CVE-2026-50686

CVE-2026-50686 is a Windows OLE remote code execution vulnerability caused by a type confusion in resource access. It enables network-exposed code execution without authentication and is documented with CVSS v3.1 base score 8.1 (High). Public references identify the affected area as Windows OLE, ...

CVE-2026-57083

CVE-2026-57083 : A vulnerability in the Windows Codecs Library (Windows Media Photo Codec) arises from use of an uninitialized resource, enabling a local attacker to disclose information. Documented impact is local information disclosure with a CVSS 3.1/5.5 (Local, Privileges NONE, User Interacti...

CVE-2026-62690

CVE-2026-62690 concerns Windows Push Notifications. The issue is a race condition caused by concurrent execution using a shared resource with improper synchronization, allowing an authorized attacker to elevate privileges locally. The available documents do not specify the affected product versio...

CVE-2025-50166

CVE-2025-50166 affects Windows Distributed Transaction Coordinator (MSDTC). The issue is an integer overflow/wraparound in MSDTC that can lead to information disclosure over the network when exploited by an attacker with low privileges and no user interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N...

CVE-2025-50175

CVE-2025-50175 is a Windows Digital Media use-after-free that allows a local, authorized attacker to elevate privileges. The provided documents confirm the vulnerability name and impact (local elevation of privilege) and indicate Microsoft Windows components are involved, but they do not supply c...

CVE-2025-53134

Technical details about CVE-2025-53134 are not publicly disclosed in the provided Connected documents. Available sources confirm the vulnerability description only (race condition in Windows Ancillary Function Driver for WinSock with local privilege escalation). Monitor for updates.

CVE-2025-53154

CVE-2025-53154 concerns the Windows Ancillary Function Driver for WinSock and describes a null pointer dereference that enables a local, authorized user to achieve privilege escalation. The CVSSv3.1 metrics cited by Microsoft indicate a local attack vector, low attack complexity, and required pri...

CVE-2025-55226

Technical details about CVE-2025-55226 are not publicly provided in the supplied documents. Monitor for updates from Microsoft and Vulners for affected products, versions, and fixes once details are published.

CVE-2025-58714

CVE-2025-58714 is an elevation-of-privilege issue in the Windows Ancillary Function Driver for WinSock caused by improper access control. The description indicates an authorized attacker could locally elevate privileges. Connected Microsoft advisories (KB/OS update pages) show this CVE among Wind...

CVE-2025-58720

CVE-2025-58720 (Windows Cryptographic Services) has concrete details in connected docs. The vulnerability arises from using a cryptographic primitive with a risky implementation in Windows Cryptographic Services, enabling an authenticated local attacker to disclose information. The vulnerability ...

CVE-2025-60709

Technical details (affected product/version, root cause, impact, exploit specifics) are not publicly provided in the given documents for CVE-2025-60709. Monitor for updates from Microsoft; no additional vulnerability specifics are available here.

CVE-2025-60720

Technical details for CVE-2025-60720 (TDX.sys) are not provided in the Connected documents. The Initial Description notes local privilege escalation via a buffer over-read; no vendor/version/patch details are supplied here; monitor for updates.

CVE-2025-62452

Technical details about CVE-2025-62452 (heap-based buffer overflow in RRAS) are not publicly provided in the supplied documents. The connected KB/MS documents do not specify affected products/versions, exploit details, or mitigations. Monitor for updates.

CVE-2025-62473

CVE-2025-62473 is a Windows RRAS information-disclosure vulnerability caused by a buffer over-read. It enables an unauthenticated attacker to disclose information over the network. Connected sources confirm affected component as Windows Routing and Remote Access Service (RRAS) and label the vulne...

CVE-2026-25171

Use-after-free in Windows at the level of Windows Authentication Methods allows an authorized attacker to elevate privileges locally. The vulnerability, CVE-2026-25171, is documented as a local privilege escalation in Windows Authentication Methods; exploitation requires the attacker to be locall...

CVE-2026-45588

CVE-2026-45588 concerns a protection mechanism failure in Windows Secure Boot that allows an authorized attacker to bypass a security feature locally. The NVD/CVE entry describes a local attack with high impact on confidentiality and integrity and no availability impact, requiring high privileges...

CVE-2026-45594

CVE-2026-45594 : This vulnerability concerns the Windows Application Identity (AppID) Subsystem , where an exposure of sensitive information to an unauthorized actor enables a local attacker to disclose information. The NVD entry reiterates the issue as a local confidentiality breach (impact: Hig...

