CVE-2026-50308

CVE-2026-50308 is a Windows NTFS vulnerability described as an integer underflow (wrap or wraparound) that could allow an unauthorized attacker to execute code locally. Sources consistently state: affected component is Windows NTFS on Windows systems; impact is local code execution with high seve...

CVE-2026-50685

CVE-2026-50685 is a Windows DHCP Server Remote Code Execution vulnerability caused by a double-free in the DHCP Server component. It is network-exploitable (no user interaction) and rated by Microsoft as an in-scope issue with high impact (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; CVSS v3.1 base 7.5)....

CVE-2026-50695

CVE-2026-50695 refers to a stack-based buffer overflow in Microsoft Windows Active Directory Federation Services (AD FS) that enables an unauthenticated, remote attacker to cause a denial of service over the network. The vulnerability is described with a CVSS v3.1 base score of 7.5 (HIGH) with at...

CVE-2025-53138

CVE-2025-53138 affects Windows Routing and Remote Access Service (RRAS). The issue is caused by use of an uninitialized resource, enabling an authorized network attacker to disclose information over the network. The connected RRAS entries corroborate that this CVE is present and assign a CVSS v3....

CVE-2025-53143

CVE-2025-53143 is listed for Windows Message Queuing with high impact (CVSS 3.1: 8.8, Network, Privileges Low, User Interaction None). The entry indicates a remote code execution potential via resource type confusion. Connected sources confirm the vulnerability exists in MSMQ and note a network-e...

CVE-2025-53724

CVE-2025-53724 is a Windows Push Notifications vulnerability described as a type confusion that allows an authorized, locally authenticated attacker to elevate privileges. The CVE is linked to Windows Push Notifications and is rated with a base score of 7.8 (HIGH) via CVSS 3.1, with attack vector...

CVE-2025-53810

CVE-2025-53810 describes a type confusion vulnerability in Windows Defender Firewall Service that allows an authorized local attacker to escalate privileges. The connected NC SC/ENISA-style document confirms the affected component as Windows Defender Firewall Service and lists the impact as obtai...

CVE-2025-54096

CVE-2025-54096 : Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthenticated network attacker to disclose information. The vulnerability is characterized by network access (AV:N) with low complexity (AC:L) and no privileges required (PR:N), but requires user i...

CVE-2025-62458

CVE-2025-62458 is a Windows Win32K GRFX elevation-of-privilege vulnerability (heap-based overflow) that enables local privilege escalation by an authorized user. Connected sources confirm the issue is associated with Windows Win32K GRFX components and is part of Microsoft’s December 2025 patch cy...

CVE-2026-20843

CVE-2026-20843 describes an Elevation of Privilege in Windows Routing and Remote Access Service (RRAS) due to improper access control. The CVE is confirmed by multiple feeds; affected is RRAS on Windows. The reported impact is local privilege escalation for an authorized attacker with low privile...

CVE-2026-20869

CVE-2026-20869 affects Windows Local Session Manager (LSM) and is described as a race-condition vulnerability in the management of a shared resource that allows an authenticated, local attacker to elevate privileges. The initial CVE entry cites local privilege escalation with a high impact. Micro...

CVE-2026-27925

CVE-2026-27925 concerns a use-after-free in Windows Universal Plug and Play (UPnP) Device Host that allows an adjacent-network attacker to disclose information. Affected component: Windows UPnP Device Host (upnp.dll). Impact as described: information disclosure with high confidentiality impact; n...

CVE-2026-32084

CVE-2026-32084 is a Windows vulnerability labeled as a Windows Print Spooler information-disclosure issue with local access and potential exposure of sensitive data via Windows File Explorer. The CVE entry notes local attack vector, low attack complexity, and low privileges required, with a high ...

CVE-2026-32150

CVE-2026-32150 is a local privilege-escalation vulnerability in Windows Function Discovery Service (fdwsd.dll) caused by a race condition from concurrent access to a shared resource. An authenticated, local attacker could elevate privileges. Public references indicate the issue is addressed by Mi...

CVE-2026-50445

CVE-2026-50445 is a Windows Remote Desktop Protocol (RDP) information-disclosure vulnerability caused by a buffer over-read. An unauthenticated, remote attacker could disclose memory information over the network. Microsoft and partners have released updates (MSRC guidance) to address this vulnera...

CVE-2026-50456

CVE-2026-50456 is a Windows File Explorer information disclosure vulnerability. A local attacker with low privileges and no user interaction can access sensitive information due to the underlying issue in Windows File Explorer. The CVSS.3.1 score is 5.5 (Medium), with attack vector Local, impact...

