CVE-2025-58739

CVE-2025-58739 affects Windows File Explorer and is described as the exposure of sensitive information to an unauthorized actor, enabling spoofing over a network. The CVSS 3.1 base score is 6.5 (Network, Low attack complexity, No privileges, User interaction required) with Confidentiality impact ...

CVE-2025-59187

CVE-2025-59187 corresponds to a Windows Kernel local privilege escalation described in EUVD-2025-34304 as due to improper input validation. The vulnerability affects the Windows Kernel with the potential for an authorized attacker to elevate privileges locally. The connected KB updates discuss Wi...

CVE-2025-62219

CVE-2025-62219 is a local elevation-of-privilege in the Microsoft Wireless Provisioning System caused by a double-free error. The public descriptions in the connected documents confirm the vulnerability exists and that it enables an authorized attacker to elevate privileges on affected Windows pl...

CVE-2026-20826

CVE-2026-20826 describes a race-condition in the Tablet Windows User Interface (TWINUI) Subsystem. The initial entry asserts an information disclosure/elevation of privileges vector via concurrent access to a shared resource, enabling an authorized attacker to elevate privileges locally. Microsof...

CVE-2026-21246

CVE-2026-21246 is a heap-based buffer overflow in the Microsoft Graphics Component that enables local privilege escalation for an authorized attacker. The CVSS 3.1 vector (LOCAL, LOW complexity, LOW privileges, NONE user interaction) yields a base score of 7.8 (HIGH impact on confidentiality, int...

CVE-2026-24290

CVE-2026-24290 concerns the Windows Projected File System and is an Elevation of Privilege vulnerability. The CVE shows a LOCAL attack vector with LOW privileges required and NONE user interaction, with impacts on confidentiality, integrity, and availability rated as High. The metric set indicate...

CVE-2026-25186

Technical details not publicly available in the provided documents. Monitor for updates.

CVE-2026-32152

CVE-2026-32152 is a use-after-free in Desktop Window Manager that allows an authenticated, local attacker to elevate privileges. Microsoft has issued multiple security updates addressing this vulnerability across Windows SKUs (e.g., KB5082142 for Server 2022, KB5082052 for Windows 11 23H2, KB5083...

CVE-2026-32159

CVE-2026-32159 affects Windows Push Notifications. The issue is a local elevation-of-privilege vulnerability with a CVSS v3.1 base score of 7.8 (HIGH). Attack requires local access, high attack complexity, and low privileges, with no user interaction, and can impact confidentiality, integrity, an...

CVE-2025-49761

CVE-2025-49761 is a Windows Kernel local privilege escalation (Use-after-free) vulnerability. The connected data confirms an effect: “Obtaining elevated privileges” with CVSS v3.1 base metrics indicating LOCAL, low attack complexity and privileges required, high impact to confidentiality/integrit...

CVE-2025-53804

CVE-2025-53804 affects the Windows Kernel and involves exposure of sensitive information to an unauthorized actor, allowing local disclosure. The threat is categorized with a CVSS v3.1 base score of 5.5 (Medium) and a local attack vector with low complexity, where privileges are low and no user i...

CVE-2025-55700

CVE-2025-55700 describes an out-of-bounds read in Windows Routing and Remote Access Service (RRAS) that enables an unauthenticated attacker to disclose information over the network. The Connected documents include a matching description (EUVD-2025-34409) but do not provide concrete technical deta...

CVE-2025-59205

CVE-2025-59205 is described as a race-condition vulnerability in the Microsoft Graphics Component caused by concurrent access to a shared resource, enabling an authorized local attacker to elevate privileges. The connected EUVD-2025-34293 entry reiterates the root cause and local privilege escala...

CVE-2026-20847

CVE-2026-20847 is described in connected sources as a Windows Shell vulnerability that allows spoofing of a user over a network. The NVD entry lists a MEDIUM severity (CVSS 3.1: 6.5) with network attack vector, low complexity, and requires low privileges; impact shown as high confidentiality loss...

CVE-2026-25174

CVE-2026-25174 is a Windows Privilege Elevation vulnerability described as an out-of-bounds read in the Windows Extensible File Allocation feature. The connected NCSC advisory confirms Microsoft has fixed vulnerabilities across Windows components, listing CVE-2026-25174 under Windows Extensible F...

CVE-2025-53139

CVE-2025-53139 is tied to Windows Hello. The connected sources confirm a vulnerability where sensitive information is transmitted in cleartext, enabling a local attacker to bypass a Windows Hello security feature. The risk is described as a local, low-gesture exploit with high impact on confident...

