CVE-2026-69669

CVE-2026-69669 is a heap-based buffer overflow in the Windows Kernel that allows an unauthorized attacker to achieve remote code execution over a network. The Microsoft-provided CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-reachable attack...

CVE-2026-69689

An out-of-bounds read in the Windows Win32K component allows an authorized attacker to elevate privileges over a network . The CVSS v3.1 score is 8.0 (HIGH) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H , indicating a network-based attack requiring low privileges and user interaction, with high...

CVE-2026-69709

A heap-based buffer overflow in Windows NTFS allows an authorized attacker with low privileges and no user interaction to execute code locally. The vulnerability is rated CVSS 3.1 7.8 (HIGH) with full impact on confidentiality, integrity, and availability. The Microsoft reference points to a spec...

CVE-2026-69711

CVE-2026-69711 is a use after free vulnerability in the Windows Device Association Service that allows an authorized local attacker with low privileges to achieve privilege escalation . The attack requires high complexity and no user interaction, with high impact on confidentiality, integrity, an...

CVE-2026-69782

Windows DNS Server is affected by a race condition caused by concurrent execution using a shared resource with improper synchronization. This flaw allows an unauthorized attacker to achieve remote code execution over the network with no privileges required , though the attack complexity is rated ...

CVE-2026-69801

This CVE describes a heap-based buffer overflow in the Windows Audio Service that allows an authorized attacker to achieve local privilege escalation . The vulnerability is rated CVSS 7.8 (HIGH) with low attack complexity and low privileges required, impacting confidentiality, integrity, and avai...

CVE-2026-69816

CVE-2026-69816 is a use-after-free vulnerability in Windows Accounts Control that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 base score is 7.0 (HIGH) with a local attack vector, high complexity, low privileges required, and no user interaction, resulting in high im...

CVE-2026-69889

CVE-2026-69889 is a use-after-free vulnerability in the Windows Bluetooth Service that allows an authorized attacker to elevate privileges locally . The CVSS v3.1 base score is 7.0 (HIGH) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , indicating a local attack requiring low privileges, ...

CVE-2026-71337

CVE-2026-71337 is a stack-based buffer overflow in the Windows Storage Management Provider that allows a locally authenticated attacker with low privileges to achieve local privilege escalation . The CVSS 3.1 score is 7.8 (HIGH) , reflecting local attack vector, low complexity, and high impact to...

CVE-2026-72940

CVE-2026-72940 is a heap-based buffer overflow in Windows Schannel (Microsoft's Secure Channel/SSL library) that allows an unauthorized, remote attacker to achieve remote code execution over a network. The CVSS v3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R , indicating a network-re...

CVE-2026-72988

CVE-2026-72988 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation requires low privileges and no user inter...

CVE-2026-72994

CVE-2026-72994 is a heap-based buffer overflow in the Windows Biometric Service that allows an authorized attacker to elevate privileges locally . The vulnerability requires low privileges and no user interaction , with low attack complexity . The CVSS 3.1 base score is 7.8 (HIGH) , with high imp...

CVE-2026-72997

CVE-2026-72997 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker with low privileges and no user interaction to escalate privileges locally. The vulnerability is rated CVSS 3.1: 7.8 (HIGH) with high impact to confidentiality, integrity, and availabili...

CVE-2026-83498

CVE-2026-83498 affects the Windows Virtualization-Based Security (VBS) Enclave and is caused by an untrusted pointer dereference , allowing an authorized local attacker with low privileges to escalate privileges without user interaction. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) wi...

CVE-2026-83969

A heap-based buffer overflow in Windows Biometric Service allows an authorized attacker with low privileges to escalate privileges locally, resulting in high impact to confidentiality, integrity, and availability. The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector and no user interaction...

CVE-2026-83999

Windows Resilient File System (ReFS) Deduplication Service is affected by an improper link resolution before file access (link following) flaw that allows an authorized local attacker to elevate privileges. The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) , with a local attack vector, hig...

CVE-2025-55690

CVE-2025-55690 is described in connected advisories as a Windows PrintWorkflowUserSvc use-after-free vulnerability that enables local privilege escalation by an authorized user. The MSRC entry confirms the affected component and vulnerability class (use-after-free leading to elevation of privileg...

CVE-2025-59510

Technical details about CVE-2025-59510 (RRAS in Windows) are not publicly provided in the supplied documents. Monitor for updates from Microsoft regarding affected products, impact, and remediation.

