CVE-2025-21257

CVE-2025-21257 corresponds to Windows WLAN AutoConfig Service Information Disclosure Vulnerability. The connected documents identify the affected component as the Windows WLAN AutoConfig Service and describe the issue as an information disclosure vulnerability, with local attack requirements (Loc...

CVE-2025-30385

Technical details about CVE-2025-30385 are not provided in the connected documents. The initial description mentions a Windows use-after-free in the CLFS driver that could elevate privileges, but no vendor/version specifics or fixes are disclosed here. Monitor for authoritative updates.

CVE-2026-20940

CVE-2026-20940 is a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver that enables a locally authenticated attacker to elevate privileges. Connected advisories confirm the affected component (Cloud Files Mini Filter Driver) and the privilege-escalation impact; Microsoft has...

CVE-2026-21265

CVE-2026-21265 describes a Secure Boot bypass tied to expiration of Microsoft root certificates in the UEFI KEK/DB chain. Affected certificates include KEK CA 2011 (expires 2026-06-24), UEFI CA 2011 (expires 2026-06-27), and Windows Production PCA 2011 (expires 2026-10-19). The vulnerability aris...

CVE-2026-26174

CVE-2026-26174 is a race-condition vulnerability in Windows Server Update Services (WSUS) that enables a locally authenticated attacker to achieve elevation of privileges. The issue is described as concurrent execution using a shared resource with improper synchronization. Multiple connected docu...

CVE-2026-26180

CVE-2026-26180 is a Windows kernel local elevation of privilege issue. The vulnerability affects the Windows kernel with a local attacker able to gain HIGH impact on confidentiality, integrity, and availability. Exploitation is LOCAL with LOW complexity and LOW privileges required, and no user in...

CVE-2026-42825

CVE-2026-42825 describes a use-after-free in Windows Telephony Service that allows an authorized attacker to elevate privileges locally. The description clearly states local privilege escalation as the impact, but the connected documents do not provide specifics on affected product versions, root...

CVE-2026-49794

CVE-2026-49794 concerns the Windows USB Audio Class driver (usbaudio.sys). The vulnerability is an out-of-bounds read in the driver that enables an unauthorized attacker to disclose information when a physical access scenario is present. Attacker class: physical access with low attack complexity ...

CVE-2026-50304

CVE-2026-50304 is a confirmed vulnerability affecting Microsoft Windows Active Directory Federation Services (AD FS). The issue is a stack-based buffer overflow in AD FS that could allow an unauthenticated network attacker to cause a denial of service. Connected sources corroborate the nature of ...

CVE-2026-50405

CVE-2026-50405 affects the Windows Filtering Platform (WFP). The issue is described as insufficient granularity of access control, enabling an authorized local attacker to elevate privileges. Connected sources (NVD, EUVD, CIRCL) corroborate the local privilege escalation impact and link to Micros...

CVE-2026-70344

CVE-2026-70344 originates from a stack-based buffer overflow in Windows Installer. The vulnerability could allow an authorized attacker to perform local privilege escalation on affected systems. The CVSS 3.1 vector (L/L/P:L/U:N/S:U/C:H/I:H/A:H) indicates local attack vector, low attack complexity...

CVE-2026-26155

CVE-2026-26155 is a Microsoft Local Security Authority Subsystem Service information disclosure vulnerability. The entry lists a CVSS v3.1 base score 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a Network attack vector, low complexity , and low privileges requ...

CVE-2026-50480

Windows Web Proxy Auto-Discovery Protocol (WPAD) has a heap-based buffer overflow vulnerability (CVE-2026-50480) that can be exploited by an authenticated local attacker to achieve privilege escalation. The issue affects WPAD in Windows, with the root cause described as a heap-based overflow in W...

CVE-2026-50498

CVE-2026-50498 affects the Windows Universal Disk Format File System Driver (UDFS) and is an Elevation of Privilege vulnerability in the UDFS component. The root cause is described as a privilege/escalation condition within the Windows UDFS driver, leading to local privilege escalation with a hig...

CVE-2026-54115

CVE-2026-54115 is a Windows Message Queuing (MSMQ) elevation of privilege vulnerability with an integer overflow/wraparound issue described as affecting Windows Active Directory. The CVE entry indicates an authorized, local attacker can elevate privileges. Public references show multiple advisori...

CVE-2026-62692

CVE-2026-62692 : Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 vector is LOCAL, LOW exploitability with NONE user interaction and impact on Confidentiality, Integrity, Availability (HIGH) ; base sco...

CVE-2024-38233

CVE-2024-38233 is a Windows Networking Denial of Service vulnerability. The provided sources confirm it as a network-accessible issue with CVSS v3.1 base score 7.5 (HIGH) and no user interaction required. Several advisories/NVD entries link this CVE to Microsoft security updates KB5043051 (Septem...

