CVE-2026-69711

CVE-2026-69711 is a use after free vulnerability in the Windows Device Association Service that allows an authorized local attacker with low privileges to achieve privilege escalation . The attack requires high complexity and no user interaction, with high impact on confidentiality, integrity, an...

CVE-2026-69782

Windows DNS Server is affected by a race condition caused by concurrent execution using a shared resource with improper synchronization. This flaw allows an unauthorized attacker to achieve remote code execution over the network with no privileges required , though the attack complexity is rated ...

CVE-2026-69787

CVE-2026-69787 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized local attacker to escalate privileges. The assigned CVSS 3.1 score is 7.8 (High) , with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and low privileges re...

CVE-2026-69817

A use-after-free vulnerability in the Windows Bluetooth Port Driver allows an authorized local attacker to elevate privileges . The Microsoft-assigned CVSS 3.1 score is 7.0 (HIGH) , reflecting a local attack vector with high complexity , low privileges required , and no user interaction , resulti...

CVE-2026-69847

CVE-2026-69847 is a heap-based buffer overflow in Windows DHCP Server that allows an authorized attacker to execute code over an adjacent network. The flaw resides in how the DHCP Server processes input, leading to memory corruption that can be leveraged for remote code execution . The vulnerabil...

CVE-2026-72991

CVE-2026-72991 is a heap-based buffer overflow in the Windows Biometric Service that allows a locally authenticated attacker with low privileges to escalate to higher privileges. The vulnerability scores 7.8 (HIGH) under CVSS v3.1, with all three impact dimensions rated High. Attack requires loca...

CVE-2026-73014

CVE-2026-73014 is a missing authorization flaw in the Data Sharing Service Client , a Microsoft component, that allows an attacker with local, low-privilege access to escalate privileges on the affected system. The vulnerability is rated CVSS 3.1 7.8 (High) with a local attack vector, low complex...

CVE-2026-83973

CVE-2026-83973 is a heap-based buffer overflow in the Windows Biometric Service component, allowing a locally authenticated attacker with low privileges to achieve privilege escalation with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 7.8 – HIGH ). CISA's SSVC asses...

CVE-2026-83978

Windows Biometric Service is affected by a heap-based buffer overflow that allows a locally authenticated attacker to elevate privileges. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and low require...

CVE-2025-58729

CVE-2025-58729 affects Windows Local Session Manager (LSM). The connected documents confirm an issue with improper validation of input type in LSM, allowing an authorized attacker to cause a Denial of Service over the network . The CVSS vectors indicate network access, low attack complexity, and ...

CVE-2026-20821

CVE-2026-20821 is a Windows Remote Procedure Call information disclosure vulnerability that could allow a local attacker to obtain sensitive data. The available description confirms an information disclosure resulting from RPC handling, but the connected documents do not provide vendor-specific p...

CVE-2026-20847

CVE-2026-20847 is described in connected sources as a Windows Shell vulnerability that allows spoofing of a user over a network. The NVD entry lists a MEDIUM severity (CVSS 3.1: 6.5) with network attack vector, low complexity, and requires low privileges; impact shown as high confidentiality loss...

CVE-2026-68875

CVE-2026-68875 is a buffer over-read in Windows NTFS that allows an authorized local attacker to achieve code execution . The vulnerability is rated CVSS 3.1 7.8 (High) with a local attack vector, low complexity, low privileges required, and no user interaction needed. No exploitation details or ...

CVE-2026-68898

Windows iSCSI is vulnerable to an out-of-bounds read that allows an unauthorized, remote attacker to cause a denial of service over a network. The CVSS 3.1 score is 6.5 (Medium) , with the attack requiring user interaction (e.g., opening a crafted file) but no prior privileges. CISA's SSVC assess...

CVE-2026-69277

CVE-2026-69277 is a stack-based buffer overflow in the Microsoft Local Security Authority Server (lsasrv) component that enables a locally authenticated attacker to escalate privileges . The vulnerability is scored CVSS 3.1: 7.8 (HIGH) with a local attack vector, low complexity, and low privilege...

CVE-2026-69297

CVE-2026-69297 affects Windows DHCP Server , where passwords are stored in a recoverable format, allowing an authorized attacker (with low privileges) to disclose information over a network. The CVSS v3.1 score is 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability impa...

