CVE-2026-21246

CVE-2026-21246 is a heap-based buffer overflow in the Microsoft Graphics Component that enables local privilege escalation for an authorized attacker. The CVSS 3.1 vector (LOCAL, LOW complexity, LOW privileges, NONE user interaction) yields a base score of 7.8 (HIGH impact on confidentiality, int...

CVE-2026-25174

CVE-2026-25174 is a Windows Privilege Elevation vulnerability described as an out-of-bounds read in the Windows Extensible File Allocation feature. The connected NCSC advisory confirms Microsoft has fixed vulnerabilities across Windows components, listing CVE-2026-25174 under Windows Extensible F...

CVE-2026-49799

Technical details are not publicly available in the provided documents. No confirmed affected products, fixes, or exploit specifics are described here; monitor official sources for updates.

CVE-2026-56649

CVE-2026-56649 is a race-condition in Windows Network File System that could let a remote attacker execute code over the network by abusing a shared resource. Public sources (NVD, EUVD, CIRCL) confirm the race condition as the root cause. Microsoft has released updates addressing this vulnerabili...

CVE-2026-69295

CVE-2026-69295 is an out-of-bounds read in the Windows USB Driver that allows an authorized local attacker to escalate privileges. The flaw yields high impact across confidentiality, integrity, and availability (CVSS 3.1 score 7.8 HIGH , vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning a low-...

CVE-2026-69345

CVE-2026-69345 is an out-of-bounds read in Microsoft Standard XPS that allows an authorized attacker (low privileges, no user interaction) to disclose information locally , with high confidentiality impact and no integrity or availability impact (CVSS 3.1: 5.5 MEDIUM ). CISA's SSVC assessment rat...

CVE-2026-69476

A heap-based buffer overflow in the Windows Biometric Service allows an authorized attacker to escalate privileges locally. The vulnerability is rated CVSS 7.8 (High) with low complexity and low privileges required, resulting in high impact to confidentiality, integrity, and availability. No spec...

CVE-2026-69494

CVE-2026-69494 is an out-of-bounds read vulnerability in the Windows Event Logging Service that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction (CVSS: UI:R) and no prior privileges (PR:N), yielding a CVSS 3.1 score of 8....

CVE-2026-69511

CVE-2026-69511 is a heap-based buffer overflow in Microsoft Windows Media Foundation that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction but no prior privileges, with a CVSS 3.1 base score of 8.8 (HIGH) and high impact ...

CVE-2026-69583

Windows Biometric Service is affected by a heap-based buffer overflow that allows an authorized attacker to achieve local privilege escalation . The vulnerability carries a CVSS 3.1 base score of 7.8 (HIGH) , with local attack vector, low complexity, and low privileges required, resulting in high...

CVE-2026-69638

CVE-2026-69638 is a heap-based buffer overflow in Windows NTFS (New Technology File System) that allows an unauthorized attacker to execute code locally. The vulnerability requires no privileges and no user interaction, yielding a CVSS 3.1 base score of 8.4 (HIGH) with high impact to confidential...

CVE-2026-69685

Windows Kerberos is affected by a heap-based buffer overflow that allows an authorized attacker to locally elevate privileges . Per Microsoft, the vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low complexity, low privileges required, and no user interaction, res...

CVE-2026-69727

A heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. The vulnerability is rated CVSS 8.0 (High) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating a network attack vector with low complexity, requiring low privilege...

CVE-2026-69770

CVE-2026-69770 is an information disclosure vulnerability in the Windows Spaceport.sys kernel driver, caused by the use of an uninitialized resource . An authorized attacker with local access and low privileges can exploit it to disclose sensitive information (high confidentiality impact, no inte...

CVE-2026-69794

CVE-2026-69794 is a buffer over-read in Windows Encrypting File System (EFS) that allows an authorized local attacker to disclose information . The flaw resides within the EFS component and results in a confidentiality impact with no integrity or availability impact. The CVSS 3.1 base score is 5....

CVE-2026-69891

CVE-2026-69891 is a use-after-free vulnerability in Windows Media that allows an authorized attacker to perform a local privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack requiring low privileges and high complex...

