CVE-2025-62473

CVE-2025-62473 is a Windows RRAS information-disclosure vulnerability caused by a buffer over-read. It enables an unauthenticated attacker to disclose information over the network. Connected sources confirm affected component as Windows Routing and Remote Access Service (RRAS) and label the vulne...

CVE-2026-26173

CVE-2026-26173 affects the Windows Ancillary Function Driver for WinSock and is described as a race-condition vulnerability in a shared-resource path that can allow an authenticated local attacker to elevate privileges to SYSTEM. The connected sources confirm this is a Windows elevation-of-privil...

CVE-2026-26177

Technical details about CVE-2026-26177 are not provided in the supplied documents. Monitor for updates from Microsoft and the CVE record.

CVE-2026-32214

Technical details about CVE-2026-32214 are not provided in the given documents. No explicit affected products, vulnerable components, impact, or remediation details are disclosed here. Monitor for updates from official sources.

CVE-2026-50390

CVE-2026-50390 is a Windows Kernel elevation-of-privilege in which an authorized attacker can gain local privileges through a type-confusion vulnerability (incompatible resource type). The CVE is documented with a CVSSv3.1 vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, BASE SCORE 7.0 (HIGH). Affe...

CVE-2026-50673

CVE-2026-50673 is a Windows Kernel elevation-of-privilege vulnerability caused by a null pointer dereference. The issue allows an authorized attacker to elevate privileges locally. Public sources confirm details across NVD, MSRC, EUVD, and related advisories, with a CVSSv3.1 vector of LOCAL, HIGH...

CVE-2026-54107

The CVE-2026-54107 entry documents a race condition caused by improper synchronization in Windows Win32K, enabling a locally authenticated attacker to achieve privilege escalation. Affected software/component: Windows Win32K. Root cause: concurrent execution with shared resource lacking proper sy...

CVE-2026-57979

CVE-2026-57979 describes an out-of-bounds read in Windows Remote Desktop Protocol (RDP) that could allow an unauthenticated or network-attached attacker to disclose information over the network. Publicly referenced sources (NVD, MSRC updates, ENISA EUVD, and security advisories) corroborate an in...

CVE-2026-62796

The CVE CVE-2026-62796 describes an out-of-bounds read in Windows NTFS that can let an authorized, low-privilege attacker disclose information locally. The defined attack vector is LOCAL with LOW complexity and no user interaction, and the impact is a confidentiality breach (information disclosed...

CVE-2025-50167

CVE-2025-50167 involves a race condition in Windows Hyper-V due to improper synchronization on a shared resource, enabling an authorized local attacker to elevate privileges. The description in the Connected Documents confirms the vulnerability impact as local privilege escalation within Hyper‑V....

CVE-2025-53723

CVE-2025-53723 : Numeric truncation error in Windows Hyper-V allows an authorized, local attacker to elevate privileges. The entry is confirmed to affect the Windows Hyper-V component, with impact described as local privilege escalation and high confidentiality/integrity/availability effects in t...

CVE-2025-53726

CVE-2025-53726 affects Windows Push Notifications and is described as an in-resource access using an incompatible type ('type confusion') that allows an authenticated local attacker to elevate privileges. The CVSS v3.1 base score is 7.8 (HIGH) with LOCAL attack vector, LOW attack complexity, and ...

CVE-2025-54895

CVE-2025-54895 : Integer overflow or wraparound in Windows SPNEGO Extended Negotiation can let an authorized, locally authenticated attacker elevate privileges. The connected documents confirm the vulnerability in the Windows SPNEGO Extended Negotiation path and indicate the impact as local privi...

CVE-2025-59208

CVE-2025-59208 is an out-of-bounds read in Windows MapUrlToZone that could allow an unauthenticated attacker to disclose information over a network. The description and connected documents confirm a network-based exposure affecting Windows, with the root cause being a memory read beyond bounds in...

CVE-2025-59278

CVE-2025-59278 affects Windows Authentication Methods and is tied to an improper validation of input type, enabling local privilege escalation for an authorized user. The CVE is rated with CVSS v3.1 base metrics around 7.8 (HIGH) by Microsoft/CNA sources, indicating a local, high-severity impact ...

CVE-2026-20860

CVE-2026-20860 affects the Windows Ancillary Function Driver for WinSock and is a local privilege escalation via type confusion. Connected documents confirm the affected component and that exploitation requires local access with privileges already. Public details on exploit methods are not provid...

CVE-2026-26160

CVE-2026-26160 affects the Windows Remote Desktop Licensing Service. The issue arises from missing authentication for a critical function, enabling an authorized local attacker to elevate privileges on affected systems. The CVE has a CVSS v3.1 base score of 7.8 (HIGH) with LOCAL attack vector, lo...

