CVE-2026-40398

CVE-2026-40398 is a heap-based buffer overflow in Windows Remote Desktop Services that allows an authenticated attacker to perform local privilege escalation. The description across sources consistently identifies a local, authenticated exploit path with a high impact (C/H/I/A: High) and a CVSS v...

CVE-2026-45592

CVE-2026-45592 describes an integer overflow/wraparound in Windows Internet (wininet.dll) that enables local privilege escalation for an authorized attacker. The CVSS 3.1 metrics indicate a HIGH impact across confidentiality, integrity, and availability, with a LOCAL attack vector, LOW privileges...

CVE-2026-62732

CVE-2026-62732 is a heap-based buffer overflow in the Windows Telephony Service that enables a locally authenticated attacker to achieve privilege elevation. The vulnerability affects the Telephony Service component and is characterized by a local exploit path with low privileges required and no ...

CVE-2026-62741

CVE-2026-62741 is a Windows HTTP.sys elevation-of-privilege vulnerability caused by an integer underflow/wrap in HTTP.sys. An authorized local attacker can elevate privileges. Affected: Windows HTTP.sys. Root cause: integer underflow; Impact: local privilege escalation with high confidentiality/i...

CVE-2024-43525

CVE-2024-43525 refers to a Windows Mobile Broadband Driver Remote Code Execution vulnerability. The CVE entry lists a CVSS v3.1 base score of 6.8 (Medium) with an attack vector of Physical, requiring no privileges and no user interaction, and impacting confidentiality, integrity, and availability...

CVE-2024-43608

CVE-2024-43608 is a Windows RRAS remote code execution vulnerability with network access (AV:N, AC:L, PR:N, UI:R, S:U, C/H/I/H/A:H) and high impact across confidentiality, integrity, and availability. Connected sources corroborate RRAS involvement and classify the exploit as a remote code executi...

CVE-2025-29829

Technical details about CVE-2025-29829 are not provided in the supplied documents. Monitor official updates from Microsoft/NVD for affected products, impact, and mitigations.

CVE-2025-29968

Technical details (affected product/versions, root cause, impact, exploit info, and fixes) are not provided in the connected documents. Based on the supplied sources, only the basic description and CVSS metrics are available. Monitor for updates.

CVE-2025-49735

CVE-2025-49735 describes a use-after-free vulnerability in Windows KDC Proxy Service (KPSSVC) that could allow remote code execution over the network. The entry is publicly tracked with a Network attack vector, high impact on confidentiality, integrity, and availability (CVSS v3.1 base score 8.1)...

CVE-2025-59295

CVE-2025-59295 is a heap-based buffer overflow in Internet Explorer that could allow an unauthenticated attacker to execute code remotely over the network (CVSS 3.1/8.8). The connected MSKB guidance and advisories indicate Windows security updates addressing this class of issue; apply the latest ...

CVE-2026-50387

CVE-2026-50387 — Windows GDI Elevation of Privilege Affects: Windows GDI subsystem. The vulnerability is a stack-based buffer overflow in GDI that can be triggered by an authorized attacker to achieve local privilege escalation. Impact: Local elevation of privileges with a CVSS v3.1 base score of...

CVE-2026-61358

The CVE-2026-61358 entry concerns Windows Accessibility Infrastructure (ATBroker.exe) with an improper link resolution before file access (‘link following’) vulnerability that allows an authorized, local attacker to elevate privileges. Reported CVSSv3.1: 7.8 (HIGH) with Local access, Low attack c...

CVE-2024-43536

CVE-2024-43536 affects the Windows Mobile Broadband driver and enables remote code execution through the driver component (execute random code). The CVSS vector from the initial data shows physical attack vector, no user interaction, and no privileges required, with high impact to confidentiality...

CVE-2025-49724

CVE-2025-49724 is a Use-After-Free vulnerability in Windows Connected Devices Platform Service that can lead to remote code execution over the network. According to initial data, impact is high (C/H/I/A) with CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U. Connected documents confirm the vulnerability exists ...

CVE-2025-49734

CVE-2025-49734 affects Windows PowerShell. The root cause is an improper restriction of the communication channel to intended endpoints, enabling an authorized local attacker to elevate privileges. The CVE maps to a local privilege escalation with high impact (C:H/I:H/A:H) and requires local acce...

CVE-2026-42900

The CVE-2026-42900 entry concerns a race condition caused by improper synchronization in the Windows App Store. Reported impact is privilege elevation over a network, implying an unauthorized attacker could exploit a timing-related flaw to escalate access. Documents consistently describe a concur...

CVE-2024-43542

CVE-2024-43542 affects the Windows Mobile Broadband Driver. The vulnerability is described as a Denial-of-Service issue (impact: Availability) with an adjacent attacker and low attack complexity; no root-cause details are provided in the supplied documents. Mitigation/fix: Microsoft has released ...