CVE-2026-70289

CVE-2026-70289 is a heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) that allows an authorized (low-privilege) attacker to elevate privileges locally . The vulnerability is rated CVSS 7.8 (HIGH) with local attack vector, low complexity, and high impact to confidentiality,...

CVE-2026-70585

CVE-2026-70585 is a use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver . An authorized local attacker with low privileges can exploit it to achieve code execution , with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.0 HIGH ; vector AV:L/...

CVE-2026-71336

Windows Work Folder Service is vulnerable to an integer overflow or wraparound flaw that allows an authorized attacker to achieve remote code execution over the network. The CVSS 3.1 base score is 8.8 (HIGH) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-attackable exploitati...

CVE-2026-72980

CVE-2026-72980 affects Windows Hello on Microsoft Windows. The vulnerability is an uncontrolled search path element that allows an authorized, local attacker to bypass a security feature. The attack vector is local with low complexity and requires high privileges but no user interaction. The prim...

CVE-2026-73024

CVE-2026-73024 is a heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver that allows an authorized attacker to perform local privilege escalation . The CVSS v3.1 score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity, low ...

CVE-2026-83989

CVE-2026-83989 is an out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver that allows an unauthenticated, remote attacker to cause a denial of service over a network. The vulnerability is rated CVSS 7.5 (HIGH) with a network attack vector, low complexity, no privileges or user int...

CVE-2025-60719

Technical details about CVE-2025-60719 are not provided in the connected documents. The initial description notes a local privilege elevation in Windows AFD/WinSock, but no vendor/version specifics or fixes are included here. Monitor official advisories for updates.

CVE-2025-62455

CVE-2025-62455 relates to an Elevation of Privilege in Windows Message Queuing (MSMQ). The initial description cites improper input validation in MSMQ that could allow an authorized local attacker to elevate privileges. Connected documents corroborate MSMQ as the affected component and reference ...

CVE-2025-62571

CVE-2025-62571 is a Windows Installer Elevation of Privilege vulnerability caused by improper input validation. The CVE affects Windows Installer, enabling an authorized, local attacker to escalate privileges (CVSS v3.1: 7.8, Local, Privileges Required: Low, User Interaction: None). Connected sou...

CVE-2026-20818

CVE-2026-20818 is a Windows Kernel information-disclosure vulnerability caused by insertion of sensitive data into a log file, allowing a local attacker to disclose information. The CTI indicates this is a locally exploitable issue with a MEDIUM base score (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I...

CVE-2026-25186

Technical details not publicly available in the provided documents. Monitor for updates.

CVE-2026-69265

CVE-2026-69265 is an out-of-bounds read vulnerability in Windows NTFS that allows an authorized attacker with low privileges to perform local privilege escalation . The CVSS v3.1 score is 7.8 (High) , with low attack complexity, no user interaction, and high impact across confidentiality, integri...

CVE-2026-69312

CVE-2026-69312 is an out-of-bounds read in Windows NTFS that allows an authorized local attacker to elevate privileges . The flaw resides in the NTFS filesystem component of Windows. The CVSS v3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a low-complexit...

CVE-2026-69316

CVE-2026-69316 is a buffer over-read vulnerability in the Windows Overlay Filter component. An authorized local attacker with low privileges can exploit it to disclose sensitive information . The attack requires high complexity and no user interaction, with a CVSS v3.1 base score of 4.7 (MEDIUM) ...

CVE-2026-69321

CVE-2026-69321 affects Windows Power Dependency Coordinator , a Windows system component. The root cause is missing authentication for a critical function, which allows a locally authenticated attacker with low privileges to perform tampering (integrity impact). The CVSS 3.1 score is 5.5 (Medium)...

CVE-2026-69331

CVE-2026-69331 is a use-after-free vulnerability in Windows Remote Access Connection Manager that allows an authorized local attacker to elevate privileges . The vulnerability is rated HIGH (CVSS 3.1: 7.0) with a local attack vector , high complexity , and low privileges required . No user intera...

