CVE-2026-32089

Summary: CVE-2026-32089 is a local elevation-of-privilege vulnerability in Windows Speech Brokered API (Speech Brokered Api) described as a use-after-free issue. The vulnerability can be exploited by an authorized attacker to gain higher privileges on a vulnerable Windows host. Connected advisori...

CVE-2026-49784

Summary: CVE-2026-49784 describes a race condition in the Microsoft Windows App Store caused by concurrent access to a shared resource with improper synchronization. The vulnerability allows an authorized local attacker to elevate privileges. The reported CVSS v3.1 vector is AV:L/AC:H/PR:L/UI:N/S...

CVE-2026-49797

CVE-2026-49797 : Heap-based buffer overflow in Windows NTFS enables local code execution by an unauthenticated attacker. Affected component: NTFS. CVSSv3.1: 7.8 (HIGH). Exploitation status is not provided in the available documents; no remediation details are included.

CVE-2026-57097

CVE-2026-57097 describes an Untrusted search path in Microsoft XML that allows a physical attacker to bypass a security feature. Affects Microsoft XML; impact is described as high for confidentiality, integrity, and availability with a physical attack requiring no user interaction. No exploit det...

CVE-2026-58539

CVE-2026-58539 is a Windows Remote Desktop Client/RDP vulnerability described as an out-of-bounds read that could allow an unauthenticated attacker to disclose information over a network. The connected documents corroborate this as a Windows RDP/Remote Desktop Client issue with public advisories ...

CVE-2026-68884

A heap-based buffer overflow in the Windows Kernel allows an authorized (low-privilege) local attacker to elevate privileges , per Microsoft's advisory (CVE-2026-68884). The vulnerability carries a CVSS v3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploit...

CVE-2026-69334

CVE-2026-69334 is a heap-based buffer overflow in the Windows Volume Manager Extension Driver that allows an unauthorized attacker to execute code over a network. The CVSS 3.1 base score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network-reachable remote code e...

CVE-2026-69338

CVE-2026-69338 is a use-after-free vulnerability in the Remote Desktop Gateway Service that allows an authorized (low-privilege) attacker to elevate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) , with high complexity, required user interaction, and high impact on confidentiality, i...

CVE-2026-69390

CVE-2026-69390 is an out-of-bounds read vulnerability in Windows Spaceport.sys that allows an authorized attacker to locally disclose information . The Microsoft CNA rates it CVSS 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges required, and a high impact on confidentialit...

CVE-2026-69395

Active Directory Certificate Services (AD CS) contains a vulnerability caused by the use of an externally-controlled format string , allowing an authorized attacker (low privileges required) to disclose information over a network . The CVSS v3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR...

CVE-2026-69654

CVE-2026-69654 is a use-after-free vulnerability in Windows Accounts Control that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack requiring high complexity and low pri...

CVE-2026-69738

CVE-2026-69738 is an integer overflow or wraparound in the Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability scores CVSS 7.8 (HIGH) with a local attack vector, low complexity, low privileges required, and high impact to confidentiality, i...

CVE-2026-70290

CVE-2026-70290 is an information disclosure vulnerability in the Windows Win32 Kernel Subsystem (Win32k) caused by the use of an uninitialized resource . An authorized local attacker with low privileges can leverage this to read sensitive kernel information, with no user interaction required. The...

CVE-2026-72927

A heap-based buffer overflow exists in Winsock , which allows an authorized attacker to perform a local privilege escalation . While the specific software versions are not explicitly detailed in the provided documents, the vulnerability is addressed in Microsoft's September 8, 2026 security updat...

CVE-2026-72954

CVE-2026-72954 is a use-after-free vulnerability in Windows Deployment Services (Microsoft) that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The CVSS 3.1 score is 7.5 (HIGH) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high attack...

CVE-2026-78508

CVE-2026-78508 is an out-of-bounds read in the Windows CD-ROM Driver that allows an unauthorized attacker with physical access to disclose information. The CVSS 3.1 score is 4.6 (MEDIUM) , reflecting the physical attack vector, low complexity, no privileges required, and a high confidentiality im...

CVE-2026-83983

CVE-2026-83983 is a heap-based buffer overflow in the Windows Biometric Service component, allowing an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low privileges and no user in...

CVE-2025-59209

CVE-2025-59209 is listed by NCSC as a vulnerability in Windows Push Notification Core that can lead to unauthorized disclosure of sensitive data locally. The advisory table assigns it a base impact of access to sensitive data (CVSS-like 5.5) with local attack vector. No specific patch/version rem...

