2441 matches found
CVE-2026-34351
CVE-2026-34351 describes a race condition in Windows TCP/IP where concurrent access to a shared resource allows an authorized attacker to elevate privileges locally. The provided description states a local, privilege-escalation risk with a high impact on confidentiality, integrity, and availabili...
CVE-2026-45606
CVE-2026-45606 concerns an out-of-bounds read in the Microsoft UxTheme Library (uxtheme.dll) that allows an authorized, low-privilege user to cause a local denial of service. The NVD/NIST and CVE records concur on the impact as a local DoS; attack vector is LOCAL, with LOW prerequisites and NONE ...
CVE-2026-49167
CVE-2026-49167 is a Windows Kernel use-after-free vulnerability enabling local privilege escalation by an authorized attacker. Affected component: Windows Kernel. Root cause: use-after-free in kernel code leading to elevation of privileges. Impact: local elevation with high confidentiality/integr...
CVE-2026-50307
CVE-2026-50307 (Windows TCP/IP) is a local privilege-escalation vulnerability in the Windows TCP/IP stack caused by a use-after-free condition. The issue could allow an authenticated, local attacker to elevate privileges on a vulnerable system. The CVE is documented across multiple sources, inclu...
CVE-2026-50308
CVE-2026-50308 is a Windows NTFS vulnerability described as an integer underflow (wrap or wraparound) that could allow an unauthorized attacker to execute code locally. Sources consistently state: affected component is Windows NTFS on Windows systems; impact is local code execution with high seve...
CVE-2026-50410
CVE-2026-50410 is a Windows Runtime use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Multiple connected sources confirm the issue affecting Windows Runtime and describe local privilege escalation as the impact, with CVSS v3.1 score of 7.0 (HIGH) and L...
CVE-2026-50692
CVE-2026-50692 is a Windows vulnerability in Desktop Window Manager (DWM): a heap-based buffer overflow that enables local privilege escalation by an authorized, low-privilege user with no user interaction. Public sources confirm the issue and Microsoft has released updates to address it; affecte...
CVE-2026-57087
CVE-2026-57087 is a Windows Media Foundation remote code execution vulnerability caused by a heap-based buffer overflow in Windows Media Foundation. An unauthenticated attacker could trigger code execution over a network. Public sources confirm the flaw affects Windows Media/Media Foundation comp...
CVE-2026-58541
CVE-2026-58541 — Windows DWM Core Library Elevation of Privilege due to a type confusion in DWM. Affected component: Windows DWM Core Library/DWM (Windows OS). Description from sources: Access of resource using incompatible type ('type confusion') in Windows DWM allows an authorized attacker to e...
CVE-2025-24052
CVE-2025-24052 concerns vulnerabilities in the Agere modem driver (ltmdm64.sys) shipped with Windows. The connected Microsoft KBs confirm that the ltmdm64.sys driver is removed in October 2025 updates, and that fax-modem hardware relying on this driver will no longer function on Windows after the...
CVE-2025-53722
CVE-2025-53722 affects Windows Remote Desktop Services. Described as Denial-of-Service via uncontrolled resource consumption, exploitable over the network with no user interaction and no privileges required. CVSS v3.1 base score 7.5 (Network, Low attack complexity, No privileges, No user interact...
CVE-2025-53724
CVE-2025-53724 is a Windows Push Notifications vulnerability described as a type confusion that allows an authorized, locally authenticated attacker to elevate privileges. The CVE is linked to Windows Push Notifications and is rated with a base score of 7.8 (HIGH) via CVSS 3.1, with attack vector...
CVE-2025-53810
CVE-2025-53810 describes a type confusion vulnerability in Windows Defender Firewall Service that allows an authorized local attacker to escalate privileges. The connected NC SC/ENISA-style document confirms the affected component as Windows Defender Firewall Service and lists the impact as obtai...
CVE-2025-55338
CVE-2025-55338 is associated with Windows BitLocker and is described as a ROM-patching deficiency that could allow circumvention of a security feature via a physical attack. Connected documents reference Windows BitLocker entries including CVE-2025-55338 in MSKB/brief vulnerability lists, noting ...
CVE-2025-58734
CVE-2025-58734 is described as a use-after-free vulnerability in the Windows Inbox COM Objects that can allow a local attacker to achieve arbitrary code execution. The connected document from CNVD confirms that Inbox COM Objects contain a code execution vulnerability, supporting the CVE’s impact ...
CVE-2025-59290
CVE-2025-59290 is a local privilege escalation caused by a use-after-free in Windows Bluetooth Service. Affected component: Windows Bluetooth Service. Root cause: use-after-free. Impact: an authorized attacker can elevate privileges locally. Exploitation status is not specified in the provided do...
