CVE-2026-83955

CVE-2026-83955 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker (low privileges, no user interaction) to achieve local privilege escalation . The assigned CVSS 3.1 score is 7.8 (HIGH) , with high impact to confidentiality, integrity, and availabi...

CVE-2026-83969

A heap-based buffer overflow in Windows Biometric Service allows an authorized attacker with low privileges to escalate privileges locally, resulting in high impact to confidentiality, integrity, and availability. The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector and no user interaction...

CVE-2026-83974

CVE-2026-83974 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The CNA (Microsoft) assigns a CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting low attack complexity, ...

CVE-2026-83978

Windows Biometric Service is affected by a heap-based buffer overflow that allows a locally authenticated attacker to elevate privileges. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and low require...

CVE-2026-68831

CVE-2026-68831 is an information disclosure vulnerability in Windows Defender Firewall Service . The issue arises from files or directories accessible to external parties, allowing an authorized attacker with low privileges to disclose information locally (CVSS 3.1 score 5.5 – MEDIUM ; vector AV:...

CVE-2026-68874

CVE-2026-68874 is an out-of-bounds read vulnerability in the Windows Program Compatibility Assistant Service that allows an authorized attacker with low privileges to disclose information over a network. The vulnerability requires user interaction and results in a High confidentiality impact with...

CVE-2026-69479

CVE-2026-69479 is a heap-based buffer overflow in Windows NTFS that allows an unauthorized local attacker to achieve code execution. The Microsoft-assigned CVSS 3.1 score is 8.4 (HIGH) , with a vector of AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and no privileges or us...

CVE-2026-69490

CVE-2026-69490 is an out-of-bounds read vulnerability in the Windows USB Mass Storage Class Driver that allows an unauthorized attacker to elevate privileges via a physical attack . The CVSS 3.1 base score is 6.8 (Medium) , reflecting the physical attack vector requirement (AV:P), low complexity,...

CVE-2026-69514

CVE-2026-69514 is a heap-based buffer overflow in Windows Remote Desktop Services (RDS) that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The vulnerability requires high attack complexity and no user interaction, yielding a CVSS 3.1 base score of...

CVE-2026-69591

CVE-2026-69591 is an out-of-bounds read vulnerability in Windows NTFS that allows an authorized attacker to disclose information over a network. The CVSS 3.1 score is 5.7 (Medium) , requiring network access, low privileges, and user interaction, with a high confidentiality impact but no integrity...

CVE-2026-69707

CVE-2026-69707 is an integer overflow or wraparound vulnerability in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized, locally-privileged attacker to escalate privileges. The flaw is rated CVSS 3.1: 7.8 (HIGH) with a local attack vector, low complexity, low privileges r...

CVE-2026-69822

CVE-2026-69822 is a local privilege escalation vulnerability in Windows Kerberos caused by a numeric truncation error . An authorized attacker with low privileges can exploit this to achieve full confidentiality, integrity, and availability impact (CVSS 3.1: 7.8 HIGH , vector AV:L/AC:L/PR:L/UI:N/...

CVE-2026-69838

CVE-2026-69838 is a use-after-free vulnerability in Windows Print Spooler Components that allows an authorized attacker to achieve local privilege escalation . The attack vector is local, requires low privileges, and has high complexity with no user interaction needed. The CVSS 3.1 score is 7.0 (...

CVE-2026-69862

CVE-2026-69862 is an out-of-bounds read in the Windows Wireless Wide Area Network Service that allows an authorized local attacker to disclose information . The CVSS v3.1 score is 5.5 (Medium) with High confidentiality impact, no integrity or availability impact, and requires low privileges over ...

CVE-2026-69866

CVE-2026-69866 is a use-after-free vulnerability in Windows Device Association Service that allows an authorized local attacker to escalate privileges. The CVSS v3.1 score is 7.0 (HIGH) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , meaning exploitation requires local access , low privi...

CVE-2026-69890

CVE-2026-69890 is a Use-After-Free vulnerability in Windows Virtual Trusted Platform Module (vTPM) that allows an authorized local attacker to escalate privileges. The attack requires high privileges and high complexity , with no user interaction needed, but results in a scope change and high imp...