CVE-2025-59512

Technical details about CVE-2025-59512, including affected product, root cause, exploitability or remediation, are not publicly provided in the supplied Connected Documents. Monitor for official updates (mitigations/patches) as newer MSKBs may cover this CVE.

CVE-2026-21222

CVE-2026-21222 is a Windows Kernel information-disclosure vulnerability where insertion of sensitive data into a kernel log file could allow a locally authenticated attacker with LOW privileges to read sensitive data (CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The connected sources confirm t...

CVE-2026-21508

CVE-2026-21508 concerns improper authentication in Windows Storage, enabling a locally authenticated attacker to elevate privileges. The CVSS v3.1 base score is 7.0 (HIGH), with LOCAL attack vector, HIGH impact on confidentiality, integrity, and availability, and a HIGH attack complexity requirin...

CVE-2026-25168

CVE-2026-25168 is a Windows Graphics Component denial-of-service vulnerability. Exploitation requires local access with low complexity and no user interaction, and can cause an availability impact flagged as HIGH. The CVSSv3.1 score is 6.2 (MEDIUM overall) with an exploit that is unproven and rem...

CVE-2026-27914

CVE-2026-27914 affects the Microsoft Management Console (MMC). It is an Elevation of Privilege vulnerability where a local attacker with low privileges and no user interaction can potentially gain high impact on confidentiality, integrity, and availability due to the underlying root cause describ...

CVE-2026-34351

CVE-2026-34351 describes a race condition in Windows TCP/IP where concurrent access to a shared resource allows an authorized attacker to elevate privileges locally. The provided description states a local, privilege-escalation risk with a high impact on confidentiality, integrity, and availabili...

CVE-2026-50344

CVE-2026-50344 corresponds to an Windows OLE elevation-of-privilege vulnerability. Description from sources: “Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.” Exploitation details are not provided beyond that this is a local privilege escalation ...

CVE-2026-68819

CVE-2026-68819 is a Windows Network File System vulnerability characterized by a buffer over-read that enables a remote attacker to cause a Denial of Service over the network. Public sources (NVD) describe it as a network-exploitable issue with no required user interaction, resulting in availabil...

CVE-2026-68827

CVE-2026-68827 is an integer underflow (wrap or wraparound) vulnerability in Windows GDI+ that allows an authorized attacker to achieve elevation of privileges over a network . The vulnerability is rated HIGH severity (CVSS 8.0) with a vector of AV:N/AC:L/PR:L/UI:R, meaning exploitation requires ...

CVE-2026-68846

CVE-2026-68846 is a use-after-free vulnerability in the Windows Kernel that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R, indicating a network-based attack requiring high complexity , low privileges , and...

CVE-2026-69283

CVE-2026-69283 is a heap-based buffer overflow in the Windows CD-ROM Driver that allows an authorized local attacker to elevate privileges . The vulnerability requires low privileges , no user interaction , and has low attack complexity , resulting in a CVSS 3.1 score of 7.8 (HIGH) with High impa...

CVE-2026-69293

CVE-2026-69293 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability is rated CVSS 3.1 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, resulting in high impa...

CVE-2026-69305

CVE-2026-69305 is a use-after-free vulnerability in the Microsoft Windows Search Component that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 base score is 7.1 (HIGH) , with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H , indicating that exploitation requires ...

CVE-2026-69445

CVE-2026-69445 is a local privilege escalation vulnerability in Windows Compressed Folder caused by an improper limitation of a pathname to a restricted directory (path traversal ). An authorized attacker with low privileges can exploit this locally without user interaction to achieve high impact...

CVE-2026-69564

CVE-2026-69564 is a heap-based buffer overflow in Windows Online Certificate Status Protocol (OCSP) that allows an authorized attacker to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attac...

CVE-2026-69582

CVE-2026-69582 is a buffer over-read vulnerability in the Windows Volume Manager Extension Driver , identified by Microsoft (CNA). An authorized local attacker with low privileges can exploit this flaw to elevate privileges locally, achieving high impact on confidentiality, integrity, and availab...

CVE-2026-69610

A buffer over-read in Windows Win32K (the kernel-mode component handling graphical subsystem operations) allows an authorized attacker with low privileges to achieve local privilege escalation . The vulnerability requires local access , has high attack complexity , and does not require user inter...

