CVE-2026-45642

Microsoft Azure Attestation service and Device Health Attestation Service are affected by improper input validation, allowing an authorized attacker to perform spoofing with a physical attack. CVSS 3.1, base score 3.9 (LOW); attack vector Physical, privileges required High, integrity impact High,...

CVE-2026-45655

CVE-2026-45655 affects Windows BitLocker. The description indicates a protection mechanism failure that could allow an unauthorized attacker to bypass a security feature via a physical attack. The connected documents provide the following details: CVSSv3.1 base score 5.3 (Medium), attack vector P...

CVE-2026-70304

Windows DNS contains a heap-based buffer overflow exploitable by an authorized local attacker to elevate privileges. NVD rates it HIGH (7.8, PR:L); Microsoft's CVSS rates MEDIUM (6.7, PR:H). No in-the-wild exploitation reported. Patch via August 2026 Microsoft security updates (KB5121000, KB51202...

CVE-2024-43558

CVE-2024-43558 is a Windows Mobile Broadband Driver Denial of Service vulnerability. Affected component: Windows Mobile Broadband Driver. Underlying impact: Denial of Service (availability impact stated). CVSSv3.1 base score 6.5 (Adjac ent attack vector, Low attack complexity, No privileges, No u...

CVE-2025-29960

CVE-2025-29960: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) can lead to information disclosure over the network. The description specifies network-based access with high confidentiality impact; no explicit product version or fix details are provided in the connected doc...

CVE-2025-32721

CVE-2025-32721 is a Windows Recovery Driver privilege-escalation flaw caused by improper link resolution before file access. Reported CVSS v3.1 base score 7.3 (High) with local, low-attack-skill requirements, user interaction required, and high impact on confidentiality, integrity, and availabili...

CVE-2025-49721

CVE-2025-49721 describes a heap-based buffer overflow in the Windows Fast FAT Driver that enables local privilege escalation for an unauthenticated attacker requiring user interaction. The CVSS 3.1 vector (LOCAL/LOW/NONE UI:R S:U) yields a base score of 7.8 (HIGH) with impact on confidentiality, ...

CVE-2026-20926

CVE-2026-20926 describes a race condition in the Windows SMB Server that allows an authorized network attacker to elevate privileges. The vulnerability affects Windows SMB Server components and is tied to concurrent execution on a shared resource with improper synchronization. Mitigation is via M...

CVE-2026-26184

CVE-2026-26184 is a Buffer over-read in the Windows Projected File System that can enable local privilege elevation for an authenticated user. Connected sources confirm it is tracked under Windows Projected File System and that Microsoft has released security updates to fix vulnerabilities in Win...

CVE-2026-32091

CVE-2026-32091 is a Microsoft elevation of privilege vulnerability in the Brokering File System with a CVSS 3.1 base score of 8.4 (HIGH). It is a local, no-user-interaction attack requiring no privileges, with high impact on confidentiality, integrity, and availability. The exploitation status is...

CVE-2026-42971

CVE-2026-42971 involves a use of an uninitialized resource in Windows Push Notifications, enabling a locally authenticated attacker to disclose information. Affected component: Windows Push Notifications. Root cause: use of an uninitialized resource. Impact: local information disclosure with Conf...

CVE-2026-45595

Technical details about CVE-2026-45595 are not publicly available in the provided documents. Monitor for updates about affected components, root cause, and remediation.

CVE-2026-45608

CVE-2026-45608: Out-of-bounds read in Windows DHCP Server enables an authorized, local attacker to disclose information. Documents confirm the affected component as Windows DHCP Server and a local attack vector with low complexity and no privileges required (CVSSv3.1: AV:L/AC:L/PR:N/UI:N/S:U). Ba...

CVE-2026-50391

CVE-2026-50391 is a Microsoft Windows Group Policy privilege-escalation vulnerability. Affects Windows Group Policy functionality; root cause is improper privilege management that permits an authorized local attacker to elevate privileges. CVSS v3.1 base score 7.8 (High) with local, low attack co...

CVE-2026-50430

CVE-2026-50430 is the Windows Push Notifications information-disclosure vulnerability. The available sources state that exposure of sensitive information to an unauthorized actor can occur, allowing a locally-present attacker to disclose information. Affected component: Windows Push Notifications...

CVE-2026-50439

CVE-2026-50439 affects Microsoft Message Queuing Queue Manager. Description and connected records confirm a use-after-free vulnerability that allows an unauthenticated attacker to execute code remotely over a network. Impact is described as remote code execution with high-severity CVSS in public ...