CVE-2026-69427

CVE-2026-69427 is an out-of-bounds read vulnerability in the Windows VOLSNAP.SYS driver (Volume Shadow Copy service). An authorized attacker can exploit it over a network to elevate privileges . The CVSS 3.1 base score is 8.0 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , indicatin...

CVE-2026-69430

CVE-2026-69430 is a use after free vulnerability in the Windows Embedded Mode Service that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 base score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating the attack requires local access ...

CVE-2026-69472

CVE-2026-69472 is a use-after-free vulnerability in the Windows Devices Human Interface component that allows an authorized, local attacker with low privileges to achieve local privilege escalation . The CVSS v3.1 score is 7.0 (HIGH) , with high complexity and no user interaction required. The im...

CVE-2026-69492

A heap-based buffer overflow in the Windows Partition Management Driver allows an authorized local attacker to escalate privileges . The vulnerability is rated CVSS 7.0 (HIGH) , with a vector requiring local access , low privileges , and high attack complexity , but no user interaction. Impact is...

CVE-2026-69578

CVE-2026-69578 is a numeric truncation error in the Windows Kernel that allows an authorized attacker with low privileges to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high attack complexit...

CVE-2026-69612

CVE-2026-69612 is an absolute path traversal vulnerability in Windows Error Reporting that allows an authorized attacker to elevate privileges locally . The flaw resides in how the component handles file paths, permitting traversal beyond the intended directory. The CVSS 3.1 score is 7.8 (HIGH) w...

CVE-2026-69643

Windows Spaceport.sys (a system driver) contains a heap-based buffer overflow that allows an authorized attacker to escalate privileges over a network. The CVSS v3.1 score is 8.0 (HIGH) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating low attack complexity and required user interaction...

CVE-2026-69669

CVE-2026-69669 is a heap-based buffer overflow in the Windows Kernel that allows an unauthorized attacker to achieve remote code execution over a network. The Microsoft-provided CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-reachable attack...

CVE-2026-70568

This is a heap-based buffer overflow vulnerability in Windows Defender Firewall Service that allows an authorized attacker to achieve local privilege escalation with high impact on confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (HIGH) , reflecting a local attack vector wi...

CVE-2026-72944

CVE-2026-72944 is a heap-based buffer overflow in the Windows Fax Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability carries a CVSS 3.1 base score of 7.8 (High) , with a local attack vector, low complexity, low required privileges, and no user int...

CVE-2026-72967

A heap-based buffer overflow in the Windows Network Connection Broker component allows an authorized low-privilege attacker to escalate privileges locally. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low complexity, no user interaction, and high impact on ...

CVE-2026-72988

CVE-2026-72988 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation requires low privileges and no user inter...

CVE-2026-72993

CVE-2026-72993 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated HIGH (CVSS 3.1: 7.8) with an attack vector of local , low complexity , and low privileges required , with high impact on confid...

CVE-2026-73019

CVE-2026-73019 involves an improper resolution of path equivalence in the Windows URL Moniker component, allowing an unauthorized attacker to bypass a security feature over a network. The vulnerability requires user interaction and grants low confidentiality impact with no integrity or availabili...

CVE-2026-81355

A heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally. The vulnerability is rated CVSS 3.1 7.5 (HIGH) with the vector AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H , indicating a local attack vector with high complexity, high privi...

CVE-2026-83972

CVE-2026-83972 is a heap-based buffer overflow in the Windows Biometric Service that allows a locally authenticated attacker to elevate privileges. The vulnerability requires low privileges and no user interaction , with low attack complexity , scoring 7.8 (HIGH) under CVSS 3.1 with high impact t...

CVE-2025-49761

CVE-2025-49761 is a Windows Kernel local privilege escalation (Use-after-free) vulnerability. The connected data confirms an effect: “Obtaining elevated privileges” with CVSS v3.1 base metrics indicating LOCAL, low attack complexity and privileges required, high impact to confidentiality/integrit...

CVE-2025-55328

Vulnerability summary (CVE-2025-55328) : A race condition in Windows Hyper-V involving a shared resource can be exploited by an authorized local attacker to elevate privileges. The issue is categorized under Windows Hyper-V with a high impact (local, privilege escalation) and a high base score in...