CVE-2026-77887

CVE-2026-77887 is an out-of-bounds read vulnerability in Windows DHCP Server that allows an authorized attacker to achieve local code execution . Per the CVSS 3.1 vector (6.4 MEDIUM), exploitation requires a local attack vector with high complexity and high privileges , no user interaction, and y...

CVE-2026-68848

CVE-2026-68848 is a heap-based buffer overflow in Windows Print Spooler Components that allows an authorized local attacker to escalate privileges . The vulnerability requires low privileges , has low attack complexity , and needs no user interaction , yielding a CVSS 3.1 score of 7.8 (HIGH) with...

CVE-2026-69265

CVE-2026-69265 is an out-of-bounds read vulnerability in Windows NTFS that allows an authorized attacker with low privileges to perform local privilege escalation . The CVSS v3.1 score is 7.8 (High) , with low attack complexity, no user interaction, and high impact across confidentiality, integri...

CVE-2026-69318

Windows Imaging Component contains an out-of-bounds read flaw that allows a locally authenticated attacker to disclose information. The vulnerability carries a CVSS 3.1 score of 5.5 (MEDIUM) , with a local attack vector, low complexity, low privileges required, no user interaction, and a High imp...

CVE-2026-69514

CVE-2026-69514 is a heap-based buffer overflow in Windows Remote Desktop Services (RDS) that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The vulnerability requires high attack complexity and no user interaction, yielding a CVSS 3.1 base score of...

CVE-2026-69571

CVE-2026-69571 is a heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized local attacker to elevate privileges. The vulnerability is scored CVSS 3.1: 7.8 (HIGH) with a vector of local attack, low complexity, low privileges required, no user inte...

CVE-2026-69574

CVE-2026-69574 is a use-after-free vulnerability in the Windows Device Association Service that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 base score is 7.0 (HIGH) , with high impact to confidentiality, integrity, and availability, but the attack requires l...

CVE-2026-69624

Active Directory Certificate Services (AD CS) is affected by an incomplete list of disallowed inputs , enabling an authorized attacker to perform tampering over a network . The root cause is that the input validation does not fully cover all disallowed values, allowing manipulation of certificate...

CVE-2026-69688

CVE-2026-69688 is a heap-based buffer overflow in Windows Encrypting File System (EFS) that allows an authorized attacker to achieve privilege elevation over a network. The Microsoft Security Response Center classifies it as an Elevation of Privilege vulnerability. The CVSS 3.1 score is 7.1 (HIGH...

CVE-2026-70568

This is a heap-based buffer overflow vulnerability in Windows Defender Firewall Service that allows an authorized attacker to achieve local privilege escalation with high impact on confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (HIGH) , reflecting a local attack vector wi...

CVE-2026-70581

An integer overflow or wraparound vulnerability in the Windows Biometric Service allows an authorized local attacker to elevate privileges . According to Microsoft's CVSS 3.1 scoring, the flaw rates 7.8 (HIGH) , with local attack vector, low complexity, low privileges required, no user interactio...

CVE-2026-71336

Windows Work Folder Service is vulnerable to an integer overflow or wraparound flaw that allows an authorized attacker to achieve remote code execution over the network. The CVSS 3.1 base score is 8.8 (HIGH) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-attackable exploitati...

CVE-2026-72989

CVE-2026-72989 affects Windows Failover Cluster due to a use of uninitialized resource , allowing an unauthorized attacker to disclose information over a network . The vulnerability carries a CVSS 3.1 score of 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-e...

CVE-2026-72993

CVE-2026-72993 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated HIGH (CVSS 3.1: 7.8) with an attack vector of local , low complexity , and low privileges required , with high impact on confid...

CVE-2026-73026

CVE-2026-73026 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 3.1 7.8 (HIGH) , with low complexity, low privileges required, and high impact to confidentiality, integrity, and avai...

CVE-2026-78447

CVE-2026-78447 is a heap-based buffer overflow in the Windows Biometric Service component, which allows an authorized local attacker to achieve privilege escalation . Microsoft rates the vulnerability as HIGH severity with a CVSS v3.1 score of 7.8 (vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), in...

