CVE-2026-21530

CVE-2026-21530 : A double-free vulnerability in Windows Rich Text Edit is described as enabling an authorized attacker to perform local privilege escalation. The connected documents confirm the affected component and the local-privilege-elevation impact but do not provide exploit details, specifi...

CVE-2026-49181

CVE-2026-49181 is a Windows DHCP Client vulnerability described as an integer underflow (wrap or wraparound) that allows an unauthenticated attacker to elevate privileges over a network. The CVE is corroborated by multiple sources in Connected documents, including NVD and MSRC updates, and ENISA/...

CVE-2026-58640

CVE-2026-58640 is a heap-based buffer overflow in Windows NTFS that enables an authorized local attacker to execute code. The vulnerability is tied to Windows NTFS logic and has a CVSS v3.1 score of 7.3 (HIGH) with local access required and user interaction. Affected component: Windows NTFS; root...

CVE-2024-49091

Technical details for CVE-2024-49091 are not publicly provided in the supplied documents; no affected products, root cause, or remediation are stated. Monitor for updates.

CVE-2024-49125

Technical details about CVE-2024-49125 are not publicly available in the provided connected documents. Monitor for updates from official sources for affected products, impact, and fixes.

CVE-2025-21236

CVE-2025-21236 is a Windows Telephony Service remote code execution vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-based access with low complexity, requiring user interaction, and with high impact across confidentiality, integrity, and availability. Th...

CVE-2025-21313

CVE-2025-21313 corresponds to a Windows SAM Denial-of-Service vulnerability. The connected sources identify the affected component as Windows Security Account Manager (SAM) and classify the impact as Denial of Service (DoS) with CVSS v3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Expl...

CVE-2025-24069

CVE-2025-24069 is an out-of-bounds read in the Windows Storage Management Provider that permits an authorized local attacker to disclose information. Affected component: Windows Storage Management Provider. CVSS: Local attack, Low privileges required, no user interaction, Confidentiality impact H...

CVE-2026-20856

CVE-2026-20856 is a Windows Server Update Services (WSUS) remote code execution vulnerability caused by improper input validation. Exploitation is possible over a network with no user interaction; CVSSv3.1 base score 8.1 (High). Public references note this is addressed by January 2026 security up...

CVE-2026-50472

The CVE-2026-50472 entry refers to a heap-based buffer overflow in Windows LUA File Virtualization Filter Driver (LUAFV) that allows an authorized, local attacker to achieve privilege escalation. Affected software is Windows LUAFV; the underlying issue is a heap-based overflow, leading to local p...

CVE-2026-61352

The CVE-2026-61352 entry describes a race condition in the Remote Desktop Client caused by concurrent execution with improper synchronization on a shared resource. This leads to remote code execution over the network, classified with a high impact (CVSS 3.1: 7.5) and network attack vector, requir...

CVE-2024-43621

CVE-2024-43621 affects Windows Telephony Service (a Windows OS component). The vulnerability is a Remote Code Execution flaw in the Windows Telephony Service, with CVSS 3.1 base metrics indicating Network attack vector, no privileges required, and user interaction needed; impact is High/High/High...

CVE-2024-49075

Technical details for CVE-2024-49075 are not publicly provided in the connected documents. The sources reference Windows Remote Desktop Services DoS but do not specify affected versions, root cause, exploit information, or fixes within this corpus. Monitor for updates.

CVE-2025-21294

CVE-2025-21294 refers to a Microsoft Digest Authentication Remote Code Execution vulnerability. Public documents indicate it affects Windows components and has high impact (RCE). Connected sources confirm updates exist to fix the vulnerabilities and recommend installing January 2025 security upda...

CVE-2025-21299

Technical details about CVE-2025-21299 (affected products, root cause, exploit methods, and remediation) are not provided in the given documents. Monitor for updates from Microsoft MSRC/MSKB entries for this CVE.

CVE-2025-21315

CVE-2025-21315 affects Microsoft Brokering File System on Windows, enabling local elevation of privileges. Root cause details are not fully disclosed in the provided docs, but mitigations are available via updates KB5050009 (and related KB5049984/KB5050107) from Microsoft. Public exploits are not...

CVE-2025-21371

CVE-2025-21371 is a remote code execution vulnerability in Windows Telephony Service. Connected documents identify the affected component as Windows Telephony Service and annotate the CVE with a high severity (CVSS v3.1: 8.8, NETWORK attack, no privileges required, user interaction required, C/H/...

CVE-2025-26665

CVE-2025-26665 affects Windows UPnP Device Host (upnphost.dll). The issue is described as sensitive data stored in memory that is not properly locked, enabling a local attacker with authorized access to obtain increased entitlements (privilege escalation). Connected sources corroborate the impact...