CVE-2026-54989

CVE-2026-54989 is a use-after-free in the Quality Windows Audio/Video Experience (QWAVE) service that enables a locally authenticated attacker to elevate privileges. The CVSS 3.1 metrics describe a Local attack with High impact on confidentiality, integrity, and availability, requiring LOW privil...

CVE-2026-54995

CVE-2026-54995 refers to a use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). The flaw could allow an unauthenticated attacker to execute arbitrary code over the network. Public references in the provided docs (NVD, MSRC update guidance, and patch reviews) c...

CVE-2025-54097

CVE-2025-54097 is an information-disclosure vulnerability in Windows Routing and Remote Access Service (RRAS) caused by an out-of-bounds read. It can allow an unauthenticated attacker to disclose information over a network. The CVE is listed in multiple sources (NVD, CVE List) with RRAS-specific ...

CVE-2025-59512

Technical details about CVE-2025-59512, including affected product, root cause, exploitability or remediation, are not publicly provided in the supplied Connected Documents. Monitor for official updates (mitigations/patches) as newer MSKBs may cover this CVE.

CVE-2026-24285

Technical details about CVE-2026-24285 are not provided in the given documents. Monitor for updates from Microsoft and CVE records for affected products, impact, and mitigations.

CVE-2026-25185

Technical details (affected products, components, root cause, impact, and remediation) are not provided in the supplied documents. Monitor for updates.

CVE-2026-32083

CVE-2026-32083 pertains to Windows’ Simple Search and Discovery Protocol (SSDP) Service elevation of privilege. The vulnerability is local, with low privileges required and no user interaction, and yields a high impact on confidentiality, integrity, and availability. Microsoft lists an official f...

CVE-2026-35423

Technical details (affected product, root cause, impact, or fixes) are not publicly available in the provided documents. Monitor for updates from NVD/EUVD/CVE listings for additional specifics.

CVE-2026-49791

CVE-2026-49791 affects Windows Routing and Remote Access Service (RRAS). The issue is an improper link resolution before file access (link following) that can allow an authorized, local attacker to elevate privileges. The vulnerability is triggered locally with low attack complexity and low privi...

CVE-2026-50311

CVE-2026-50311 concerns Windows Server where improper access control allows an authorized user to locally elevate privileges. Root cause: insufficient authorization checks in the affected Windows Server components, enabling privilege escalation with local access and no user interaction required. ...

CVE-2026-50312

CVE-2026-50312 is a Windows Ancillary Function Driver for WinSock use-after-free vulnerability that enables local privilege escalation when exploited. The initial description and connected sources confirm the affected component and root cause, and indicate the impact is elevation of privileges fo...

CVE-2026-50341

CVE-2026-50341 is a Windows NTFS information-disclosure issue caused by a buffer over-read. The vulnerability allows an authorized local attacker to disclose information from memory. Public documentation in connected sources confirms the affected component as NTFS and describes a local-exploitati...

CVE-2026-57093

CVE-2026-57093 – Windows Ancillary Function Driver for WinSock is a reported use-after-free vulnerability in the WinSock ancillary function driver that can be exploited locally to achieve privilege escalation. The issue affects the specific Windows driver handling WinSock operations; successful e...

CVE-2025-49762

CVE-2025-49762 describes a race condition caused by concurrent access to a shared resource in the Windows Ancillary Function Driver for WinSock, enabling a locally authenticated attacker to escalate privileges. The description explicitly identifies the affected component and the impact as local p...

CVE-2025-50160

CVE-2025-50160 maps to a Windows RRAS heap-based buffer overflow that enables remote code execution. The vulnerability affects RRAS and is described in public sources as allowing an authenticated, network-based attacker to execute code with low privileges and user interaction required. The connec...

CVE-2025-53719

CVE-2025-53719 affects Windows Routing and Remote Access Service (RRAS); an uninitialized resource in RRAS can allow an authorized network attacker to disclose information. The issue is tied to RRAS in Windows, with CVSS v3.1 base score 5.7 (Network, Low attack complexity, Privileges required: Lo...

CVE-2025-53804

CVE-2025-53804 affects the Windows Kernel and involves exposure of sensitive information to an unauthorized actor, allowing local disclosure. The threat is categorized with a CVSS v3.1 base score of 5.5 (Medium) and a local attack vector with low complexity, where privileges are low and no user i...

CVE-2025-58735

CVE-2025-58735 is a Use-after-free vulnerability in Inbox COM Objects leading to local code execution. The base CVSS v3.1 score is 7.0 (HIGH) with LOCAL attackVector, HIGH impact on confidentiality/integrity/availability, and user interaction required. Connected MSKB/NCSC entries confirm a Window...