CVE-2025-49760

Technical details about CVE-2025-49760 are not publicly provided in the supplied documents. No affected products, CVSS specifics, or remediation are confirmed here. Monitor for updates from official advisories (e.g., MSRC) for concrete information.

CVE-2026-26159

CVE-2026-26159 concerns the Windows Remote Desktop Licensing Service. The issue allows local attackers with low privileges and no user interaction to exploit elevation of privilege, impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.8 (HIGH) with LOCAL attack ve...

CVE-2026-41092

CVE-2026-41092 describes an improper access control in Microsoft Kinect that enables a locally authenticated attacker to elevate privileges. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.8 (HIGH). Affected component: Kinect functionality; root cause is insuffic...

CVE-2026-42972

CVE-2026-42972 describes a Windows Hyper-V information disclosure vulnerability. The issue allows a locally authenticated attacker (low privileges) to disclose sensitive information due to exposure of information to an unauthorized actor. CVSS 3.1/Local, Low complexity, Privileges Low, Confidenti...

CVE-2026-44799

This CVE (CVE-2026-44799) describes a heap-based buffer overflow in the Remote Desktop Client that allows an unauthorized attacker to execute code remotely over a network . The connected records corroborate a network-based, remote code execution vulnerability affecting the Remote Desktop Client, ...

CVE-2026-45607

CVE-2026-45607 affects Windows Hyper-V with an out-of-bounds read vulnerability that allows an attacker to execute code locally. Documents indicate LOCAL attack vector, no user interaction required, and high impact on confidentiality, integrity, and availability. No specific remediation steps or ...

CVE-2026-45635

CVE-2026-45635 affects Windows UPnP Device Host through a use-after-free in upnp.dll, enabling remote code execution over the network. The issue is tied to the Universal Plug and Play component, with impact described as remote, unauthenticated code execution; CVSSv3.1 base score 8.1 (HIGH). Affec...

CVE-2026-48564

CVE-2026-48564 refers to a heap-based buffer overflow in Windows DHCP Server that enables a network-based remote code execution by an authorized attacker. According to the available records, the vulnerability is high severity (CVSS v3.1: 8.8), with network as the attack vector, low attack complex...

CVE-2026-50351

The CVE-2026-50351 issue concerns Windows Audio Compression Manager (ACM). It describes improper access control that could let an authenticated, local attacker elevate privileges on affected Windows systems. Documented impact is local privilege escalation with high severity (CVSS v3.1 base score ...

CVE-2026-50461

CVE-2026-50461 is a Windows NTFS heap-based buffer overflow vulnerability that allows a local attacker to execute code. The issue is linked to the NTFS subsystem, enabling arbitrary code execution with high impact (Local, Requires User Interaction, Privilege: None). Public records in NVD/EUVD/NCS...

CVE-2026-50690

CVE-2026-50690 is a Windows SMB information-disclosure vulnerability described as caused by the use of an uninitialized resource within Windows SMB that can allow an authorized local attacker to disclose information. The CVE is linked to Microsoft advisories and MSRC updates addressing the issue,...

CVE-2026-61939

CVE-2026-61939 is a Winlogon-use-after-free vulnerability that allows an authorized, low-privilege attacker to elevate privileges locally. Public description confirms local access as attack vector (LOCAL) with high impact on confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:...

CVE-2026-62768

CVE-2026-62768 describes a stack-based buffer overflow in Windows Installer that can allow an authorized, locally authenticated user to elevate privileges. Affected component is Windows Installer; root cause is a buffer overflow in processing certain installer data, leading to high impact on conf...

CVE-2026-72986

CVE-2026-72986 is a heap-based buffer overflow in Graphic Fonts that allows an unauthorized attacker to achieve remote code execution over a network. The CNA (Microsoft) assigns a CVSS 3.1 score of 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-reachable exp...

CVE-2025-29839

Technical details about CVE-2025-29839 (affected product/version/root cause/impact/fix) are not publicly provided in the supplied connected documents. Monitor for updates.

CVE-2025-33060

CVE-2025-33060 affects the Windows Storage Management Provider and is described as an out-of-bounds read that can allow an authorized, locally authenticated attacker to disclose information. The NCSC advisory confirms it under Windows Storage Management Provider with CVSS 5.5 (LOCAL, Privileges L...

CVE-2025-48000

CVE-2025-48000 is described as a use-after-free vulnerability in the Windows Connected Devices Platform Service that allows an authorized local attacker to achieve privilege escalation. The provided documents specify the vulnerable component and the impact (local privilege escalation) but do not ...