CVE-2025-26680

CVE-2025-26680 affects the Windows Standards-Based Storage Management Service and describes an adversary-enabled condition of uncontrolled resource consumption leading to a network-based denial of service. The vulnerability is categorized with a high base score (CVSS 3.1: 7.5, NETWORK, no user in...

CVE-2025-33064

CVE-2025-33064 affects Windows Routing and Remote Access Service (RRAS). It is a heap-based buffer overflow that allows an authenticated attacker to execute code over the network. CVSS v3.1 base score 8.8 (HIGH). Affected component: RRAS on Windows. Root cause: heap-based overflow in RRAS handlin...

CVE-2024-38264

CVE-2024-38264 is a Microsoft Virtual Hard Disk (VHDX) Denial of Service vulnerability. The initial entry notes a network-accessible DoS with MEDIUM severity (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Connected Microsoft advisories confirm Windows updates exist to fix this issue (e.g., KB50...

CVE-2025-21202

CVE-2025-21202 is a Windows Recovery Environment Agent elevation-of-privilege vulnerability. The consolidated sources show an impact of obtaining elevated privileges (CVE mapped under Windows Recovery Environment Agent) with a CVSS-like score around 6.1 (Medium) and physical access as a considera...

CVE-2025-26640

CVE-2025-26640 is a Windows Digital Media elevation-of-privilege vulnerability caused by a use-after-free condition. The issue affects Windows Digital Media components and could allow an authorized local user to obtain elevated privileges. Microsoft released updates as part of the April 2025 secu...

CVE-2025-26688

CVE-2025-26688 is a stack-based buffer overflow in Microsoft Virtual Hard Disk that enables a locally authenticated attacker to elevate privileges. The vulnerability is labeled as “Obtaining Increased Entitlements” (CVSS v3.1 base score 7.8). Connected sources corroborate the affected product (Mi...

CVE-2025-27471

CVE-2025-27471 affects Microsoft Windows Streaming Service. Technical details in connected docs confirm that the vulnerability arises from sensitive data storage in improperly locked memory, enabling a network-based Denial of Service. The CVSS v3.1 base score is 5.9 (Network, High attack complexi...

CVE-2025-29811

CVE-2025-29811 is a Windows vulnerability affecting the Windows Mobile Broadband Driver. It stems from improper input validation and enables an authorized local attacker to escalate privileges . The impact is local privilege escalation with potential elevation to higher privileges on the host. Th...

CVE-2026-54999

The CVE-2026-54999 entry concerns a race condition in Windows TCP/IP where concurrent access to a shared resource allows an unauthorized attacker on an adjacent network to execute code. Documented impact is remote code execution with high severity (CVSSv3.1: AV=A, AC=L, PR=N, UI=N, S=U, C=H, I=H,...

CVE-2026-57094

CVE-2026-57094 is a remote-code-execution vulnerability in Microsoft Windows Media Foundation caused by a heap-based buffer overflow. It affects Windows Media Foundation components and can be exploited over a network to run arbitrary code. Public details confirm the vulnerability as a network-att...

CVE-2024-43449

CVE-2024-43449 is a Windows USB Video Class System Driver elevation-of-privilege vulnerability. The CVE entry lists a CVSSv3.1 base score of 6.8 (Medium) with attack vector as Physical, no user interaction required, and an impact profile of High on confidentiality, integrity, and availability. Mi...

CVE-2024-49108

CVE-2024-49108 is a Windows Remote Desktop Services remote code execution vulnerability. According to the connected advisories, it is rated high severity (CVSSv3.1 base 8.1) with network access required and no user interaction, and the impact is execution of arbitrary code with high confidentiali...

CVE-2025-21347

CVE-2025-21347 is linked to the Windows Update Stack and is described in the connected NCSC advisory as a Denial-of-Service vulnerability. The CVE entry in that document assigns a base CVSS-like severity of 6.0 and notes that Microsoft has updates available to fix the issue. The mode of the vulne...

CVE-2025-27477

CVE-2025-27477 is a heap-based buffer overflow in Windows Telephony Service that enables remote code execution over a network. The CVE is confirmed in multiple sources (NVD entry and Microsoft KB references) as affecting Windows Telephony Service with network-exposed vectors and total impact. The...

CVE-2026-40378

CVE-2026-40378 affects Windows Local Security Authority Subsystem Service (LSASS). A memory allocation with an excessive size value can allow an unauthenticated attacker to cause a network-based denial of service. The CVSSv3.1 base score is 7.5 (HIGH). No exploitation details are provided in the ...