CVE-2026-70563

CVE-2026-70563 is an improper link resolution before file access ("link following") vulnerability in Windows Shell that allows an unauthorized attacker to perform spoofing over a network . The assigned CVSS 3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating h...

CVE-2026-70568

This is a heap-based buffer overflow vulnerability in Windows Defender Firewall Service that allows an authorized attacker to achieve local privilege escalation with high impact on confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (HIGH) , reflecting a local attack vector wi...

CVE-2026-70569

CVE-2026-70569 is a local privilege escalation vulnerability in the Windows Spaceport.sys kernel driver, caused by an out-of-bounds read . An authorized attacker with low privileges can exploit it to achieve full local privilege escalation, with High impact on confidentiality, integrity, and avai...

CVE-2026-70573

CVE-2026-70573 is a heap-based buffer overflow in Windows Biometric Service that allows a local attacker with low privileges to achieve privilege escalation . The vulnerability is rated CVSS 3.1: 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector wit...

CVE-2026-70581

An integer overflow or wraparound vulnerability in the Windows Biometric Service allows an authorized local attacker to elevate privileges . According to Microsoft's CVSS 3.1 scoring, the flaw rates 7.8 (HIGH) , with local attack vector, low complexity, low privileges required, no user interactio...

CVE-2026-71329

CVE-2026-71329 is a heap-based buffer overflow in Windows NTFS that allows an unauthorized attacker to execute code via a physical attack vector. The vulnerability requires low complexity and no privileges or user interaction, but demands physical access to the target system. The CVSS 3.1 base sc...

CVE-2026-71334

CVE-2026-71334 is a heap-based buffer overflow in the Windows NFS Portmapper component that allows an authorized local attacker to elevate privileges. The Microsoft-assigned CVSS 3.1 base score is 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting low privilege requiremen...

CVE-2026-71337

CVE-2026-71337 is a stack-based buffer overflow in the Windows Storage Management Provider that allows a locally authenticated attacker with low privileges to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (HIGH) , reflecting local attack vector, low complexity, and high impact to...

CVE-2026-72966

CVE-2026-72966 affects Windows Remote Access Connection Manager , where a missing authorization check allows an already-authorized (low-privilege) local attacker to perform tampering without user interaction. The impact is rated HIGH for integrity with no effect on confidentiality or availability...

CVE-2026-73004

CVE-2026-73004 is a missing authentication vulnerability in Windows Autopilot that allows a locally authenticated attacker to perform tampering of a critical function. The Microsoft-assigned CVSS 3.1 score is 5.5 (Medium) , with a local attack vector, low complexity, low required privileges, no u...

CVE-2026-73008

CVE-2026-73008 is an information disclosure vulnerability in Windows Biometric Service . It allows a locally authenticated attacker with low privileges to expose private personal information to an unauthorized actor, resulting in high confidentiality impact with no integrity or availability impac...

CVE-2026-73015

CVE-2026-73015 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , requiring low privileges and no user interaction (vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)....

CVE-2026-73021

CVE-2026-73021 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 base score is 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, impacting confidentiality, integrit...

CVE-2026-73026

CVE-2026-73026 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 3.1 7.8 (HIGH) , with low complexity, low privileges required, and high impact to confidentiality, integrity, and avai...

CVE-2026-77491

CVE-2026-77491 is an out-of-bounds read in Windows GDI that allows an unauthorized local attacker to disclose information. The CVSS 3.1 base score is 5.5 (MEDIUM) with a local attack vector, no privileges required, user interaction required, and high confidentiality impact but no integrity or ava...

CVE-2026-77495

CVE-2026-77495 is a heap-based buffer overflow in Windows Imaging Component that allows an unauthorized attacker to execute code over a network. The vulnerability is rated CVSS 3.1: 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning it is exploitable over the network with low com...

CVE-2026-78508

CVE-2026-78508 is an out-of-bounds read in the Windows CD-ROM Driver that allows an unauthorized attacker with physical access to disclose information. The CVSS 3.1 score is 4.6 (MEDIUM) , reflecting the physical attack vector, low complexity, no privileges required, and a high confidentiality im...

CVE-2026-83987

CVE-2026-83987 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , with low attack complexity, low privileges required, no user interaction, and high impact on ...

