CVE-2025-58732

CVE-2025-58732 is described as a use-after-free in Inbox COM Objects that enables local code execution. The Connected Documents provide broader Windows security updates (KBs and advisories) but do not specify a vendor/product remediation or a patch explicit to this CVE in the provided materials. ...

CVE-2025-58739

CVE-2025-58739 affects Windows File Explorer and is described as the exposure of sensitive information to an unauthorized actor, enabling spoofing over a network. The CVSS 3.1 base score is 6.5 (Network, Low attack complexity, No privileges, User interaction required) with Confidentiality impact ...

CVE-2025-62219

CVE-2025-62219 is a local elevation-of-privilege in the Microsoft Wireless Provisioning System caused by a double-free error. The public descriptions in the connected documents confirm the vulnerability exists and that it enables an authorized attacker to elevate privileges on affected Windows pl...

CVE-2025-62474

CVE-2025-62474 is a Windows Remote Access Connection Manager Elevation of Privilege vulnerability. It involves improper access control in the Remote Access Connection Manager, enabling a locally authenticated attacker (low privileges, no user interaction) to obtain elevated rights. CVSS v3.1 base...

CVE-2026-21222

CVE-2026-21222 is a Windows Kernel information-disclosure vulnerability where insertion of sensitive data into a kernel log file could allow a locally authenticated attacker with LOW privileges to read sensitive data (CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The connected sources confirm t...

CVE-2026-25166

CVE-2026-25166 /Windows System Image Manager ADK: A.local, low-privilege, no-user-interaction remote code execution vulnerability with high impact (C/H/I/A) per CVSS 3.1; fix is an official update. Exploitation details are not provided in the document.

CVE-2026-26162

CVE-2026-26162 is a Windows OLE vulnerability described as a type-confusion in resource access that enables a locally authenticated attacker to elevate privileges. The Red Hat and NVD/NCSC entries confirm the same issue, with Microsoft’s MSRC entry associating it to Windows OLE and listing Window...

CVE-2026-49171

The CVE-2026-49171 entry describes a Use-After-Free vulnerability in Windows Speech Runtime that enables a locally authenticated attacker to elevate privileges. Affected: Microsoft Windows Speech Runtime components; root cause: use-after-free leading to arbitrary code or privilege escalation (det...

CVE-2026-49789

CVE-2026-49789 is a Windows NTFS elevation-of-privilege vulnerability. A stack-based buffer overflow in NTFS could allow an authorized local attacker to escalate privileges. Affected component: Windows NTFS subsystem. Root cause: stack-based overflow in an NTFS operation, leading to potential cod...

CVE-2026-50299

The CVE-2026-50299 entry describes an integer overflow/wraparound in Windows Storage Spaces Direct. Affected component: Storage Spaces Direct (Windows). Root cause: integer overflow allowing an unauthorized attacker to execute code. Impact: code execution with a physical attack vector; CVSS vecto...

CVE-2026-50337

CVE-2026-50337 is a Windows Notification vulnerability described as an issue with an incorrect type conversion or cast that allows an authorized attacker to achieve local privilege escalation. The CVE is listed with a CVSS v3.1 base score of 7.8 (HIGH), indicating a local attack vector with low c...

CVE-2026-50417

CVE-2026-50417 is a Windows NTFS heap-based buffer overflow that could allow an authenticated, local attacker to execute arbitrary code. The vulnerability affects Windows NTFS components and is described as a local, privilege-leveraging scenario with HIGH impact (CVE-3.1, base score 7.8). Connect...

CVE-2026-50421

CVE-2026-50421 is a Windows vulnerability in Windows Connected User Experiences and Telemetry described as a local privilege escalation via a resource access type confusion. The CVE entry is supported by multiple records: NVD/NCSC/CIRCL indicate the issue and Microsoft has released updates to add...

CVE-2026-50442

Public technical details about CVE-2026-50442 are not provided in the supplied documents. Monitor for updates from MSRC/NCSC and NVD; apply the available Windows File Explorer update when released.

CVE-2026-57096

CVE-2026-57096 affects Windows Routing and Remote Access Service (RRAS). The issue is a heap-based buffer overflow in RRAS that allows an authorized attacker to elevate privileges locally. The CVSSv3.1 base score is 7.8 (HIGH). Exploitation details are not provided beyond local privilege escalati...

CVE-2026-58632

CVE-2026-58632 is a Windows Win32K use-after-free vulnerability in the Win32 Kernel Subsystem that could allow a locally authenticated attacker to escalate privileges. The CVE is described as a local elevation of privilege (no remote code execution). Public sources in the connected set consistent...

CVE-2025-59209

CVE-2025-59209 is listed by NCSC as a vulnerability in Windows Push Notification Core that can lead to unauthorized disclosure of sensitive data locally. The advisory table assigns it a base impact of access to sensitive data (CVSS-like 5.5) with local attack vector. No specific patch/version rem...

