CVE-2026-62740

CVE-2026-62740 describes a vulnerability in the Windows Imaging Component where an uninitialized resource can lead to local information disclosure by an authorized attacker. The issue is reported with a CVSS v3.1 base score of 5.5 (Medium), vector: Local, low attack complexity, and low privileges...

CVE-2026-49170

CVE-2026-49170 affects the Windows StateRepository API server file due to insufficient granularity in access control, enabling an authorized local attacker to elevate privileges. Base metrics show CVSS v3.1: 7.8 (HIGH) with local access, low attack complexity, low privileges required, and no user...

CVE-2026-49174

CVE-2026-49174 describes a vulnerability in Microsoft Windows DNS where missing authentication for a critical function could allow a locally authorized attacker to tamper with DNS behavior. The NVD entry notes a CVSS v3.1 base score of 6.1 (Medium) with a LOCAL attack vector, LOW attack complexit...

CVE-2026-50313

CVE-2026-50313 is a Windows NTFS heap-based buffer overflow vulnerability that could allow an attacker to achieve local code execution. The CVE entry describes a heap-based overflow in NTFS that enables exploitation by a privileged/unauthenticated attacker with local access, with the NVD entry al...

CVE-2026-50318

CVE-2026-50318 affects the Windows Resilient File System (ReFS). It describes a stack-based buffer overflow that allows an authorized local attacker to elevate privileges. The CVSSv3.1 vector is LOCAL/LOW+LOW/LOW with no user interaction and implies high impact on confidentiality, integrity, and ...

CVE-2026-50335

CVE-2026-50335 is a Windows Operating Systems elevation of privilege vulnerability enabled by improper access control. The entry is supported by multiple connected sources (NVD, CIRCL sighting, MSRC/KB pages) and is documented as a local, privilege-escalation issue with CVSSv3.1 base score 7.8 (H...

CVE-2026-50354

CVE-2026-50354 involves a use-after-free in the Windows Kernel that enables an authorized local attacker to elevate privileges. The affected source is the Windows Kernel; the vulnerability stems from memory management misuse leading to arbitrary code execution with SYSTEM-level privileges. Exploi...

CVE-2026-50450

CVE-2026-50450 describes a race condition in Windows Wireless Wide Area Network Service where concurrent execution on a shared resource with improper synchronization can allow an authenticated, local attacker to elevate privileges. The CVE is associated with a local exploit vector and a base CVSS...

CVE-2026-50479

CVE-2026-50479 affects the Windows USB Hub Driver via an untrusted pointer dereference, enabling local privilege escalation for an authenticated user. Public sources confirm this vulnerability and Microsoft has released a security update to address it (MSRC vulnerability page). The entry is corro...

CVE-2026-50697

The CVE-2026-50697 entry concerns a vulnerability in the Windows Common Log File System Driver that could allow an attacker with local access to elevate privileges. The issue is described as exposure of sensitive information to an unauthorized actor, enabling local privilege escalation. Public de...

CVE-2026-54122

CVE-2026-54122 describes a heap-based buffer overflow in Windows GDI+ that enables local code execution by an unauthenticated attacker. The vulnerability affects the Windows GDI+ component and is rated high (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.4). The available documents confirm the ...

CVE-2026-54987

CVE-2026-54987 is a Windows vulnerability described as a heap-based buffer overflow in the Windows Overlay Filter, enabling a locally authenticated attacker to elevate privileges. The CVSSv3.1 score is 7.8 (HIGH) with local attack vector, low attack complexity, and requires low privileges with no...

CVE-2026-56643

CVE-2026-56643 is a DirectX Graphics Kernel elevation of privilege vulnerability tracked by Microsoft. It stems from a use-after-free in the Windows Kernel’s DirectX Graphics Kernel component, enabling a local attacker with normal privileges to escalate to higher privileges. The vulnerability is ...

CVE-2026-58628

CVE-2026-58628 affects Windows Wireless Networking and is described as a race condition in concurrent access to a shared resource, allowing an authenticated local attacker to elevate privileges. The underlying issue is improper synchronization that leads to elevation of privileges on Windows syst...

CVE-2026-58629

CVE-2026-58629 is a Windows DirectX vulnerability described as a use-after-free in the DirectX Graphics Kernel that allows a locally authenticated attacker to elevate privileges. The NVD entry notes a local attack vector with high impact (C/H/I/A all high) and the CVSSv3.1 score of 7.0 (Local, Pr...

CVE-2026-61364

The CVE-2026-61364 entry concerns Windows Remote Desktop Services. A missing authentication flaw in a critical function enables a locally authenticated attacker with low privileges to elevate to higher privileges, as indicated by the CVSS 3.1 vector (L/L). Exploitation details or in-the-wild stat...

