2443 matches found
CVE-2025-53155
CVE-2025-53155 is a Windows Hyper-V heap-based buffer overflow that enables an authenticated, local attacker to elevate privileges. The initial entry states an local privilege escalation via Hyper-V; connected materials corroborate Windows Hyper-V involvement under the Windows security ecosystem ...
CVE-2025-54099
CVE-2025-54099 affects the Windows Ancillary Function Driver for WinSock. The issue is a stack-based buffer overflow that can be exploited by an authorized, locally-located attacker to obtain elevated privileges. The connected NCSC advisory corroborates the CVE’s association with privilege escala...
CVE-2025-54112
CVE-2025-54112 is a local privilege escalation in the Microsoft Virtual Hard Drive caused by a use-after-free, enabling an authenticated attacker to obtain higher privileges on affected Windows systems. The connected sources (including the NCSC advisory and the CVE table for Windows Hyper-V) cate...
CVE-2025-58717
Technical details (affected product/component/version/root cause/mitigation) for CVE-2025-58717 are not disclosed in the provided connected documents. Monitor official advisories (e.g., MSRC/KB updates) for remediation and version-specific guidance.
CVE-2025-62470
CVE-2025-62470 is a heap-based buffer overflow in the Windows Common Log File System (CLFS) Driver that enables a locally authenticated attacker to escalate privileges. The vulnerability affects the CLFS driver in Windows, with local access required and high impact on confidentiality, integrity, ...
CVE-2026-20839
CVE-2026-20839 : Improper access control in the Windows Client-Side Caching (CSC) Service may allow an authorized local attacker to disclose information. The CVSSv3.1 vector indicates a local attack with low complexity and low privileges required, but with high confidentiality impact (C:H, I:N, A...
CVE-2026-20852
CVE-2026-20852 is a Windows Hello privilege-assignment vulnerability that enables a locally authenticated attacker to tamper with local data due to incorrect privilege handling in the Windows Hello component. The issue is labeled as a local, high-severity problem with no user interaction required...
CVE-2026-24297
CVE-2026-24297 : Windows Kerberos contains a race condition in a shared resource that can allow a network-based bypass of a security feature. The vulnerability is listed across multiple sources (NVD, OSV, CIRCL, ENISA EUVD, CVE list) and is associated with Windows Kerberos components. Exploitatio...
CVE-2026-26176
Technical details about CVE-2026-26176 are not provided in the supplied documents. Monitor for updates from Microsoft Security Update Guide and CVE records for affected specifics, impact, and remediation.
CVE-2026-27917
CVE-2026-27917 is a use-after-free vulnerability in the Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) that can elevate privileges locally. Connected documents confirm the issue and its root cause (memory corruption via use-after-free) and indicate that Microsoft released fixes (e.g., K...
CVE-2026-32068
CVE-2026-32068 impacts Windows SSDP service, enabling local elevation of privilege via the Simple Search and Discovery Protocol. The issue is local, requires low privileges, and does not require user interaction. CVSS v3.1 base score 7.0 (HIGH) with HIGH impact on confidentiality, integrity, and ...
CVE-2026-34330
Technical details about CVE-2026-34330 (Win32K GRFX integer overflow leading to local privilege elevation) are not publicly provided in the supplied connected documents. Please monitor official advisories (MSRC/NVD) for affected products, impact, and fixes.
CVE-2026-34334
Technical details (affected component, root cause, impact, remediation) are not provided in the supplied documents. Monitor for updates from Microsoft and CVE repositories.
CVE-2026-34347
Technical details about CVE-2026-34347 are not publicly provided in the connected documents. The initial description notes a use-after-free in Windows Win32K GRFX enabling local privilege elevation, but no patch/version specifics are included in the supplied materials.
CVE-2026-41087
CVE-2026-41087 affects Windows File Explorer; a local attacker can cause exposure of sensitive information to obtain disclosure on the host. The vulnerability is rated CVSSv3.1: 5.5 (Medium) with Local access, Low attack complexity, Privileges Required: Low, no user interaction, and Confidentiali...
CVE-2026-41108
CVE-2026-41108 is a heap-based buffer overflow in the Microsoft Windows DNS Client that allows an authorized, local attacker to perform privilege escalation. Affected component: Windows DNS client functionality (DNS resolution path); root cause: heap-based overflow leading to elevation of privile...
CVE-2026-49183
CVE-2026-49183 describes a race condition in Windows Clipboard Server due to improper synchronization, enabling a local attacker with low privileges to elevate to higher rights. The affected component is the Windows Clipboard Server (shared resource handling) and the root cause is concurrent exec...