CVE-2025-59512
Technical details about CVE-2025-59512, including affected product, root cause, exploitability or remediation, are not publicly provided in the supplied Connected Documents. Monitor for official updates (mitigations/patches) as newer MSKBs may cover this CVE.
CVE-2026-20825
CVE-2026-20825 is a Windows Hyper-V information-disclosure vulnerability described as “improper access control” that can allow an authorized local attacker to disclose information. The CVE is rated with local attack vector, high privilege requirement, and high confidentiality impact (CVSS: 4.4, M...
CVE-2026-21240
CVE-2026-21240 describes a local, authenticated TOCTOU race in Windows HTTP.sys that can allow privilege escalation. Affected component: Windows HTTP.sys. Root cause: time-of-check/time-of-use race condition. Impact: high (local escalation of privileges, potential confidentiality, integrity, and ...
CVE-2026-24292
CVE-2026-24292 is a Windows vulnerability in the Connected Devices Platform Service (Cdpsvc) described as a use-after-free that enables local privilege escalation for an authenticated, non-user interaction scenario. Connected documents corroborate the issue with Cdpsvc and list the CVE-2026-24292...
CVE-2026-25185
Technical details (affected products, components, root cause, impact, and remediation) are not provided in the supplied documents. Monitor for updates.
CVE-2026-32155
CVE-2026-32155 – Desktop Window Manager Use-After-Free : A security issue in Windows Desktop Window Manager allows an authenticated local attacker to achieve elevation of privilege via a use-after-free condition. The vulnerability is described as a local, post-authentication privilege escalation ...
CVE-2026-32160
CVE-2026-32160 is a Windows Push Notifications Elevation of Privilege vulnerability. The CVSSv3.1 score is 7.8 (HIGH), with local, high-impact access and no user interaction. Exploit code maturity is UNPROVEN; remediation is an official fix per Microsoft. References point to the Microsoft update ...
CVE-2026-34328
CVE-2026-34328 describes an information-disclosure issue in Windows Audio Service, allowing a local attacker with low privileges to disclose sensitive information. Affected: Windows Audio Service (Windows). Root cause details are not provided beyond the high-level description. CVSS v3.1 base scor...
CVE-2026-50312
CVE-2026-50312 is a Windows Ancillary Function Driver for WinSock use-after-free vulnerability that enables local privilege escalation when exploited. The initial description and connected sources confirm the affected component and root cause, and indicate the impact is elevation of privileges fo...
CVE-2026-50389
CVE-2026-50389 affects Windows File Explorer and is a local information-disclosure vulnerability where an authorized attacker can disclose sensitive information. The issue is confirmed in Windows File Explorer (Explorer.exe) and is addressed by Microsoft security updates; multiple MSRC/MSKB entri...
CVE-2026-54989
CVE-2026-54989 is a use-after-free in the Quality Windows Audio/Video Experience (QWAVE) service that enables a locally authenticated attacker to elevate privileges. The CVSS 3.1 metrics describe a Local attack with High impact on confidentiality, integrity, and availability, requiring LOW privil...
CVE-2026-54995
CVE-2026-54995 refers to a use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). The flaw could allow an unauthenticated attacker to execute arbitrary code over the network. Public references in the provided docs (NVD, MSRC update guidance, and patch reviews) c...
CVE-2026-57976
The CVE-2026-57976 entry concerns Windows Active Directory Domain Services and is triggered by a null pointer dereference that can cause a denial of service over the network by an authorized attacker. The NVD entry corroborates a CVSS v3.1 base score of 6.5 (Medium), with NETWORK attack vector, L...
CVE-2025-53131
CVE-2025-53131 is a heap-based buffer overflow in Windows Media that could allow an unauthenticated attacker to execute code over the network. The Connected documents show Windows security updates in August 2025 (and related servicing stack updates) addressing Windows Media and other components, ...
CVE-2025-53143
CVE-2025-53143 is listed for Windows Message Queuing with high impact (CVSS 3.1: 8.8, Network, Privileges Low, User Interaction None). The entry indicates a remote code execution potential via resource type confusion. Connected sources confirm the vulnerability exists in MSMQ and note a network-e...
CVE-2025-53807
CVE-2025-53807 describes a race condition in the Microsoft Graphics Component that allows local privilege escalation. The NCSC document confirms CVE-2025-53807 under Windows-related vulnerabilities. The CVSS3.1 vector from the initial document indicates a Local attack vector, High impact on confi...
CVE-2025-58735
CVE-2025-58735 is a Use-after-free vulnerability in Inbox COM Objects leading to local code execution. The base CVSS v3.1 score is 7.0 (HIGH) with LOCAL attackVector, HIGH impact on confidentiality/integrity/availability, and user interaction required. Connected MSKB/NCSC entries confirm a Window...