CVE-2026-62711

The CVE-2026-62711 issue is a local privilege escalation caused by a use-after-free in Windows Win32K. Affected component: Win32K memory management; root cause: use-after-free vulnerability. Impact, if exploited: an authorized local attacker can elevate privileges. CVSS v3.1 score is 7.8 ( HIGH )...

CVE-2026-62774

Technical details are not publicly available in the provided documents for CVE-2026-62774. Monitor for updates on affected products, impact, and remediation.

CVE-2025-53141

CVE-2025-53141 refers to a null pointer dereference in the Windows Ancillary Function Driver for WinSock that can enable local privilege escalation for an authenticated user. The connected Windows-ecosystem data identifies this CVE as affecting the WinSock ancillary driver with a high base severi...

CVE-2025-53147

CVE-2025-53147 refers to a local privilege escalation in the Windows Ancillary Function Driver for WinSock caused by a use-after-free condition. The CVSS vector indicates a local, high-privilege impact with “LOW” privileges required and no user interaction, consistent with an attacker who already...

CVE-2025-53151

CVE-2025-53151 is a Windows Kernel use-after-free local privilege escalation vulnerability. Connected sources indicate the affected component is the Windows Kernel and that exploitation leads to obtaining elevated privileges locally. Microsoft security updates are referenced in the surrounding ad...

CVE-2025-58738

CVE-2025-58738 is a local-execution vulnerability caused by a use-after-free in Inbox COM Objects. Reported impact: unauthorized code execution on the affected system with local attacker access. Documented impact aligns with high-severity CVSS metrics (AV: Local, AC: High, PR: None, UI: Required;...

CVE-2025-59200

CVE-2025-59200 describes a race-condition vulnerability in the Data Sharing Service Client where concurrent access to a shared resource allows an unauthorized local attacker to spoof locally. The CVE entry states a base CVSS v3.1 score of 7.7 ( HIGH ), with LOCAL attack vector, LOW confidentialit...

CVE-2025-59202

CVE-2025-59202 is a local privilege escalation via a use-after-free in Windows Remote Desktop Services. The Connected documents confirm affected component as Windows Remote Desktop Services and list the CVE with a high-severity context, but do not provide exploit details. No root-cause specifics ...

CVE-2025-59214

CVE-2025-59214 is a Microsoft Windows File Explorer spoofing and information-disclosure vulnerability. Public advisories describe exposure of sensitive information to unauthorized actors, enabling spoofing over a network via Windows File Explorer. Multiple connected sources confirm that Windows F...

CVE-2026-20812

CVE-2026-20812 is an LDAP tampering vulnerability in Windows LDAP (the Lightweight Directory Access Protocol) caused by improper input validation. The issue is exploitable by an authorized attacker over the network and primarily impacts data integrity (CVE CVSS indicates network access, low privi...

CVE-2026-20828

CVE-2026-20828 is an out-of-bounds read vulnerability in Windows Internet Connection Sharing (ICS). The impact is information disclosure and requires physical access (attack vector: PHYSICAL; base score 4.6). Affected: Windows ICS component within Windows. Root cause: out-of-bounds read as descri...

CVE-2026-20833

CVE-2026-20833 is a Windows Kerberos information-disclosure vulnerability. An authorized attacker with local access and low privileges can disclose information due to use of a broken or risky cryptographic algorithm in Kerberos. The CVSSv3.1 base score is 5.5 (Medium); attack vector: Local; user ...

CVE-2026-20858

CVE-2026-20858 is a Windows Management Services use-after-free local privilege escalation (high risk, CVSS 7.8). Connected documents confirm it affects Windows Management Services and is tracked in Microsoft’s January 2026 security updates (e.g., KB5073379/KB5073457). Remediation is via the poste...

CVE-2026-20928

CVE-2026-20928 affects Windows Recovery Environment Agent. Root cause: improper removal of sensitive information before storage/transfer. Impact: allows bypass of a security feature with physical access; confidentiality is impacted. Affected product: Windows Recovery Environment Agent component. ...

CVE-2026-21244

CVE-2026-21244 affects Windows Hyper-V with a heap-based buffer overflow that enables local code execution by an authenticated attacker. The CVSS 3.1 vector ( LOCAL, LOW PR, LOW AC, USER INTERACTION REQUIRED, S: U ) indicates high impact to confidentiality, integrity, and availability if exploite...

CVE-2026-25169

Technical details about CVE-2026-25169 are not provided in the supplied documents. No affected products, vulnerable components, impact, or remediation are specified here. Monitor for updates.

CVE-2026-27921

CVE-2026-27921 describes a race condition in the Windows TDI Translation Driver (tdx.sys) that can allow an authenticated attacker to elevate to SYSTEM privileges. The description in multiple sources confirms a concurrency flaw involving a shared resource, aligned with the CVE entry’s root cause ...