CVE-2026-50494

CVE-2026-50494 is a Windows NTFS vulnerability caused by a heap-based buffer overflow in NTFS handling that can let an authorized, local attacker execute code on the host. The issue affects Windows NTFS components and is being addressed by Microsoft security updates (e.g., KB5099539, KB5099540) r...

CVE-2026-61920

CVE-2026-61920 – Windows DNS Server : A race condition caused by improper synchronization on a shared resource enables an authorized attacker to execute code over a network. Affected product: Windows DNS Server. Root cause: concurrent execution due to lack of proper synchronization in the shared ...

CVE-2026-62771

CVE-2026-62771 describes a heap-based buffer overflow in Windows Cloud Files Mini Filter Driver that allows an authorized attacker to elevate privileges locally. Impact is local privilege escalation with high severity (CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The provided documents do not...

CVE-2026-65798

CVE-2026-65798 corresponds to a numeric truncation error in Windows DNS that enables an authorized attacker to perform local privilege escalation. Affected component: Windows DNS. Root cause: numeric truncation in DNS handling leading to elevated privileges. Impact is described as local elevation...

CVE-2026-84000

CVE-2026-84000 is a heap-based buffer overflow in Microsoft Graphics Component that allows an authorized attacker to execute code locally. The vulnerability requires local access and low privileges but no user interaction, resulting in high impact to confidentiality, integrity, and availability (...

CVE-2025-49684

Technical details about CVE-2025-49684 (affected product, version, root cause, exploitability) are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2025-49690

CVE-2025-49690 is a local-privilege-elevation flaw in Windows' Capability Access Management Service (camsvc) caused by race-condition due to improper synchronization. The issue affects camsvc and can lead to elevated privileges on affected Windows builds. The CVE entry cites a local, user‑no‑inte...

CVE-2026-26156

CVE-2026-26156 is a Windows Hyper-V heap-based buffer overflow that enables local code execution. The connected sources corroborate the vulnerability in Windows Hyper-V and indicate it has been fixed by Microsoft in security updates (e.g., KBs and advisories referenced in the sources). The Red Ha...

CVE-2026-40410

Technical details (affected component, root cause, affected versions, exploit vectors or fixes) are not publicly provided in the supplied documents; monitor for updates from official advisories.

CVE-2026-44806

CVE-2026-44806 : Windows Cryptographic Services vulnerability causing denial of service over the network due to missing release of memory after its effective lifetime. Affected component: Windows Cryptographic Services. Root cause described as missing memory release, leading to potential DoS. Rem...

CVE-2026-47648

CVE-2026-47648 — Windows Storage contains an untrusted search path vulnerability that enables a locally authenticated attacker to perform privilege escalation. The issue arises from a trusted component loading an untrusted search path, potentially elevating privileges with high impact (C/H/I/H/A/...

CVE-2026-50357

CVE-2026-50357 affects Windows Resilient File System (ReFS). The issue is a numeric truncation error in ReFS that, per the provided documents, can enable an authorized attacker to execute code locally. The MSRC/MSVCN details list this as an elevation of privileges / local arbitrary code execution...

CVE-2026-56644

CVE-2026-56644 is a Windows Kernel elevation-of-privilege vulnerability described as a use-after-free in the DirectX Graphics Kernel. Exploitation would allow a local, authenticated attacker to escalate privileges. Public references indicate Microsoft has released updates (MSRC pages and related ...

CVE-2026-62885

CVE-2026-62885 describes a heap-based buffer overflow in Windows Win32K that allows an authorized attacker to perform a local privilege escalation . The vulnerability is tied to the Win32K subsystem; the specific code path and vulnerable component are not further detailed in the provided document...

CVE-2026-73010

CVE-2026-73010 is a use-after-free vulnerability in Windows Failover Cluster that allows an unauthenticated, remote attacker to achieve code execution over the network. Microsoft rates it CVSS 9.8 (Critical) with low attack complexity, no required privileges, and high impact to confidentiality, i...

CVE-2025-48803

CVE-2025-48803 affects Windows Virtualization-Based Security (VBS) Enclave. The root cause is a missing integrity check in the Enclave, enabling an authorized local attacker to obtain elevated privileges. The NCSC aggregation also lists CVE-2025-48803 with an impact of gaining elevated privileges...

CVE-2025-49659

Technical details for CVE-2025-49659 are not present in the provided connected documents. Public information about affected products, root cause, exploit status, and fixes is not available here; monitor for updates from official advisories.

CVE-2025-49689

Technical details for CVE-2025-49689 (affected product/component/impact) are not publicly available in the provided documents. Monitor for updates from official sources; no concrete vendor/version/exploit information is available here.

