CVE-2026-42909

CVE-2026-42909 involves a heap-based buffer overflow in the Remote Desktop Client that enables a remote attacker to execute code over the network. The vulnerability arises from improper handling of data during remote desktop operations, leading to memory corruption. The CVSS-3.1 vector (AV:N/AC:H...

CVE-2017-8566

CVE-2017-8566 is a Windows IME elevation-of-privilege vulnerability in which Windows IME improperly handles parameters in a DCOM class method. A locally authenticated attacker could exploit it by running a crafted application to gain higher privileges. Affected: Windows 1607, 1703, and Windows Se...

CVE-2025-47971

CVE-2025-47971 describes a buffer over-read in the Virtual Hard Disk (VHDX) component that can allow a local attacker to elevate privileges. The publicly documented impact is local privilege elevation via a buffer over-read in VHDX; vendors have not provided version-specific affected products in ...

CVE-2025-49667

Technical details about CVE-2025-49667 are not publicly provided in the supplied connected and initial documents. Monitor for updates from official advisories; current materials only indicate a local privilege escalation via Win32K ICOMP without specifics.

CVE-2025-49734

CVE-2025-49734 affects Windows PowerShell. The root cause is an improper restriction of the communication channel to intended endpoints, enabling an authorized local attacker to elevate privileges. The CVE maps to a local privilege escalation with high impact (C:H/I:H/A:H) and requires local acce...

CVE-2025-54101

CVE-2025-54101: Use-after-free in Windows SMBv3 Client can lead to remote code execution by an authorized attacker over the network. The Connected documents confirm this SMBv3 Client issue and tie remediation to the September 2025 Windows updates that address SMB-related vulnerabilities (e.g., SM...

CVE-2017-8706

CVE-2017-8706 affects the Windows Hyper-V component on Windows 10 (Gold/1511/1607/1703) and Windows Server 2016. The vulnerability is an information disclosure caused by improper validation of input from an authenticated user on a guest OS within Hyper-V. The interconnected CVE entries (8707/8712...

CVE-2025-29830

Technical details about CVE-2025-29830 are not provided in the connected documents. The available data only notes a RRAS information disclosure vulnerability. Monitor official sources for updates on affected products, root cause, and remediation.

CVE-2026-26182

CVE-2026-26182 is a Windows elevation-of-privilege vulnerability caused by a use-after-free in the Windows Ancillary Function Driver for WinSock. The impact is local privilege escalation for an authorized user, as described by multiple sources. Public notices confirm the issue affects Windows com...

CVE-2025-29957

Technical details about CVE-2025-29957 (Windows Deployment Services) are not provided in the supplied documents. Please monitor for updated advisories from Microsoft or NVD for affected product/version, root cause, impact, and remediation.

CVE-2026-23669

CVE-2026-23669 is a Windows Print Spooler remote code execution vulnerability with CVSS 3.1 base score 8.8 (Network, Low attack complexity, Low privileges required, No user interaction). It impacts confidentiality, integrity, and availability (all HIGH). Exploit code maturity is UNPROVEN. The Mic...

CVE-2026-35420

CVE-2026-35420 is described in the provided sources as a heap-based buffer overflow in the Windows kernel that enables a locally authenticated attacker to achieve privilege escalation. The CVE entry itself cites an elevation of privileges without detailing exploit vectors beyond local access, and...

CVE-2025-29960

CVE-2025-29960: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) can lead to information disclosure over the network. The description specifies network-based access with high confidentiality impact; no explicit product version or fix details are provided in the connected doc...

CVE-2025-48800

CVE-2025-48800 affects Windows BitLocker. Description confirms a protection mechanism failure that enables bypass of BitLocker with physical access. Connected NC SC advisory lists Windows BitLocker under CVE-2025-48800 with a CVSS v3.1 impact of 6.80 (Physical access required, no user interaction...

CVE-2025-48803

CVE-2025-48803 affects Windows Virtualization-Based Security (VBS) Enclave. The root cause is a missing integrity check in the Enclave, enabling an authorized local attacker to obtain elevated privileges. The NCSC aggregation also lists CVE-2025-48803 with an impact of gaining elevated privileges...

CVE-2025-55230

CVE-2025-55230 is a local privilege-escalation in the Windows MBT Transport driver (netbt.sys) caused by an untrusted pointer dereference when handling a specific IOCTL. An authenticated local user can elevate to SYSTEM by dereferencing a kernel address via kernel memory access. A PoC exploit exi...

