CVE-2026-68894

CVE-2026-68894 is a heap-based buffer overflow in Windows Error Reporting that allows an authorized attacker to elevate privileges over a network . The vulnerability is rated CVSS 8.0 (High) with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , meaning it requires low privileges and user interact...

CVE-2026-69468

CVE-2026-69468 is a heap-based buffer overflow in the Windows Volume Manager Extension Driver that allows a locally authenticated attacker to elevate privileges . Microsoft rates the vulnerability CVSS 3.1: 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requ...

CVE-2026-69479

CVE-2026-69479 is a heap-based buffer overflow in Windows NTFS that allows an unauthorized local attacker to achieve code execution. The Microsoft-assigned CVSS 3.1 score is 8.4 (HIGH) , with a vector of AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and no privileges or us...

CVE-2026-69600

CVE-2026-69600 is a use after free vulnerability in the Microsoft Windows Search Component that allows an authorized attacker to perform local privilege escalation . The vulnerability requires low privileges, high attack complexity, and no user interaction, with high impact to confidentiality, in...

CVE-2026-70563

CVE-2026-70563 is an improper link resolution before file access ("link following") vulnerability in Windows Shell that allows an unauthorized attacker to perform spoofing over a network . The assigned CVSS 3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating h...

CVE-2026-70577

CVE-2026-70577 is a use-after-free vulnerability in Windows Modern Device Management (MDM) that allows an authorized attacker to achieve local privilege escalation . The flaw is rated CVSS 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a locally exploitable issue with...

CVE-2026-83978

Windows Biometric Service is affected by a heap-based buffer overflow that allows a locally authenticated attacker to elevate privileges. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and low require...

CVE-2026-68891

CVE-2026-68891 is an out-of-bounds read in Microsoft Standard XPS that allows an authorized attacker to disclose information locally. The CVSS v3.1 score is 4.7 (MEDIUM) , reflecting a local attack vector with high complexity and low privileges required, resulting in high confidentiality impact w...

CVE-2026-69289

CVE-2026-69289 is an elevation of privilege vulnerability in Windows Setup Files Cleanup , caused by improper link resolution before file access ("link following"). An authorized local attacker with low privileges can exploit it without user interaction to gain high impact across confidentiality,...

CVE-2026-69311

CVE-2026-69311 is a use-after-free vulnerability in Windows Audio Service that allows a locally authenticated attacker to elevate privileges . The flaw requires low privileges , high attack complexity , and no user interaction , but yields high impact across confidentiality, integrity, and availa...

CVE-2026-69349

CVE-2026-69349 is an information disclosure vulnerability in Windows Management Instrumentation (WMI) caused by use of an uninitialized resource . An authorized attacker can exploit it over a network to disclose information, with high confidentiality impact but no integrity or availability impact...

CVE-2026-69357

Windows NDIS (Network Driver Interface Specification) contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges over a network. The flaw requires low privileges , user interaction , and a high-attack-complexity network vector to succeed, resulting in high im...

CVE-2026-69358

Microsoft Remote Desktop Client is affected by a use of uninitialized resource flaw that allows an authorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction and carries a CVSS 3.1 score of 7.1 (HIGH) with high impact on confidentiality, integ...

CVE-2026-69376

CVE-2026-69376 is an out-of-bounds read vulnerability in Microsoft Standard XPS that allows an authorized local attacker to disclose information . The CVSS 3.1 score is 5.5 (Medium) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local attack, low complexity, low privileges requi...

CVE-2026-69394

CVE-2026-69394 is a heap-based buffer overflow in the Windows Audio Service that allows an authorized local attacker to escalate privileges. The vulnerability is rated CVSS 3.1 7.0 (HIGH) by Microsoft (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attack vector with high complexity, lo...

CVE-2026-69403

CVE-2026-69403 is an information disclosure vulnerability in the Windows SMB Server component, caused by missing authorization that allows an authorized (low-privilege) local attacker to disclose information. The impact is limited to confidentiality with no integrity or availability impact. CNA-a...

CVE-2026-69426

CVE-2026-69426 is a heap-based buffer overflow in the Windows VOLSNAP.SYS driver (part of the Volume Shadow Copy service). An authorized attacker with low privileges can exploit this flaw to achieve local code execution with high impact on confidentiality, integrity, and availability. The vulnera...