CVE-2025-59207
CVE-2025-59207 is an elevation-of-privilege vulnerability in the Windows Kernel caused by an untrusted pointer dereference, enabling a locally authenticated attacker to elevate privileges. The Initial Description confirms the vulnerability type and impact. The Connected Documents provide Windows-...
CVE-2025-62458
CVE-2025-62458 is a Windows Win32K GRFX elevation-of-privilege vulnerability (heap-based overflow) that enables local privilege escalation by an authorized user. Connected sources confirm the issue is associated with Windows Win32K GRFX components and is part of Microsoft’s December 2025 patch cy...
CVE-2025-62461
CVE-2025-62461 is a Windows Projected File System Filter Driver elevation-of-privilege vulnerability caused by a buffer over-read. It allows an authorized local attacker to elevate privileges. Public sources (NCSC/NVD-style listings) assign a CVSS v3.1 base score of 7.8 (High) with Local attack v...
CVE-2026-20869
CVE-2026-20869 affects Windows Local Session Manager (LSM) and is described as a race-condition vulnerability in the management of a shared resource that allows an authenticated, local attacker to elevate privileges. The initial CVE entry cites local privilege escalation with a high impact. Micro...
CVE-2026-20937
CVE-2026-20937 affects Windows File Explorer and is described as an information-disclosure vulnerability allowing a locally authorized attacker to disclose information. The provided documents confirm a Windows File Explorer exposure, with CVSS 3.1/5.5 (Local access, Low attack complexity, High co...
CVE-2026-26161
Technical details such as affected product/component, root cause, impact specifics, or available remediation are not provided in the supplied documents. Monitor official CVE and vendor advisories for updates.
CVE-2026-32212
CVE-2026-32212 refers to a Universal Plug and Play information disclosure in upnp.dll. The CVSSv3.1 base score is 5.5 (Medium) with LOCAL attack vector, LOW attack complexity, LOW privileges required, and no user interaction. Impact is confined to confidentiality (HIGH) with no integrity/availabi...
CVE-2026-49180
This CVE concerns the Universal Plug and Play component upnp.dll, where an improper link resolution before file access (link following) can lead to local information disclosure. The entry notes that an authorized attacker can disclose information locally, with a CVSS base score of 5.5 (Medium). A...
CVE-2026-49804
CVE-2026-49804 describes a heap-based buffer overflow in the Windows USB Video Driver that can allow an unauthorized attacker to elevate privileges via a physical attack. The vulnerability is characterized by a physical attack vector with low exploit complexity and the need for user interaction, ...
CVE-2026-50296
CVE-2026-50296 is a use-after-free vulnerability in the DirectX Graphics Kernel that allows an authorized, local attacker to elevate privileges. The cited CVSS 3.1 vector is LOCAL, with HIGH impact on confidentiality, integrity, and availability, and requires LOW privileges with no user interacti...
CVE-2026-50303
CVE-2026-50303 describes a vulnerability in Windows Key Guard where use of a cryptographic primitive with a risky implementation enables an authorized local attacker to bypass a security feature. Affected component: Windows Key Guard cryptographic handling; root cause: risky implementation of the...
CVE-2026-50377
CVE-2026-50377 is a Windows Kernel elevation-of-privilege vulnerability described as an out-of-bounds read that enables an authorized local attacker to gain higher privileges. The connected materials consistently identify the Windows Kernel as the affected component and state the root cause as a ...
CVE-2026-50445
CVE-2026-50445 is a Windows Remote Desktop Protocol (RDP) information-disclosure vulnerability caused by a buffer over-read. An unauthenticated, remote attacker could disclose memory information over the network. Microsoft and partners have released updates (MSRC guidance) to address this vulnera...
CVE-2026-50456
CVE-2026-50456 is a Windows File Explorer information disclosure vulnerability. A local attacker with low privileges and no user interaction can access sensitive information due to the underlying issue in Windows File Explorer. The CVSS.3.1 score is 5.5 (Medium), with attack vector Local, impact...
CVE-2026-50695
CVE-2026-50695 refers to a stack-based buffer overflow in Microsoft Windows Active Directory Federation Services (AD FS) that enables an unauthenticated, remote attacker to cause a denial of service over the network. The vulnerability is described with a CVSS v3.1 base score of 7.5 (HIGH) with at...
CVE-2026-54112
CVE-2026-54112 affects Windows Win32K. The issue is a race condition caused by concurrent execution on a shared resource due to improper synchronization, enabling a locally authenticated user to elevate privileges. The base score is 7.8 (HIGH) with LOCAL attack vector, requiring LOW privileges an...