2583 matches found
CVE-2026-73013
CVE-2026-73013 is a heap-based buffer overflow in Windows Imaging Component that allows an unauthorized, remote attacker to achieve code execution over a network. The Microsoft CNA assigns a CVSS 3.1 base score of 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a networ...
CVE-2026-73023
A heap-based buffer overflow in the Windows Imaging Component allows an unauthorized attacker to achieve remote code execution over a network . The vulnerability is rated CVSS 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network reachability, low complexity, no priv...
CVE-2025-49657
Technical details about CVE-2025-49657 are not provided in the connected documents. The Initial description notes a heap-based buffer overflow in RRAS, but no affected versions, root cause specifics, impact scope, or remediation are included here; monitor for updates.
CVE-2025-49681
No additional technical details are provided in the connected documents for CVE-2025-49681 beyond the description. Public information about affected software, root cause, impact, or fixes is not included; monitoring recommended.
CVE-2025-53148
CVE-2025-53148 affects Windows Routing and Remote Access Service (RRAS); the issue is described as an information disclosure due to use of an uninitialized resource. Connected sources confirm RRAS involvement and show that Microsoft released updates to fix Windows vulnerabilities, including RRAS-...
CVE-2025-53806
CVE-2025-53806 describes a buffer over-read in Windows Routing and Remote Access Service (RRAS) that could allow an unauthenticated, remote attacker to disclose information over the network. The provided documents confirm the vulnerability description and network-exposure, but do not include expl...
CVE-2025-54095
CVE-2025-54095 is an information-disclosure vulnerability in Windows Routing and Remote Access Service (RRAS) characterized by an out-of-bounds read that could allow an unauthenticated attacker to disclose data over the network. Public materials in the connected documents show RRAS as the affecte...
CVE-2025-54099
CVE-2025-54099 affects the Windows Ancillary Function Driver for WinSock. The issue is a stack-based buffer overflow that can be exploited by an authorized, locally-located attacker to obtain elevated privileges. The connected NCSC advisory corroborates the CVE’s association with privilege escala...
CVE-2025-58719
CVE-2025-58719 affects the Connected Devices Platform Service (Cdpsvc) in Windows. The issue is a use-after-free vulnerability that could allow an authorized local attacker to achieve privilege elevation. The connected documents confirm the vulnerability and its local impact, but do not provide e...
CVE-2026-20872
CVE-2026-20872 affects Windows NTLM: external control of a file name or path allows an attacker to spoof authentication over the network. The description states this vulnerability and related references indicate a Windows NTLM spoofing risk. The connected Nessus/NCSC/EUVD/NVD entries confirm the ...
CVE-2026-21251
CVE-2026-21251 describes a use-after-free in the Windows Cluster Client Failover, enabling a locally authenticated attacker to achieve privilege elevation. The CVSS 3.1 base score is 7.8 (HIGH) with local attack vector, low complexity, and low privileges required; confidentiality, integrity, and ...
CVE-2026-26169
CVE-2026-26169 is a Windows Kernel Memory information-disclosure vulnerability described as a buffer over-read that can leak information to an authorized local attacker. The CVE is listed across multiple feeds (NVD/NCSC/EUVD) with the impact described as local information disclosure and a high co...
CVE-2026-32225
CVE-2026-32225 pertains to a Windows Shell security feature bypass. The entry indicates a remote-accessible vulnerability with NETWORK attack vector, requiring user interaction, and impacts confidentiality, integrity, and availability (all HIGH). The CVSSv3.1 base score is 8.8 (HIGH) with an Offi...
CVE-2026-50299
The CVE-2026-50299 entry describes an integer overflow/wraparound in Windows Storage Spaces Direct. Affected component: Storage Spaces Direct (Windows). Root cause: integer overflow allowing an unauthorized attacker to execute code. Impact: code execution with a physical attack vector; CVSS vecto...
CVE-2026-50306
CVE-2026-50306 is a Windows TCP/IP use-after-free vulnerability that allows an authorized, local attacker to elevate privileges. Affected component is the Windows TCP/IP stack; impact is local privilege escalation with high severity (CVSS 3.1: 7.8). Microsoft has released updates (KB5095051, KB50...
CVE-2026-50347
CVE-2026-50347 is a Windows Data.dll vulnerability characterized by a heap-based buffer overflow that allows an unauthorized, local attacker to execute code. The affected component is Windows Data.dll; the underlying issue is a heap overflow leading to remote-code-execution-style impact via local...