CVE-2026-50432
CVE-2026-50432 describes a Use-after-free vulnerability in the Windows Virtual Filtering Platform (VFP) . An authenticated attacker could trigger a denial-of-service condition over the network by exploiting this flaw in the VFP code path, as indicated by the CVE entry: AV:N/AC:H/PR:L/UI:N/S:U/C:N...
CVE-2026-50448
CVE-2026-50448 – Windows NTFS Heap-based Overflow (Windows NTFS): A local, heap-based buffer overflow in NTFS could allow an authenticated attacker to execute arbitrary code on the affected system. The CVE is documented as a local-execution vulnerability with a Microsoft-provided CVSS v3.1 base s...
CVE-2026-50485
CVE-2026-50485 is a Windows Hyper-V Denial of Service vulnerability caused by a buffer over-read. It can be exploited by an attacker who has adjacent network access to deny service on the target host, with high privileges required and no user interaction. The documented impact is availability los...
CVE-2026-56648
CVE-2026-56648 is a Windows Network File System (NFS) server vulnerability described as a time-of-check time-of-use (TOCTOU) race condition that could allow an authorized attacker to elevate privileges over the network. Public sources identify the root cause as a TOCTOU race in NFS and classify t...
CVE-2026-58530
CVE-2026-58530 affects Windows Resilient File System (ReFS). The issue is a heap-based buffer overflow in ReFS that allows an unauthorized attacker to execute code locally. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH), with LOCAL attack vector, no privileges required, and user inter...
CVE-2026-61364
The CVE-2026-61364 entry concerns Windows Remote Desktop Services. A missing authentication flaw in a critical function enables a locally authenticated attacker with low privileges to elevate to higher privileges, as indicated by the CVSS 3.1 vector (L/L). Exploitation details or in-the-wild stat...
CVE-2026-62793
CVE-2026-62793 describes a buffer over-read in Windows NTFS that can allow an authorized local attacker to disclose information. Affected component: Windows NTFS filesystem handling. Root cause: memory over-read leading to confidential data exposure (C: HIGH, I: NONE, A: NONE per CVSS 3.1). Explo...
CVE-2025-50158
CVE-2025-50158 is a TOCTOU race condition in Windows NTFS that could allow a local attacker to disclose information. The description confirms the vulnerability is a local information-disclosure flaw affecting NTFS. Connected sources list CVE-2025-50158 under Windows NTFS with an impact of Access ...
CVE-2025-53150
CVE-2025-53150 is a Use-After-Free vulnerability in Windows Digital Media that enables a locally authenticated attacker to elevate privileges. Public documents (NVD, NCSC, EUVD, CIRCL/CVE listings) describe the issue as a local privilege-escalation bug but do not provide concrete details on affec...
CVE-2025-54092
Technical details for CVE-2025-54092 are not publicly provided in the supplied documents. Connected KB/MSFT resources reference related issues but do not specify affected products, versions, root cause, or remediation for this CVE. Monitor for updates.
CVE-2025-55223
CVE-2025-55223 involves a race condition in the Graphics Kernel allowing a locally authenticated attacker to elevate privileges. The initial entry notes local privilege elevation via concurrent execution with improper synchronization. Connected documents confirm the CVE-55223 reference in a risk ...
CVE-2025-59190
CVE-2025-59190 affects the Microsoft Windows Search Component. It is due to improper input validation and allows a local attacker to cause a Denial of Service. The CVE is rated with CVSS 3.1 (base 5.5, MEDIUM); attack vector LOCAL, privileges REQUIRED NONE, user interaction REQUIRED, and impact l...
CVE-2025-62573
CVE-2025-62573 is a DirectX Graphics Kernel elevation-of-privilege vulnerability described as a use-after-free in Windows DirectX that enables an authorized, local attacker to obtain elevated privileges. The EUVD and related advisories confirm the issue and map it to a Windows DirectX privilege e...
CVE-2026-20831
The CVE-2026-20831 entry corresponds to a TOCTOU race condition in Windows Ancillary Function Driver for WinSock that could allow a local, authenticated attacker to elevate privileges. The description in the initial document confirms local privilege escalation as the impact. Connected documents i...
CVE-2026-27919
CVE-2026-27919 is a Windows UPnP Device Host elevation-of-privilege vulnerability. It is a local attack with low privileges required and no user interaction, carrying a CVSS v3.1 base score of 7.8 (High). The impact spans confidentiality, integrity, and availability (all High). The exploitation m...
CVE-2026-32090
CVE-2026-32090 affects the Windows Speech Brokered API. The vulnerability is an Elevation of Privilege with a CVSSv3.1 base score of 7.8 (HIGH). It is a LOCAL, LOW attack complexity, LOW privileges required, with no user interaction and UNCHANGED scope. The impact is HIGH for confidentiality, int...