CVE-2026-69323

CVE-2026-69323 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker with low privileges to achieve local privilege escalation . The vulnerability requires no user interaction and carries a CVSS 3.1 score of 7.8 (HIGH) with high impact to confidentiality,...

CVE-2026-69325

CVE-2026-69325 is a heap-based buffer overflow in Microsoft JScript that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.1 (High) , with a network attack vector, high complexity, no required privileges or user interaction, and high impact o...

CVE-2026-69441

CVE-2026-69441 is a race condition vulnerability in Windows Installer , caused by concurrent execution using a shared resource with improper synchronization . An authorized attacker can exploit this to elevate privileges locally . The vulnerability is rated CVSS 7.0 (HIGH) with a local attack vec...

CVE-2026-69478

CVE-2026-69478 is a heap-based buffer overflow in the Windows Device Association Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, resulting in high impact ...

CVE-2026-69481

CVE-2026-69481 is a heap-based buffer overflow in Windows Enterprise App Management that allows an authorized attacker to elevate privileges over a network. The vulnerability requires low privileges and user interaction, with high impact to confidentiality, integrity, and availability (CVSS 3.1 b...

CVE-2026-69561

CVE-2026-69561 is an out-of-bounds read vulnerability in the Windows CD-ROM Driver that allows an authorized attacker to achieve local privilege escalation . The flaw resides in how the driver reads memory beyond its allocated bounds, potentially allowing an attacker with local low-privilege acce...

CVE-2026-69709

A heap-based buffer overflow in Windows NTFS allows an authorized attacker with low privileges and no user interaction to execute code locally. The vulnerability is rated CVSS 3.1 7.8 (HIGH) with full impact on confidentiality, integrity, and availability. The Microsoft reference points to a spec...

CVE-2026-69731

CVE-2026-69731 is a heap-based buffer overflow in the HID class driver that allows an authorized attacker to perform a local privilege escalation . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , with a low-complexity attack vector requiring no user interaction. No exploitation details...

CVE-2026-69813

A use-after-free flaw in Windows DNS Server allows an unauthenticated remote attacker to achieve code execution over the network . The vulnerability is rated CVSS 3.1 8.1 (HIGH) , with an attack vector of network, high complexity, and no required privileges or user interaction. No specific affect...

CVE-2026-69816

CVE-2026-69816 is a use-after-free vulnerability in Windows Accounts Control that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 base score is 7.0 (HIGH) with a local attack vector, high complexity, low privileges required, and no user interaction, resulting in high im...

CVE-2026-72966

CVE-2026-72966 affects Windows Remote Access Connection Manager , where a missing authorization check allows an already-authorized (low-privilege) local attacker to perform tampering without user interaction. The impact is rated HIGH for integrity with no effect on confidentiality or availability...

CVE-2026-72994

CVE-2026-72994 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability requires low privileges and no user interaction , with low attack complexity . The CVSS 3.1 base score is 7.8 (HIGH) , with high imp...

CVE-2026-73002

CVE-2026-73002 affects Windows Biometric Service , where an integer overflow or wraparound vulnerability allows a locally authenticated attacker to elevate privileges . The flaw requires low privileges , no user interaction, and low attack complexity, yet yields high impact on confidentiality, in...

CVE-2026-73015

CVE-2026-73015 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , requiring low privileges and no user interaction (vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)....

CVE-2026-78453

CVE-2026-78453 is an integer underflow (wraparound) in the Microsoft Windows SCSI Class System File that allows an unauthorized, remote attacker to disclose information over a network . The vulnerability requires user interaction and demands no prior privileges , with a CVSS 3.1 base score of 6.5...

CVE-2026-83954

CVE-2026-83954 is a heap-based buffer overflow in Windows Biometric Service that allows a local, low-privilege attacker to elevate privileges without user interaction. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with full impact to confidentiality, integrity, and availability, indica...

CVE-2026-85360

A use after free flaw in the Windows Kernel allows a local, authenticated attacker to elevate privileges . The vulnerability is scored CVSS 3.1 7.0 (HIGH) with a local attack vector , high attack complexity , low privileges required , and no user interaction , resulting in high impact to confiden...