CVE-2025-59198

CVE-2025-59198 is a Microsoft Windows vulnerability in the Windows Search Component caused by improper input validation that can allow an authorized, local attacker to cause a denial of service. The CVE is shown in the Windows Search Component entries with a base CVSS v3.1 score of 5.0 (MEDIUM), ...

CVE-2026-21508

CVE-2026-21508 concerns improper authentication in Windows Storage, enabling a locally authenticated attacker to elevate privileges. The CVSS v3.1 base score is 7.0 (HIGH), with LOCAL attack vector, HIGH impact on confidentiality, integrity, and availability, and a HIGH attack complexity requirin...

CVE-2026-27914

CVE-2026-27914 affects the Microsoft Management Console (MMC). It is an Elevation of Privilege vulnerability where a local attacker with low privileges and no user interaction can potentially gain high impact on confidentiality, integrity, and availability due to the underlying root cause describ...

CVE-2026-49180

This CVE concerns the Universal Plug and Play component upnp.dll, where an improper link resolution before file access (link following) can lead to local information disclosure. The entry notes that an authorized attacker can disclose information locally, with a CVSS base score of 5.5 (Medium). A...

CVE-2026-49797

CVE-2026-49797 : Heap-based buffer overflow in Windows NTFS enables local code execution by an unauthenticated attacker. Affected component: NTFS. CVSSv3.1: 7.8 (HIGH). Exploitation status is not provided in the available documents; no remediation details are included.

CVE-2026-50355

CVE-2026-50355 is a vulnerability in Active Directory Federation Services (AD FS) described as a stack-based buffer overflow that enables a remote, unauthenticated attacker to cause a denial of service over the network. The CVSS v3.1 base score is 7.5 (Network, Low attack complexity, No privilege...

CVE-2026-50476

Microsoft Windows CVE-2026-50476 is a local privilege-escalation vulnerability in the Windows Network Connections Service caused by a use-after-free. Affected component is the Windows Network Connections Service; root cause is a use-after-free condition that enables an authorized attacker to elev...

CVE-2025-49761

CVE-2025-49761 is a Windows Kernel local privilege escalation (Use-after-free) vulnerability. The connected data confirms an effect: “Obtaining elevated privileges” with CVSS v3.1 base metrics indicating LOCAL, low attack complexity and privileges required, high impact to confidentiality/integrit...

CVE-2025-53153

Technical details about CVE-2025-53153 (RRAS information disclosure) are not provided in the connected documents; available sources only reiterate the use of an uninitialized resource in RRAS. Monitor for updates.

CVE-2025-58732

CVE-2025-58732 is described as a use-after-free in Inbox COM Objects that enables local code execution. The Connected Documents provide broader Windows security updates (KBs and advisories) but do not specify a vendor/product remediation or a patch explicit to this CVE in the provided materials. ...

CVE-2025-62474

CVE-2025-62474 is a Windows Remote Access Connection Manager Elevation of Privilege vulnerability. It involves improper access control in the Remote Access Connection Manager, enabling a locally authenticated attacker (low privileges, no user interaction) to obtain elevated rights. CVSS v3.1 base...

CVE-2026-25186

Technical details not publicly available in the provided documents. Monitor for updates.

CVE-2026-26163

CVE-2026-26163 is a Windows Kernel elevation-of-privilege vulnerability described as a double free allowing an authorized local attacker to escalate privileges. Connected sources confirm the affected surface is Windows Kernel and the issue enables local privilege escalation with high impact. The ...

CVE-2026-50298

CVE-2026-50298 concerns Windows Spaceport.sys: an integer overflow/wraparound vulnerability in the kernel component that could allow an unauthenticated, physical attacker to achieve privilege escalation. Affected software is Windows kernel-space Spaceport.sys; impact is elevation of privileges wi...

CVE-2026-50306

CVE-2026-50306 is a Windows TCP/IP use-after-free vulnerability that allows an authorized, local attacker to elevate privileges. Affected component is the Windows TCP/IP stack; impact is local privilege escalation with high severity (CVSS 3.1: 7.8). Microsoft has released updates (KB5095051, KB50...

CVE-2026-50347

CVE-2026-50347 is a Windows Data.dll vulnerability characterized by a heap-based buffer overflow that allows an unauthorized, local attacker to execute code. The affected component is Windows Data.dll; the underlying issue is a heap overflow leading to remote-code-execution-style impact via local...