (local, high confidentiality/integrity/availability impact) and does not reveal exp...
CVE-2025-53145
CVE-2025-53145 is tracked as a Windows Message Queuing (MSMQ) remote code execution vulnerability. The connected data list it under Windows MSMQ with impact: Execute code (high severity, CVSS ~8.8/10) and references indicate MSMQ-related fixes were shipped in August 2025 security updates (KBs and...
CVE-2025-54111
CVE-2025-54111 is documented in the connected materials with concrete details: it involves a use-after-free in Windows UI XAML Phone DatePickerFlyout that can allow an attacker to elevate privileges locally. The NCSC-2025-0277 listing assigns a high severity (CVSS ~7.8–7.8 range) to CVE-2025-5411...
CVE-2026-20831
The CVE-2026-20831 entry corresponds to a TOCTOU race condition in Windows Ancillary Function Driver for WinSock that could allow a local, authenticated attacker to elevate privileges. The description in the initial document confirms local privilege escalation as the impact. Connected documents i...
CVE-2026-21255
CVE-2026-21255 is a Windows Hyper-V security feature bypass vulnerability described as improper access control that enables an authorized local attacker to bypass a security feature. Publicly available sources identify Hyper-V as the affected component, with the root cause tied to access-control ...
CVE-2026-26176
Technical details about CVE-2026-26176 are not provided in the supplied documents. Monitor for updates from Microsoft Security Update Guide and CVE records for affected specifics, impact, and remediation.
CVE-2026-26178
CVE-2026-26178 is a Windows Advanced Rasterization Platform Elevation of Privilege vulnerability with CVSS v3.1 base score 8.8 (HIGH). The issue is exploitable via NETWORK with LOW attack complexity and NONE privileges required, but it requires user interaction. Impact is rated HIGH for confident...
CVE-2026-27922
CVE-2026-27922 is a vulnerability described as a use-after-free in the Windows Ancillary Function Driver for WinSock that can allow an authorized local attacker to elevate privileges. The Red Hat/NVD entries confirm the same description. The connected documents do not enumerate affected product v...
CVE-2026-40406
Technical details about CVE-2026-40406 are not publicly available in the provided documents; monitor for updates as additional specifics (affected products, root cause, fixes) may be released.
CVE-2026-40413
Technical details about CVE-2026-40413, including affected products, vulnerable components, root cause, impact, and fixes, are not publicly provided in the connected documents. Monitor official advisories for updates.
CVE-2026-49184
The CVE-2026-49184 entry describes a heap-based buffer overflow in Windows NTFS that allows a local attacker to execute code. Affected component: Windows NTFS subsystem; root cause is a heap-based overflow. Impact: local code execution with high severity (CVSSv3.1 base score 8.4). No specific pat...
CVE-2026-50321
CVE-2026-50321 is a Windows USB Driver elevation-of-privilege vulnerability (race condition on a shared resource). An authorized, local attacker could exploit this to gain higher privileges on the affected system, per the NVD entry and cross-referenced sources. Connected advisories corroborate th...
CVE-2026-50352
CVE-2026-50352 affects Windows Cryptographic Services. Description: Exposure of sensitive information to an unauthorized actor allows a locally authenticated attacker to disclose information. Impact: information disclosure (CONFIDENTIALITY) with LOCAL attack vector; CVSS 3.1 base 5.5 (AV:L/AC:L/P...
CVE-2026-50429
CVE-2026-50429 describes an out-of-bounds read in the Windows Kernel that may allow a remote attacker to disclose information over a network. The entry is tied to Microsoft’s Windows kernel information-disclosure vulnerability with a base CVSSv3.1 score of 8.2 (Network, Low attack complexity, No ...
CVE-2026-50683
CVE-2026-50683 is a Windows DHCP Client/Server heap-based buffer overflow that enables an authenticated attacker on an adjacent network to elevate privileges. Public details in the initial entry cite a heap-based overflow and adjacent-access attack path with high impact (C:H, I:H, A:H) and a CVSS...
CVE-2026-56647
CVE-2026-56647 is a Windows vulnerability in the Windows Remote Access Service Infrastructure where an integer overflow/wraparound can let an authorized attacker elevate privileges over a network. The affected component is the Windows Remote Access Service Infrastructure, and the root cause is an...