CVE-2026-40407

CVE-2026-40407 describes a heap-based buffer overflow in the Windows Common Log File System (CLFS) Driver that permits an authorized, local attacker to elevate privileges. The vulnerability impact is local privilege escalation with a CVSS v3.1 base score of 7.8 (HIGH) and impact to confidentialit...

CVE-2026-42908

The CVE-2026-42908 entry describes an Out-of-bounds read in Windows Remote Desktop Protocol (RDP) that enables an unauthenticated attacker to disclose information over the network. Affected component is Windows RDP; the underlying fault is an out-of-bounds read, leading to information disclosure....

CVE-2026-48583

CVE-2026-48583 is a Windows kernel use-after-free vulnerability that enables a local privilege escalation by an authorized attacker. Sources confirm the issue and report CVSS v3.1 base score 7.8 (High) with LOCAL attack vector, LOW privileges required, no user interaction. The documents do not sp...

CVE-2026-50471

CVE-2026-50471 is a heap-based buffer overflow in Windows NTFS that could allow a local attacker to execute arbitrary code. The vulnerability affects Windows NTFS components as described in multiple sources (NVD/NCSC/CIRCL) and is being addressed by Microsoft with published updates (e.g., KB arti...

CVE-2026-62717

Summary: CVE-2026-62717 is a heap-based buffer overflow in Windows Message Queuing that could allow an authorized local attacker to elevate privileges. This is supported by multiple sources (NVD entry and CVE records). Affected component: Windows Message Queuing. Vulnerability type & root cause: ...

CVE-2026-62745

Summary: CVE-2026-62745 is an information-disclosure vulnerability in Windows DHCP Server caused by an integer underflow (wrap/wraparound). The issue enables an unauthenticated attacker on an adjacent network to potentially disclose information. CVSS 3.1 base score is 6.5 (Medium) with attack vec...

CVE-2026-62776

CVE-2026-62776 describes an elevation-of-privilege flaw in Windows DHCP Server caused by improper link resolution before file access ("link following"). An authorized, local attacker could leverage this to gain higher privileges on the affected system. The vulnerability is associated with a high-...

CVE-2026-65797

CVE-2026-65797 involves a numeric truncation error in Windows DNS that can allow an authorized attacker to elevate privileges locally. The available documents confirm the affected component as Windows DNS and the root cause as a numeric truncation flaw. The impact is local privilege escalation wi...

CVE-2026-69824

CVE-2026-69824 is an integer underflow (wrap or wraparound) vulnerability in Microsoft Standard XPS that allows an unauthorized attacker to achieve remote code execution over a network with no privileges required and no user interaction. The CVSS v3.1 score is 9.8 (Critical) with a vector of AV:N...

CVE-2025-29836

Technical details for CVE-2025-29836 (e.g., affected product, root cause, impact, or remediation) are not provided in the supplied connected documents. Please monitor for updates from official advisories.

CVE-2025-29967

Technical details about CVE-2025-29967 are not provided in the connected documents. Public details in the initial description exist, but no accompanying technical specifics (affected versions, root cause, exploit info, or remediation) are available here. Monitor for updates.

CVE-2025-54110

CVE-2025-54110 concerns a Windows Kernel integer overflow in NtQueryDirectoryObject that could enable local privilege escalation. Connected PoCs describe a kernel-EoP flow via crafted inputs, thresholds (e.g., 0xFFFFFDBC) and direct memory handling, but reports assert exploitation yields only STA...

CVE-2025-59192

CVE-2025-59192 is a local privilege-escalation issue described as a buffer over-read in Storport.sys. The vulnerability affects the Storport.sys driver and is assigned a CVSS v3.1 score of 7.8 (Local, Privileges Required: Low, User Interaction: None) with Impact on confidentiality, integrity, and...

CVE-2026-50389

CVE-2026-50389 affects Windows File Explorer and is a local information-disclosure vulnerability where an authorized attacker can disclose sensitive information. The issue is confirmed in Windows File Explorer (Explorer.exe) and is addressed by Microsoft security updates; multiple MSRC/MSKB entri...

CVE-2026-50470

CVE-2026-50470 describes an out-of-bounds read in Windows Network Policy Server SNMP that could let an unauthenticated attacker disclose information over the network. The vulnerability affects the NPS SNMP handling and has a CVSS v3.1 base score of 7.5 (High) with network attack vector, low attac...

CVE-2026-50509

CVE-2026-50509 is a Windows WWAN Service deserialization vulnerability that could enable local privilege escalation when an authorized user triggers the flaw. Affected component: Windows Wireless Wide Area Network Service (WwanSvc). Root cause: deserialization of untrusted data leading to elevati...