CVE-2026-50412

CVE-2026-50412 is a Windows NTFS elevation-of-privilege vulnerability caused by a stack-based buffer overflow. The affected component is NTFS in Windows, allowing an authorized local attacker with low privileges and no user interaction to gain SYSTEM-level privileges (base CVSS v3.1: 7.8, Local, ...

CVE-2026-50683

CVE-2026-50683 is a Windows DHCP Client/Server heap-based buffer overflow that enables an authenticated attacker on an adjacent network to elevate privileges. Public details in the initial entry cite a heap-based overflow and adjacent-access attack path with high impact (C:H, I:H, A:H) and a CVSS...

CVE-2025-47998

Technical details about CVE-2025-47998 are not provided in the supplied connected documents; the initial description notes a heap-based overflow in RRAS but no additional product/version/impact details are given here. Monitor for updates.

CVE-2025-48001

Technical details about CVE-2025-48001 are not publicly provided in the supplied documents. No affected products, root cause, impact, or remediation specifics are present. Monitor for updates from vendors and security advisories.

CVE-2025-48805

CVE-2025-48805 describes a heap-based buffer overflow in the Microsoft MPEG-2 Video Extension that could allow an authorized local attacker to execute code. The provided Connected Documents do not supply additional technical details (no vendor, product version, root-cause, specific vulnerable com...

CVE-2025-48823

CVE-2025-48823: Windows Cryptographic Services vulnerability allowing an unauthenticated network attacker to disclose information. Connected data lists CVSS v3.1 base score 5.9 (Medium) with Confidentiality Impact high and no listed impact on integrity/availability. The only explicit detail in so...

CVE-2025-49675

Technical details (affected product, exploit specifics, root cause) are not provided in the connected documents. Monitor for official CVE disclosures and vendor advisories for concrete remediation and impact.

CVE-2025-49679

Technical details about CVE-2025-49679 (affected product/module, root cause, impact, and remediation) are not publicly provided in the supplied documents. Monitor for official updates from Microsoft (KB/SSU) and ENISA EUVD for specifics.

CVE-2025-50153

Technical details about CVE-2025-50153 (affected components, root cause, impact specifics, and fixes) are not provided in the connected documents. Monitor for updates from MSRC/NVD for technical disclosure.

CVE-2025-50161

CVE-2025-50161 is a heap-based buffer overflow affecting Windows Win32K - GRFX. The vulnerability allows an authorized attacker to achieve local privilege escalation. Exploitation requires user interaction and low privileges before escalation. Microsoft has released security updates addressing vu...

CVE-2025-53136

CVE-2025-53136 is listed under Windows NT OS Kernel with a Medium CVSS v3.1 (5.5) and impact described as Access to sensitive data . The connected documents provide the affected product (Windows NT OS Kernel) and impact, but do not disclose root cause details or a specific fix. Public references ...

CVE-2025-59242

CVE-2025-59242 is a heap-based buffer overflow in the Windows Ancillary Function Driver for WinSock that enables local privilege escalation for an authenticated user. Connected Microsoft KB advisories confirm the vendor-fixed remediation via October 2025 security updates (e.g., KB5066793 and rela...

CVE-2025-60703

Technical details about CVE-2025-60703 are not provided in the initial or connected documents. Monitor for updates as more specifics (affected product/version, root cause, mitigations) may be published.

CVE-2026-20809

CVE-2026-20809 is a Windows Kernel Memory TOCTOU race condition that enables local privilege escalation. Public docs confirm the vulnerability and classify impact as obtaining elevated privileges. Remediation linked to January 2026 updates (e.g., KB5073457/KB5073379 families) addressing Windows K...

CVE-2026-20875

CVE-2026-20875 is a null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) that enables a network-based denial of service. The vulnerability is documented with a CVSS v3.1 base score of 7.5 (Network, Low complexity, No privileges, No user interaction; impact: Avail...

CVE-2026-24297

CVE-2026-24297 : Windows Kerberos contains a race condition in a shared resource that can allow a network-based bypass of a security feature. The vulnerability is listed across multiple sources (NVD, OSV, CIRCL, ENISA EUVD, CVE list) and is associated with Windows Kerberos components. Exploitatio...

CVE-2026-45634

The CVE describes an out-of-bounds read in the Windows DHCP Server that enables an authorized local attacker to disclose information. The affected component is Windows DHCP Server; the root cause is a memory read violation leading to information disclosure. The CVSS metrics indicate a local attac...

