CVE-2026-61350

Windows NTFS contains a buffer over-read that can disclose information when an attacker performs a physical attack. Affected component: NTFS; root cause: buffer over-read. CVSSv3.1 metrics indicate AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N with base score 4.6 (Medium). Impact is limited to confidential...

CVE-2026-62729

CVE-2026-62729 describes a race condition in Windows Telephony Service caused by concurrent execution on a shared resource with improper synchronization. This allows an authorized, local attacker to elevate privileges. The entry notes a local attack vector with high impact on confidentiality, int...

CVE-2026-62755

CVE-2026-62755 affects the Windows DHCP Client. The vulnerability is a stack-based buffer overflow in the DHCP client component, leading to local privilege escalation for an authorized attacker. The CVSS 3.1 vector indicates Local attack, Low attack complexity, Low privileges required, with no us...

CVE-2026-65662

CVE-2026-65662 describes an out-of-bounds read in Windows GDI that allows an authorized local attacker to disclose information. The vulnerability impacts Windows GDI components and is rated with a CVSS v3.1 base score of 5.5 (Medium) , with local attack vector, low attack complexity, and low priv...

CVE-2017-8623

CVE-2017-8623 affects Microsoft Windows Hyper-V (Windows 10 versions 1607/1703 and Windows Server 2016). The flaw is due to Hyper-V Denial of Service arising from improper validation of input by a privileged user on a guest operating system, enabling a guest VM to cause the host to crash. The pra...

CVE-2025-47991

CVE-2025-47991 maps to a Microsoft IME (Input Method Editor) use-after-free vulnerability reported as a resource-management error that can enable local privilege escalation. Connected CNVD-2025-16874 corroborates an IME privilege-elevation risk from Microsoft IME. Publicly stated impact in the CV...

CVE-2025-49664

Technical details about CVE-2025-49664 (affected components, root cause, impact, or remediation) are not provided in the connected documents. Monitor official advisories and vendor patch notes for authoritative information and fixes.

CVE-2025-49686

Technical details for CVE-2025-49686 are not publicly provided in the supplied documents. No affected products, root cause, or remediation are confirmed here. Monitor for official updates from Microsoft and CVE references.

CVE-2026-20849

CVE-2026-20849 is a Windows Kerberos elevation of privilege vulnerability caused by reliance on untrusted inputs in a security decision. The description indicates an authorized attacker could elevate privileges over a network. The provided documents give a CVSS v3.1 base score of 7.5 (Network, Hi...

CVE-2026-35424

Technical details about CVE-2026-35424 (affected products, root cause, exploitability, and fixes) are not publicly provided in the supplied documents. Monitor for updates from official sources.

CVE-2026-45638

CVE-2026-45638 relates to Windows’ Ancillary Function Driver for WinSock and is due to a use-after-free in that driver. This vulnerability allows an authorized attacker to escalate privileges locally. The available documents specify the affected component and the local-privilege-escalation impact...

CVE-2026-49794

CVE-2026-49794 concerns the Windows USB Audio Class driver (usbaudio.sys). The vulnerability is an out-of-bounds read in the driver that enables an unauthorized attacker to disclose information when a physical access scenario is present. Attacker class: physical access with low attack complexity ...

CVE-2026-50366

CVE-2026-50366 describes a Denial of Service in Windows Active Directory Domain Services caused by a null pointer dereference. The vulnerability is exploitable over the network with no user interaction, requiring low privileges and network access from an authenticated attacker; the impact is deni...

CVE-2026-50419

CVE-2026-50419 is a Windows Kernel information-disclosure vulnerability that could allow an authorized local attacker to disclose sensitive data. The CVSS v3.1 base score is 3.3 (LOW) with LOCAL access and low complexity; no exploitation details are provided in the connected documents. Microsoft ...

CVE-2026-59137

Technical details about CVE-2026-59137 are not publicly provided in the supplied documents. No affected products, versions, or remediation are specified here. Monitor for updates from official sources.

CVE-2026-65681

CVE-2026-65681 : A null pointer dereference in the Windows iSCSI Target Service allows an unauthenticated, remote attacker to cause a denial of service over the network. The NVD entry states a CVSS v3.1 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no privileges requ...

CVE-2025-48815

CVE-2025-48815 affects Windows OS via a type confusion in the SSDP Service that could allow an authorized local attacker to elevate privileges. The description states local privilege escalation with high impact (CVSSv3.1: 7.8, HIGH). No explicit exploitation details or vendor/product versions are...