CVE-2026-69428

Windows LDAP (Lightweight Directory Access Protocol) is vulnerable to an out-of-bounds read that allows an unauthorized, network-based attacker to cause a denial of service , with a CVSS 3.1 base score of 7.5 (HIGH) . The vulnerability requires no privileges and no user interaction, though it imp...

CVE-2026-69434

A heap-based buffer overflow in Windows URL Moniker allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction (e.g., opening a malicious URL) but no prior authentication or privileges, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/...

CVE-2026-69472

CVE-2026-69472 is a use-after-free vulnerability in the Windows Devices Human Interface component that allows an authorized, local attacker with low privileges to achieve local privilege escalation . The CVSS v3.1 score is 7.0 (HIGH) , with high complexity and no user interaction required. The im...

CVE-2026-69481

CVE-2026-69481 is a heap-based buffer overflow in Windows Enterprise App Management that allows an authorized attacker to elevate privileges over a network. The vulnerability requires low privileges and user interaction, with high impact to confidentiality, integrity, and availability (CVSS 3.1 b...

CVE-2026-69498

Windows Win32K contains a use-after-free vulnerability that allows an authorized local attacker to escalate privileges . The CVSS 3.1 score is 7.0 (High) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high attack complexity but low privileges required and no user interaction . T...

CVE-2026-69578

CVE-2026-69578 is a numeric truncation error in the Windows Kernel that allows an authorized attacker with low privileges to elevate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high attack complexit...

CVE-2026-69612

CVE-2026-69612 is an absolute path traversal vulnerability in Windows Error Reporting that allows an authorized attacker to elevate privileges locally . The flaw resides in how the component handles file paths, permitting traversal beyond the intended directory. The CVSS 3.1 score is 7.8 (HIGH) w...

CVE-2026-69711

CVE-2026-69711 is a use after free vulnerability in the Windows Device Association Service that allows an authorized local attacker with low privileges to achieve privilege escalation . The attack requires high complexity and no user interaction, with high impact on confidentiality, integrity, an...

CVE-2026-69787

CVE-2026-69787 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized local attacker to escalate privileges. The assigned CVSS 3.1 score is 7.8 (High) , with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack complexity and low privileges re...

CVE-2026-69794

CVE-2026-69794 is a buffer over-read in Windows Encrypting File System (EFS) that allows an authorized local attacker to disclose information . The flaw resides within the EFS component and results in a confidentiality impact with no integrity or availability impact. The CVSS 3.1 base score is 5....

CVE-2026-69862

CVE-2026-69862 is an out-of-bounds read in the Windows Wireless Wide Area Network Service that allows an authorized local attacker to disclose information . The CVSS v3.1 score is 5.5 (Medium) with High confidentiality impact, no integrity or availability impact, and requires low privileges over ...

CVE-2026-72935

CVE-2026-72935 is an out-of-bounds read in the Windows NTFS driver that allows a local attacker with high privileges to escalate privileges . The Microsoft CVSS 3.1 score is 6.7 (Medium) , reflecting a local attack vector, low complexity, and high impact on confidentiality, integrity, and availab...

CVE-2026-83970

CVE-2026-83970 is a heap-based buffer overflow in Windows Biometric Service that allows an attacker with local access and low privileges to escalate to higher privileges , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH ). No user interaction is requir...

CVE-2026-83973

CVE-2026-83973 is a heap-based buffer overflow in the Windows Biometric Service component, allowing a locally authenticated attacker with low privileges to achieve privilege escalation with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 7.8 – HIGH ). CISA's SSVC asses...

CVE-2026-85360

A use after free flaw in the Windows Kernel allows a local, authenticated attacker to elevate privileges . The vulnerability is scored CVSS 3.1 7.0 (HIGH) with a local attack vector , high attack complexity , low privileges required , and no user interaction , resulting in high impact to confiden...

CVE-2025-59511

CVE-2025-59511 : External control of a file name or path in the Windows WLAN Service enables a local attacker with low privilege to escalate privileges. The NVD entry and the Dutch NCSC advisory corroborate a local-priority, high-impact privilege-escalation scenario tied to Windows WLAN Service. ...

