CVE-2026-69654

CVE-2026-69654 is a use-after-free vulnerability in Windows Accounts Control that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack requiring high complexity and low pri...

CVE-2026-69564

CVE-2026-69564 is a heap-based buffer overflow in Windows Online Certificate Status Protocol (OCSP) that allows an authorized attacker to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attac...

CVE-2026-69707

CVE-2026-69707 is an integer overflow or wraparound vulnerability in the Windows USB Audio Class driver (usbaudio.sys) that allows an authorized, locally-privileged attacker to escalate privileges. The flaw is rated CVSS 3.1: 7.8 (HIGH) with a local attack vector, low complexity, low privileges r...

CVE-2026-69773

A heap-based buffer overflow in the Windows Biometric Service allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 8.0 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating that exploitation requires low privileges and user interaction , but ...

CVE-2026-69826

CVE-2026-69826 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to achieve privilege escalation over a network . The CVSS 3.1 score is 8.0 (HIGH) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating an attacker with low privileges and user...

CVE-2026-69852

CVE-2026-69852 is a Remote Code Execution vulnerability in Windows Routing and Remote Access Service (RRAS) , allowing a network-based attacker with low privileges to gain unauthorized access to a victim's machine. The CVSS v3.1 score is 7.5 (HIGH) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/...

CVE-2026-72927

A heap-based buffer overflow exists in Winsock , which allows an authorized attacker to perform a local privilege escalation . While the specific software versions are not explicitly detailed in the provided documents, the vulnerability is addressed in Microsoft's September 8, 2026 security updat...

CVE-2026-72995

CVE-2026-72995 is a heap-based buffer overflow in Windows Biometric Service that allows a local attacker with low privileges to elevate privileges, leading to high impact on confidentiality, integrity, and availability (CVSS 3.1 score: 7.8 HIGH ). The attack requires local access, has low complex...

CVE-2026-73011

CVE-2026-73011 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability carries a CVSS 3.1 score of 7.8 (High) with high impact to confidentiality, integrity, and availability. CISA's SSVC assessment ...

CVE-2025-53143

CVE-2025-53143 is listed for Windows Message Queuing with high impact (CVSS 3.1: 8.8, Network, Privileges Low, User Interaction None). The entry indicates a remote code execution potential via resource type confusion. Connected sources confirm the vulnerability exists in MSMQ and note a network-e...

CVE-2025-54096

CVE-2025-54096 : Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthenticated network attacker to disclose information. The vulnerability is characterized by network access (AV:N) with low complexity (AC:L) and no privileges required (PR:N), but requires user i...

CVE-2025-54106

CVE-2025-54106 affects Windows Routing and Remote Access Service (RRAS) with an integer overflow/wraparound vulnerability that enables remote code execution over the network (CVSSv3.1: 8.8). A GitHub exploit proof-of-concept exists: Exploit for Integer Overflow or Wraparound in Microsoft RRAS, in...

CVE-2025-55700

CVE-2025-55700 describes an out-of-bounds read in Windows Routing and Remote Access Service (RRAS) that enables an unauthenticated attacker to disclose information over the network. The Connected documents include a matching description (EUVD-2025-34409) but do not provide concrete technical deta...

CVE-2025-58720

CVE-2025-58720 (Windows Cryptographic Services) has concrete details in connected docs. The vulnerability arises from using a cryptographic primitive with a risky implementation in Windows Cryptographic Services, enabling an authenticated local attacker to disclose information. The vulnerability ...

CVE-2025-62458

CVE-2025-62458 is a Windows Win32K GRFX elevation-of-privilege vulnerability (heap-based overflow) that enables local privilege escalation by an authorized user. Connected sources confirm the issue is associated with Windows Win32K GRFX components and is part of Microsoft’s December 2025 patch cy...

CVE-2026-20924

CVE-2026-20924 is a Windows Management Services use-after-free vulnerability that allows an authorized, local attacker to elevate privileges. The CVE is listed among Windows Management Services findings with a high base CVSS (7.8, LOCAL, HIGH impact). Connected sources confirm the vulnerability n...

CVE-2026-21508

CVE-2026-21508 concerns improper authentication in Windows Storage, enabling a locally authenticated attacker to elevate privileges. The CVSS v3.1 base score is 7.0 (HIGH), with LOCAL attack vector, HIGH impact on confidentiality, integrity, and availability, and a HIGH attack complexity requirin...

