CVE-2026-84001

An out-of-bounds read vulnerability in Windows Key Distribution Center allows an unauthorized, remote attacker to cause a denial of service over the network. The flaw requires no privileges, no user interaction, and has low attack complexity, yielding a CVSS 3.1 score of 7.5 (HIGH) with high avai...

CVE-2026-32220

CVE-2026-32220 : Improper access control in the Windows Virtualization-Based Security (VBS) Enclave allows an authorized local attacker to bypass a security feature. Affected component: Windows VBS Enclave within the Hyper-V/OS security stack. Documented impact includes local bypass of protection...

CVE-2026-62801

CVE-2026-62801 is a path traversal vulnerability in Windows PowerShell that allows an unauthorized, remote attacker to bypass a security feature. The improper limitation of a pathname to a restricted directory means an attacker can reference files or resources outside the intended directory. The ...

CVE-2026-68835

CVE-2026-68835 is a use-after-free vulnerability in Windows Print Spooler Components that allows an authorized attacker to elevate privileges over a network . The Microsoft-assigned CVSS 3.1 score is 7.1 (HIGH) , with an attack vector of network, high complexity, low privileges required, and user...

CVE-2026-68837

CVE-2026-68837 is a use-after-free vulnerability in Windows File History Service that allows an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexity, low required ...

CVE-2026-69323

CVE-2026-69323 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker with low privileges to achieve local privilege escalation . The vulnerability requires no user interaction and carries a CVSS 3.1 score of 7.8 (HIGH) with high impact to confidentiality,...

CVE-2026-69425

CVE-2026-69425 is an improper link resolution before file access (link following) vulnerability in Windows NTFS . An authorized attacker with low privileges and high attack complexity can perform local tampering , resulting in high integrity impact with no confidentiality or availability impact (...

CVE-2026-69467

CVE-2026-69467 is a stack-based buffer overflow in the Microsoft Graphics Component that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 7.8 (HIGH) with a vector of local attack, low complexity, low privileges required, and high impact on confidentiality, integ...

CVE-2026-69599

Windows Remote Desktop Services contains a use-after-free vulnerability that allows an authorized attacker (low privileges required) to execute code over a network. The CVSS 3.1 score is 7.5 (HIGH) , with high attack complexity and no user interaction required, impacting confidentiality, integrit...

CVE-2026-69687

CVE-2026-69687 is an integer underflow (wrap or wraparound) vulnerability in the Windows USB Audio Class driver (usbaudio.sys). An authorized local attacker can exploit this flaw to elevate privileges , achieving high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH ; ve...

CVE-2026-70565

CVE-2026-70565 is a use-after-free vulnerability in the Windows AF_UNIX Socket Provider that allows an authorized attacker to perform local privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexit...

CVE-2026-73020

CVE-2026-73020 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability requires low privileges and no user interaction, with a CVSS 3.1 score of 7.8 (HIGH) and high impact to confidentiality, integrity, ...

CVE-2026-78452

Out-of-bounds read in the Microsoft Windows SCSI Class System File allows an unauthorized attacker with physical access to perform an information disclosure attack. The vulnerability requires no privileges and no user interaction , with a CVSS 3.1 base score of 4.6 (MEDIUM) . CISA's SSVC assessme...

CVE-2026-78454

An out-of-bounds read in the Windows CD-ROM Driver allows a local, low-privilege attacker to achieve information disclosure . The CVSS 3.1 score is 5.5 (Medium) , reflecting a local attack vector, low complexity, and high confidentiality impact with no integrity or availability impact. CISA's SSV...

CVE-2026-83940

CVE-2026-83940 is a use after free vulnerability in the Windows Device Association Service that allows an authorized local attacker to elevate privileges . The CVSS 3.1 base score is 7.0 (HIGH) with a high attack complexity , low privileges required , and high impact across confidentiality, integ...

CVE-2026-83989

CVE-2026-83989 is an out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver that allows an unauthenticated, remote attacker to cause a denial of service over a network. The vulnerability is rated CVSS 7.5 (HIGH) with a network attack vector, low complexity, no privileges or user int...

CVE-2026-83999

Windows Resilient File System (ReFS) Deduplication Service is affected by an improper link resolution before file access (link following) flaw that allows an authorized local attacker to elevate privileges. The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) , with a local attack vector, hig...