CVE-2026-50497
CVE-2026-50497 is an off-by-one error in Windows Remote Desktop Protocol that allows an unauthenticated network attacker to disclose information. Public sources in the provided documents identify the affected component as RDP and describe a network-triggered information disclosure, without detail...
CVE-2026-56182
CVE-2026-56182 is a Windows NTFS elevation-of-privilege vulnerability caused by an integer overflow/wraparound in NTFS operations that can be exploited by an authorized local attacker. Public sources in the connected data corroborate the root cause and the affected component is NTFS on Windows. T...
CVE-2026-57083
CVE-2026-57083 : A vulnerability in the Windows Codecs Library (Windows Media Photo Codec) arises from use of an uninitialized resource, enabling a local attacker to disclose information. Documented impact is local information disclosure with a CVSS 3.1/5.5 (Local, Privileges NONE, User Interacti...
CVE-2026-62725
CVE-2026-62725 describes a use-after-free in the Windows Telephony Service that can allow a locally authenticated user to elevate privileges. The NVD/CVE records indicate an elevated-privilege, local-execution risk with a CVSS v3.1 base score of 7.0 (high) and impact on confidentiality, integrity...
CVE-2025-49672
Technical details about CVE-2025-49672 are not publicly provided in the supplied documents. No vendor/version specifics or remediation are included. Monitor for updates from Microsoft and CVE references.
CVE-2025-49673
Technical details about CVE-2025-49673 are not provided in the supplied documents. No affected products, impact specifics, or remediation are confirmed here. Monitor for updates from official advisories.
CVE-2025-53147
CVE-2025-53147 refers to a local privilege escalation in the Windows Ancillary Function Driver for WinSock caused by a use-after-free condition. The CVSS vector indicates a local, high-privilege impact with “LOW” privileges required and no user interaction, consistent with an attacker who already...
CVE-2025-62565
CVE-2025-62565 is a Windows Shell elevation-of-privilege vulnerability caused by a use-after-free in Windows Shell. A locally authenticated attacker can exploit it to elevate privileges; CVSSv3.1 base score 7.3 (HIGH) with LOCAL attack vector, LOW attack complexity, LOW privileges required, and U...
CVE-2026-20832
CVE-2026-20832 is a Windows component vulnerability described as a Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege. Connected documents confirm the flaw affects the Windows RPC IDL handling, enabling local privilege escalation with high impact. The vulnera...
CVE-2026-20836
CVE-2026-20836 is a Windows graphics kernel vulnerability where a race condition in a shared resource allows local privilege elevation. The issue stems from concurrent execution with improper synchronization in the Graphics Kernel. The impact is local privilege escalation (C:H/I:H/A:H per CVSS 3....
CVE-2026-20852
CVE-2026-20852 is a Windows Hello privilege-assignment vulnerability that enables a locally authenticated attacker to tamper with local data due to incorrect privilege handling in the Windows Hello component. The issue is labeled as a local, high-severity problem with no user interaction required...
CVE-2026-20869
CVE-2026-20869 affects Windows Local Session Manager (LSM) and is described as a race-condition vulnerability in the management of a shared resource that allows an authenticated, local attacker to elevate privileges. The initial CVE entry cites local privilege escalation with a high impact. Micro...
CVE-2026-24295
CVE-2026-24295 concerns the Windows Device Association Service Elevation of Privilege. The entry indicates a LOCAL attack with LOW privileges required and NO user interaction, leading to HIGH impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.0 (HIGH). The vulne...
CVE-2026-25169
Technical details about CVE-2026-25169 are not provided in the supplied documents. No affected products, vulnerable components, impact, or remediation are specified here. Monitor for updates.
CVE-2026-32080
CVE-2026-32080 affects Windows WalletService and is a use-after-free that enables local privilege escalation for an authenticated user. The initial sources and connected advisories confirm impact on Windows WalletService with local execution and privilege elevation. Microsoft has published securi...
CVE-2026-34334
Technical details (affected component, root cause, impact, remediation) are not provided in the supplied documents. Monitor for updates from Microsoft and CVE repositories.
CVE-2026-40408
CVE-2026-40408 is described as a use-after-free in Windows kernel-mode drivers that enables local privilege escalation for an authenticated attacker. The provided documents consistently state local elevation of privileges but do not specify the affected products, driver components, or vulnerable ...