CVE-2025-48819

Technical details about CVE-2025-48819 are not publicly provided in the supplied documents; no product/version/root-cause/impact information is included beyond the basic description. Monitor for official updates.

CVE-2025-49742

Technical details about CVE-2025-49742 are not provided in the supplied documents. No information on affected products, root cause, impact, or fixes is available here; monitor for updates.

CVE-2026-50471

CVE-2026-50471 is a heap-based buffer overflow in Windows NTFS that could allow a local attacker to execute arbitrary code. The vulnerability affects Windows NTFS components as described in multiple sources (NVD/NCSC/CIRCL) and is being addressed by Microsoft with published updates (e.g., KB arti...

CVE-2026-50498

CVE-2026-50498 affects the Windows Universal Disk Format File System Driver (UDFS) and is an Elevation of Privilege vulnerability in the UDFS component. The root cause is described as a privilege/escalation condition within the Windows UDFS driver, leading to local privilege escalation with a hig...

CVE-2026-62714

CVE-2026-62714 describes an integer underflow (wrap/wraparound) in Windows DHCP Server that allows an unauthorized attacker on an adjacent network to disclose information. The NVD entry confirms an ADJACENT network attack vector with LOW complexity, NONE privileges, and NONE user interaction, and...

CVE-2026-62743

CVE-2026-62743 describes an out-of-bounds read in Windows Win32K that can lead to local information disclosure by an authorized attacker. The vulnerability affects the Win32K component and is exploitable with low privileges and no user interaction, with a local attack vector. The CVSS3.1 base sco...

CVE-2026-70344

CVE-2026-70344 originates from a stack-based buffer overflow in Windows Installer. The vulnerability could allow an authorized attacker to perform local privilege escalation on affected systems. The CVSS 3.1 vector (L/L/P:L/U:N/S:U/C:H/I:H/A:H) indicates local attack vector, low attack complexity...

CVE-2025-48804

CVE-2025-48804 : Windows BitLocker is affected by a security feature bypass through acceptance of extraneous untrusted data with trusted data, enabling a physical attacker to bypass protections. The connected Microsoft-related documents indicate that Microsoft released security updates addressing...

CVE-2025-49659

Technical details for CVE-2025-49659 are not present in the provided connected documents. Public information about affected products, root cause, exploit status, and fixes is not available here; monitor for updates from official advisories.

CVE-2025-49671

CVE-2025-49671 affects Windows Routing and Remote Access Service (RRAS). The RRAS entry shows an issue enabling an unauthorized network attacker to access sensitive data (Confidentiality impact HIGH). CVSSv3.1 metrics (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) yield base score 6.5 (MEDIUM). The Connec...

CVE-2025-49683

Technical details about CVE-2025-49683 (VHDX integer overflow) are not provided in the connected documents. Monitor for updates.

CVE-2025-49732

Technical details about CVE-2025-49732 are not provided in the connected documents. Public information appears limited to the CVE entry and general Microsoft updates; monitor for official advisories for affected products, impact, and fix timing.

CVE-2025-64679

CVE-2025-64679 is a heap-based buffer overflow in Windows DWM Core Library that enables a locally authenticated attacker to escalate privileges. The NCSC advisory and CVE listings confirm this affects Windows DWM Core Library and is tracked under CVE-2025-64679 with a high-severity impact (local,...

CVE-2026-26168

CVE-2026-26168 describes a race condition in the Windows Ancillary Function Driver for WinSock that allows an authorized local attacker to elevate privileges. Publicly referenced Red Hat and Dutch/NCSC/CIRCL sources confirm the Windows driver component and local privilege impact; exploitation sta...

CVE-2026-32156

CVE-2026-32156 is a use-after-free vulnerability in the Windows Universal Plug and Play (UPnP) Device Host (upnp.dll) that allows a local, unauthorized attacker to execute code on the system. The connected sources confirm the issue affects Windows UPnP Device Host and list it among UPnP-related C...

CVE-2026-34336

Technical details (affected product/version, root cause, exploit information, or patch specifics) are not provided in the supplied documents. Monitor for updates as public details may be released separately.

CVE-2026-45603

The vulnerability CVE-2026-45603 affects Windows’ Ancillary Function Driver for WinSock (AFD). The issue is a use-after-free in the WinSock-related driver, leading to local privilege escalation for an authorized attacker. The CVSS3.1 assessment shows HIGH impact with LOCAL access, HIGH confidenti...