CVE-2025-53137

CVE-2025-53137 affects Windows' Ancillary Function Driver for WinSock. It is a use-after-free vulnerability that can lead to local privilege escalation when exploited by an authenticated attacker. The connected documents confirm the affected component and the high-severity impact (local, with ele...

CVE-2025-55229

CVE-2025-55229 concerns improper verification of cryptographic signatures in Windows Certificates, enabling a network attacker to spoof over the network. The primary root cause is flawed verification during certificate handling, with the CVSS data indicating network access, low attack complexity,...

CVE-2026-24296

CVE-2026-24296 affects Windows Device Association Service, where concurrent execution on a shared resource with improper synchronization (race condition) enables a local, authorized attacker to elevate privileges. The issue is documented across multiple sources (NVD/NCSC/ENISA/CVEs listing) with ...

CVE-2026-26168

CVE-2026-26168 describes a race condition in the Windows Ancillary Function Driver for WinSock that allows an authorized local attacker to elevate privileges. Publicly referenced Red Hat and Dutch/NCSC/CIRCL sources confirm the Windows driver component and local privilege impact; exploitation sta...

CVE-2026-45639

The CVE-2026-45639 entry relates to an out-of-bounds read in Windows Remote Desktop Protocol (RDP). The underlying issue enables an unauthenticated, network-based attacker to disclose information over the network without user interaction. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:...

CVE-2026-49183

CVE-2026-49183 describes a race condition in Windows Clipboard Server due to improper synchronization, enabling a local attacker with low privileges to elevate to higher rights. The affected component is the Windows Clipboard Server (shared resource handling) and the root cause is concurrent exec...

CVE-2026-50349

A race condition (concurrent execution using a shared resource with improper synchronization) in the Windows Ancillary Function Driver for WinSock allows an authorized attacker with low privileges to escalate privileges locally. The vulnerability is rated CVSS 3.1 7.0 (HIGH) with high impact on c...

CVE-2026-50441

An active CVE: CVE-2026-50441 affects Windows Resilient File System (ReFS). Description confirms an Untrusted pointer dereference leading to local Privilege Escalation by an authorized attacker. Impact per CVSS: Local, Privilege Elevation, with High confidentiality/integrity/availability impact. ...

CVE-2026-50670

CVE-2026-50670 is a Windows Win32k elevation-of-privilege vulnerability caused by an out-of-bounds read in the Windows kernel. Connected sources confirm local privilege escalation potential and indicate Microsoft has released updates (e.g., KB5099538/KB5099540; MSRC guidance) addressing this issu...

CVE-2026-56648

CVE-2026-56648 is a Windows Network File System (NFS) server vulnerability described as a time-of-check time-of-use (TOCTOU) race condition that could allow an authorized attacker to elevate privileges over the network. Public sources identify the root cause as a TOCTOU race in NFS and classify t...

CVE-2026-59135

The CVE-2026-59135 entry describes a weakness in the Microsoft Windows Search Component where weak authentication could allow an authorized local attacker to disclose information. Affected software is Windows with the Windows Search Component implicated as the vulnerable element; root cause is we...

CVE-2026-69518

CVE-2026-69518 is a heap-based buffer overflow in Windows Remote Desktop that allows an unauthorized attacker to execute code over a network. The vulnerability is classified with CVSS 3.1 score 8.8 (HIGH) , with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H , indicating network-reachable attack...

CVE-2025-29961

Technical details for CVE-2025-29961 are not provided in the connected documents. The RRAS out-of-bounds read description exists in the Initial Document, but no vendor/affected versions, root cause, or fixes are confirmed here. Monitor for updates.

CVE-2025-47982

CVE-2025-47982 affects Windows Storage VSP Driver. The root cause is improper input validation, enabling a locally authenticated attacker to elevate privileges. CVSS v3.1 base score 7.8 (HIGH) with local, low-complexity, no user interaction required; impact includes high confidentiality, integrit...

CVE-2025-64658

CVE-2025-64658 is a Windows Shell elevation-of-privilege vulnerability described as a race condition caused by concurrent execution using a shared resource. The available connected documents confirm impact as local privilege escalation for an attacker with local access and low privileges, requiri...

CVE-2026-50352

CVE-2026-50352 affects Windows Cryptographic Services. Description: Exposure of sensitive information to an unauthorized actor allows a locally authenticated attacker to disclose information. Impact: information disclosure (CONFIDENTIALITY) with LOCAL attack vector; CVSS 3.1 base 5.5 (AV:L/AC:L/P...