CVE-2026-85360

A use after free flaw in the Windows Kernel allows a local, authenticated attacker to elevate privileges . The vulnerability is scored CVSS 3.1 7.0 (HIGH) with a local attack vector , high attack complexity , low privileges required , and no user interaction , resulting in high impact to confiden...

CVE-2026-56172

CVE-2026-56172 is a use-after-free vulnerability in the Windows VHD miniport driver that allows an authorized local attacker to achieve privilege escalation . The CVSS 3.1 score is 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and full impact on...

CVE-2026-62759

Windows Netlogon is affected by an authentication bypass by spoofing vulnerability (CVE-2026-62759). An unauthorized attacker on an adjacent network can perform spoofing, potentially leading to high impact on confidentiality, integrity, and availability. The CVSS 3.1 score is 7.5 (HIGH) with an a...

CVE-2026-68840

CVE-2026-68840 is a local privilege escalation vulnerability in the Windows USB Driver , caused by a race condition (concurrent execution using a shared resource with improper synchronization). An authorized attacker (low privileges, no user interaction) can exploit it locally with high complexit...

CVE-2026-68898

Windows iSCSI is vulnerable to an out-of-bounds read that allows an unauthorized, remote attacker to cause a denial of service over a network. The CVSS 3.1 score is 6.5 (Medium) , with the attack requiring user interaction (e.g., opening a crafted file) but no prior privileges. CISA's SSVC assess...

CVE-2026-69298

CVE-2026-69298 is an elevation of privilege vulnerability in the Windows Biometric Service , caused by an integer overflow or wraparound . An attacker with low-level local privileges can exploit this to gain higher system privileges, with high impact on confidentiality, integrity, and availabilit...

CVE-2026-69349

CVE-2026-69349 is an information disclosure vulnerability in Windows Management Instrumentation (WMI) caused by use of an uninitialized resource . An authorized attacker can exploit it over a network to disclose information, with high confidentiality impact but no integrity or availability impact...

CVE-2026-69352

CVE-2026-69352 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized local attacker to elevate privileges . The vulnerability is rated HIGH (CVSS 7.8) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H , meaning an attacker with low privileges and no user intera...

CVE-2026-69461

CVE-2026-69461 is a stack-based buffer overflow in Windows NTFS that allows an unauthorized, unprivileged attacker to achieve remote code execution over a network. The vulnerability requires user interaction but no prior authentication, yielding a CVSS v3.1 score of 8.8 (HIGH) with full impact on...

CVE-2026-69539

CVE-2026-69539 is a use after free vulnerability in Windows Remote Desktop Services that allows an authorized attacker to achieve remote code execution over a network. The CVSS v3.1 base score is 7.5 (HIGH) , with a vector of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation requi...

CVE-2026-69847

CVE-2026-69847 is a heap-based buffer overflow in Windows DHCP Server that allows an authorized attacker to execute code over an adjacent network. The flaw resides in how the DHCP Server processes input, leading to memory corruption that can be leveraged for remote code execution . The vulnerabil...

CVE-2026-69864

CVE-2026-69864 is a use-after-free vulnerability in Windows Hello , Microsoft's biometric authentication component, that allows a low-privileged local attacker to escalate privileges. The CVSS 3.1 score is 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a changed s...

CVE-2026-72963

CVE-2026-72963 is a use-after-free vulnerability in Windows Modern Execution Server that allows an authorized attacker to achieve local privilege escalation . The CVSS v3.1 score is 7.0 (HIGH) , with a local attack vector, high complexity, low privileges required, and high impact on confidentiali...

CVE-2026-72990

CVE-2026-72990 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability requires low privileges, no user interaction, and has low attack complexity, yet results in high impact across confidentiality, ...

CVE-2026-73000

CVE-2026-73000 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized local attacker to elevate privileges . The CVSS 3.1 score is 7.8 (HIGH) with a vector of local attack, low complexity, low privileges required, no user interaction, and high impact to confide...

CVE-2026-73012

CVE-2026-73012 is a heap-based buffer overflow in Windows Management Services that allows an authorized (low-privilege) attacker to elevate privileges over a network . The vulnerability is rated CVSS 8.8 (HIGH) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and ...

CVE-2026-83968

CVE-2026-83968 is a use-after-free vulnerability in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 7.8 (High) with impacts to confidentiality, integrity, and availability all rated High. CISA's SSVC assessment indicates no kn...