CVE-2026-42977

CVE-2026-42977 describes a race condition in Windows Push Notifications caused by improper synchronization of a shared resource. This vulnerability enables an authorized, local attacker to elevate privileges. The CVSS 3.1 base score is 7.8 (HIGH) with Local attack vector, high complexity, and req...

CVE-2026-42989

Winlogon Elevation of Privilege (CVE-2026-42989) is caused by improper link resolution before file access ("link following"). This vulnerability allows an authorized, local attacker to gain higher privileges. Affected: Winlogon component on Windows; impact is local privilege escalation with a CVS...

CVE-2026-58626

CVE-2026-58626 is a Windows Remote Desktop Services use-after-free vulnerability that can allow an authenticated attacker to execute arbitrary code over the network. The CVE is rated CVSS v3.1 base score 8.8 (High) with Network attack, Low attack complexity, Privileges Required: Low, User Interac...

CVE-2026-65787

The CVE-2026-65787 entry describes a heap-based buffer overflow in Desktop Window Manager that allows an authorized attacker to elevate privileges locally. Documented impact is local privilege escalation with a high severity (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability affec...

CVE-2025-21268

CVE-2025-21268 is a Windows MapUrlToZone security feature bypass. Affected component: MapUrlToZone logic; impact is circumvention of security boundaries (CVSS v3.1: 4.3, NETWORK attack vector, user interaction required). Connected sources confirm it as a security feature bypass vulnerability and ...

CVE-2025-26667

CVE-2025-26667 is a Windows RRAS information-disclosure vulnerability. The RRAS service can expose sensitive data to an unauthorized network actor, with the CVSSv3.1 base score listed as 6.5 (Network, Low attack complexity, Privileges None, No user interaction; Confidentiality impact High). The c...

CVE-2025-29837

Technical details about CVE-2025-29837 (affected products, root cause, exploitability) are not publicly disclosed in the provided connected documents; no specifics on impact or remediation are available here.

CVE-2025-33056

CVE-2025-33056 affects Microsoft Local Security Authority Server (lsasrv). The provided documents identify the issue as improper access control that enables a remote attacker to cause a denial of service over the network. The NCSC advisory explicitly lists this CVE under Windows LSASS with a CVSS...

CVE-2026-42983

CVE-2026-42983 is a Windows vulnerability described across multiple sources as a use-after-free in the DWM Core Library that allows an authorized, local attacker to elevate privileges. The issue is identified consistently in Microsoft’s MSRC page and NVD records; no public exploit details or defa...

CVE-2026-50447

CVE-2026-50447 is a Windows Message Queuing (MSMQ) remote-code-execution vulnerability. The issue is a heap-based buffer overflow in MSMQ that could allow an unauthenticated attacker to execute code over the network. Public sources indicate high-severity impact (CVSS v3.1: 9.8, network attack, no...

CVE-2026-62728

The vulnerability CVE-2026-62728 affects Windows systems via the Common Log File System (CLFS) Driver. It is a time-of-check time-of-use (TOCTOU) race condition that allows an authorized, local attacker to elevate privileges. The CVSSv3.1 metrics indicate a Local attack, High impact on confidenti...

CVE-2026-62766

CVE-2026-62766 describes a double free in Windows Kerberos that allows an authorized attacker to elevate privileges locally . The affected component is Windows Kerberos; the underlying cause is a memory-management error leading to a use-after-free-like condition, as stated. The provided documents...

CVE-2024-49081

Technical details about CVE-2024-49081 are not provided in the supplied documents. Public information on affected components, root cause, impact, and fixes is not present here. Monitor for updates from Microsoft and CVE/NVD feeds.

CVE-2024-49092

CVE-2024-49092 is a Windows Mobile Broadband Driver elevation-of-privilege vulnerability. Public sources (CNNVD) describe a buffer-error flaw in the Windows Mobile Broadband Driver that could allow privilege escalation. Microsoft has released updates addressing this family of issues; see the MSRC...

CVE-2025-21287

CVE-2025-21287 is a Windows Installer elevation of privilege vulnerability. The linked documents confirm this CVE affects the Windows Installer component in Windows OS, enabling a local attacker with low privileges and no user interaction to elevate privileges. Remediation is provided by Microsof...

CVE-2025-21378

Technical details about CVE-2025-21378 are not publicly available in the provided documents. The set includes only high-level summaries and advisories; monitor for updates from Microsoft and NVD for affected products, impact, and fixes.

CVE-2025-24073

CVE-2025-24073 affects the Windows DWM Core Library and stems from improper input validation, enabling a locally authorized attacker to elevate privileges. The vulnerability is described with a base CVSS v3.1 score of 7.8 (High) and local attack vector with low complexity, requiring low privilege...