CVE-2026-72994

CVE-2026-72994 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability requires low privileges and no user interaction , with low attack complexity . The CVSS 3.1 base score is 7.8 (HIGH) , with high imp...

CVE-2026-73001

CVE-2026-73001 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and that low privileges ...

CVE-2026-73024

CVE-2026-73024 is a heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver that allows an authorized attacker to perform local privilege escalation . The CVSS v3.1 score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity, low ...

CVE-2026-77503

CVE-2026-77503 is an out-of-bounds read vulnerability in Windows NTFS that allows an unauthorized attacker to achieve local privilege escalation . The vulnerability is rated HIGH (CVSS 8.4) with a vector of AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning it requires no prior privileges or user inter...

CVE-2026-78448

CVE-2026-78448 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The CVSS v3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that a low-privileged local attacker can compro...

CVE-2026-78453

CVE-2026-78453 is an integer underflow (wraparound) in the Microsoft Windows SCSI Class System File that allows an unauthorized, remote attacker to disclose information over a network . The vulnerability requires user interaction and demands no prior privileges , with a CVSS 3.1 base score of 6.5...

CVE-2026-83955

CVE-2026-83955 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker (low privileges, no user interaction) to achieve local privilege escalation . The assigned CVSS 3.1 score is 7.8 (HIGH) , with high impact to confidentiality, integrity, and availabi...

CVE-2026-83969

A heap-based buffer overflow in Windows Biometric Service allows an authorized attacker with low privileges to escalate privileges locally, resulting in high impact to confidentiality, integrity, and availability. The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector and no user interaction...

CVE-2026-83974

CVE-2026-83974 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The CNA (Microsoft) assigns a CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting low attack complexity, ...

CVE-2026-83978

Windows Biometric Service is affected by a heap-based buffer overflow that allows a locally authenticated attacker to elevate privileges. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and low require...

CVE-2026-56177

CVE-2026-56177 is a use-after-free vulnerability in Windows Server that allows an authorized attacker to achieve local privilege elevation . The flaw is scored CVSS 3.1: 7.8 (HIGH) with a vector of local attack, low complexity, low privileges required, and no user interaction, resulting in high i...

CVE-2026-68831

CVE-2026-68831 is an information disclosure vulnerability in Windows Defender Firewall Service . The issue arises from files or directories accessible to external parties, allowing an authorized attacker with low privileges to disclose information locally (CVSS 3.1 score 5.5 – MEDIUM ; vector AV:...

CVE-2026-68838

CVE-2026-68838 is a stack-based buffer overflow in Windows NTFS that allows an authorized attacker with low privileges to elevate privileges over a network, requiring user interaction. Microsoft assigned a CVSS 3.1 score of 8.0 (HIGH) with high impacts to confidentiality, integrity, and availabil...

CVE-2026-68874

CVE-2026-68874 is an out-of-bounds read vulnerability in the Windows Program Compatibility Assistant Service that allows an authorized attacker with low privileges to disclose information over a network. The vulnerability requires user interaction and results in a High confidentiality impact with...

CVE-2026-69479

CVE-2026-69479 is a heap-based buffer overflow in Windows NTFS that allows an unauthorized local attacker to achieve code execution. The Microsoft-assigned CVSS 3.1 score is 8.4 (HIGH) , with a vector of AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and no privileges or us...

CVE-2026-69490

CVE-2026-69490 is an out-of-bounds read vulnerability in the Windows USB Mass Storage Class Driver that allows an unauthorized attacker to elevate privileges via a physical attack . The CVSS 3.1 base score is 6.8 (Medium) , reflecting the physical attack vector requirement (AV:P), low complexity,...

CVE-2026-69514

CVE-2026-69514 is a heap-based buffer overflow in Windows Remote Desktop Services (RDS) that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The vulnerability requires high attack complexity and no user interaction, yielding a CVSS 3.1 base score of...

CVE-2026-69591

CVE-2026-69591 is an out-of-bounds read vulnerability in Windows NTFS that allows an authorized attacker to disclose information over a network. The CVSS 3.1 score is 5.7 (Medium) , requiring network access, low privileges, and user interaction, with a high confidentiality impact but no integrity...