CVE-2025-55328

Vulnerability summary (CVE-2025-55328) : A race condition in Windows Hyper-V involving a shared resource can be exploited by an authorized local attacker to elevate privileges. The issue is categorized under Windows Hyper-V with a high impact (local, privilege escalation) and a high base score in...

CVE-2025-55686

CVE-2025-55686 is described as a use-after-free vulnerability in Windows PrintWorkflowUserSvc that allows an authorized, local attacker to elevate privileges. The Initial and connected sources confirm the vulnerable component (PrintWorkflowUserSvc) and the local privilege-escalation impact, but d...

CVE-2025-58725

CVE-2025-58725 is described in connected documents as a heap-based buffer overflow in Windows COM that allows a locally authenticated attacker to elevate privileges. The CVE is associated with Windows COM components, with a CVSS v3.1 score of 7.0 (Local, High impact, Privilege escalation) and Exp...

CVE-2025-58727

CVE-2025-58727 describes a race-condition in the Windows Connected Devices Platform Service (Cdpsvc) that allows an authenticated, local attacker to elevate privileges. The issue originates from concurrent execution using a shared resource without proper synchronization. Documents identify the af...

CVE-2025-58729

CVE-2025-58729 affects Windows Local Session Manager (LSM). The connected documents confirm an issue with improper validation of input type in LSM, allowing an authorized attacker to cause a Denial of Service over the network . The CVSS vectors indicate network access, low attack complexity, and ...

CVE-2025-59191

CVE-2025-59191 is a Windows security vulnerability in the Connected Devices Platform Service (Cdpsvc). It is described as a heap-based buffer overflow that, when exploited by an authenticated local attacker, enables elevation of privileges. The CVE is documented with a high impact (local, privile...

CVE-2026-20866

CVE-2026-20866 is a race condition in Windows Management Services caused by concurrent access to a shared resource without proper synchronization, leading to local privilege escalation. Affected component: Windows Management Services. Impact: elevated privileges locally. The connected documents i...

CVE-2026-26162

CVE-2026-26162 is a Windows OLE vulnerability described as a type-confusion in resource access that enables a locally authenticated attacker to elevate privileges. The Red Hat and NVD/NCSC entries confirm the same issue, with Microsoft’s MSRC entry associating it to Windows OLE and listing Window...

CVE-2026-27931

CVE-2026-27931 : Windows GDI contains an out-of-bounds read vulnerability that allows a local, unprivileged attacker to disclose information. Affected component: Windows GDI. Root cause: read past buffer bounds in GDI. Impact: local information disclosure of sensitive data. Exploitation status: n...

CVE-2026-62723

CVE-2026-62723 is a use-after-free vulnerability in Windows Telephony Service that allows an authorized attacker to elevate privileges locally. The NVD entry and CVE records confirm a local exploit path with low privileges required and no user interaction, with a CVSSv3.1 base score of 7.0 (High)...

CVE-2025-54103

Technical details about CVE-2025-54103 (affected product, vulnerable component, root cause, impact, and patch status) are not provided in the supplied documents. Monitor MSRC updates and NVD for concrete remediation steps.

CVE-2025-55679

CVE-2025-55679 is a Windows Kernel information-disclosure vulnerability caused by improper input validation, enabling a local attacker to disclose information. The CVE is documented in multiple sources (NVD/NCSC lists) with a local attack vector and a medium base impact. Connected MS advisories a...

CVE-2025-62463

CVE-2025-62463 is a Windows DirectX Graphics Kernel vulnerability where a null pointer dereference in DirectX can allow an authorized local attacker to cause Denial of Service. The CVE is classified as a local, low-privilege, non-user-interaction DoS with a medium base score (6.5) per CVSS 3.1 me...

CVE-2025-62467

CVE-2025-62467 is a Windows Projected File System Elevation of Privilege vulnerability where an integer overflow/wraparound in ProjFS can allow an authenticated, local attacker to escalate privileges. Public sources confirm the issue is tied to Windows Projected File System and summarize the impa...

CVE-2025-62571

CVE-2025-62571 is a Windows Installer Elevation of Privilege vulnerability caused by improper input validation. The CVE affects Windows Installer, enabling an authorized, local attacker to escalate privileges (CVSS v3.1: 7.8, Local, Privileges Required: Low, User Interaction: None). Connected sou...

CVE-2026-20939

CVE-2026-20939: Windows File Explorer information disclosure allowing a locally authenticated user to view sensitive data. The issue has a CVSSv3.1 base score of 5.5 (Local, Low attack complexity, Low privileges, Confidentiality impact: High). Microsoft has released fixes in January 2026 security...

CVE-2026-62726

CVE-2026-62726 is a Windows vulnerability described as a use-after-free in the Windows Telephony Service that enables local privilege escalation by an authorized user. The CVSS 3.1 vector (LOCAL, HIGH impact to confidentiality, integrity, and availability) yields a base score of 7.0. The provided...