CVE-2026-49796
CVE-2026-49796 is a heap-based buffer overflow in Windows GDI+ that can let a local attacker execute code. Affected: Windows GDI+ component; root cause is a heap buffer overflow. Impact per CVSS: local attack with user interaction required, high confidentiality, integrity, and availability impact...
CVE-2026-50386
CVE-2026-50386 refers to a heap-based buffer overflow in Windows NTFS that allows an unauthorized attacker to execute code locally. The vulnerability affects Windows NTFS components as described in authoritative sources (NVD entry and MSRC update guidance). The exploitation detail in the provided...
CVE-2026-50412
CVE-2026-50412 is a Windows NTFS elevation-of-privilege vulnerability caused by a stack-based buffer overflow. The affected component is NTFS in Windows, allowing an authorized local attacker with low privileges and no user interaction to gain SYSTEM-level privileges (base CVSS v3.1: 7.8, Local, ...
CVE-2026-50429
CVE-2026-50429 describes an out-of-bounds read in the Windows Kernel that may allow a remote attacker to disclose information over a network. The entry is tied to Microsoft’s Windows kernel information-disclosure vulnerability with a base CVSSv3.1 score of 8.2 (Network, Low attack complexity, No ...
CVE-2026-54997
Public technical details are not provided in the supplied documents for CVE-2026-54997. No specifics on affected products, versions, root cause, or remediation are available here. Monitor for updates from official sources.
CVE-2026-58545
CVE-2026-58545 is a Windows Kernel Security Feature Bypass vulnerability. The connected documents confirm an improper access control in the Windows Kernel that could let an authorized locally attacker bypass a security feature. Metrics indicate CVSS v3.1 base score 5.5 (Medium), with Local attac...
CVE-2026-58546
CVE-2026-58546 is a Windows Remote Desktop Client Information Disclosure vulnerability. The initial and connected records confirm that the issue stems from use of an uninitialized resource in Windows RDP, enabling an unauthorized attacker to disclose information over a network. Affected component...
CVE-2026-62730
CVE-2026-62730 describes a buffer over-read in the Windows Wired AutoConfig Service that can disclose information locally. The issue is exploitable by an authorized, low-privilege local attacker (LOCAL attack vector, LOW privileges, no user interaction) with a CVSS v3.1 base score of 5.5 (HIGH co...
CVE-2026-62738
The vulnerability CVE-2026-62738 affects Windows Management Instrumentation and enables an authorized, local attacker to disclose information through an out-of-bounds read. The available descriptions consistently state information disclosure as the impact; no details on specific vulnerable binari...
CVE-2026-62771
CVE-2026-62771 describes a heap-based buffer overflow in Windows Cloud Files Mini Filter Driver that allows an authorized attacker to elevate privileges locally. Impact is local privilege escalation with high severity (CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The provided documents do not...
CVE-2026-65798
CVE-2026-65798 corresponds to a numeric truncation error in Windows DNS that enables an authorized attacker to perform local privilege escalation. Affected component: Windows DNS. Root cause: numeric truncation in DNS handling leading to elevated privileges. Impact is described as local elevation...
CVE-2025-49660
Technical details about CVE-2025-49660 (affected product/component/version, root cause, impact, exploit status, or available patch) are not provided in the connected documents; monitor official disclosures for updates.
CVE-2025-50177
CVE-2025-50177 affects Windows Message Queuing (MSMQ) with a use-after-free in the MSMQ path that enables remote code execution over a network. Affected: Windows MSMQ component. Impact per CVSS: high (8.1) with network access, no user interaction required. Exploitation as of the connected documen...
CVE-2025-53801
CVE-2025-53801 is a Windows DWM core library elevation-of-privilege vulnerability described as an untrusted pointer dereference that enables a locally authenticated attacker to achieve elevation of privileges . The CVE is associated with a CVSS v3.1 base score of 7.8 (HIGH) with local attack vect...
CVE-2025-55696
CVE-2025-55696 describes a time-of-check time-of-use (TOCTOU) race condition in the NtQueryInformation Token function (ntifs.h) that can allow a local, authorized attacker to elevate privileges. The connected Microsoft advisories indicate Windows updates addressing security vulnerabilities in Oct...
CVE-2026-20810
CVE-2026-20810 affects the Windows Ancillary Function Driver for WinSock. The vulnerability allows an authorized local attacker to elevate privileges due to a memory allocation issue that is not on the heap. The CVE entry shows a local attack vector with high impact (confidentiality, integrity, a...
CVE-2026-20824
CVE-2026-20824 is a Windows Remote Assistance vulnerability described as a protection mechanism failure that enables a local attacker to circumvent a security measure. It is listed with a local attack vector, requiring user interaction, and a high confidentiality impact. Connected sources identif...