CVE-2026-58545
CVE-2026-58545 is a Windows Kernel Security Feature Bypass vulnerability. The connected documents confirm an improper access control in the Windows Kernel that could let an authorized locally attacker bypass a security feature. Metrics indicate CVSS v3.1 base score 5.5 (Medium), with Local attac...
CVE-2026-58546
CVE-2026-58546 is a Windows Remote Desktop Client Information Disclosure vulnerability. The initial and connected records confirm that the issue stems from use of an uninitialized resource in Windows RDP, enabling an unauthorized attacker to disclose information over a network. Affected component...
CVE-2026-62711
The CVE-2026-62711 issue is a local privilege escalation caused by a use-after-free in Windows Win32K. Affected component: Win32K memory management; root cause: use-after-free vulnerability. Impact, if exploited: an authorized local attacker can elevate privileges. CVSS v3.1 score is 7.8 ( HIGH )...
CVE-2026-62738
The vulnerability CVE-2026-62738 affects Windows Management Instrumentation and enables an authorized, local attacker to disclose information through an out-of-bounds read. The available descriptions consistently state information disclosure as the impact; no details on specific vulnerable binari...
CVE-2025-50158
CVE-2025-50158 is a TOCTOU race condition in Windows NTFS that could allow a local attacker to disclose information. The description confirms the vulnerability is a local information-disclosure flaw affecting NTFS. Connected sources list CVE-2025-50158 under Windows NTFS with an impact of Access ...
CVE-2025-50177
CVE-2025-50177 affects Windows Message Queuing (MSMQ) with a use-after-free in the MSMQ path that enables remote code execution over a network. Affected: Windows MSMQ component. Impact per CVSS: high (8.1) with network access, no user interaction required. Exploitation as of the connected documen...
CVE-2025-53155
CVE-2025-53155 is a Windows Hyper-V heap-based buffer overflow that enables an authenticated, local attacker to elevate privileges. The initial entry states an local privilege escalation via Hyper-V; connected materials corroborate Windows Hyper-V involvement under the Windows security ecosystem ...
CVE-2025-59196
CVE-2025-59196: Windows SSDP Service race condition leading to local privilege escalation. Affected component: Windows SSDP Service. Root cause: concurrency with improper synchronization on a shared resource. Impact: attacker with local access could elevate privileges (CVSSv3.1: AV Local, AC High...
CVE-2026-20852
CVE-2026-20852 is a Windows Hello privilege-assignment vulnerability that enables a locally authenticated attacker to tamper with local data due to incorrect privilege handling in the Windows Hello component. The issue is labeled as a local, high-severity problem with no user interaction required...
CVE-2026-26152
CVE-2026-26152 pertains to Microsoft Cryptographic Services with a local elevation-of-privilege vulnerability. The CVSS 3.1 vector indicates local access, high impact on confidentiality, integrity, and availability, with user interaction not required. PrivilegesRequired is LOW, AttackComplexity i...
CVE-2026-27910
CVE-2026-27910 concerns Windows Installer privilege elevation. The vulnerability is described as an improper handling of insufficient permissions in Windows Installer that allows an authorized attacker to elevate privileges locally. The CVSS v3.1 base score is 7.8 (HIGH), with Local attack vector...
CVE-2026-33100
CVE-2026-33100: Use-after-free in Windows Ancillary Function Driver for WinSock allows a locally authorized privilege escalation. The connected advisory set confirms the driver as affected and lists CVE-2026-33100 with a base CVSS v3.1 score of 7.0 (High) and local attack vector. Mitigation is vi...
CVE-2026-49801
The CVE-2026-49801 entry concerns Windows SMB: an uninitialized resource within SMB handling can lead to local information disclosure by an authorized user. The attack is described as local with low privileges required and no user interaction, and the impact targets confidentiality (information d...
CVE-2026-50388
CVE-2026-50388 is an Windows NTFS local vulnerability described as an out-of-bounds read that allows an unauthenticated/unauthorized attacker to execute code locally. The CVE is tracked across multiple sources (NVD, MSRC, CIRCL) with a base CVSS v3.1 score of 7.8 (High) and LOCAL attack vector, r...
