CVE-2026-72980

CVE-2026-72980 affects Windows Hello on Microsoft Windows. The vulnerability is an uncontrolled search path element that allows an authorized, local attacker to bypass a security feature. The attack vector is local with low complexity and requires high privileges but no user interaction. The prim...

CVE-2026-69580

A heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to escalate privileges locally. The vulnerability is rated CVSS 3.1 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, yielding full impact on confidentiality, integrity, and a...

CVE-2026-69911

CVE-2026-69911 is a use-after-free vulnerability in the Microsoft Windows Search Component that allows a locally authenticated attacker to achieve local privilege escalation . The flaw requires low privileges , high attack complexity , and no user interaction , with unchanged scope and high impac...

CVE-2025-62209

CVE-2025-62209 concerns the Windows License Manager. The vulnerability involves insertion of sensitive information into a log file, which could allow an authorized local attacker to disclose sensitive information. The CVSS 3.1 metrics (local, low attack complexity, low privileges required) indica...

CVE-2026-68845

CVE-2026-68845 is a heap-based buffer overflow in the Windows Program Compatibility Assistant Service that allows an authorized attacker to perform local privilege escalation . Microsoft rates it HIGH severity (CVSS 3.1: 7.8) with a local attack vector, low complexity, low privileges required, an...

CVE-2026-69316

CVE-2026-69316 is a buffer over-read vulnerability in the Windows Overlay Filter component. An authorized local attacker with low privileges can exploit it to disclose sensitive information . The attack requires high complexity and no user interaction, with a CVSS v3.1 base score of 4.7 (MEDIUM) ...

CVE-2026-69390

CVE-2026-69390 is an out-of-bounds read vulnerability in Windows Spaceport.sys that allows an authorized attacker to locally disclose information . The Microsoft CNA rates it CVSS 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges required, and a high impact on confidentialit...

CVE-2026-83979

CVE-2026-83979 is a use-after-free vulnerability in Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The Microsoft CVSS 3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and no require...

CVE-2026-83990

CVE-2026-83990 is a stack-based buffer overflow in the Microsoft Graphics Component that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (High) , with a local attack vector, low privileges required, no user interaction, and high impact on confidenti...

CVE-2026-69501

CVE-2026-69501 is an untrusted pointer dereference in Windows Secure Kernel Mode that allows an authorized local attacker to achieve privilege escalation . The underlying cause is improper handling of a pointer in the Secure Kernel Mode component, leading to arbitrary memory access in a high-priv...

CVE-2026-69669

CVE-2026-69669 is a heap-based buffer overflow in the Windows Kernel that allows an unauthorized attacker to achieve remote code execution over a network. The Microsoft-provided CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-reachable attack...

CVE-2026-69787

CVE-2026-69787 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized local attacker to escalate privileges. The assigned CVSS 3.1 score is 7.8 (High) , with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and low privileges re...

CVE-2026-69921

CVE-2026-69921 is a heap-based buffer overflow in Windows Print Spooler Components that allows a low-privilege local attacker to elevate privileges , with no user interaction required. The CVSS 3.1 score is 7.8 (HIGH) , reflecting local attack vector, low complexity, and high impact on confidenti...

CVE-2026-70342

CVE-2026-70342 affects the Windows Ancillary Function Driver for WinSock (AFD). The vulnerability is a use after free flaw that allows an unauthorized attacker to elevate privileges over a network. The CVSS 3.1 score is 8.1 (HIGH) , with a vector of network-based, high complexity, no privileges r...

CVE-2026-73019

CVE-2026-73019 involves an improper resolution of path equivalence in the Windows URL Moniker component, allowing an unauthorized attacker to bypass a security feature over a network. The vulnerability requires user interaction and grants low confidentiality impact with no integrity or availabili...

CVE-2026-81354

CVE-2026-81354 is a heap-based buffer overflow in Windows Hello that allows an authorized local attacker to elevate privileges. The vulnerability carries a CVSS 3.1 score of 8.2 (HIGH) with a changed scope, impacting confidentiality, integrity, and availability at high levels. Attack requirements...