CVE-2025-62569

CVE-2025-62569 is a Use‑After‑Free vulnerability in the Microsoft Brokering File System that elevates privileges locally for an authenticated attacker. The CVE is categorized with CVSS v3.1 as Local, Low Privileges Required, High Impact (Confidentiality, Integrity, Availability), base score 7.0. ...

CVE-2026-32217

CVE-2026-32217 affects Windows Kernel. The vulnerability arises from insertion of sensitive information into a log file, enabling an authorized, local attacker with LOW privileges to disclose information. CVSS v3.1 is provided as 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Microsoft and par...

CVE-2026-32219

CVE-2026-32219 is a Microsoft-related local privilege escalation in the brokering file system. The entry cites a local attack vector with high impact on confidentiality, integrity, and availability, requiring low privileges and no user interaction; exploitation is marked as UNPROVEN and the remed...

CVE-2026-49793

CVE-2026-49793 is a heap-based buffer overflow in the Windows Resilient File System (ReFS) that could allow an authorized local attacker to execute code. Affected component: ReFS mechanisms handling memory allocations during I/O; root cause described as a heap-based overflow, enabling code execut...

CVE-2026-50668

CVE-2026-50668 is a heap-based buffer overflow in Windows NTFS that can elevate privileges on a system with physical access. The entry, described across multiple sources, identifies the affected component as Windows NTFS and notes a privilege-escalation impact with a physical-attack attack vector...

CVE-2026-57085

CVE-2026-57085 is a Windows Print Spooler vulnerability described as an out-of-bounds read in Print Spooler Components that allows an authorized, local attacker to disclose information. Connected sources confirm the affected component and local disclosure impact, with Microsoft and CVE trackers n...

CVE-2026-58543

CVE-2026-58543 corresponds to a race condition in the Windows USB Print Driver (shared resource synchronization) that can allow an authorized attacker with physical access to elevate privileges. The NVD entry states concurrent execution with improper synchronization in the Windows USB Print Drive...

CVE-2026-69297

CVE-2026-69297 affects Windows DHCP Server , where passwords are stored in a recoverable format, allowing an authorized attacker (with low privileges) to disclose information over a network. The CVSS v3.1 score is 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability impa...

CVE-2026-69323

CVE-2026-69323 is a heap-based buffer overflow in Windows Biometric Service that allows an authorized attacker with low privileges to achieve local privilege escalation . The vulnerability requires no user interaction and carries a CVSS 3.1 score of 7.8 (HIGH) with high impact to confidentiality,...

CVE-2026-69376

CVE-2026-69376 is an out-of-bounds read vulnerability in Microsoft Standard XPS that allows an authorized local attacker to disclose information . The CVSS 3.1 score is 5.5 (Medium) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local attack, low complexity, low privileges requi...

CVE-2026-69394

CVE-2026-69394 is a heap-based buffer overflow in the Windows Audio Service that allows an authorized local attacker to escalate privileges. The vulnerability is rated CVSS 3.1 7.0 (HIGH) by Microsoft (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attack vector with high complexity, lo...

CVE-2026-69434

A heap-based buffer overflow in Windows URL Moniker allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction (e.g., opening a malicious URL) but no prior authentication or privileges, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/...

CVE-2026-69441

CVE-2026-69441 is a race condition vulnerability in Windows Installer , caused by concurrent execution using a shared resource with improper synchronization . An authorized attacker can exploit this to elevate privileges locally . The vulnerability is rated CVSS 7.0 (HIGH) with a local attack vec...

CVE-2026-69481

CVE-2026-69481 is a heap-based buffer overflow in Windows Enterprise App Management that allows an authorized attacker to elevate privileges over a network. The vulnerability requires low privileges and user interaction, with high impact to confidentiality, integrity, and availability (CVSS 3.1 b...

CVE-2026-69549

An out-of-bounds read in the Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally . The vulnerability is scored 7.0 (HIGH) by Microsoft with a vector of local attack, high complexity, and low privileges required, yielding high impact across confident...

CVE-2026-69599

Windows Remote Desktop Services contains a use-after-free vulnerability that allows an authorized attacker (low privileges required) to execute code over a network. The CVSS 3.1 score is 7.5 (HIGH) , with high attack complexity and no user interaction required, impacting confidentiality, integrit...