CVE-2026-54987
CVE-2026-54987 is a Windows vulnerability described as a heap-based buffer overflow in the Windows Overlay Filter, enabling a locally authenticated attacker to elevate privileges. The CVSSv3.1 score is 7.8 (HIGH) with local attack vector, low attack complexity, and requires low privileges with no...
CVE-2026-54997
Public technical details are not provided in the supplied documents for CVE-2026-54997. No specifics on affected products, versions, root cause, or remediation are available here. Monitor for updates from official sources.
CVE-2026-58601
CVE-2026-58601 describes a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized, local attacker to elevate privileges. The available description specifies a local-privelege-escalation impact, but does not provide product/version specifics, exploitati...
CVE-2026-61366
Affected component: Windows Network Connection Broker. Vulnerability: double free allows local privilege escalation by an authorized user. Root cause: double-free in the broker when handling network connection objects. Impact: high; local attacker with low privileges and no user interaction can e...
CVE-2026-62718
The CVE-2026-62718 entry concerns an integer underflow (wrap/wraparound) in Windows DHCP Server that enables an unauthorized attacker on an adjacent network to disclose information. This vulnerability affects Windows DHCP Server and is driven by an underflow in handling certain inputs, leading to...
CVE-2025-54099
CVE-2025-54099 affects the Windows Ancillary Function Driver for WinSock. The issue is a stack-based buffer overflow that can be exploited by an authorized, locally-located attacker to obtain elevated privileges. The connected NCSC advisory corroborates the CVE’s association with privilege escala...
CVE-2025-59201
CVE-2025-59201 concerns Windows Network Connection Status Indicator (NCSI). The issue is described as improper access control that could allow a locally authenticated attacker to escalate privileges on affected Windows systems. Connected Microsoft security advisories (KB5066793, KB5066835–KB50668...
CVE-2026-20814
CVE-2026-20814 is a local privilege-escalation in the Microsoft Graphics Kernel caused by a race condition when accessing a shared resource. An authorized local attacker could elevate privileges on affected Windows systems. The issue is documented in multiple sources (e.g., CVE lists and ENISA EU...
CVE-2026-21253
CVE-2026-21253 is a Windows vulnerability in the Mailslot File System described as a use-after-free issue that can enable local privilege escalation. The CVE’s CVSS 3.1 score is 7.0 (HIGH) with a local attack vector, high attack complexity, and requires low privileges and no user interaction. The...
CVE-2026-27917
CVE-2026-27917 is a use-after-free vulnerability in the Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) that can elevate privileges locally. Connected documents confirm the issue and its root cause (memory corruption via use-after-free) and indicate that Microsoft released fixes (e.g., K...
CVE-2026-27919
CVE-2026-27919 is a Windows UPnP Device Host elevation-of-privilege vulnerability. It is a local attack with low privileges required and no user interaction, carrying a CVSS v3.1 base score of 7.8 (High). The impact spans confidentiality, integrity, and availability (all High). The exploitation m...
CVE-2026-32170
Technical details for CVE-2026-32170 are not publicly available in the provided documents beyond the basic description. No vendor, product, version, root cause, impact, or fix specifics are supplied here. Monitor official disclosures and CVE/Microsoft update guidance for updates.
CVE-2026-50294
CVE-2026-50294 : Windows Kernel exposes sensitive system information to an unauthorized control sphere, enabling a local attacker to disclose information. Documents confirm a local attack vector with high confidentiality impact; no exploitation details or remediation are provided in the connected...
CVE-2026-50354
CVE-2026-50354 involves a use-after-free in the Windows Kernel that enables an authorized local attacker to elevate privileges. The affected source is the Windows Kernel; the vulnerability stems from memory management misuse leading to arbitrary code execution with SYSTEM-level privileges. Exploi...
CVE-2026-50359
CVE-2026-50359 is a Microsoft XML Core Services elevation-of-privilege vulnerability described as a use-after-free issue. The NVD/NCSC/CIRCL entries confirm local privilege escalation for an authorized user. No exploit vectors are provided in the documents. Microsoft has released updates addressi...
CVE-2026-50371
CVE-2026-50371 affects Windows LUAFV (Windows LUAFV driver). The issue is a race condition due to concurrent access to a shared resource without proper synchronization, enabling an authorized local attacker to elevate privileges. Microsoft has released updates addressing this family of vulnerabil...