CVE-2025-60705

Technical details about CVE-2025-60705 (affected product, root cause, impact, or Fix) are not provided in the connected documents. Monitor for updates from Microsoft/MSRC for validation, impact, and remediation.

CVE-2026-25175

CVE-2026-25175 is a Windows NTFS elevation of privilege vulnerability. The CVSS v3.1 base score is 7.8 (HIGH) with local attack vector, low attack complexity, and privileges required set to LOW. User interaction is NONE and the impact spans Confidentiality, Integrity, and Availability (HIGH/ HIGH...

CVE-2026-50435

CVE-2026-50435 (Windows Overlay Filter): A buffer over-read in the Windows Overlay Filter enables a locally authenticated attacker to elevate privileges. The exploitation context is local with low attack complexity and no user interaction, and the impact is elevation of privileges with high confi...

CVE-2026-50462

CVE-2026-50462 affects the Windows Ancillary Function Driver for WinSock. The disclosed issue is external control of a file name or path, enabling an authorized attacker to elevate privileges locally (local privilege escalation). CVSS v3.1 score is 7.8 (High) with Privileges: Low, User Interactio...

CVE-2026-50475

CVE-2026-50475 is a Windows Kernel information‑disclosure vulnerability caused by a buffer over‑read in the kernel. An authorized local attacker can disclose information from memory. Documented impact is local information disclosure; no remote code execution is indicated in the provided sources. ...

CVE-2026-50504

CVE-2026-50504 is a buffer over-read affecting the Windows Remote Desktop Client that can disclose information to an unauthenticated, network-attached attacker. The description and linked CVE entries consistently indicate the underlying issue is a buffer over-read in the Remote Desktop Client, en...

CVE-2026-54986

NVD reports CVE-2026-54986 as a heap-based buffer overflow in Windows Win32K that enables a locally authenticated attacker to perform privilege escalation. Affected component is Windows Win32K; root cause described as heap overflow within that subsystem. The available sources do not specify vulne...

CVE-2025-55328

Vulnerability summary (CVE-2025-55328) : A race condition in Windows Hyper-V involving a shared resource can be exploited by an authorized local attacker to elevate privileges. The issue is categorized under Windows Hyper-V with a high impact (local, privilege escalation) and a high base score in...

CVE-2025-59187

CVE-2025-59187 corresponds to a Windows Kernel local privilege escalation described in EUVD-2025-34304 as due to improper input validation. The vulnerability affects the Windows Kernel with the potential for an authorized attacker to elevate privileges locally. The connected KB updates discuss Wi...

CVE-2025-59517

CVE-2025-59517 is a Windows Storage VSP Driver elevation of privilege vulnerability caused by improper access control. Exploitation would enable a locally authenticated attacker to elevate privileges on affected Windows systems. Connected documents confirm this is tied to the Windows Storage VSP ...

CVE-2025-60704

Technical details about CVE-2025-60704 are not publicly provided in the supplied Connected Documents. The initial description notes a Kerberos cryptographic step missing that could enable network-based privilege elevation, but no vendor/version/impact specifics are disclosed here. Monitor for upd...

CVE-2025-62455

CVE-2025-62455 relates to an Elevation of Privilege in Windows Message Queuing (MSMQ). The initial description cites improper input validation in MSMQ that could allow an authorized local attacker to elevate privileges. Connected documents corroborate MSMQ as the affected component and reference ...

CVE-2026-20847

CVE-2026-20847 is described in connected sources as a Windows Shell vulnerability that allows spoofing of a user over a network. The NVD entry lists a MEDIUM severity (CVSS 3.1: 6.5) with network attack vector, low complexity, and requires low privileges; impact shown as high confidentiality loss...

CVE-2026-20939

CVE-2026-20939: Windows File Explorer information disclosure allowing a locally authenticated user to view sensitive data. The issue has a CVSSv3.1 base score of 5.5 (Local, Low attack complexity, Low privileges, Confidentiality impact: High). Microsoft has released fixes in January 2026 security...

CVE-2026-25168

CVE-2026-25168 is a Windows Graphics Component denial-of-service vulnerability. Exploitation requires local access with low complexity and no user interaction, and can cause an availability impact flagged as HIGH. The CVSSv3.1 score is 6.2 (MEDIUM overall) with an exploit that is unproven and rem...

CVE-2026-25174

CVE-2026-25174 is a Windows Privilege Elevation vulnerability described as an out-of-bounds read in the Windows Extensible File Allocation feature. The connected NCSC advisory confirms Microsoft has fixed vulnerabilities across Windows components, listing CVE-2026-25174 under Windows Extensible F...