CVE-2026-0390

Technical details about CVE-2026-0390 are not publicly provided in the available documents. No information on affected product versions, root cause, exploitability, or remediation is included. Monitor for updates from official sources.

CVE-2026-20868

CVE-2026-20868 is a heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) that enables remote code execution over the network. Public disclosures and vendor advisories (RRAS context) indicate this vulnerability affects Windows RRAS; Microsoft has released January 2026 sec...

CVE-2026-32202

CVE-2026-32202 is a Windows Shell vulnerability described as a protection mechanism failure that enables spoofing over a network. Connected sources label the issue under Windows Shell with the capability for an attacker to pretend to be another user (e.g., “Pretend to be another user”) and refere...

CVE-2017-8702

CVE-2017-8702 is a Windows Elevation of Privilege vulnerability in Windows Error Reporting (WER). Affects Windows 10 Gold/1511/1607 and Windows Server 2016; caused by how WER handles and executes files, enabling a local attacker to gain higher privileges and access sensitive information and syste...

CVE-2025-29832

Technical details about CVE-2025-29832 are not publicly provided in the supplied documents; no affected products, root cause, or remediation are detailed here. Monitor for updates.

CVE-2025-48807

CVE-2025-48807 affects Windows Hyper-V: improper restriction of communication to intended endpoints enables an authorized, local attacker to execute code. The CVE is tracked with a 3.1 3.1 CVSSv3.1 vector: Local, High impact on confidentiality, integrity, and availability; exploit requires Low pr...

CVE-2025-48818

CVE-2025-48818 is a TOCTOU race condition in Windows BitLocker that enables bypass of a security feature via physical access. The CVE is listed in NCSC/NCSC-2025-0213 with impact described as bypassing security measures under Windows BitLocker and a CVSS v3.1 base score of 6.8 (PHYSICAL vector, L...

CVE-2025-49753

Technical details for CVE-2025-49753 are not provided in the Connected documents; the Initial Description mentions a heap-based buffer overflow in RRAS but no vendor/product/version/impact details are given in the connected material.

CVE-2025-54918

CVE-2025-54918 describes an improper authentication flaw in Windows NTLM that enables a network-authenticated attacker to elevate privileges. The CVSS v3.1 base score is 8.8 (HIGH) with network access, low attack complexity, and privileges required. A PoC exploit exists on GitHub (CVE-2025-54918-...

CVE-2026-20922

CVE-2026-20922 is a heap-based buffer overflow in Windows NTFS that enables a locally authenticated attacker to execute code. The description and connected sources confirm NTFS as the vulnerable component and local execution as the impact. Public details in the provided documents are consistent w...

CVE-2026-40377

Technical details (affected components, root cause, impact specifics, or fixes) are not publicly provided in the connected documents. Monitor vendor advisories for patch information and affected products; no additional specifics are available here.

CVE-2017-8623

CVE-2017-8623 affects Microsoft Windows Hyper-V (Windows 10 versions 1607/1703 and Windows Server 2016). The flaw is due to Hyper-V Denial of Service arising from improper validation of input by a privileged user on a guest operating system, enabling a guest VM to cause the host to crash. The pra...

CVE-2025-47991

CVE-2025-47991 maps to a Microsoft IME (Input Method Editor) use-after-free vulnerability reported as a resource-management error that can enable local privilege escalation. Connected CNVD-2025-16874 corroborates an IME privilege-elevation risk from Microsoft IME. Publicly stated impact in the CV...

CVE-2025-49722

Technical details about CVE-2025-49722 are not present in the provided documents. No affected products, root cause, exploit vector, or fixes are disclosed here. Monitor for updates and consult the primary CVE entry for authoritative information.

CVE-2025-55231

CVE-2025-55231 describes a race condition in the Windows Storage-based Management Service where concurrent access to a shared resource is improperly synchronized, enabling a network-based attacker to potentially execute code. Affected component: Windows Storage-based Management Service (Windows S...

CVE-2025-54107

CVE-2025-54107 involves the Windows MapUrlToZone component with improper resolution of path equivalence, enabling circumvention of a security feature over a network. The entry lists CVSS 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (base 4.3, MEDIUM) and notes a network-exposed vector with no privileg...