CVE-2026-32081

Technical details (affected products, vulnerable components, root cause, exploits, or remediation) are not provided in the supplied documents; monitor for updates from Microsoft.

CVE-2026-32151

CVE-2026-32151 is a Windows Shell information disclosure vulnerability. The entry shows a network-based exploit with low privileges required and no user interaction, and a high impact on confidentiality (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; base score 6.5). The official fix is noted as ...

CVE-2026-47654

CVE-2026-47654 is described as a heap-based buffer overflow in Remote Desktop Client enabling remote code execution over a network. The CVSS v3.1 metrics indicate NETWORK attack vector, HIGH impact on confidentiality, integrity, and availability, with NO privileges and UI interaction required. No...

CVE-2026-50356

CVE-2026-50356 describes a race-condition in Microsoft Windows App Store caused by concurrent execution using a shared resource with improper synchronization. This allows a locally authenticated attacker to elevate privileges. The fixed details or patch versions are not provided in the connected ...

CVE-2026-50388

CVE-2026-50388 is an Windows NTFS local vulnerability described as an out-of-bounds read that allows an unauthenticated/unauthorized attacker to execute code locally. The CVE is tracked across multiple sources (NVD, MSRC, CIRCL) with a base CVSS v3.1 score of 7.8 (High) and LOCAL attack vector, r...

CVE-2026-50400

CVE-2026-50400 is a Windows App Installer elevation-of-privilege vulnerability caused by a stack-based buffer overflow. An attacker with local, low-privilege access could exploit this to gain higher privileges on the system. Public sources confirm a local-execution path via Windows App Installer ...

CVE-2026-50686

CVE-2026-50686 is a Windows OLE remote code execution vulnerability caused by a type confusion in resource access. It enables network-exposed code execution without authentication and is documented with CVSS v3.1 base score 8.1 (High). Public references identify the affected area as Windows OLE, ...

CVE-2026-54119

CVE-2026-54119 describes a loop with an unreachable exit condition in Windows Active Directory that can be exploited to cause a network-based denial of service by an unauthorized attacker. The affected component is Windows Active Directory; the vulnerability stems from an infinite loop, leading t...

CVE-2026-54983

The CVE-2026-54983 entry concerns a stack-based buffer overflow in Active Directory Federation Services (AD FS) that allows an unauthenticated, network-based attacker to trigger a denial of service. The authoritative sources describe the vulnerability as enabling network-ported DoS without requir...

CVE-2026-56647

CVE-2026-56647 is a Windows vulnerability in the Windows Remote Access Service Infrastructure where an integer overflow/wraparound can let an authorized attacker elevate privileges over a network. The affected component is the Windows Remote Access Service Infrastructure, and the root cause is an...

CVE-2026-57083

CVE-2026-57083 : A vulnerability in the Windows Codecs Library (Windows Media Photo Codec) arises from use of an uninitialized resource, enabling a local attacker to disclose information. Documented impact is local information disclosure with a CVSS 3.1/5.5 (Local, Privileges NONE, User Interacti...

CVE-2026-58601

CVE-2026-58601 describes a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized, local attacker to elevate privileges. The available description specifies a local-privelege-escalation impact, but does not provide product/version specifics, exploitati...

CVE-2026-61360

The CVE-2026-61360 entry concerns an issue in Windows GDI described as an untrusted pointer dereference that could allow an authorized attacker to disclose information locally. Affected component is Windows GDI; root cause is a pointer dereference involving untrusted data, enabling local informat...

CVE-2026-61926

CVE-2026-61926 : Heap-based buffer overflow in the Windows USB Driver allows an authorized local attacker to perform a local privilege escalation . Exploitation details are not provided beyond the CVSS metrics (LOCAL, LOW complexity, LOW privileges, NONE user interaction; high impact to confident...

CVE-2026-62690

CVE-2026-62690 concerns Windows Push Notifications. The issue is a race condition caused by concurrent execution using a shared resource with improper synchronization, allowing an authorized attacker to elevate privileges locally. The available documents do not specify the affected product versio...

CVE-2026-65671

The CVE-2026-65671 entry describes a heap-based buffer overflow in Windows Remote Access API that allows an authorized attacker to achieve local privilege escalation. The impact is indicated as high (CVSSv3.1 base score 7.8) with local access required and no user interaction. Public details in th...

CVE-2025-50157

CVE-2025-50157 affects Windows Routing and Remote Access Service (RRAS) with an information disclosure due to use of an uninitialized resource. The base CVSS v3.1 score is 5.7 (Network, Low attack complexity, Privileges Required: Low, User Interaction: Required; Confidentiality Impact: High). Mic...