CVE-2026-78508

CVE-2026-78508 is an out-of-bounds read in the Windows CD-ROM Driver that allows an unauthorized attacker with physical access to disclose information. The CVSS 3.1 score is 4.6 (MEDIUM) , reflecting the physical attack vector, low complexity, no privileges required, and a high confidentiality im...

CVE-2026-83972

CVE-2026-83972 is a heap-based buffer overflow in the Windows Biometric Service that allows a locally authenticated attacker to elevate privileges. The vulnerability requires low privileges and no user interaction , with low attack complexity , scoring 7.8 (HIGH) under CVSS 3.1 with high impact t...

CVE-2026-83974

CVE-2026-83974 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The CNA (Microsoft) assigns a CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting low attack complexity, ...

CVE-2026-83976

CVE-2026-83976 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability requires low privileges and no user interaction , with an attack vector of local and low complexity , rated CVSS 7.8 (HIGH) ...

CVE-2026-83987

CVE-2026-83987 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , with low attack complexity, low privileges required, no user interaction, and high impact on ...

CVE-2026-68831

CVE-2026-68831 is an information disclosure vulnerability in Windows Defender Firewall Service . The issue arises from files or directories accessible to external parties, allowing an authorized attacker with low privileges to disclose information locally (CVSS 3.1 score 5.5 – MEDIUM ; vector AV:...

CVE-2026-68887

CVE-2026-68887 is an out-of-bounds read in Windows Message Queuing Queue Manager that allows an unauthorized, network-based attacker to trigger a denial of service . The vulnerability requires no prior authentication or user interaction and carries a CVSS 3.1 base score of 7.5 (HIGH) , with impac...

CVE-2026-69267

CVE-2026-69267 is an information disclosure vulnerability in Windows Connected User Experiences and Telemetry , caused by insufficient granularity of access control . An authorized local attacker can leverage this flaw to disclose information, with a CVSS 3.1 score of 6.5 (MEDIUM) and a scope cha...

CVE-2026-69270

A heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) allows a locally authenticated attacker to escalate privileges , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8 HIGH ). No specific affected Windows version or patc...

CVE-2026-69288

CVE-2026-69288 is a use of uninitialized resource vulnerability in Windows GDI+ that allows a locally authenticated attacker with low privileges to disclose information . The attack vector is local , requires no user interaction , and has no impact on integrity or availability , with a high confi...

CVE-2026-69307

CVE-2026-69307 is a heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized local attacker to escalate privileges . The vulnerability is rated CVSS 3.1 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning low-privilege local ac...

CVE-2026-69457

An out-of-bounds read in the Windows USB Driver allows a local, authorized attacker with low privileges and no user interaction to disclose information (high confidentiality impact, no integrity or availability impact). The vulnerability is rated CVSS 3.1 5.5 (MEDIUM) with a vector of AV:L/AC:L/P...

CVE-2026-69503

CVE-2026-69503 is a stack-based buffer overflow in the Windows USB Driver that allows an authorized attacker to elevate privileges over a network. The vulnerability carries a CVSS 3.1 base score of 8.0 (HIGH) with a network attack vector, low complexity, low required privileges, and required user...

CVE-2026-69566

CVE-2026-69566 is a heap-based buffer overflow in Windows NTFS that allows an unauthorized attacker to execute code with a physical attack . The assigned CVSS 3.1 score is 6.8 (Medium) with a vector of AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting that exploitation requires physical access but ...

CVE-2026-69567

CVE-2026-69567 is a use-after-free vulnerability in Windows NTFS (New Technology File System) that allows a locally authenticated attacker with low privileges to elevate privileges on the affected system. The CVSS v3.1 score is 7.0 (HIGH) , reflecting a local attack vector with high complexity, n...

CVE-2026-69568

CVE-2026-69568 is an out-of-bounds read vulnerability in the Windows Storage Spaces Controller component. An authorized attacker with local access and low privileges can exploit this flaw to achieve information disclosure (high confidentiality impact, no integrity or availability impact). The CVS...

CVE-2026-69569

CVE-2026-69569 is an untrusted pointer dereference in Windows Print Spooler Components that allows an authorized attacker to cause a denial of service over a network. The CVSS v3.1 score is 5.7 (Medium) , with high availability impact but no confidentiality or integrity impact. Exploitation requi...

