CVE-2024-43646

Technical details are not publicly provided in the supplied documents. Monitor for updates from Microsoft/Microsoft Security Update Guide and NVD.

CVE-2025-29835

CVE-2025-29835 describes an out-of-bounds read in Windows Routing and Remote Access Service (RRAS) that could allow an unauthenticated attacker to disclose information over the network. The initial description does not provide concrete remediation guidance, and the connected documents do not spec...

CVE-2025-29964

CVE-2025-29964 is a Windows Media heap-based buffer overflow that allows a network-exploiting attacker to execute code remotely. The connected NCSC advisory lists this CVE under Windows Media with a high risk score (8.80) and confirms an exploitable path labeled as “Execute random code.” The avai...

CVE-2025-33055

CVE-2025-33055 is an information-disclosure vulnerability: an out-of-bounds read in Windows Storage Management Provider could allow an authorized, local attacker to disclose information. Connected sources confirm the flaw and impact but do not provide concrete exploit details or a documented reme...

CVE-2025-33058

CVE-2025-33058 describes an out-of-bounds read in the Windows Storage Management Provider, enabling a locally authorized attacker to disclose information. Affected product/component: Windows Storage Management Provider. Root cause: memory read beyond bounds leading to information disclosure (conf...

CVE-2025-33066

CVE-2025-33066 is associated with Windows Routing and Remote Access Service (RRAS). The connected NCSC advisory lists CVE-2025-33066 under RRAS with an impact of “Execute Random Code” and a network-exploitable vector, indicating a heap-based buffer overflow that could allow remote code execution....

CVE-2025-49724

CVE-2025-49724 is a Use-After-Free vulnerability in Windows Connected Devices Platform Service that can lead to remote code execution over the network. According to initial data, impact is high (C/H/I/A) with CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U. Connected documents confirm the vulnerability exists ...

CVE-2026-40398

CVE-2026-40398 is a heap-based buffer overflow in Windows Remote Desktop Services that allows an authenticated attacker to perform local privilege escalation. The description across sources consistently identifies a local, authenticated exploit path with a high impact (C/H/I/A: High) and a CVSS v...

CVE-2026-42991

CVE-2026-42991 describes a race condition in Windows Push Notifications arising from improper synchronization of a shared resource. This yields local privilege escalation for an authorized attacker. The CVSS v3.1 metrics indicate local attack vector, high impact on confidentiality, integrity, and...

CVE-2026-50451

CVE-2026-50451 affects Windows Routing and Remote Access Service (RRAS): missing authentication for a critical function enables local privilege escalation by an authorized attacker. Documented impact is privilege escalation (local), base CVSSv3.1 7.1 (HIGH); remediation is Microsoft security upda...

CVE-2026-59128

The CVE-2026-59128 entry documents an out-of-bounds read in Windows Encrypting File System (EFS) that can let an authorized local attacker disclose information. Affected component: Windows EFS. Root cause: out-of-bounds read leading to information disclosure. Impact: local disclosure of informati...

CVE-2023-33172

Technical details about CVE-2023-33172 are not publicly provided in the supplied documents; no affected products, versions, impact, or mitigations are specified. Monitor for updates.

CVE-2024-43525

CVE-2024-43525 refers to a Windows Mobile Broadband Driver Remote Code Execution vulnerability. The CVE entry lists a CVSS v3.1 base score of 6.8 (Medium) with an attack vector of Physical, requiring no privileges and no user interaction, and impacting confidentiality, integrity, and availability...

CVE-2025-21304

CVE-2025-21304 affects the Windows DWM Core Library (Desktop Window Manager). The connected sources confirm a local elevation of privilege vulnerability in the DWM Core Library, with the CVSS 3.1 metrics indicating local attack vector, low attack complexity, and need for low privileges, leading t...

CVE-2025-21389

Technical details about CVE-2025-21389 are not publicly provided in the connected documents. Monitor for updates from Microsoft and CVE repositories for affected products, exploitability, and remediation.

CVE-2025-29954

Technical details for CVE-2025-29954 are not publicly provided in the supplied documents. Monitor for official updates from Microsoft (MSRC) and vulnerability feeds as the connected sources are not detailed here.

CVE-2025-29962

Technical details about CVE-2025-29962 are not provided in the supplied documents; no affected products, root cause, or fixes are disclosed here. Monitor for updates.

CVE-2025-32713

CVE-2025-32713 corresponds to a heap-based buffer overflow in Windows Common Log File System Driver that enables local privilege escalation for an authorized attacker. The connected sources identify the affected component as the Windows Common Log File System Driver and list the impact as obtaini...