CVE-2026-32083

CVE-2026-32083 pertains to Windows’ Simple Search and Discovery Protocol (SSDP) Service elevation of privilege. The vulnerability is local, with low privileges required and no user interaction, and yields a high impact on confidentiality, integrity, and availability. Microsoft lists an official f...

CVE-2026-32084

CVE-2026-32084 is a Windows vulnerability labeled as a Windows Print Spooler information-disclosure issue with local access and potential exposure of sensitive data via Windows File Explorer. The CVE entry notes local attack vector, low attack complexity, and low privileges required, with a high ...

CVE-2026-32215

CVE-2026-32215 is a Windows Kernel information-disclosure vulnerability caused by insertion of sensitive data into a log file, enabling an authenticated, local attacker to disclose information. Affected component is the Windows Kernel logging path; the described impact is local confidentiality br...

CVE-2026-58632

CVE-2026-58632 is a Windows Win32K use-after-free vulnerability in the Win32 Kernel Subsystem that could allow a locally authenticated attacker to escalate privileges. The CVE is described as a local elevation of privilege (no remote code execution). Public sources in the connected set consistent...

CVE-2026-62694

CVE-2026-62694 is a use-after-free vulnerability in Windows Installer that allows a locally authenticated attacker with low privileges to escalate privileges . The attack requires high complexity and no user interaction , with high impact on confidentiality, integrity, and availability (CVSS 3.1:...

CVE-2026-68846

CVE-2026-68846 is a use-after-free vulnerability in the Windows Kernel that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) with a vector of AV:N/AC:H/PR:L/UI:R, indicating a network-based attack requiring high complexity , low privileges , and...

CVE-2026-69338

CVE-2026-69338 is a use-after-free vulnerability in the Remote Desktop Gateway Service that allows an authorized (low-privilege) attacker to elevate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) , with high complexity, required user interaction, and high impact on confidentiality, i...

CVE-2026-69388

CVE-2026-69388 is a use-after-free vulnerability in Windows Bluetooth Service that allows a local attacker with low privileges to elevate privileges . The attack requires local access and is characterized by high complexity , with no user interaction needed. The CVSS 3.1 base score is 7.0 (HIGH) ...

CVE-2026-69445

CVE-2026-69445 is a local privilege escalation vulnerability in Windows Compressed Folder caused by an improper limitation of a pathname to a restricted directory (path traversal ). An authorized attacker with low privileges can exploit this locally without user interaction to achieve high impact...

CVE-2026-69553

CVE-2026-69553 is a missing authorization vulnerability in Windows Hyper-V that allows an authorized attacker (with low privileges) to elevate privileges over a network . The attack requires user interaction and has high attack complexity , but the impact on confidentiality, integrity, and availa...

CVE-2026-69760

Windows Kerberos is affected by an out-of-bounds read vulnerability that allows an unauthorized, unauthenticated attacker to trigger a denial of service over the network. The vulnerability is rated CVSS 7.5 (HIGH) with a low attack complexity and no user interaction required. CISA's SSVC assessme...

CVE-2026-72962

CVE-2026-72962 is a heap-based buffer overflow in the Windows USB Video Driver that allows an authorized attacker to achieve local privilege escalation . The Microsoft CVSS 3.1 score is 8.2 (HIGH) with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating a local attack with low complexity, high...

CVE-2026-72963

CVE-2026-72963 is a use-after-free vulnerability in Windows Modern Execution Server that allows an authorized attacker to achieve local privilege escalation . The CVSS v3.1 score is 7.0 (HIGH) , with a local attack vector, high complexity, low privileges required, and high impact on confidentiali...

CVE-2025-50160

CVE-2025-50160 maps to a Windows RRAS heap-based buffer overflow that enables remote code execution. The vulnerability affects RRAS and is described in public sources as allowing an authenticated, network-based attacker to execute code with low privileges and user interaction required. The connec...

CVE-2025-50163

CVE-2025-50163 affects Windows Routing and Remote Access Service (RRAS). The issue is a heap-based buffer overflow in RRAS that enables remote code execution over the network. Exploitation is network-based (AV:N) with low attack complexity, no privileges required, but user interaction is required...

CVE-2025-53138

CVE-2025-53138 affects Windows Routing and Remote Access Service (RRAS). The issue is caused by use of an uninitialized resource, enabling an authorized network attacker to disclose information over the network. The connected RRAS entries corroborate that this CVE is present and assign a CVSS v3....