CVE-2026-49787

The CVE-2026-49787 entry describes a Denial of Service vulnerability in Windows HTTP.sys caused by allocation of resources without limits or throttling, leading to an unauthorized network-based disruption. Affected component is HTTP.sys on Windows; impact is availability (denial of service) with ...

CVE-2026-50347

CVE-2026-50347 is a Windows Data.dll vulnerability characterized by a heap-based buffer overflow that allows an unauthorized, local attacker to execute code. The affected component is Windows Data.dll; the underlying issue is a heap overflow leading to remote-code-execution-style impact via local...

CVE-2026-50376

CVE-2026-50376 is a Windows Remote Desktop Client information disclosure vulnerability caused by use of an uninitialized resource in the Windows RDP client. It enables a network-based attacker to disclose information. The CVE is referenced in multiple feeds (NVD, NCSC, CIRCL) and is addressed by ...

CVE-2026-50377

CVE-2026-50377 is a Windows Kernel elevation-of-privilege vulnerability described as an out-of-bounds read that enables an authorized local attacker to gain higher privileges. The connected materials consistently identify the Windows Kernel as the affected component and state the root cause as a ...

CVE-2026-56189

CVE-2026-56189 is a local, heap-based buffer overflow in Microsoft Windows Media Foundation. The affected component is Windows Media Foundation within Windows, and the vulnerability allows an unauthenticated local attacker to execute arbitrary code. The root cause is a heap-based overflow in the ...

CVE-2026-56649

CVE-2026-56649 is a race-condition in Windows Network File System that could let a remote attacker execute code over the network by abusing a shared resource. Public sources (NVD, EUVD, CIRCL) confirm the race condition as the root cause. Microsoft has released updates addressing this vulnerabili...

CVE-2025-55700

CVE-2025-55700 describes an out-of-bounds read in Windows Routing and Remote Access Service (RRAS) that enables an unauthenticated attacker to disclose information over the network. The Connected documents include a matching description (EUVD-2025-34409) but do not provide concrete technical deta...

CVE-2025-58729

CVE-2025-58729 affects Windows Local Session Manager (LSM). The connected documents confirm an issue with improper validation of input type in LSM, allowing an authorized attacker to cause a Denial of Service over the network . The CVSS vectors indicate network access, low attack complexity, and ...

CVE-2026-20827

CVE-2026-20827 affects the Tablet Windows User Interface (TWINUI) Subsystem, enabling local disclosure of sensitive information to an attacker with low privileges and no user interaction. The vulnerability is mapped to a local-attack vector with high confidentiality impact (C:H, I:N, A:N) and a C...

CVE-2026-21246

CVE-2026-21246 is a heap-based buffer overflow in the Microsoft Graphics Component that enables local privilege escalation for an authorized attacker. The CVSS 3.1 vector (LOCAL, LOW complexity, LOW privileges, NONE user interaction) yields a base score of 7.8 (HIGH impact on confidentiality, int...

CVE-2026-24289

Technical details about CVE-2026-24289 are not provided in the documents; no affected products, vulnerable components, impact, or remediation details are listed here. Monitor for updates.

CVE-2026-32075

CVE-2026-32075 affects Windows that uses the UPnP Device Host; vulnerability is Elevation of Privilege via a local vector. Requires LOW privileges and no user interaction, with high impact on confidentiality, integrity, and availability. Exploit code maturity is UNPROVEN; remediation is an offici...

CVE-2026-54109

CVE-2026-54109 : Integer overflow or wraparound in Windows Resilient File System (ReFS) allows an authorized local attacker to execute code. The NVD entry confirms a local-execution impact with high severity (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Details in connected sources show the vulnerabilit...

CVE-2026-57097

CVE-2026-57097 describes an Untrusted search path in Microsoft XML that allows a physical attacker to bypass a security feature. Affects Microsoft XML; impact is described as high for confidentiality, integrity, and availability with a physical attack requiring no user interaction. No exploit det...

CVE-2025-55687

CVE-2025-55687 is a local privilege-escalation vulnerability in Windows Resilient File System (ReFS) caused by a race condition when concurrent access to a shared resource occurs with improper synchronization. The impact is local elevation of privileges. Public docs (NCSC advisory and EUVD summar...

CVE-2025-58725

CVE-2025-58725 is described in connected documents as a heap-based buffer overflow in Windows COM that allows a locally authenticated attacker to elevate privileges. The CVE is associated with Windows COM components, with a CVSS v3.1 score of 7.0 (Local, High impact, Privilege escalation) and Exp...

CVE-2025-59205

CVE-2025-59205 is described as a race-condition vulnerability in the Microsoft Graphics Component caused by concurrent access to a shared resource, enabling an authorized local attacker to elevate privileges. The connected EUVD-2025-34293 entry reiterates the root cause and local privilege escala...