CVE-2026-50330

CVE-2026-50330 is a Windows Remote Desktop Client vulnerability described as a heap-based buffer overflow that allows an unauthenticated attacker to escalate privileges over the network. The CVE appears in multiple sources (NVD, EUVD, CIRCL) with consistent language about privilege elevation via ...

CVE-2026-50430

CVE-2026-50430 is the Windows Push Notifications information-disclosure vulnerability. The available sources state that exposure of sensitive information to an unauthorized actor can occur, allowing a locally-present attacker to disclose information. Affected component: Windows Push Notifications...

CVE-2026-50444

CVE-2026-50444 is a Windows Server Update Services (WSUS) Elevation of Privilege vulnerability caused by Missing authentication for a critical function. An authorized attacker could elevate privileges over the network. Public details are supported by multiple sources (MSRC update guide, NCSC advi...

CVE-2026-56175

CVE-2026-56175 describes a heap-based buffer overflow in Windows NTFS that allows an authorized, local attacker to elevate privileges. Connected sources (Microsoft MSRC update, NVD, NTFS/CIRCL sightings) confirm the vulnerability is in Windows NTFS, with local-privilege-escalation potential and a...

CVE-2026-62758

CVE-2026-62758 is a heap-based buffer overflow in Windows Remote Access Connection Manager that permits a locally authenticated attacker to elevate privileges. Affected component: RASMAN service on Windows. Root cause: heap overflow enabling arbitrary code execution with HIGH impact on confidenti...

CVE-2025-49663

Technical details for CVE-2025-49663 are not provided in the connected documents; the initial description mentions RRAS heap overflow but lacks concrete product/version/impact details—monitor for updates.

CVE-2025-53137

CVE-2025-53137 affects Windows' Ancillary Function Driver for WinSock. It is a use-after-free vulnerability that can lead to local privilege escalation when exploited by an authenticated attacker. The connected documents confirm the affected component and the high-severity impact (local, with ele...

CVE-2026-20840

CVE-2026-20840 is a Windows NTFS heap-based buffer overflow that enables local code execution by an authorized attacker. The vulnerability affects the Windows NTFS component and is rated with a CVSS v3.1 base score of 7.8 (High) for local, low-attack‑complexity, no user interaction, with high con...

CVE-2026-20926

CVE-2026-20926 describes a race condition in the Windows SMB Server that allows an authorized network attacker to elevate privileges. The vulnerability affects Windows SMB Server components and is tied to concurrent execution on a shared resource with improper synchronization. Mitigation is via M...

CVE-2026-25190

CVE-2026-25190 is a Windows GDI vulnerability (Untrusted search path) that enables local code execution. The CVE is documented across NVD/NCSC/EUVD with a base CVSS v3.1 score of 7.8 (High) and a local attack vector requiring user interaction. Microsoft has released fixes via March 2026 updates (...

CVE-2026-27920

CVE-2026-27920 is a Windows vulnerability in the UPnP Device Host that enables a local privilege escalation . The entry indicates a local attack vector with low required privileges and no user interaction, leading to high impact on confidentiality, integrity, and availability. The CVSS 3.1 base s...

CVE-2026-27928

CVE-2026-27928 is a Windows Hello security feature bypass vulnerability. The initial sources describe improper input validation in Windows Hello that allows an unauthenticated attacker to bypass a security feature over a network (attack vector: network; user interaction: none). The CVSS 3.1 base ...

CVE-2026-47289

CVE-2026-47289 is a heap-based buffer overflow in the Remote Desktop Client that enables remote code execution over a network. The vulnerability is exploitable remotely (attack vector: NETWORK) with low complexity and requires user interaction, yielding a high impact on confidentiality, integrity...

CVE-2026-50365

CVE-2026-50365 describes an Elevation of Privileges in the Windows RPC API (RPC server) due to improper authentication, enabling an adjacent-network attacker to gain high-priority access. Public data confirms an adjacent-network attack vector with high severity (CVSS ~8.0). The affected component...

CVE-2026-50509

CVE-2026-50509 is a Windows WWAN Service deserialization vulnerability that could enable local privilege escalation when an authorized user triggers the flaw. Affected component: Windows Wireless Wide Area Network Service (WwanSvc). Root cause: deserialization of untrusted data leading to elevati...

CVE-2026-58619

CVE-2026-58619 is a Windows Sensor Data Service vulnerability described as a use-after-free that enables an authorized attacker to locally elevate privileges. The vulnerability is reported with CVSS 3.1: LOCAL attack vector, HIGH impact (C, I, A), and low privileges required with no user interact...