CVE-2026-69627

CVE-2026-69627 is an out-of-bounds read vulnerability in the Windows Remote Desktop Licensing Service . An authorized local attacker with low privileges can exploit this flaw to disclose information , resulting in high confidentiality impact but no integrity or availability impact (CVSS 3.1: 5.5 ...

CVE-2026-69630

CVE-2026-69630 is an out-of-bounds read vulnerability in the Windows Win32K kernel driver that allows a locally authenticated attacker to escalate privileges . The CVSS v3.1 score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting the high complexity and required low-privil...

CVE-2026-69731

CVE-2026-69731 is a heap-based buffer overflow in the HID class driver that allows an authorized attacker to perform a local privilege escalation . The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) , with a low-complexity attack vector requiring no user interaction. No exploitation details...

CVE-2026-69762

CVE-2026-69762 is a stack-based buffer overflow in Windows Win32K that allows an authorized attacker with low privileges to elevate privileges over a network , requiring user interaction. The CVSS 3.1 base score is 8.0 (HIGH) , reflecting high impact to confidentiality, integrity, and availabilit...

CVE-2026-69822

CVE-2026-69822 is a local privilege escalation vulnerability in Windows Kerberos caused by a numeric truncation error . An authorized attacker with low privileges can exploit this to achieve full confidentiality, integrity, and availability impact (CVSS 3.1: 7.8 HIGH , vector AV:L/AC:L/PR:L/UI:N/...

CVE-2026-69847

CVE-2026-69847 is a heap-based buffer overflow in Windows DHCP Server that allows an authorized attacker to execute code over an adjacent network. The flaw resides in how the DHCP Server processes input, leading to memory corruption that can be leveraged for remote code execution . The vulnerabil...

CVE-2026-70283

CVE-2026-70283 affects Windows Win32K , the kernel-mode component handling window management. The root cause is an incorrect authorization flaw that allows a local attacker with low privileges to achieve local privilege escalation , resulting in full compromise of confidentiality, integrity, and ...

CVE-2026-71332

CVE-2026-71332 is a use-after-free vulnerability in Windows Secure Socket Tunneling Protocol (SSTP) that allows an authorized attacker to perform a local privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a high-attack-complexi...

CVE-2026-72952

CVE-2026-72952 is an out-of-bounds read vulnerability in the Windows Spaceport.sys driver that allows an authorized attacker to achieve local code execution . The attack vector is local, with high complexity and low privileges required ; no user interaction is needed. The CVSS v3.1 base score is ...

CVE-2026-72966

CVE-2026-72966 affects Windows Remote Access Connection Manager , where a missing authorization check allows an already-authorized (low-privilege) local attacker to perform tampering without user interaction. The impact is rated HIGH for integrity with no effect on confidentiality or availability...

CVE-2026-72991

CVE-2026-72991 is a heap-based buffer overflow in the Windows Biometric Service that allows a locally authenticated attacker with low privileges to escalate to higher privileges. The vulnerability scores 7.8 (HIGH) under CVSS v3.1, with all three impact dimensions rated High. Attack requires loca...

CVE-2026-73002

CVE-2026-73002 affects Windows Biometric Service , where an integer overflow or wraparound vulnerability allows a locally authenticated attacker to elevate privileges . The flaw requires low privileges , no user interaction, and low attack complexity, yet yields high impact on confidentiality, in...

CVE-2026-73003

CVE-2026-73003 is a Use After Free vulnerability in Windows Modern Device Management (MDM) . An authorized attacker can exploit it to achieve local privilege elevation . The CVSS v3.1 base score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high impact across confident...

CVE-2026-78457

CVE-2026-78457 is a use-after-free vulnerability in Windows Security Health Service that enables a locally authenticated attacker to achieve privilege escalation . The CVSS 3.1 score is 7.0 (HIGH) , with a local attack vector, high complexity, low privileges required, and no user interaction. Imp...

CVE-2025-53139

CVE-2025-53139 is tied to Windows Hello. The connected sources confirm a vulnerability where sensitive information is transmitted in cleartext, enabling a local attacker to bypass a Windows Hello security feature. The risk is described as a local, low-gesture exploit with high impact on confident...

CVE-2025-59516

CVE-2025-59516 is a Windows Storage VSP Driver elevation-of-privilege vulnerability. The issue is described as missing authentication for a critical function, enabling an authorized local attacker to elevate privileges. Public references in connected documents confirm the affected component is th...