CVE-2026-49792

CVE-2026-49792 is a Windows ReFS vulnerability due to a numeric truncation error that allows an authorized, local attacker to execute code. Affected component is Windows Resilient File System (ReFS); impact is local code execution with high confidentiality, integrity, and availability impact as p...

CVE-2026-50334

CVE-2026-50334 is a Windows Push Notifications/Windows Notification information disclosure vulnerability. The NVD description states an unauthorized local actor could disclose sensitive information. The CIRCL seen entries corroborate a Windows notification component issue with multiple advisories...

CVE-2026-50339

CVE-2026-50339 is a Windows Push Notifications information-disclosure vulnerability. It allows a low-privilege, local attacker with no user interaction to disclose sensitive data locally. Affected software is Windows Push Notifications; CVSS v3.1 base score 5.5 (Medium). Microsoft has released up...

CVE-2026-50375

CVE-2026-50375 is a Windows DirectX Graphics Kernel elevation-of-privilege vulnerability. The issue stems from a heap-based buffer overflow in DirectX, allowing an authorized attacker to locally elevate privileges. Affected component: Windows DirectX/DirectX Graphics Kernel (dxgkrnl). Current doc...

CVE-2026-50390

CVE-2026-50390 is a Windows Kernel elevation-of-privilege in which an authorized attacker can gain local privileges through a type-confusion vulnerability (incompatible resource type). The CVE is documented with a CVSSv3.1 vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, BASE SCORE 7.0 (HIGH). Affe...

CVE-2026-50437

CVE-2026-50437 describes an out-of-bounds read in Windows DWM Core Library that could allow an authenticated local attacker to disclose information. Public docs identify the affected component (Windows DWM Core Library) and the impact (local information disclosure) with a CVSSv3.1 base score of 5...

CVE-2026-50492

CVE-2026-50492 describes a heap-based buffer overflow in the Windows Resilient File System (ReFS) that allows an unauthorized attacker to achieve remote code execution with a physical attack. The connected sources corroborate ReFS as the affected component and frame the impact as remote code exec...

CVE-2026-56173

CVE-2026-56173 is a use-after-free vulnerability in Windows WebView that allows an authorized local attacker to escalate privileges. The issue is tied to the Windows WebView component and is listed with a high impact (local elevation of privileges) in the CVE entry. Connected sources corroborate ...

CVE-2026-57982

CVE-2026-57982 is a Windows Remote Desktop Protocol (RDP) information-disclosure vulnerability caused by the use of an uninitialized resource. An authenticated attacker could disclose information over the network. Public details identify the affected component as Windows RDP/RDP client-server int...

CVE-2026-61366

Affected component: Windows Network Connection Broker. Vulnerability: double free allows local privilege escalation by an authorized user. Root cause: double-free in the broker when handling network connection objects. Impact: high; local attacker with low privileges and no user interaction can e...

CVE-2025-50152

CVE-2025-50152 is a Windows Kernel vulnerability (Out-of-bounds read) that could enable an authorized local attacker to elevate privileges. The initial record lists the CVE with a CVSS v3.1 base score of 7.8 (HIGH) and LOCAL attack vector/low complexity, with no exploitation details. Connected do...

CVE-2025-50167

CVE-2025-50167 involves a race condition in Windows Hyper-V due to improper synchronization on a shared resource, enabling an authorized local attacker to elevate privileges. The description in the Connected Documents confirms the vulnerability impact as local privilege escalation within Hyper‑V....

CVE-2025-53716

CVE-2025-53716 is a Denial-of-Service vulnerability due to a null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS). The CVE description states an authorized attacker can trigger a network-based DoS without user interaction, with attack vector NETWORK and impact Av...

CVE-2025-53718

Technical details about CVE-2025-53718 are not publicly available in the provided connected documents. No specific product/version/root-cause/impact details are provided here. Monitor future updates from Microsoft and CVE databases for remediation and impact information.

CVE-2025-54895

CVE-2025-54895 : Integer overflow or wraparound in Windows SPNEGO Extended Negotiation can let an authorized, locally authenticated attacker elevate privileges. The connected documents confirm the vulnerability in the Windows SPNEGO Extended Negotiation path and indicate the impact as local privi...

CVE-2025-54919

CVE-2025-54919 is linked to Windows Win32K GRFX and is described as a race condition in a shared resource that could allow an authorized, local attacker to execute code. The Connected documents confirm the CVE within Windows Win32K GRFX but do not provide concrete exploit details, affected versio...