CVE-2026-40422
CVE-2026-40422 concerns Windows File Explorer where an uninitialized resource leads to local information disclosure. The affected component is File Explorer; the underlying issue is an uninitialized resource, enabling an authorized user with local access (low privilege, no user interaction) to di...
CVE-2026-45588
CVE-2026-45588 concerns a protection mechanism failure in Windows Secure Boot that allows an authorized attacker to bypass a security feature locally. The NVD/CVE entry describes a local attack with high impact on confidentiality and integrity and no availability impact, requiring high privileges...
CVE-2026-49171
The CVE-2026-49171 entry describes a Use-After-Free vulnerability in Windows Speech Runtime that enables a locally authenticated attacker to elevate privileges. Affected: Microsoft Windows Speech Runtime components; root cause: use-after-free leading to arbitrary code or privilege escalation (det...
CVE-2026-50492
CVE-2026-50492 describes a heap-based buffer overflow in the Windows Resilient File System (ReFS) that allows an unauthorized attacker to achieve remote code execution with a physical attack. The connected sources corroborate ReFS as the affected component and frame the impact as remote code exec...
CVE-2026-56643
CVE-2026-56643 is a DirectX Graphics Kernel elevation of privilege vulnerability tracked by Microsoft. It stems from a use-after-free in the Windows Kernel’s DirectX Graphics Kernel component, enabling a local attacker with normal privileges to escalate to higher privileges. The vulnerability is ...
CVE-2026-57982
CVE-2026-57982 is a Windows Remote Desktop Protocol (RDP) information-disclosure vulnerability caused by the use of an uninitialized resource. An authenticated attacker could disclose information over the network. Public details identify the affected component as Windows RDP/RDP client-server int...
CVE-2026-58638
CVE-2026-58638 is a Windows Boot Loader security feature bypass caused by a missing cryptographic step. The vulnerability allows a locally authenticated attacker to bypass a security feature. Public material in connected sources attributes the issue to Windows Boot Loader behavior and notes Micro...
CVE-2026-69366
CVE-2026-69366 is a use-after-free vulnerability in the Windows Kernel that allows an authorized attacker with low privileges to elevate privileges over a network, with user interaction required. The CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. No specific af...
CVE-2026-69846
An integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. The flaw requires high privileges and low attack complexity with no user interaction, but changes scope to affect the full system with high impact on confidentiality, integ...
CVE-2026-69929
CVE-2026-69929 is an out-of-bounds read in Windows DHCP Server that allows an unauthorized, network-based attacker to disclose information. NVD assigns a CVSS 3.1 score of 7.5 (HIGH) with low attack complexity, while Microsoft (CNA) rates it 5.9 (MEDIUM) with high attack complexity. CISA's SSVC a...
CVE-2026-73006
CVE-2026-73006 is a stack-based buffer overflow in DirectWrite , a component of the Microsoft Graphics Component , that allows an unauthorized remote attacker to achieve remote code execution over a network. The flaw requires user interaction (e.g., opening a crafted file) but no prior authentica...
CVE-2026-83940
CVE-2026-83940 is a use after free vulnerability in the Windows Device Association Service that allows an authorized local attacker to elevate privileges . The CVSS 3.1 base score is 7.0 (HIGH) with a high attack complexity , low privileges required , and high impact across confidentiality, integ...
CVE-2025-49660
Technical details about CVE-2025-49660 (affected product/component/version, root cause, impact, exploit status, or available patch) are not provided in the connected documents; monitor official disclosures for updates.
CVE-2025-49726
CVE-2025-49726 is a Windows vulnerability described as a use-after-free in Windows Notification that allows an authenticated local attacker to escalate privileges. The initial document provides a high-level impact (local, high confidentiality/integrity/availability impact) and does not reveal exp...
CVE-2025-50158
CVE-2025-50158 is a TOCTOU race condition in Windows NTFS that could allow a local attacker to disclose information. The description confirms the vulnerability is a local information-disclosure flaw affecting NTFS. Connected sources list CVE-2025-50158 under Windows NTFS with an impact of Access ...
CVE-2025-58722
CVE-2025-58722 is a heap-based buffer overflow in Windows DWM that could enable a locally authenticated attacker to elevate privileges. The available connected documents confirm the affected component (Windows DWM) and the local privilege elevation impact, but do not provide concrete exploit deta...