CVE-2025-29839

Technical details about CVE-2025-29839 (affected product/version/root cause/impact/fix) are not publicly provided in the supplied connected documents. Monitor for updates.

CVE-2026-23669

CVE-2026-23669 is a Windows Print Spooler remote code execution vulnerability with CVSS 3.1 base score 8.8 (Network, Low attack complexity, Low privileges required, No user interaction). It impacts confidentiality, integrity, and availability (all HIGH). Exploit code maturity is UNPROVEN. The Mic...

CVE-2026-33835

Technical details about CVE-2026-33835 are not publicly provided in the connected documents. The initial description notes a use-after-free in Windows Cloud Files Mini Filter Driver with local privilege elevation, but no vendor/product/version specifics or fix details are included here. Monitor f...

CVE-2026-42825

CVE-2026-42825 describes a use-after-free in Windows Telephony Service that allows an authorized attacker to elevate privileges locally. The description clearly states local privilege escalation as the impact, but the connected documents do not provide specifics on affected product versions, root...

CVE-2026-42991

CVE-2026-42991 describes a race condition in Windows Push Notifications arising from improper synchronization of a shared resource. This yields local privilege escalation for an authorized attacker. The CVSS v3.1 metrics indicate local attack vector, high impact on confidentiality, integrity, and...

CVE-2026-50452

CVE-2026-50452 (Windows Runtime) describes a race condition in Windows Runtime due to improper synchronization on a shared resource. This concurrency flaw can allow an unauthenticated, remote attacker to elevate privileges over the network. The CVE is associated with a high base score (7.0) and n...

CVE-2026-61928

An issue affecting Windows Hello : sensitive information is stored in cleartext, allowing an authorized local attacker to tamper with the system. The CVSSv3.1 vector indicates a local, low-complexity attack requiring low privileges with a high integrity impact (I:H). Base score 5.5 (Medium). No e...

CVE-2024-43526

Technical details (affected product/version, root cause, impact, or fix) for CVE-2024-43526 are not publicly provided in the supplied connected documents. Monitor for updates from official advisories.

CVE-2024-43534

CVE-2024-43534 is a Windows Graphics Component Information Disclosure vulnerability. The affected product is Windows Graphics Component; the entry indicates an information disclosure impact (confidentiality) with network attack vector, no integrity/availability impact, and user interaction requir...

CVE-2024-43540

CVE-2024-43540 corresponds to a Windows Mobile Broadband Driver Denial of Service vulnerability. Affected component: Windows Mobile Broadband Driver. Root cause/impact: DoS vulnerability; base CVSS not exceeding MEDIUM in the provided metrics, with impact limited to availability. Mitigation: Micr...

CVE-2024-43555

CVE-2024-43555 is listed in the connected documents as affecting the Windows Mobile Broadband Driver with a Denial-of-Service impact (CVSS approx. 6.5). The materials do not provide a detailed root cause, affected subcomponent, exploit vectors, or explicit patch/version information for this CVE. ...

CVE-2025-21248

CVE-2025-21248 is a Windows Telephony Service Remote Code Execution vulnerability. The initial and connected documents confirm affected software: Windows Telephony Service component, with exploitable path over the network and required user interaction. CVSS v3.1 base score 8.8 (HIGH), with full i...

CVE-2025-21257

CVE-2025-21257 corresponds to Windows WLAN AutoConfig Service Information Disclosure Vulnerability. The connected documents identify the affected component as the Windows WLAN AutoConfig Service and describe the issue as an information disclosure vulnerability, with local attack requirements (Loc...

CVE-2025-29836

Technical details for CVE-2025-29836 (e.g., affected product, root cause, impact, or remediation) are not provided in the supplied connected documents. Please monitor for updates from official advisories.

CVE-2025-47971

CVE-2025-47971 describes a buffer over-read in the Virtual Hard Disk (VHDX) component that can allow a local attacker to elevate privileges. The publicly documented impact is local privilege elevation via a buffer over-read in VHDX; vendors have not provided version-specific affected products in ...

CVE-2025-49716

CVE-2025-49716 corresponds to an Uncontrolled resource consumption in Windows Netlogon path, with vulnerability mitigations implemented via Microsoft security updates. Connected updates (KB5062592, KB5062597, KB5062624, KB5062619, KB5062618, KB5062570, KB5062572, KB5062619) describe a security ha...

CVE-2025-49743

CVE-2025-49743 is a local privilege-escalation vulnerability in the Microsoft Graphics Component caused by a race condition due to improper synchronization when a shared resource is accessed concurrently. The issue affects Windows graphics-related code paths and can let an authorized, local attac...