CVE-2026-68887

CVE-2026-68887 is an out-of-bounds read in Windows Message Queuing Queue Manager that allows an unauthorized, network-based attacker to trigger a denial of service . The vulnerability requires no prior authentication or user interaction and carries a CVSS 3.1 base score of 7.5 (HIGH) , with impac...

CVE-2026-68898

Windows iSCSI is vulnerable to an out-of-bounds read that allows an unauthorized, remote attacker to cause a denial of service over a network. The CVSS 3.1 score is 6.5 (Medium) , with the attack requiring user interaction (e.g., opening a crafted file) but no prior privileges. CISA's SSVC assess...

CVE-2026-69406

CVE-2026-69406 is a Windows Kernel information disclosure vulnerability. It stems from the exposure of sensitive system information to an unauthorized control sphere, allowing an authorized attacker to disclose information locally. The assigned CVSS 3.1 score is 5.5 (Medium) with a local attack v...

CVE-2026-69413

CVE-2026-69413 is a use-after-free vulnerability in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized attacker to perform local privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high attack complexity...

CVE-2026-69469

CVE-2026-69469 is an elevation of privilege vulnerability in the Windows USB Audio Class driver (usbaudio.sys). The root cause is an integer overflow or wraparound in the driver, which allows an unauthorized attacker with physical access to escalate privileges. The CVSS 3.1 base score is 6.6 (MED...

CVE-2026-69489

A heap-based buffer overflow in the Windows Biometric Service allows a low-privilege local attacker to escalate privileges. The flaw requires no user interaction and is rated CVSS 7.8 (HIGH) with high impact on confidentiality, integrity, and availability. No specific affected Windows version or ...

CVE-2026-69567

CVE-2026-69567 is a use-after-free vulnerability in Windows NTFS (New Technology File System) that allows a locally authenticated attacker with low privileges to elevate privileges on the affected system. The CVSS v3.1 score is 7.0 (HIGH) , reflecting a local attack vector with high complexity, n...

CVE-2026-69569

CVE-2026-69569 is an untrusted pointer dereference in Windows Print Spooler Components that allows an authorized attacker to cause a denial of service over a network. The CVSS v3.1 score is 5.7 (Medium) , with high availability impact but no confidentiality or integrity impact. Exploitation requi...

CVE-2026-69875

CVE-2026-69875 is a heap-based buffer overflow in Windows NTFS that allows an authorized attacker (low privileges, user interaction required) to elevate privileges over a network . The vulnerability carries a CVSS 3.1 score of 8.0 (HIGH) with impacts of High across confidentiality, integrity, and...

CVE-2026-69907

CVE-2026-69907 affects Windows Enterprise App Management , where improper handling of insufficient permissions or privileges allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 3.1: 7.8 (HIGH) with a local attack vector , low complexity , low privileges r...

CVE-2026-71330

CVE-2026-71330 is an information disclosure vulnerability in Windows Services for NFS ONCRPC XDR Driver . An unauthorized network-based attacker with no privileges can expose sensitive system information over the network, resulting in a High confidentiality impact (CVSS 3.1: 7.5 ). CISA's SSVC as...

CVE-2026-72967

A heap-based buffer overflow in the Windows Network Connection Broker component allows an authorized low-privilege attacker to escalate privileges locally. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low complexity, no user interaction, and high impact on ...

CVE-2026-73005

CVE-2026-73005 is a Use After Free vulnerability in Windows Authentication Methods that allows an authorized, locally privileged attacker to escalate privileges. The CVSS v3.1 score is 7.0 (HIGH) , reflecting a local attack vector with high complexity and high impact on confidentiality, integrity...

CVE-2026-78446

CVE-2026-78446 is a use-after-free vulnerability in Windows Distributed File System (DFS) that allows an authorized attacker to cause a denial of service over a network. The CVSS 3.1 score is 5.3 (Medium) , reflecting a network attack vector with high complexity , low privileges required , and no...

CVE-2026-69270

A heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) allows a locally authenticated attacker to escalate privileges , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8 HIGH ). No specific affected Windows version or patc...

CVE-2026-69288

CVE-2026-69288 is a use of uninitialized resource vulnerability in Windows GDI+ that allows a locally authenticated attacker with low privileges to disclose information . The attack vector is local , requires no user interaction , and has no impact on integrity or availability , with a high confi...