CVE-2025-47971

CVE-2025-47971 describes a buffer over-read in the Virtual Hard Disk (VHDX) component that can allow a local attacker to elevate privileges. The publicly documented impact is local privilege elevation via a buffer over-read in VHDX; vendors have not provided version-specific affected products in ...

CVE-2025-49723

CVE-2025-49723 affects Windows StateRepository API, enabling local tampering of data due to missing authorization in the Server file path. The CNVD/NCSC entries confirm impact as manipulation of data with a high CVSS (8.8) and local attack vector; no public exploitation details are provided in th...

CVE-2025-55234

CVE-2025-55234 (Windows SMB Relay Elevation of Privilege) : The vulnerability relates to SMB Server relay attacks that can escalate privileges when signing and EPA protections are not enabled. Public docs indicate SMB Server signing and Extended Protection for Authentication (EPA) exist as harden...

CVE-2026-33104

CVE-2026-33104 is a Windows Win32K - GRFX race condition vulnerability rated CVSS v3.1 7.0 (High) with local privilege escalation impact. The connected sources label this as a Win32K-GRFX issue enabling “Obtain increased privileges” and reference Microsoft Windows updates guidance, but the provid...

CVE-2026-50419

CVE-2026-50419 is a Windows Kernel information-disclosure vulnerability that could allow an authorized local attacker to disclose sensitive data. The CVSS v3.1 base score is 3.3 (LOW) with LOCAL access and low complexity; no exploitation details are provided in the connected documents. Microsoft ...

CVE-2026-61932

The CVE-2026-61932 entry describes a type confusion vulnerability in the Windows DWM Core Library that allows an authorized attacker to achieve local privilege escalation . Affected component is the Windows DWM Core Library; root cause is resource access via incompatible type. The provided docume...

CVE-2025-32714

CVE-2025-32714 maps to an improper access control in Windows Installer enabling local privilege escalation for an authenticated attacker. Connected sources confirm Windows Installer as the vulnerable component and describe the impact as obtaining elevated privileges locally. Remediation is via Mi...

CVE-2025-33061

CVE-2025-33061 is a Windows Storage Management Provider vulnerability characterized by an out-of-bounds read that could allow an authorized local attacker to disclose information. The CVE affects the Storage Management component and is rated with LOCAL attack vector and LOW privileges required, w...

CVE-2025-48800

CVE-2025-48800 affects Windows BitLocker. Description confirms a protection mechanism failure that enables bypass of BitLocker with physical access. Connected NC SC advisory lists Windows BitLocker under CVE-2025-48800 with a CVSS v3.1 impact of 6.80 (Physical access required, no user interaction...

CVE-2025-49743

CVE-2025-49743 is a local privilege-escalation vulnerability in the Microsoft Graphics Component caused by a race condition due to improper synchronization when a shared resource is accessed concurrently. The issue affects Windows graphics-related code paths and can let an authorized, local attac...

CVE-2026-32149

CVE-2026-32149 is a Windows Hyper-V remote code execution vulnerability. The issue involves a local attack vector (AV: Local) with low attack complexity (AC: Low) and privileges required (PR: Low) that requires user interaction (UI: Required). Impact is high on confidentiality, integrity, and ava...

CVE-2026-34335

Use-after-free in the Windows Ancillary Function Driver for WinSock is the root cause of CVE-2026-34335. The vulnerability can allow an authenticated, local attacker to elevate privileges. The CVSSv3.1 score is 7.0 (High) with local attack vector, high complexity, and requires low privileges and ...

CVE-2026-42825

CVE-2026-42825 describes a use-after-free in Windows Telephony Service that allows an authorized attacker to elevate privileges locally. The description clearly states local privilege escalation as the impact, but the connected documents do not provide specifics on affected product versions, root...

CVE-2026-61348

This CVE (CVE-2026-61348) is a local privilege escalation in the Windows Ancillary Function Driver for WinSock. The issue is a use-after-free in the driver component, enabling an authenticated attacker to elevate privileges on the affected system. The provided materials indicate a high-severity i...

CVE-2026-61350

Windows NTFS contains a buffer over-read that can disclose information when an attacker performs a physical attack. Affected component: NTFS; root cause: buffer over-read. CVSSv3.1 metrics indicate AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N with base score 4.6 (Medium). Impact is limited to confidential...

CVE-2026-62710

CVE-2026-62710 : Heap-based buffer overflow in the Windows Device Association Service allows an authorized attacker to elevate privileges locally. This entry is supported by multiple sources: the NVD/NVD-derived description confirms a local, privilege-escalation flaw with high impact (confidentia...