CVE-2026-27930

CVE-2026-27930 is a Windows GDI information disclosure vulnerability. The CVSSv3.1 base score is 5.5 (Medium); attack is LOCAL, requires user interaction, and does not affect integrity or availability, but threatens confidentiality HIGH. The record notes an OFFICIAL_FIX remediation level, implyin...

CVE-2026-32070

CVE-2026-32070 affects Windows where the Common Log File System Driver contains an elevation-of-privilege flaw. The root cause is not explicitly described in the provided text, but the CVSS 3.1 metrics indicate a local attack vector with high impact on confidentiality, integrity, and availability...

CVE-2026-45596

The CVE-2026-45596 entry concerns a use-after-free in the Windows Ancillary Function Driver for WinSock, leading to local privilege elevation. Affected component/function is the Windows AFD for WinSock; root cause is a use-after-free condition that can be exploited by an authorized local attacker...

CVE-2026-49790

Technical details about CVE-2026-49790 are not publicly provided in the supplied documents. No confirmed affected products, root cause, or remediation are described here. Monitor for updates from official advisories for concrete technical information.

CVE-2026-50402

CVE-2026-50402 targets Windows NTFS with an elevation-of-privilege flaw caused by incorrect numeric-type conversion. A locally authenticated attacker could exploit this to gain system privileges. The CVE is documented with a High severity (CVSS 3.1: 7.8, Local, Privilege Escalation, no user inter...

CVE-2026-50505

CVE-2026-50505 is a Windows Message Queuing (MSMQ) remote code execution vulnerability described as a use-after-free in MSMQ that could allow an authorized attacker to execute code over a network. Public sources (MSRC update guidance) confirm updates addressing this issue and advise applying the ...

CVE-2026-54126

CVE-2026-54126 is a Windows RDP information-disclosure vulnerability (out-of-bounds read). It is triggered over the network and requires user interaction, with no privileges required by the attacker; impact is disclosure of confidential information. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C...

CVE-2026-62725

CVE-2026-62725 describes a use-after-free in the Windows Telephony Service that can allow a locally authenticated user to elevate privileges. The NVD/CVE records indicate an elevated-privilege, local-execution risk with a CVSS v3.1 base score of 7.0 (high) and impact on confidentiality, integrity...

CVE-2025-50163

CVE-2025-50163 affects Windows Routing and Remote Access Service (RRAS). The issue is a heap-based buffer overflow in RRAS that enables remote code execution over the network. Exploitation is network-based (AV:N) with low attack complexity, no privileges required, but user interaction is required...

CVE-2025-53725

Technical details about CVE-2025-53725 are not provided in the connected documents. Public exposure, affected components, and fixes are not described here; monitor for updates.

CVE-2025-53797

CVE-2025-53797 is a Windows RRAS information disclosure vulnerability caused by a buffer over-read in RRAS. The CVE description notes a network-exposed flaw that could allow an unauthorized attacker to disclose information, with a CVSS3.1 base score of 6.5 (Network attack vector, no privileges, u...

CVE-2025-59253

CVE-2025-59253 is documented with concrete details in connected sources: a local-privilege/reliance on an access-control flaw in the Windows Search Component that can enable a denial-of-service by an authorized attacker. The CVE is linked to Microsoft/security guidance entries and EUVD-2025-34274...

CVE-2025-62452

Technical details about CVE-2025-62452 (heap-based buffer overflow in RRAS) are not publicly provided in the supplied documents. The connected KB/MS documents do not specify affected products/versions, exploit details, or mitigations. Monitor for updates.

CVE-2026-21239

CVE-2026-21239 describes a heap-based buffer overflow in the Windows Kernel. An authorized attacker can achieve local privilege escalation. The vulnerability is rated CVSS v3.1 base score 7.8 (HIGH) with LOCAL, low complexity, and no user interaction required beyond initial access, and it has hig...

CVE-2026-32082

CVE-2026-32082 is a Windows SSDP Service race condition vulnerability that can enable local privilege escalation. Multiple connected sources confirm the flaw exists in Windows SSDP Service and describe an improper synchronization on a shared resource leading to elevation of privileges for a local...

CVE-2026-34351

CVE-2026-34351 describes a race condition in Windows TCP/IP where concurrent access to a shared resource allows an authorized attacker to elevate privileges locally. The provided description states a local, privilege-escalation risk with a high impact on confidentiality, integrity, and availabili...

CVE-2026-45606

CVE-2026-45606 concerns an out-of-bounds read in the Microsoft UxTheme Library (uxtheme.dll) that allows an authorized, low-privilege user to cause a local denial of service. The NVD/NIST and CVE records concur on the impact as a local DoS; attack vector is LOCAL, with LOW prerequisites and NONE ...