CVE-2026-20939

CVE-2026-20939: Windows File Explorer information disclosure allowing a locally authenticated user to view sensitive data. The issue has a CVSSv3.1 base score of 5.5 (Local, Low attack complexity, Low privileges, Confidentiality impact: High). Microsoft has released fixes in January 2026 security...

CVE-2026-32087

Summary (CVE-2026-32087): Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) on Windows can allow an authorized, locally authenticated attacker to elevate privileges. Reported base CVSS v3.1 score: 7.0 (HIGH) with LOCAL attack vector, HIGH impact on confidentiality, integrity, a...

CVE-2026-58535

CVE-2026-58535 affects the Windows Remote Desktop Client. The root cause is a use of an uninitialized resource in Windows RDP, enabling an unauthenticated, network-based disclosure of information. Public data from NVD lists CVSS v3.1 base metrics: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base score 7...

CVE-2026-68832

CVE-2026-68832 is a local privilege escalation vulnerability in Windows NTFS caused by an integer overflow or wraparound . An authorized attacker with low privileges can exploit this with low complexity and no user interaction to achieve high impact on confidentiality, integrity, and availability...

CVE-2026-69317

Windows Remote Desktop Client is affected by an out-of-bounds read vulnerability that allows an authorized attacker to disclose information over a network. The flaw is classified as an information disclosure with a CVSS 3.1 score of 5.7 (Medium) , requiring low privileges and user interaction. CI...

CVE-2026-69343

CVE-2026-69343 is an out-of-bounds read in the Windows Overlay Filter component that allows a low-privilege local attacker to achieve information disclosure without user interaction. The vulnerability is rated CVSS 5.5 (MEDIUM) with a vector of local attack, low complexity, and high confidentiali...

CVE-2026-69352

CVE-2026-69352 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability is rated HIGH (CVSS 7.8) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H , meaning an attacker with low privileges and no user intera...

CVE-2026-69385

CVE-2026-69385 is a local elevation of privilege vulnerability in Windows TCP/IP caused by a race condition (improper synchronization of a shared resource during concurrent execution). An authorized attacker with low privileges can exploit this to gain higher privileges on the target system. The ...

CVE-2026-69432

CVE-2026-69432 is a heap-based buffer overflow in the Volume Manager Driver (Microsoft) that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 3.1 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector, low compl...

CVE-2026-69451

Windows Management Instrumentation (WMI) contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, meaning exploitation requires network access , low priv...

CVE-2026-69453

CVE-2026-69453 is a missing authorization vulnerability in the Microsoft Windows Search Component that allows an authenticated, low-privilege local attacker to perform tampering (integrity impact). The CVSS 3.1 base score is 5.5 (Medium) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indica...

CVE-2026-69514

CVE-2026-69514 is a heap-based buffer overflow in Windows Remote Desktop Services (RDS) that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The vulnerability requires high attack complexity and no user interaction, yielding a CVSS 3.1 base score of...

CVE-2026-69560

CVE-2026-69560 is a use-after-free vulnerability in the Windows Work Folder Service that allows an authorized local attacker to elevate privileges . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting a high attack complexity and low privileges requir...

CVE-2026-69589

CVE-2026-69589 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized, low-privilege attacker to achieve local privilege escalation . The vulnerability carries a CVSS v3.1 base score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low...

CVE-2026-69608

CVE-2026-69608 is a local elevation of privilege vulnerability in the Microsoft Windows Search Component , caused by an integer overflow or wraparound . An authorized (low-privilege) attacker can exploit it locally without user interaction to achieve high impact across confidentiality, integrity,...

CVE-2026-69627

CVE-2026-69627 is an out-of-bounds read vulnerability in the Windows Remote Desktop Licensing Service . An authorized local attacker with low privileges can exploit this flaw to disclose information , resulting in high confidentiality impact but no integrity or availability impact (CVSS 3.1: 5.5 ...

CVE-2026-69630

CVE-2026-69630 is an out-of-bounds read vulnerability in the Windows Win32K kernel driver that allows a locally authenticated attacker to escalate privileges . The CVSS v3.1 score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting the high complexity and required low-privil...