CVE-2026-69652

CVE-2026-69652 is a use-after-free vulnerability in Windows Win32K that allows an authorized attacker to elevate privileges locally . The CVSS v3.1 base score is 7.0 (HIGH) , with a local attack vector, high complexity, low privileges required, no user interaction, and high impact to confidential...

CVE-2026-70124

CVE-2026-70124 is an out-of-bounds read in Windows DHCP Server that allows an unauthorized, unprivileged network attacker to disclose information. NVD assigns CVSS 3.1: 7.5 (HIGH) with low attack complexity, while Microsoft's CNA scores it 5.9 (MEDIUM) citing high attack complexity. CISA SSVC ass...

CVE-2026-72995

CVE-2026-72995 is a heap-based buffer overflow in Windows Biometric Service that allows a local attacker with low privileges to elevate privileges, leading to high impact on confidentiality, integrity, and availability (CVSS 3.1 score: 7.8 HIGH ). The attack requires local access, has low complex...

CVE-2025-53724

CVE-2025-53724 is a Windows Push Notifications vulnerability described as a type confusion that allows an authorized, locally authenticated attacker to elevate privileges. The CVE is linked to Windows Push Notifications and is rated with a base score of 7.8 (HIGH) via CVSS 3.1, with attack vector...

CVE-2025-54102

CVE-2025-54102 is a use-after-free in the Windows Connected Devices Platform Service that allows an authenticated, local attacker to escalate privileges (obtain increased entitlements). The connected documents corroborate the local-privilege-escalation impact (NCSC advisory lists CVE-2025-54102 w...

CVE-2025-58725

CVE-2025-58725 is described in connected documents as a heap-based buffer overflow in Windows COM that allows a locally authenticated attacker to elevate privileges. The CVE is associated with Windows COM components, with a CVSS v3.1 score of 7.0 (Local, High impact, Privilege escalation) and Exp...

CVE-2025-62571

CVE-2025-62571 is a Windows Installer Elevation of Privilege vulnerability caused by improper input validation. The CVE affects Windows Installer, enabling an authorized, local attacker to escalate privileges (CVSS v3.1: 7.8, Local, Privileges Required: Low, User Interaction: None). Connected sou...

CVE-2026-24289

Technical details about CVE-2026-24289 are not provided in the documents; no affected products, vulnerable components, impact, or remediation details are listed here. Monitor for updates.

CVE-2026-32083

CVE-2026-32083 pertains to Windows’ Simple Search and Discovery Protocol (SSDP) Service elevation of privilege. The vulnerability is local, with low privileges required and no user interaction, and yields a high impact on confidentiality, integrity, and availability. Microsoft lists an official f...

CVE-2026-32084

CVE-2026-32084 is a Windows vulnerability labeled as a Windows Print Spooler information-disclosure issue with local access and potential exposure of sensitive data via Windows File Explorer. The CVE entry notes local attack vector, low attack complexity, and low privileges required, with a high ...

CVE-2026-32150

CVE-2026-32150 is a local privilege-escalation vulnerability in Windows Function Discovery Service (fdwsd.dll) caused by a race condition from concurrent access to a shared resource. An authenticated, local attacker could elevate privileges. Public references indicate the issue is addressed by Mi...

CVE-2026-50397

CVE-2026-50397 is a Windows Kernel Use-After-Free vulnerability that allows an authenticated local attacker to elevate privileges. Root cause: use-after-free in the kernel. Impact: local privilege escalation with high severity (CVSS v3.1: 7.0, HIGH). Exploitation details are not provided in the s...

CVE-2026-58632

CVE-2026-58632 is a Windows Win32K use-after-free vulnerability in the Win32 Kernel Subsystem that could allow a locally authenticated attacker to escalate privileges. The CVE is described as a local elevation of privilege (no remote code execution). Public sources in the connected set consistent...

CVE-2026-62694

CVE-2026-62694 is a use-after-free vulnerability in Windows Installer that allows a locally authenticated attacker with low privileges to escalate privileges . The attack requires high complexity and no user interaction , with high impact on confidentiality, integrity, and availability (CVSS 3.1:...

CVE-2026-62723

CVE-2026-62723 is a use-after-free vulnerability in Windows Telephony Service that allows an authorized attacker to elevate privileges locally. The NVD entry and CVE records confirm a local exploit path with low privileges required and no user interaction, with a CVSSv3.1 base score of 7.0 (High)...