CVE-2026-69707

CVE-2026-69707 is an integer overflow or wraparound vulnerability in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized, locally-privileged attacker to escalate privileges. The flaw is rated CVSS 3.1: 7.8 (HIGH) with a local attack vector, low complexity, low privileges r...

CVE-2026-69822

CVE-2026-69822 is a local privilege escalation vulnerability in Windows Kerberos caused by a numeric truncation error . An authorized attacker with low privileges can exploit this to achieve full confidentiality, integrity, and availability impact (CVSS 3.1: 7.8 HIGH , vector AV:L/AC:L/PR:L/UI:N/...

CVE-2026-69838

CVE-2026-69838 is a use-after-free vulnerability in Windows Print Spooler Components that allows an authorized attacker to achieve local privilege escalation . The attack vector is local, requires low privileges, and has high complexity with no user interaction needed. The CVSS 3.1 score is 7.0 (...

CVE-2026-69862

CVE-2026-69862 is an out-of-bounds read in the Windows Wireless Wide Area Network Service that allows an authorized local attacker to disclose information . The CVSS v3.1 score is 5.5 (Medium) with High confidentiality impact, no integrity or availability impact, and requires low privileges over ...

CVE-2026-69866

CVE-2026-69866 is a use-after-free vulnerability in Windows Device Association Service that allows an authorized local attacker to escalate privileges. The CVSS v3.1 score is 7.0 (HIGH) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , meaning exploitation requires local access , low privi...

CVE-2026-70563

CVE-2026-70563 is an improper link resolution before file access ("link following") vulnerability in Windows Shell that allows an unauthorized attacker to perform spoofing over a network . The assigned CVSS 3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating h...

CVE-2026-70568

This is a heap-based buffer overflow vulnerability in Windows Defender Firewall Service that allows an authorized attacker to achieve local privilege escalation with high impact on confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (HIGH) , reflecting a local attack vector wi...

CVE-2026-70569

CVE-2026-70569 is a local privilege escalation vulnerability in the Windows Spaceport.sys kernel driver, caused by an out-of-bounds read . An authorized attacker with low privileges can exploit it to achieve full local privilege escalation, with High impact on confidentiality, integrity, and avai...

CVE-2026-70573

CVE-2026-70573 is a heap-based buffer overflow in Windows Biometric Service that allows a local attacker with low privileges to achieve privilege escalation . The vulnerability is rated CVSS 3.1: 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector wit...

CVE-2026-70581

An integer overflow or wraparound vulnerability in the Windows Biometric Service allows an authorized local attacker to elevate privileges . According to Microsoft's CVSS 3.1 scoring, the flaw rates 7.8 (HIGH) , with local attack vector, low complexity, low privileges required, no user interactio...

CVE-2026-71329

CVE-2026-71329 is a heap-based buffer overflow in Windows NTFS that allows an unauthorized attacker to execute code via a physical attack vector. The vulnerability requires low complexity and no privileges or user interaction, but demands physical access to the target system. The CVSS 3.1 base sc...

CVE-2026-71334

CVE-2026-71334 is a heap-based buffer overflow in the Windows NFS Portmapper component that allows an authorized local attacker to elevate privileges. The Microsoft-assigned CVSS 3.1 base score is 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting low privilege requiremen...

CVE-2026-71337

CVE-2026-71337 is a stack-based buffer overflow in the Windows Storage Management Provider that allows a locally authenticated attacker with low privileges to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (HIGH) , reflecting local attack vector, low complexity, and high impact to...

CVE-2026-72966

CVE-2026-72966 affects Windows Remote Access Connection Manager , where a missing authorization check allows an already-authorized (low-privilege) local attacker to perform tampering without user interaction. The impact is rated HIGH for integrity with no effect on confidentiality or availability...

CVE-2026-73004

CVE-2026-73004 is a missing authentication vulnerability in Windows Autopilot that allows a locally authenticated attacker to perform tampering of a critical function. The Microsoft-assigned CVSS 3.1 score is 5.5 (Medium) , with a local attack vector, low complexity, low required privileges, no u...