CVE-2026-83986

CVE-2026-83986 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized, low-privilege attacker to locally elevate privileges . The vulnerability carries a CVSS 3.1 base score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low atta...

CVE-2026-68846

CVE-2026-68846 is a use-after-free vulnerability in the Windows Kernel that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R, indicating a network-based attack requiring high complexity , low privileges , and...

CVE-2026-69723

CVE-2026-69723 is an information disclosure vulnerability in the Windows Kernel . The flaw exposes sensitive system information to an unauthorized control sphere, allowing an authorized attacker to disclose information over a network. The CVSS 3.1 score is 5.7 (MEDIUM) with high confidentiality i...

CVE-2026-69773

A heap-based buffer overflow in the Windows Biometric Service allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 8.0 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating that exploitation requires low privileges and user interaction , but ...

CVE-2026-73011

CVE-2026-73011 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability carries a CVSS 3.1 score of 7.8 (High) with high impact to confidentiality, integrity, and availability. CISA's SSVC assessment ...

CVE-2026-73016

A heap-based buffer overflow in DirectWrite , a component of Microsoft's Graphics Component, allows an unauthorized attacker to achieve remote code execution over a network. The attack requires low complexity, no privileges, and user interaction, with full impact on confidentiality, integrity, an...

CVE-2026-83982

CVE-2026-83982 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to perform a local privilege escalation . The vulnerability is rated HIGH (CVSS 3.1: 7.8 ) with a local attack vector, low complexity, low privileges required, and no user interactio...

CVE-2026-69293

CVE-2026-69293 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability is rated CVSS 3.1 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, resulting in high impa...

CVE-2026-69366

CVE-2026-69366 is a use-after-free vulnerability in the Windows Kernel that allows an authorized attacker with low privileges to elevate privileges over a network, with user interaction required. The CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. No specific af...

CVE-2026-69578

CVE-2026-69578 is a numeric truncation error in the Windows Kernel that allows an authorized attacker with low privileges to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high attack complexit...

CVE-2026-70296

CVE-2026-70296 is an out-of-bounds write in the Windows Imaging Component that allows an unauthorized, unauthenticated attacker to achieve remote code execution over the network. The vulnerability is rated CVSS 3.1 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating lo...

CVE-2026-72995

CVE-2026-72995 is a heap-based buffer overflow in Windows Biometric Service that allows a local attacker with low privileges to elevate privileges, leading to high impact on confidentiality, integrity, and availability (CVSS 3.1 score: 7.8 HIGH ). The attack requires local access, has low complex...

CVE-2026-78454

An out-of-bounds read in the Windows CD-ROM Driver allows a local, low-privilege attacker to achieve information disclosure . The CVSS 3.1 score is 5.5 (Medium) , reflecting a local attack vector, low complexity, and high confidentiality impact with no integrity or availability impact. CISA's SSV...

CVE-2026-83973

CVE-2026-83973 is a heap-based buffer overflow in the Windows Biometric Service component, allowing a locally authenticated attacker with low privileges to achieve privilege escalation with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 7.8 – HIGH ). CISA's SSVC asses...

CVE-2026-84001

An out-of-bounds read vulnerability in Windows Key Distribution Center allows an unauthorized, remote attacker to cause a denial of service over the network. The flaw requires no privileges, no user interaction, and has low attack complexity, yielding a CVSS 3.1 score of 7.5 (HIGH) with high avai...

CVE-2026-62694

CVE-2026-62694 is a use-after-free vulnerability in Windows Installer that allows a locally authenticated attacker with low privileges to escalate privileges . The attack requires high complexity and no user interaction , with high impact on confidentiality, integrity, and availability (CVSS 3.1:...