CVE-2025-60706

According to the NCSC advisory, CVE-2025-60706 is a vulnerability in Windows Hyper-V where an out-of-bounds read can allow an authorized local attacker to disclose information (impact: access to sensitive data). The CVE is listed under Windows Hyper-V in the advisory with a CVSS v3.1 base score o...

CVE-2025-60719

Technical details about CVE-2025-60719 are not provided in the connected documents. The initial description notes a local privilege elevation in Windows AFD/WinSock, but no vendor/version specifics or fixes are included here. Monitor official advisories for updates.

CVE-2025-62213

Technical details about CVE-2025-62213 (affected component, root cause, impact, remediation) are not disclosed in the provided documents; no specifics on exploitability or affected products are available here; monitor for updates.

CVE-2026-20874

CVE-2026-20874 is a Windows Management Services race condition that can lead to local privilege elevation. The initial description states the issue is a race condition in Windows Management Services exploited by an authorized attacker to escalate privileges. Connected documents corroborate this u...

CVE-2026-80093

A use-after-free flaw in the Windows Cloud Files Mini Filter Driver allows an authorized local attacker to achieve privilege escalation . The vulnerability is rated CVSS 7.0 (HIGH) with a local attack vector, high complexity, and low privileges required, impacting confidentiality, integrity, and ...

CVE-2026-83991

CVE-2026-83991 affects the Windows Cloud Files Mini Filter Driver , where a missing authentication check on a critical function allows a locally authenticated attacker to perform tampering . The vulnerability is rated CVSS 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges re...

CVE-2026-83995

CVE-2026-83995 is a heap-based buffer overflow in Windows NTFS that allows an authorized attacker to escalate privileges locally. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , with low attack complexity, low privileges required, and no user interaction needed, resulting in high impac...

CVE-2025-62462

CVE-2025-62462 is a Windows ProjFS (Projected File System) Elevation of Privilege vulnerability caused by a buffer over-read, enabling an authorized local attacker to escalate privileges. The CVSS v3.1 base score is 7.8 (HIGH) with LOCAL and LOW privileges required and no user interaction. Connec...

CVE-2026-20848

CVE-2026-20848 describes a race condition in Windows SMB Server caused by concurrent execution over a shared resource with improper synchronization. This vulnerability could allow an authorized attacker to elevate privileges over the network. Connected documents confirm the issue is categorized a...

CVE-2026-24293

CVE-2026-24293 describes a null pointer dereference in the Windows Ancillary Function Driver for WinSock that enables an authorized, local attacker to elevate privileges. The vulnerability is identified in Microsoft’s advisory ecosystem and is tracked across multiple feeds (NVD/NCSC/ENISA EUVD) w...

CVE-2025-59510

Technical details about CVE-2025-59510 (RRAS in Windows) are not publicly provided in the supplied documents. Monitor for updates from Microsoft regarding affected products, impact, and remediation.

CVE-2025-60714

Technical details for CVE-2025-60714 are not provided in the supplied documents. Connected KB/MS update entries discuss Windows Secure Boot and general OS updates but do not disclose affected products, root cause, or fixes for this CVE. Monitor for updates.

CVE-2025-62454

CVE-2025-62454 is a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver that could allow an authorized local attacker to achieve elevated privileges. Connected notes confirm this CVE is mapped to the Windows Cloud Files Mini Filter Driver elevation of privilege vulnerability ...

CVE-2026-32075

CVE-2026-32075 affects Windows that uses the UPnP Device Host; vulnerability is Elevation of Privilege via a local vector. Requires LOW privileges and no user interaction, with high impact on confidentiality, integrity, and availability. Exploit code maturity is UNPROVEN; remediation is an offici...

CVE-2026-83942

CVE-2026-83942 is a Windows Kernel elevation of privilege vulnerability caused by a missing authorization check , allowing an attacker with low local privileges to gain full control of the system (high impact on confidentiality, integrity, and availability). The vulnerability carries a CVSS 3.1 b...

CVE-2025-62465

CVE-2025-62465 is a local Denial-of-Service vulnerability in Windows DirectX (DirectX Graphics Kernel) caused by a null pointer dereference. It affects Windows DirectX components and can be exploited locally by an authorized attacker to disrupt services. Connected sources confirm the vulnerabilit...

CVE-2025-62472

CVE-2025-62472 affects Windows Remote Access Connection Manager. The issue is described as an elevation of privilege vulnerability caused by use of an uninitialized resource, allowing an authorized local attacker to gain higher privileges. Microsoft’s December 2025 updates (e.g., KB5071501/KB5071...