CVE-2026-73008

CVE-2026-73008 is an information disclosure vulnerability in Windows Biometric Service . It allows a locally authenticated attacker with low privileges to expose private personal information to an unauthorized actor, resulting in high confidentiality impact with no integrity or availability impac...

CVE-2026-73015

CVE-2026-73015 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , requiring low privileges and no user interaction (vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)....

CVE-2026-73021

CVE-2026-73021 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 base score is 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, impacting confidentiality, integrit...

CVE-2026-77491

CVE-2026-77491 is an out-of-bounds read in Windows GDI that allows an unauthorized local attacker to disclose information. The CVSS 3.1 base score is 5.5 (MEDIUM) with a local attack vector, no privileges required, user interaction required, and high confidentiality impact but no integrity or ava...

CVE-2026-77495

CVE-2026-77495 is a heap-based buffer overflow in Windows Imaging Component that allows an unauthorized attacker to execute code over a network. The vulnerability is rated CVSS 3.1: 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning it is exploitable over the network with low com...

CVE-2026-78508

CVE-2026-78508 is an out-of-bounds read in the Windows CD-ROM Driver that allows an unauthorized attacker with physical access to disclose information. The CVSS 3.1 score is 4.6 (MEDIUM) , reflecting the physical attack vector, low complexity, no privileges required, and a high confidentiality im...

CVE-2026-83987

CVE-2026-83987 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , with low attack complexity, low privileges required, no user interaction, and high impact on ...

CVE-2026-68842

CVE-2026-68842 is an information disclosure vulnerability in the Windows MIDI Service Module , where sensitive system information is exposed to an unauthorized control sphere. An authorized attacker with local access and low privileges can disclose confidential information, with high impact to co...

CVE-2026-68887

CVE-2026-68887 is an out-of-bounds read in Windows Message Queuing Queue Manager that allows an unauthorized, network-based attacker to trigger a denial of service . The vulnerability requires no prior authentication or user interaction and carries a CVSS 3.1 base score of 7.5 (HIGH) , with impac...

CVE-2026-68898

Windows iSCSI is vulnerable to an out-of-bounds read that allows an unauthorized, remote attacker to cause a denial of service over a network. The CVSS 3.1 score is 6.5 (Medium) , with the attack requiring user interaction (e.g., opening a crafted file) but no prior privileges. CISA's SSVC assess...

CVE-2026-69339

CVE-2026-69339 is an information disclosure vulnerability in the Windows MIDI Service Module . It allows an attacker with low local privileges to expose sensitive system information to an unauthorized control sphere, resulting in high confidentiality impact with no integrity or availability impac...

CVE-2026-69406

CVE-2026-69406 is a Windows Kernel information disclosure vulnerability. It stems from the exposure of sensitive system information to an unauthorized control sphere, allowing an authorized attacker to disclose information locally. The assigned CVSS 3.1 score is 5.5 (Medium) with a local attack v...

CVE-2026-69413

CVE-2026-69413 is a use-after-free vulnerability in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized attacker to perform local privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high attack complexity...

CVE-2026-69469

CVE-2026-69469 is an elevation of privilege vulnerability in the Windows USB Audio Class driver (usbaudio.sys). The root cause is an integer overflow or wraparound in the driver, which allows an unauthorized attacker with physical access to escalate privileges. The CVSS 3.1 base score is 6.6 (MED...

CVE-2026-69489

A heap-based buffer overflow in the Windows Biometric Service allows a low-privilege local attacker to escalate privileges. The flaw requires no user interaction and is rated CVSS 7.8 (HIGH) with high impact on confidentiality, integrity, and availability. No specific affected Windows version or ...

CVE-2026-69567

CVE-2026-69567 is a use-after-free vulnerability in Windows NTFS (New Technology File System) that allows a locally authenticated attacker with low privileges to elevate privileges on the affected system. The CVSS v3.1 score is 7.0 (HIGH) , reflecting a local attack vector with high complexity, n...

CVE-2026-69569

CVE-2026-69569 is an untrusted pointer dereference in Windows Print Spooler Components that allows an authorized attacker to cause a denial of service over a network. The CVSS v3.1 score is 5.7 (Medium) , with high availability impact but no confidentiality or integrity impact. Exploitation requi...