CVE-2026-50308

CVE-2026-50308 is a Windows NTFS vulnerability described as an integer underflow (wrap or wraparound) that could allow an unauthorized attacker to execute code locally. Sources consistently state: affected component is Windows NTFS on Windows systems; impact is local code execution with high seve...

CVE-2026-50341

CVE-2026-50341 is a Windows NTFS information-disclosure issue caused by a buffer over-read. The vulnerability allows an authorized local attacker to disclose information from memory. Public documentation in connected sources confirms the affected component as NTFS and describes a local-exploitati...

CVE-2026-50455

CVE-2026-50455 describes an information disclosure in Universal Plug and Play (upnp.dll) caused by the use of an uninitialized resource. The vulnerability allows an authorized local attacker to disclose information. The reported impact shows confidentiality impact (C) as High, with local access a...

CVE-2026-56194

CVE-2026-56194 : Heap-based buffer overflow in Windows Network File System (NFS) can allow an authorized attacker to elevate privileges over a network. Affected component is Windows NFS Server; root cause described as a heap-based overflow in the NFS networking path. The CVE entry indicates privi...

CVE-2026-57087

CVE-2026-57087 is a Windows Media Foundation remote code execution vulnerability caused by a heap-based buffer overflow in Windows Media Foundation. An unauthenticated attacker could trigger code execution over a network. Public sources confirm the flaw affects Windows Media/Media Foundation comp...

CVE-2026-61349

CVE-2026-61349 is a Windows vulnerability in the Work Folder Service described as a use-after-free that allows an authorized attacker to elevate privileges locally. The NVD entries (and CVE records) corroborate a local-exploit scenario with a CVSS v3.1 base score of 7.8 (HIGH), requiring LOW priv...

CVE-2025-24052

CVE-2025-24052 concerns vulnerabilities in the Agere modem driver (ltmdm64.sys) shipped with Windows. The connected Microsoft KBs confirm that the ltmdm64.sys driver is removed in October 2025 updates, and that fax-modem hardware relying on this driver will no longer function on Windows after the...

CVE-2025-53722

CVE-2025-53722 affects Windows Remote Desktop Services. Described as Denial-of-Service via uncontrolled resource consumption, exploitable over the network with no user interaction and no privileges required. CVSS v3.1 base score 7.5 (Network, Low attack complexity, No privileges, No user interact...

CVE-2025-53724

CVE-2025-53724 is a Windows Push Notifications vulnerability described as a type confusion that allows an authorized, locally authenticated attacker to elevate privileges. The CVE is linked to Windows Push Notifications and is rated with a base score of 7.8 (HIGH) via CVSS 3.1, with attack vector...

CVE-2025-54096

CVE-2025-54096 : Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthenticated network attacker to disclose information. The vulnerability is characterized by network access (AV:N) with low complexity (AC:L) and no privileges required (PR:N), but requires user i...

CVE-2025-54106

CVE-2025-54106 affects Windows Routing and Remote Access Service (RRAS) with an integer overflow/wraparound vulnerability that enables remote code execution over the network (CVSSv3.1: 8.8). A GitHub exploit proof-of-concept exists: Exploit for Integer Overflow or Wraparound in Microsoft RRAS, in...

CVE-2025-54894

CVE-2025-54894 is described as Local Security Authority Subsystem Service Elevation of Privilege, but no concrete technical details (affected product/version/root cause) are provided in the connected documents; monitor for updates.

CVE-2025-54912

CVE-2025-54912 is described as a use-after-free vulnerability in Windows BitLocker that enables local privilege escalation by an authorized attacker. The connected NC SC document confirms the vulnerability is associated with Windows BitLocker and indicates the impact as elevated privileges, but d...

CVE-2025-59259

CVE-2025-59259 affects Windows Local Session Manager (LSM) with an improper validation of input type, enabling an unauthenticated? authorized user to cause Denial of Service over a network. According to the CVE description and EUVD-2025-34370, the exploitability is network-based (AV:N, AC:L, PR:L...

CVE-2025-60720

Technical details for CVE-2025-60720 (TDX.sys) are not provided in the Connected documents. The Initial Description notes local privilege escalation via a buffer over-read; no vendor/version/patch details are supplied here; monitor for updates.

CVE-2026-20843

CVE-2026-20843 describes an Elevation of Privilege in Windows Routing and Remote Access Service (RRAS) due to improper access control. The CVE is confirmed by multiple feeds; affected is RRAS on Windows. The reported impact is local privilege escalation for an authorized attacker with low privile...