CVE-2026-45653

CVE-2026-45653: A Windows Kernel use-after-free vulnerability that enables local privilege escalation by an authorized attacker. The issue affects kernel code paths susceptible to use-after-free, with an attack vector that is LOCAL, requiring LOW privileges and NO user interaction; the impact per...

CVE-2026-50388

CVE-2026-50388 is an Windows NTFS local vulnerability described as an out-of-bounds read that allows an unauthenticated/unauthorized attacker to execute code locally. The CVE is tracked across multiple sources (NVD, MSRC, CIRCL) with a base CVSS v3.1 score of 7.8 (High) and LOCAL attack vector, r...

CVE-2026-50432

CVE-2026-50432 describes a Use-after-free vulnerability in the Windows Virtual Filtering Platform (VFP) . An authenticated attacker could trigger a denial-of-service condition over the network by exploiting this flaw in the VFP code path, as indicated by the CVE entry: AV:N/AC:H/PR:L/UI:N/S:U/C:N...

CVE-2026-50441

An active CVE: CVE-2026-50441 affects Windows Resilient File System (ReFS). Description confirms an Untrusted pointer dereference leading to local Privilege Escalation by an authorized attacker. Impact per CVSS: Local, Privilege Elevation, with High confidentiality/integrity/availability impact. ...

CVE-2026-50489

CVE-2026-50489 is a heap-based buffer overflow in Windows Win32K that allows an authorized, locally authenticated attacker to escalate privileges. The root cause is a memory corruption in the Win32K subsystem that leads to code execution with SYSTEM rights. The CVE entry is supported by multiple ...

CVE-2026-50684

CVE-2026-50684 (AD FS spoofing) : The vulnerability is described as improper neutralization of input during web page generation (XSS) in Active Directory Federation Services, enabling an authorized attacker to perform spoofing over the network. The CVSS v3.1 base metrics indicate a Medium severit...

CVE-2026-55001

CVE-2026-55001 affects Windows Active Directory / Active Directory Domain Services. The root cause is improper certificate validation within AD, enabling an authorized attacker to achieve local privilege escalation. CVSS 3.1 base score 7.8 (Local, Low complexity, Privileges Required: Low; User In...

CVE-2026-56647

CVE-2026-56647 is a Windows vulnerability in the Windows Remote Access Service Infrastructure where an integer overflow/wraparound can let an authorized attacker elevate privileges over a network. The affected component is the Windows Remote Access Service Infrastructure, and the root cause is an...

CVE-2026-62699

The CVE-2026-62699 entry concerns the Windows Universal Disk Format File System Driver (UDFS). It describes a heap-based buffer overflow in UDFS that permits code execution by an unauthenticated attacker with physical access to the system. Affected component: UDFS in Windows. Root cause: heap-bas...

CVE-2026-62740

CVE-2026-62740 describes a vulnerability in the Windows Imaging Component where an uninitialized resource can lead to local information disclosure by an authorized attacker. The issue is reported with a CVSS v3.1 base score of 5.5 (Medium), vector: Local, low attack complexity, and low privileges...

CVE-2026-62773

CVE-2026-62773 describes a use-after-free vulnerability in Windows Kerberos that enables a locally authenticated attacker to elevate privileges. The flaw is triggered in the Kerberos subsystem and, when exploited, could allow elevation of rights with high impact on confidentiality, integrity, and...

CVE-2025-47984

Technical details about CVE-2025-47984 (affected components, exploitability, root cause, and fix) are not provided in the connected documents. Monitor for updates from MSRC/NVD for concrete context and remediation.

CVE-2025-48814

Technical details about CVE-2025-48814 (affected product/version, exploit specifics, and remediation) are not provided in the connected documents. Monitor official updates from Microsoft/NVD for concrete details and fixes.

CVE-2025-48820

CVE-2025-48820 affects Windows AppX Deployment Service. It stems from improper link resolution before file access ("link following"), allowing an authenticated local attacker to elevate privileges. CVSS v3.1 score 7.8 (LOCAL, LOW privileges required, high confidentiality/integrity/availability im...

CVE-2025-49670

Technical details about CVE-2025-49670 (affected software, root cause, impact, and fixes) are not provided in the connected documents; only the initial description is available. Monitor for updates to obtain concrete vulnerability specifics.

CVE-2025-49678

Technical details for CVE-2025-49678 (affected product, root cause, impact, or fix) are not provided in the supplied documents. Monitor for updates from official sources.

CVE-2025-53132

Technical details for CVE-2025-53132 (Windows Win32K GRFX race condition privilege escalation) are not provided in the connected documents. Public specifics (affected versions, exploit details, or fixes) are not available here; monitor for updates from official advisories.