CVE-2026-62729

CVE-2026-62729 describes a race condition in Windows Telephony Service caused by concurrent execution on a shared resource with improper synchronization. This allows an authorized, local attacker to elevate privileges. The entry notes a local attack vector with high impact on confidentiality, int...

CVE-2026-70345

CVE-2026-70345 describes a heap-based buffer overflow in Windows Installer that enables a locally authenticated attacker to achieve elevation of privilege. The root cause is a heap-based overflow within the Windows Installer process, with an attacker requiring local access and no user interaction...

CVE-2023-36005

CVE-2023-36005 is documented in connected sources as a Windows Telephony Server Elevation of Privilege vulnerability with a base impact of obtaining increased privileges. The NC SC advisory lists the CVE with a base CVSS-like rating of 7.5 (HIGH) and notes a network-associated context, but the pr...

CVE-2024-49107

Technical details, affected components, and remediation specifics for CVE-2024-49107 are not provided in the supplied connected documents. Monitor for official updates from Microsoft and CVE listings for concrete technical description, impact, and fixes.

CVE-2025-30385

Technical details about CVE-2025-30385 are not provided in the connected documents. The initial description mentions a Windows use-after-free in the CLFS driver that could elevate privileges, but no vendor/version specifics or fixes are disclosed here. Monitor for authoritative updates.

CVE-2026-40377

Technical details (affected components, root cause, impact specifics, or fixes) are not publicly provided in the connected documents. Monitor vendor advisories for patch information and affected products; no additional specifics are available here.

CVE-2026-40382

CVE-2026-40382 is a use-after-free vulnerability in Windows Telephony Service that allows an authorized local attacker to elevate privileges. The CVSS 3.1 vector indicates a Local, Low-privilege, No-UI, with High confidentiality, integrity, and availability impact (base score 7.8). The connected ...

CVE-2026-45487

CVE-2026-45487 is a Windows vulnerability in the Program Compatibility Assistant Service where a TOCTOU race condition enables a local, authorized user to elevate privileges. Affected component: Program Compatibility Assistant Service on Windows. Root cause: TOCTOU race condition allowing privile...

CVE-2026-61347

CVE-2026-61347 describes a buffer over-read in Windows Event Logging Service that allows an authorized attacker with LOW privileges and local access to disclose information. The CVSS 3.1 metrics indicate a MEDIUM base score (5.5), with LOCAL attack vector, low attack complexity, no user interacti...

CVE-2026-62753

CVE-2026-62753 is a heap-based buffer overflow in Windows HTTP.sys that allows local privilege escalation by an authorized attacker. Affected: Windows HTTP.sys; Impact: local high-severity compromise of confidentiality, integrity, and availability. CVSS: 7.0 (3.1) with LOCAL, LOW privileges requi...

CVE-2026-62880

Windows CVE-2026-62880 is an out-of-bounds read in Windows NTFS that enables an authorized local user to elevate privileges. Impact: local escalation of rights with high confidentiality/integrity/availability impact per the NVD metrics. The root cause is an out-of-bounds read in NTFS handling. Th...

CVE-2026-62892

CVE-2026-62892 is a use-after-free vulnerability in the Capability Access Management Service (camsvc) that could allow an authorized attacker to elevate privileges locally. The publicly available data identifies a local attack vector with high impact (confidentiality, integrity, and availability)...

CVE-2024-43526

Technical details (affected product/version, root cause, impact, or fix) for CVE-2024-43526 are not publicly provided in the supplied connected documents. Monitor for updates from official advisories.

CVE-2025-21352

CVE-2025-21352 is a Windows Internet Connection Sharing (ICS) Denial of Service vulnerability. The NVD entry describes a DoS impact with an overall CVSS v3.1 base score of 6.5 (MEDIUM), attack vector Adjacent, attack complexity Low, privileges required None, user interaction None, and high availa...

CVE-2026-26132

CVE-2026-26132 is a Windows Kernel elevation-of-privilege vulnerability with a 7.8 CVSS score (3.1). Attack vector is LOCAL, complexity LOW, privileges required LOW, user interaction NONE, and scope UNCHANGED; impact is HIGH on confidentiality, integrity, and availability. Exploitation status: UN...

CVE-2026-32161

CVE-2026-32161 describes a race condition in the Windows Native WiFi Miniport Driver caused by improper synchronization, enabling an adjacent-network attacker to potentially execute code on the vulnerable system. The description across sources notes a remote-code-execution impact with a CVSS v3.1...