CVE-2026-69604

CVE-2026-69604 is a heap-based buffer overflow in the Windows Audio Service that allows an authorized local attacker with low privileges to elevate privileges . The vulnerability requires a local attack vector , low privileges , and no user interaction , with a CVSS 3.1 base score of 7.8 (HIGH) a...

CVE-2026-69612

CVE-2026-69612 is an absolute path traversal vulnerability in Windows Error Reporting that allows an authorized attacker to elevate privileges locally . The flaw resides in how the component handles file paths, permitting traversal beyond the intended directory. The CVSS 3.1 score is 7.8 (HIGH) w...

CVE-2026-69707

CVE-2026-69707 is an integer overflow or wraparound vulnerability in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized, locally-privileged attacker to escalate privileges. The flaw is rated CVSS 3.1: 7.8 (HIGH) with a local attack vector, low complexity, low privileges r...

CVE-2026-69803

CVE-2026-69803 is an out-of-bounds read in Windows DHCP Server that allows an unauthorized, remote attacker to disclose information over the network. Microsoft rates it MEDIUM (CVSS 5.9, high attack complexity) while NVD scores it HIGH (CVSS 7.5, low attack complexity); both agree on high confide...

CVE-2026-69834

CVE-2026-69834 is a use-after-free vulnerability in Windows ALPC (Advanced Local Procedure Call) that allows an authorized local attacker to elevate privileges . The attack requires local access , high complexity , and low privileges , with no user interaction needed. The CVSS v3.1 base score is ...

CVE-2026-69838

CVE-2026-69838 is a use-after-free vulnerability in Windows Print Spooler Components that allows an authorized attacker to achieve local privilege escalation . The attack vector is local, requires low privileges, and has high complexity with no user interaction needed. The CVSS 3.1 score is 7.0 (...

CVE-2026-69853

CVE-2026-69853 is an information disclosure vulnerability in Windows Win32K caused by use of an uninitialized resource. An authorized local attacker with low privileges can exploit it to disclose sensitive information , with no impact on integrity or availability. The CVSS 3.1 score is 4.7 (MEDIU...

CVE-2026-69866

CVE-2026-69866 is a use-after-free vulnerability in Windows Device Association Service that allows an authorized local attacker to escalate privileges. The CVSS v3.1 score is 7.0 (HIGH) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , meaning exploitation requires local access , low privi...

CVE-2026-69875

CVE-2026-69875 is a heap-based buffer overflow in Windows NTFS that allows an authorized attacker (low privileges, user interaction required) to elevate privileges over a network . The vulnerability carries a CVSS 3.1 score of 8.0 (HIGH) with impacts of High across confidentiality, integrity, and...

CVE-2026-70573

CVE-2026-70573 is a heap-based buffer overflow in Windows Biometric Service that allows a local attacker with low privileges to achieve privilege escalation . The vulnerability is rated CVSS 3.1: 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector wit...

CVE-2026-72941

CVE-2026-72941 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker with local and low-privilege access to achieve local privilege escalation . The assigned CVSS 3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H , indicatin...

CVE-2026-72945

CVE-2026-72945 is an information disclosure vulnerability in Windows Task Scheduler , caused by the use of an uninitialized resource . An authorized local attacker with low privileges can exploit this to disclose information, with high confidentiality impact and no integrity or availability impac...

CVE-2026-72978

Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

CVE-2026-73005

CVE-2026-73005 is a Use After Free vulnerability in Windows Authentication Methods that allows an authorized, locally privileged attacker to escalate privileges. The CVSS v3.1 score is 7.0 (HIGH) , reflecting a local attack vector with high complexity and high impact on confidentiality, integrity...

CVE-2026-77503

CVE-2026-77503 is an out-of-bounds read vulnerability in Windows NTFS that allows an unauthorized attacker to achieve local privilege escalation . The vulnerability is rated HIGH (CVSS 8.4) with a vector of AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning it requires no prior privileges or user inter...

CVE-2026-78446

CVE-2026-78446 is a use-after-free vulnerability in Windows Distributed File System (DFS) that allows an authorized attacker to cause a denial of service over a network. The CVSS 3.1 score is 5.3 (Medium) , reflecting a network attack vector with high complexity , low privileges required , and no...

CVE-2026-78448

CVE-2026-78448 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The CVSS v3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that a low-privileged local attacker can compro...