CVE-2026-83970

CVE-2026-83970 is a heap-based buffer overflow in Windows Biometric Service that allows an attacker with local access and low privileges to escalate to higher privileges , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH ). No user interaction is requir...

CVE-2026-68827

CVE-2026-68827 is an integer underflow (wrap or wraparound) vulnerability in Windows GDI+ that allows an authorized attacker to achieve elevation of privileges over a network . The vulnerability is rated HIGH severity (CVSS 8.0) with a vector of AV:N/AC:L/PR:L/UI:R, meaning exploitation requires ...

CVE-2026-68884

A heap-based buffer overflow in the Windows Kernel allows an authorized (low-privilege) local attacker to elevate privileges , per Microsoft's advisory (CVE-2026-68884). The vulnerability carries a CVSS v3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploit...

CVE-2026-69295

CVE-2026-69295 is an out-of-bounds read in the Windows USB Driver that allows an authorized local attacker to escalate privileges. The flaw yields high impact across confidentiality, integrity, and availability (CVSS 3.1 score 7.8 HIGH , vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning a low-...

CVE-2026-69310

CVE-2026-69310 is a use-after-free vulnerability in Windows DNS that allows an authorized attacker to elevate privileges locally. The flaw resides in the DNS component and requires local access with low privileges and no user interaction, though the attack complexity is rated as high. The CVSS 3....

CVE-2026-69466

CVE-2026-69466 is a Time-of-Check Time-of-Use (TOCTOU) race condition in the Windows Kernel that allows a low-privileged local attacker to elevate privileges . The vulnerability carries a CVSS 3.1 score of 7.0 (High) , with high impact to confidentiality, integrity, and availability, though explo...

CVE-2026-69584

CVE-2026-69584 affects the Windows USB Video Driver , where an integer overflow or wraparound flaw allows an authorized attacker to elevate privileges locally . The Microsoft CNA assigns a CVSS 3.1 score of 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low-privilege ...

CVE-2026-69585

CVE-2026-69585 affects the Microsoft Windows Search Component , where an incorrect type conversion or cast allows an authorized attacker to perform local privilege escalation . The vulnerability scores 7.8 (HIGH) under CVSS 3.1, with low attack complexity, low privileges required, no user interac...

CVE-2026-69638

CVE-2026-69638 is a heap-based buffer overflow in Windows NTFS (New Technology File System) that allows an unauthorized attacker to execute code locally. The vulnerability requires no privileges and no user interaction, yielding a CVSS 3.1 base score of 8.4 (HIGH) with high impact to confidential...

CVE-2026-69820

Windows Hello is vulnerable to a heap-based buffer overflow that allows an authorized local attacker to escalate privileges . The CVSS 3.1 score is 8.2 (HIGH) with a changed scope and high impact on confidentiality, integrity, and availability. The attack requires high privileges and no user inte...

CVE-2026-70283

CVE-2026-70283 affects Windows Win32K , the kernel-mode component handling window management. The root cause is an incorrect authorization flaw that allows a local attacker with low privileges to achieve local privilege escalation , resulting in full compromise of confidentiality, integrity, and ...

CVE-2026-73023

A heap-based buffer overflow in the Windows Imaging Component allows an unauthorized attacker to achieve remote code execution over a network . The vulnerability is rated CVSS 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network reachability, low complexity, no priv...

CVE-2026-83975

Windows Biometric Service is affected by a heap-based buffer overflow that allows a locally authenticated attacker with low privileges to escalate to higher privilege. The vulnerability requires no user interaction and has low attack complexity , resulting in a CVSS 3.1 score of 7.8 (HIGH) with h...

CVE-2026-83977

CVE-2026-83977 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized, low-privilege local attacker to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation requires n...

CVE-2026-62706

CVE-2026-62706 is an out-of-bounds read in Microsoft Windows Media Foundation that allows an unauthorized attacker to execute code over a network. The CVSS 3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H , meaning exploitation requires user interaction but no prior au...

CVE-2026-68832

CVE-2026-68832 is a local privilege escalation vulnerability in Windows NTFS caused by an integer overflow or wraparound . An authorized attacker with low privileges can exploit this with low complexity and no user interaction to achieve high impact on confidentiality, integrity, and availability...