CVE-2026-40397

CVE-2026-40397 describes an integer underflow (wrap/wraparound) in the Windows Common Log File System Driver that enables a locally authenticated attacker to elevate privileges. The description indicates a local, privileges-required (low), no user interaction vulnerability with high impact to con...

CVE-2025-47980

Technical details about CVE-2025-47980 (affected product/components, root cause, impact, fixes) are not provided in the connected documents. Monitor for updates as more information becomes public.

CVE-2025-48804

CVE-2025-48804 : Windows BitLocker is affected by a security feature bypass through acceptance of extraneous untrusted data with trusted data, enabling a physical attacker to bypass protections. The connected Microsoft-related documents indicate that Microsoft released security updates addressing...

CVE-2025-49686

Technical details for CVE-2025-49686 are not publicly provided in the supplied documents. No affected products, root cause, or remediation are confirmed here. Monitor for official updates from Microsoft and CVE references.

CVE-2025-64678

CVE-2025-64678 is a Windows RRAS heap-based buffer overflow vulnerability that allows a network-based attacker to achieve remote code execution. The NVD entry confirms the flaw, with a CVSS v3.1 base score of 8.8 (High), indicating a network attack vector, no privileges required, and user interac...

CVE-2026-45655

CVE-2026-45655 affects Windows BitLocker. The description indicates a protection mechanism failure that could allow an unauthorized attacker to bypass a security feature via a physical attack. The connected documents provide the following details: CVSSv3.1 base score 5.3 (Medium), attack vector P...

CVE-2025-49730

Technical details about CVE-2025-49730 are not publicly available in the provided connected documents. Monitor for updates from official advisories; no information on affected products, root cause, or fixes is provided here.

CVE-2026-20940

CVE-2026-20940 is a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver that enables a locally authenticated attacker to elevate privileges. Connected advisories confirm the affected component (Cloud Files Mini Filter Driver) and the privilege-escalation impact; Microsoft has...

CVE-2026-26155

CVE-2026-26155 is a Microsoft Local Security Authority Subsystem Service information disclosure vulnerability. The entry lists a CVSS v3.1 base score 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a Network attack vector, low complexity , and low privileges requ...

CVE-2026-42908

The CVE-2026-42908 entry describes an Out-of-bounds read in Windows Remote Desktop Protocol (RDP) that enables an unauthenticated attacker to disclose information over the network. Affected component is Windows RDP; the underlying fault is an out-of-bounds read, leading to information disclosure....

CVE-2025-49725

Technical details beyond the short CVE description are not provided in the supplied documents. No product/version/patch specifics, exploit details, or remediation steps are available. Monitor official Microsoft advisories for patched versions and remediation guidance.

CVE-2025-49742

Technical details about CVE-2025-49742 are not provided in the supplied documents. No information on affected products, root cause, impact, or fixes is available here; monitor for updates.

CVE-2026-32149

CVE-2026-32149 is a Windows Hyper-V remote code execution vulnerability. The issue involves a local attack vector (AV: Local) with low attack complexity (AC: Low) and privileges required (PR: Low) that requires user interaction (UI: Required). Impact is high on confidentiality, integrity, and ava...

CVE-2026-40382

CVE-2026-40382 is a use-after-free vulnerability in Windows Telephony Service that allows an authorized local attacker to elevate privileges. The CVSS 3.1 vector indicates a Local, Low-privilege, No-UI, with High confidentiality, integrity, and availability impact (base score 7.8). The connected ...

CVE-2026-49178

CVE-2026-49178 is a heap-based buffer overflow in Windows Active Directory Domain Services that enables a network-based remote code execution by an authenticated, low-privilege attacker. The affected component is AD DS; the vulnerability enables code execution with high impact on confidentiality,...

CVE-2026-57092

CVE-2026-57092 — Windows VMSwitch use-after-free can lead to a network-based Elevation of Privilege. The issue is triggered in the Windows VMSwitch component and, per sources, enables an authorized attacker to escalate privileges over the network. The CVE is listed as critical (CVSS v3.1: AV:N/AC...

CVE-2025-48815

CVE-2025-48815 affects Windows OS via a type confusion in the SSDP Service that could allow an authorized local attacker to elevate privileges. The description states local privilege escalation with high impact (CVSSv3.1: 7.8, HIGH). No explicit exploitation details or vendor/product versions are...

CVE-2025-49663

Technical details for CVE-2025-49663 are not provided in the connected documents; the initial description mentions RRAS heap overflow but lacks concrete product/version/impact details—monitor for updates.