CVE-2026-68827

CVE-2026-68827 is an integer underflow (wrap or wraparound) vulnerability in Windows GDI+ that allows an authorized attacker to achieve elevation of privileges over a network . The vulnerability is rated HIGH severity (CVSS 8.0) with a vector of AV:N/AC:L/PR:L/UI:R, meaning exploitation requires ...

CVE-2026-68833

CVE-2026-68833 is a heap-based buffer overflow in Windows NTFS (New Technology File System) that allows an unauthorized attacker to achieve code execution . The attack requires physical access to the system (CVSS:3.1 AV:P), with no privileges or user interaction needed, and results in high impact...

CVE-2026-68835

CVE-2026-68835 is a use-after-free vulnerability in Windows Print Spooler Components that allows an authorized attacker to elevate privileges over a network . The Microsoft-assigned CVSS 3.1 score is 7.1 (HIGH) , with an attack vector of network, high complexity, low privileges required, and user...

CVE-2026-69425

CVE-2026-69425 is an improper link resolution before file access (link following) vulnerability in Windows NTFS . An authorized attacker with low privileges and high attack complexity can perform local tampering , resulting in high integrity impact with no confidentiality or availability impact (...

CVE-2026-69599

Windows Remote Desktop Services contains a use-after-free vulnerability that allows an authorized attacker (low privileges required) to execute code over a network. The CVSS 3.1 score is 7.5 (HIGH) , with high attack complexity and no user interaction required, impacting confidentiality, integrit...

CVE-2026-69738

CVE-2026-69738 is an integer overflow or wraparound in the Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability scores CVSS 7.8 (HIGH) with a local attack vector, low complexity, low privileges required, and high impact to confidentiality, i...

CVE-2026-70283

CVE-2026-70283 affects Windows Win32K , the kernel-mode component handling window management. The root cause is an incorrect authorization flaw that allows a local attacker with low privileges to achieve local privilege escalation , resulting in full compromise of confidentiality, integrity, and ...

CVE-2026-72988

CVE-2026-72988 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation requires low privileges and no user inter...

CVE-2026-73020

CVE-2026-73020 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability requires low privileges and no user interaction, with a CVSS 3.1 score of 7.8 (HIGH) and high impact to confidentiality, integrity, ...

CVE-2026-78452

Out-of-bounds read in the Microsoft Windows SCSI Class System File allows an unauthorized attacker with physical access to perform an information disclosure attack. The vulnerability requires no privileges and no user interaction , with a CVSS 3.1 base score of 4.6 (MEDIUM) . CISA's SSVC assessme...

CVE-2026-83968

CVE-2026-83968 is a use-after-free vulnerability in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 7.8 (High) with impacts to confidentiality, integrity, and availability all rated High. CISA's SSVC assessment indicates no kn...

CVE-2026-83970

CVE-2026-83970 is a heap-based buffer overflow in Windows Biometric Service that allows an attacker with local access and low privileges to escalate to higher privileges , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH ). No user interaction is requir...

CVE-2026-83977

CVE-2026-83977 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized, low-privilege local attacker to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation requires n...

CVE-2026-83983

CVE-2026-83983 is a heap-based buffer overflow in the Windows Biometric Service component, allowing an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low privileges and no user in...

CVE-2026-83996

Windows Error Reporting in Windows is affected by a heap-based buffer overflow that allows an authorized attacker to elevate privileges locally . The assigned CVSS 3.1 score is 8.8 (HIGH) with a scope change (vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating that successful exploi...

CVE-2026-62697

CVE-2026-62697 is a use after free vulnerability in Windows Push Notifications that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, resulting in high impact to confident...

CVE-2026-69349

CVE-2026-69349 is an information disclosure vulnerability in Windows Management Instrumentation (WMI) caused by use of an uninitialized resource . An authorized attacker can exploit it over a network to disclose information, with high confidentiality impact but no integrity or availability impact...

CVE-2026-69352

CVE-2026-69352 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability is rated HIGH (CVSS 7.8) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H , meaning an attacker with low privileges and no user intera...