CVE-2025-59190

CVE-2025-59190 affects the Microsoft Windows Search Component. It is due to improper input validation and allows a local attacker to cause a Denial of Service. The CVE is rated with CVSS 3.1 (base 5.5, MEDIUM); attack vector LOCAL, privileges REQUIRED NONE, user interaction REQUIRED, and impact l...

CVE-2025-59196

CVE-2025-59196: Windows SSDP Service race condition leading to local privilege escalation. Affected component: Windows SSDP Service. Root cause: concurrency with improper synchronization on a shared resource. Impact: attacker with local access could elevate privileges (CVSSv3.1: AV Local, AC High...

CVE-2025-59260

CVE-2025-59260 is an information-disclosure vulnerability in the Microsoft Failover Cluster Virtual Driver that can expose sensitive data to a locally authenticated attacker. The CVSS 3.1 vector indicates a local attack with low complexity and low privileges required, and a high confidentiality i...

CVE-2025-59277

CVE-2025-59277 involves improper validation of a specified input type in Windows Authentication Methods, enabling a locally authenticated attacker to elevate privileges. Connected MSKBs and EUVD-2025-34369 corroborate the Windows Authentication Methods focus and local privilege escalation risk. T...

CVE-2026-21238

CVE-2026-21238 concerns an improper access control vulnerability in Windows Ancillary Function Driver for WinSock that enables local privilege escalation by an authorized attacker. The CVSSv3.1 vector indicates a high-severity impact (C/H, I/H, A/H) with local attack, low complexity, and a low pr...

CVE-2026-23674

CVE-2026-23674 relates to Windows MapUrlToZone: improper resolution of path equivalence allows a network-based bypass of a security feature. Affected component is the MapUrlToZone path resolution logic in Windows, with exploitation possible over the network and no user interaction required beyond...

CVE-2026-25179

CVE-2026-25179 affects the Windows Ancillary Function Driver for WinSock and is caused by improper validation of a specified input type, enabling a locally authenticated attacker to elevate privileges. The entry carries a CVSS v3.1 base score of 7.0 (High) with Local attack, High confidentiality/...

CVE-2026-26183

CVE-2026-26183 involves the Remote Access Management service/API (RPC server). According to the provided metrics, the vulnerability enables local Elevation of Privilege with a Low attack complexity and Low privileges required, and no user interaction. The impact is High for confidentiality, integ...

CVE-2026-27929

CVE-2026-27929 is a Time-of-check Time-of-use (toctou) race condition in Windows LUAFV (LUA File Virtualization Filter Driver) that enables a locally authenticated attacker to elevate privileges. Red Hat and NCSC advisories confirm the Windows LUAFV vulnerability and its local privilege-escalatio...

CVE-2026-35416

CVE-2026-35416 describes a local privilege escalation due to a use-after-free in the Windows Ancillary Function Driver for WinSock. The description in the connected documents confirms the vulnerable component and the root cause as a use-after-free, leading to elevation of privileges for an author...

CVE-2026-41087

CVE-2026-41087 affects Windows File Explorer; a local attacker can cause exposure of sensitive information to obtain disclosure on the host. The vulnerability is rated CVSSv3.1: 5.5 (Medium) with Local access, Low attack complexity, Privileges Required: Low, no user interaction, and Confidentiali...

CVE-2026-42914

Technical details are not publicly available in the provided documents. Monitor for updates from official sources.

CVE-2026-50370

CVE-2026-50370 is a heap-based buffer overflow in the Windows DHCP Server service that could allow an unauthenticated attacker on an adjacent network to execute code. The vulnerability is listed among the July 2026 Patch Tuesday disclosures and is included in Microsoft’s security updates (KB50995...

CVE-2026-58530

CVE-2026-58530 affects Windows Resilient File System (ReFS). The issue is a heap-based buffer overflow in ReFS that allows an unauthorized attacker to execute code locally. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH), with LOCAL attack vector, no privileges required, and user inter...

CVE-2026-58545

CVE-2026-58545 is a Windows Kernel Security Feature Bypass vulnerability. The connected documents confirm an improper access control in the Windows Kernel that could let an authoriz­ed locally attacker bypass a security feature. Metrics indicate CVSS v3.1 base score 5.5 (Medium), with Local attac...

CVE-2026-58546

CVE-2026-58546 is a Windows Remote Desktop Client Information Disclosure vulnerability. The initial and connected records confirm that the issue stems from use of an uninitialized resource in Windows RDP, enabling an unauthorized attacker to disclose information over a network. Affected component...