CVE-2026-32149

CVE-2026-32149 is a Windows Hyper-V remote code execution vulnerability. The issue involves a local attack vector (AV: Local) with low attack complexity (AC: Low) and privileges required (PR: Low) that requires user interaction (UI: Required). Impact is high on confidentiality, integrity, and ava...

CVE-2026-56174

The CVE-2026-56174 entry describes an elevation of privilege in Windows Narrator Braille caused by an untrusted search path. An authorized local attacker can exploit this to gain higher privileges. CVSS:3.1 base score 7.8 (HIGH); attack vector LOCAL; privileges required LOW; user interaction NONE...

CVE-2026-62728

The vulnerability CVE-2026-62728 affects Windows systems via the Common Log File System (CLFS) Driver. It is a time-of-check time-of-use (TOCTOU) race condition that allows an authorized, local attacker to elevate privileges. The CVSSv3.1 metrics indicate a Local attack, High impact on confidenti...

CVE-2024-43538

CVE-2024-43538 affects the Windows Mobile Broadband Driver and is categorized as a Denial-of-Service vulnerability. The connected documents confirm the vulnerability and indicate that Microsoft has published updates related to Windows vulnerabilities, but they do not provide a specific patch deta...

CVE-2025-32716

CVE-2025-32716 (Windows Media) is a Windows component vulnerability described as an out-of-bounds read that enables a locally authenticated attacker to elevate privileges. The NCSC advisory lists CVE-2025-32716 under Windows Media with a base impact of 7.80 (Obtaining elevated privileges). No exp...

CVE-2025-33060

CVE-2025-33060 affects the Windows Storage Management Provider and is described as an out-of-bounds read that can allow an authorized, locally authenticated attacker to disclose information. The NCSC advisory confirms it under Windows Storage Management Provider with CVSS 5.5 (LOCAL, Privileges L...

CVE-2025-33061

CVE-2025-33061 is a Windows Storage Management Provider vulnerability characterized by an out-of-bounds read that could allow an authorized local attacker to disclose information. The CVE affects the Storage Management component and is rated with LOCAL attack vector and LOW privileges required, w...

CVE-2025-48800

CVE-2025-48800 affects Windows BitLocker. Description confirms a protection mechanism failure that enables bypass of BitLocker with physical access. Connected NC SC advisory lists Windows BitLocker under CVE-2025-48800 with a CVSS v3.1 impact of 6.80 (Physical access required, no user interaction...

CVE-2025-49723

CVE-2025-49723 affects Windows StateRepository API, enabling local tampering of data due to missing authorization in the Server file path. The CNVD/NCSC entries confirm impact as manipulation of data with a high CVSS (8.8) and local attack vector; no public exploitation details are provided in th...

CVE-2026-34329

CVE-2026-34329 is a heap-based buffer overflow in Windows Message Queuing (MSMQ) that could allow an unauthenticated attacker to execute code over an adjacent network. Public details in provided connected documents describe MSMQ as affected and classify the vulnerability as remote code execution;...

CVE-2026-40377

Technical details (affected components, root cause, impact specifics, or fixes) are not publicly provided in the connected documents. Monitor vendor advisories for patch information and affected products; no additional specifics are available here.

CVE-2026-47653

CVE-2026-47653 describes a heap-based buffer overflow in the Remote Desktop Client that enables code execution over a network. Affected component is the Remote Desktop Client; the issue is caused by a memory-unsafe condition leading to potential arbitrary code execution. CVSS v3.1 metrics assign ...

CVE-2026-70330

CVE-2026-70330 is a heap-based buffer overflow in the Windows DNS service that allows an authorized attacker to elevate privileges locally . NVD assigns a CVSS 3.1 score of 7.8 (HIGH) with low privileges required, while Microsoft's CNA score is 6.7 (MEDIUM) requiring high privileges. CISA SSVC as...

CVE-2024-49107

Technical details, affected components, and remediation specifics for CVE-2024-49107 are not provided in the supplied connected documents. Monitor for official updates from Microsoft and CVE listings for concrete technical description, impact, and fixes.

CVE-2025-21304

CVE-2025-21304 affects the Windows DWM Core Library (Desktop Window Manager). The connected sources confirm a local elevation of privilege vulnerability in the DWM Core Library, with the CVSS 3.1 metrics indicating local attack vector, low attack complexity, and need for low privileges, leading t...

CVE-2025-21352

CVE-2025-21352 is a Windows Internet Connection Sharing (ICS) Denial of Service vulnerability. The NVD entry describes a DoS impact with an overall CVSS v3.1 base score of 6.5 (MEDIUM), attack vector Adjacent, attack complexity Low, privileges required None, user interaction None, and high availa...