CVE-2026-25176

CVE-2026-25176 is a local elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. The CVSS v3.1 base score is 7.8 (HIGH) with LOCAL attack vector, LOW privileges required, and no user interaction. It impacts confidentiality, integrity, and availability. Exploita...

CVE-2026-62762

CVE-2026-62762 is a null pointer dereference in Windows Active Directory Domain Services that allows an authorized attacker (low privileges required) to cause a denial of service over a network. The CVSS v3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, reflecting h...

CVE-2026-69267

CVE-2026-69267 is an information disclosure vulnerability in Windows Connected User Experiences and Telemetry , caused by insufficient granularity of access control . An authorized local attacker can leverage this flaw to disclose information, with a CVSS 3.1 score of 6.5 (MEDIUM) and a scope cha...

CVE-2026-69280

CVE-2026-69280 is a use-after-free vulnerability in Windows Push Notifications that allows an authorized attacker to achieve local privilege escalation . Microsoft assigned a CVSS 3.1 base score of 7.0 (HIGH) with a vector of local attack, high complexity, low privileges required, and high impact...

CVE-2026-69287

Windows Remote Desktop Services contains a use-after-free flaw that allows an authorized local attacker to elevate privileges . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires local access , high attack complexity , and low prio...

CVE-2026-69368

CVE-2026-69368 is a heap-based buffer overflow in the Windows Overlay Filter component that allows an authorized attacker with local access and low privileges to escalate their privileges. The vulnerability carries a CVSS 3.1 base score of 7.8 (HIGH) with high impact to confidentiality, integrity...

CVE-2026-69427

CVE-2026-69427 is an out-of-bounds read vulnerability in the Windows VOLSNAP.SYS driver (Volume Shadow Copy service). An authorized attacker can exploit it over a network to elevate privileges . The CVSS 3.1 base score is 8.0 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , indicatin...

CVE-2026-69430

CVE-2026-69430 is a use after free vulnerability in the Windows Embedded Mode Service that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 base score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating the attack requires local access ...

CVE-2026-69432

CVE-2026-69432 is a heap-based buffer overflow in the Volume Manager Driver (Microsoft) that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 3.1 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector, low compl...

CVE-2026-69476

A heap-based buffer overflow in the Windows Biometric Service allows an authorized attacker to escalate privileges locally. The vulnerability is rated CVSS 7.8 (High) with low complexity and low privileges required, resulting in high impact to confidentiality, integrity, and availability. No spec...

CVE-2026-69478

CVE-2026-69478 is a heap-based buffer overflow in the Windows Device Association Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, resulting in high impact ...

CVE-2026-69574

CVE-2026-69574 is a use-after-free vulnerability in the Windows Device Association Service that allows an authorized attacker to achieve local privilege escalation . The CVSS 3.1 base score is 7.0 (HIGH) , with high impact to confidentiality, integrity, and availability, but the attack requires l...

CVE-2026-69585

CVE-2026-69585 affects the Microsoft Windows Search Component , where an incorrect type conversion or cast allows an authorized attacker to perform local privilege escalation . The vulnerability scores 7.8 (HIGH) under CVSS 3.1, with low attack complexity, low privileges required, no user interac...

CVE-2026-69589

CVE-2026-69589 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized, low-privilege attacker to achieve local privilege escalation . The vulnerability carries a CVSS v3.1 base score of 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low...

CVE-2026-69619

CVE-2026-69619 is an out-of-bounds read in the Windows exFAT File System that allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 base score is 8.0 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:R, requiring low privileges and user interaction, with high impact on confide...

CVE-2026-69801

This CVE describes a heap-based buffer overflow in the Windows Audio Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability is rated CVSS 7.8 (HIGH) with low attack complexity and low privileges required, impacting confidentiality, integrity, and avai...

CVE-2026-69817

A use-after-free vulnerability in the Windows Bluetooth Port Driver allows an authorized local attacker to elevate privileges . The Microsoft-assigned CVSS 3.1 score is 7.0 (HIGH) , reflecting a local attack vector with high complexity , low privileges required , and no user interaction , resulti...