CVE-2025-53724

CVE-2025-53724 is a Windows Push Notifications vulnerability described as a type confusion that allows an authorized, locally authenticated attacker to elevate privileges. The CVE is linked to Windows Push Notifications and is rated with a base score of 7.8 (HIGH) via CVSS 3.1, with attack vector...

CVE-2025-54097

CVE-2025-54097 is an information-disclosure vulnerability in Windows Routing and Remote Access Service (RRAS) caused by an out-of-bounds read. It can allow an unauthenticated attacker to disclose information over a network. The CVE is listed in multiple sources (NVD, CVE List) with RRAS-specific ...

CVE-2025-55338

CVE-2025-55338 is associated with Windows BitLocker and is described as a ROM-patching deficiency that could allow circumvention of a security feature via a physical attack. Connected documents reference Windows BitLocker entries including CVE-2025-55338 in MSKB/brief vulnerability lists, noting ...

CVE-2025-55699

CVE-2025-55699 is listed in the connected NCSC MS security advisories as a Windows Kernel vulnerability with impact described as “Access to sensitive data.” The initial description also notes local disclosure exposure in Windows Kernel. The connected documents do not provide a root-cause detail, ...

CVE-2025-58739

CVE-2025-58739 affects Windows File Explorer and is described as the exposure of sensitive information to an unauthorized actor, enabling spoofing over a network. The CVSS 3.1 base score is 6.5 (Network, Low attack complexity, No privileges, User interaction required) with Confidentiality impact ...

CVE-2025-59198

CVE-2025-59198 is a Microsoft Windows vulnerability in the Windows Search Component caused by improper input validation that can allow an authorized, local attacker to cause a denial of service. The CVE is shown in the Windows Search Component entries with a base CVSS v3.1 score of 5.0 (MEDIUM), ...

CVE-2025-60705

Technical details about CVE-2025-60705 (affected product, root cause, impact, or Fix) are not provided in the connected documents. Monitor for updates from Microsoft/MSRC for validation, impact, and remediation.

CVE-2026-21239

CVE-2026-21239 describes a heap-based buffer overflow in the Windows Kernel. An authorized attacker can achieve local privilege escalation. The vulnerability is rated CVSS v3.1 base score 7.8 (HIGH) with LOCAL, low complexity, and no user interaction required beyond initial access, and it has hig...

CVE-2026-24289

Technical details about CVE-2026-24289 are not provided in the documents; no affected products, vulnerable components, impact, or remediation details are listed here. Monitor for updates.

CVE-2026-25168

CVE-2026-25168 is a Windows Graphics Component denial-of-service vulnerability. Exploitation requires local access with low complexity and no user interaction, and can cause an availability impact flagged as HIGH. The CVSSv3.1 score is 6.2 (MEDIUM overall) with an exploit that is unproven and rem...

CVE-2026-32159

CVE-2026-32159 affects Windows Push Notifications. The issue is a local elevation-of-privilege vulnerability with a CVSS v3.1 base score of 7.8 (HIGH). Attack requires local access, high attack complexity, and low privileges, with no user interaction, and can impact confidentiality, integrity, an...

CVE-2026-34351

CVE-2026-34351 describes a race condition in Windows TCP/IP where concurrent access to a shared resource allows an authorized attacker to elevate privileges locally. The provided description states a local, privilege-escalation risk with a high impact on confidentiality, integrity, and availabili...

CVE-2026-35423

Technical details (affected product, root cause, impact, or fixes) are not publicly available in the provided documents. Monitor for updates from NVD/EUVD/CVE listings for additional specifics.

CVE-2026-68827

CVE-2026-68827 is an integer underflow (wrap or wraparound) vulnerability in Windows GDI+ that allows an authorized attacker to achieve elevation of privileges over a network . The vulnerability is rated HIGH severity (CVSS 8.0) with a vector of AV:N/AC:L/PR:L/UI:R, meaning exploitation requires ...

CVE-2026-68884

A heap-based buffer overflow in the Windows Kernel allows an authorized (low-privilege) local attacker to elevate privileges , per Microsoft's advisory (CVE-2026-68884). The vulnerability carries a CVSS v3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploit...

CVE-2026-69305

CVE-2026-69305 is a use-after-free vulnerability in the Microsoft Windows Search Component that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 base score is 7.1 (HIGH) , with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H , indicating that exploitation requires ...

CVE-2026-69319

CVE-2026-69319 is a local privilege elevation vulnerability in the Windows USB Video Driver , caused by a race condition — concurrent execution using a shared resource with improper synchronization. An attacker with low local privileges and no user interaction can exploit this under conditions of...