CVE-2025-55685

CVE-2025-55685 is a use-after-free in Windows PrintWorkflowUserSvc that allows an authorized local attacker to elevate privileges. Affected software: Windows PrintWorkflowUserSvc component. Root cause: use-after-free in PrintWorkflowUserSvc (exact technical path not detailed in the provided docs)...

CVE-2025-55692

Technical details for CVE-2025-55692 are not publicly available in the provided documents. Monitor for updates from Microsoft, NVD, and the CVE list.

CVE-2025-59193

CVE-2025-59193 describes a race condition in Windows Management Services (a Windows component) where concurrent access to a shared resource allows an authorized local attacker to elevate privileges. The description in the CVE notes local, privilege-escalation impact due to improper synchronizatio...

CVE-2025-60716

CVE-2025-60716 : A use-after-free in Windows DirectX can enable an authorized local attacker to elevate privileges. The affected component is Windows DirectX; root cause is a use-after-free flaw. Impact is local privilege escalation with high potential impact. The provided connected documents do ...

CVE-2025-64670

CVE-2025-64670 is a Windows DirectX/Microsoft Graphics Component information disclosure vulnerability. The initial entry states exposure of sensitive data to an unauthorized actor over a network (CVSS v3.1: 6.5, Network, Low attack complexity, Low privileges). Connected documents corroborate a re...

CVE-2026-20853

CVE-2026-20853 is a local privilege-escalation in Windows WalletService caused by a race condition when a shared resource is concurrently accessed. Reported as a Windows WalletService privilege-vulnerability, the affected product is Windows, with the issue exploitable locally and potentially elev...

CVE-2026-20860

CVE-2026-20860 affects the Windows Ancillary Function Driver for WinSock and is a local privilege escalation via type confusion. Connected documents confirm the affected component and that exploitation requires local access with privileges already. Public details on exploit methods are not provid...

CVE-2026-20865

CVE-2026-20865 is a Windows Management Services use-after-free vulnerability that enables an authenticated, local attacker to achieve elevated privileges. The issue arises from a prior use-after-free in the Windows Management Services component, with exploitation requiring local access and no use...

CVE-2026-20925

CVE-2026-20925 affects Windows NTLM and is described as an external control of the file name or path that enables spoofing (pretend to be another user) over a network. The vulnerability is assigned a CVSS v3.1 base score of 6.5 (Medium) with network attack vector and required user interaction. Co...

CVE-2026-26160

CVE-2026-26160 affects the Windows Remote Desktop Licensing Service. The issue arises from missing authentication for a critical function, enabling an authorized local attacker to elevate privileges on affected systems. The CVE has a CVSS v3.1 base score of 7.8 (HIGH) with LOCAL attack vector, lo...

CVE-2026-26173

CVE-2026-26173 affects the Windows Ancillary Function Driver for WinSock and is described as a race-condition vulnerability in a shared-resource path that can allow an authenticated local attacker to elevate privileges to SYSTEM. The connected sources confirm this is a Windows elevation-of-privil...

CVE-2026-26177

Technical details about CVE-2026-26177 are not provided in the supplied documents. Monitor for updates from Microsoft and the CVE record.

CVE-2026-27930

CVE-2026-27930 is a Windows GDI information disclosure vulnerability. The CVSSv3.1 base score is 5.5 (Medium); attack is LOCAL, requires user interaction, and does not affect integrity or availability, but threatens confidentiality HIGH. The record notes an OFFICIAL_FIX remediation level, implyin...

CVE-2026-32164

CVE-2026-32164 describes a race condition in Windows User Interface Core that can allow an authorized local attacker to elevate privileges. Technical details in the connected advisories confirm the flaw is a Windows UI Core race condition and that Microsoft has released security updates to fix it...

CVE-2026-32214

Technical details about CVE-2026-32214 are not provided in the given documents. No explicit affected products, vulnerable components, impact, or remediation details are disclosed here. Monitor for updates from official sources.

CVE-2026-49175

CVE-2026-49175 is a Windows DNS Client vulnerability described as a heap-based buffer overflow that allows an authorized attacker to achieve local privilege escalation. The issue affects the Windows DNS client and is characterized by a LOCAL attack vector with low attack complexity and the need f...

CVE-2026-50350

CVE-2026-50350 concerns an information-disclosure vulnerability in Windows’ Trusted Runtime Interface Driver. An authenticated local attacker may disclose sensitive information due to an underlying flaw in the driver, with CVSSv3.1 metrics indicating Local attack vector, Low attack complexity, Lo...