CVE-2026-69775

CVE-2026-69775 is a use-after-free vulnerability in the Windows DWM Core Library that allows an authorized attacker to elevate privileges over a network. The CVSS 3.1 score is 7.1 (HIGH) , with a vector of AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating that exploitation requires network access, ...

CVE-2026-72937

This is an out-of-bounds read vulnerability in the Windows Storage Port Driver that allows an authorized local attacker to disclose information. The CVSS 3.1 score is 5.5 (MEDIUM) with a local attack vector, low complexity, and low privileges required, resulting in high confidentiality impact wit...

CVE-2026-78446

A Use after free vulnerability exists in the Windows Distributed File System (DFS) , which allows an authorized attacker to perform a denial of service (DoS) over a network. While the CVE title mentions Remote Code Execution, the primary description and metrics focus on the DoS impact. No specifi...

CVE-2026-69422

CVE-2026-69422 is a use-after-free vulnerability in the Windows USB Video Driver that allows a locally authenticated attacker with low privileges to escalate privileges. The attack requires high complexity and no user interaction, with high impact on confidentiality, integrity, and availability, ...

CVE-2026-69552

CVE-2026-69552 affects Windows Print Spooler Components , where a flaw in the generation of error messages containing sensitive information allows an authorized attacker to disclose information over a network. The attack requires low privileges and user interaction , with a CVSS 3.1 score of 5.7 ...

CVE-2026-70574

CVE-2026-70574 is an out-of-bounds read vulnerability in the Virtual Hard Disk (VHD) Miniport Driver (Microsoft). An attacker with low local privileges can exploit this to elevate privileges to high integrity, resulting in full compromise of confidentiality, integrity, and availability (CVSS 3.1:...

CVE-2026-71338

CVE-2026-71338 is a double free vulnerability in Windows Failover Cluster that allows an authorized attacker to elevate privileges locally . The underlying cause is a double-free memory error within the Failover Cluster component. Per the CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), the...

CVE-2026-72928

A use-after-free vulnerability in Windows DNS Server allows an authorized (low-privilege) attacker to execute remote code over a network . The CVSS 3.1 score is 7.5 (High) , reflecting a network attack vector with high complexity but high impact to confidentiality, integrity, and availability. Th...

CVE-2026-69318

Windows Imaging Component contains an out-of-bounds read flaw that allows a locally authenticated attacker to disclose information. The vulnerability carries a CVSS 3.1 score of 5.5 (MEDIUM) , with a local attack vector, low complexity, low privileges required, no user interaction, and a High imp...

CVE-2026-69679

Windows DHCP Server is affected by an out-of-bounds read vulnerability that allows an authorized attacker (low privileges) to cause a denial of service over an adjacent network . The CVSS 3.1 score is 5.7 (Medium) with high availability impact and no confidentiality or integrity impact. CISA's SS...

CVE-2026-69741

Windows Spaceport.sys is affected by an out-of-bounds read vulnerability that allows a locally authenticated attacker with low privileges to disclose information . The CVSS 3.1 score is 5.5 (Medium) with a local attack vector, low complexity, no user interaction, and a high confidentiality impact...

CVE-2026-69895

This information disclosure vulnerability exists in the Windows Spaceport.sys kernel driver, caused by an out-of-bounds read . A local, authorized attacker with low privileges can exploit it to disclose information , with no impact on integrity or availability. The CVSS 3.1 score is 4.7 (Medium) ...

CVE-2026-72965

CVE-2026-72965 is a use-after-free vulnerability in the Windows WebClient Service that allows an authorized local attacker to achieve privilege elevation . The CVSS v3.1 score is 7.8 (HIGH) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack requiring low privileges an...

CVE-2026-69279

CVE-2026-69279 is a use after free vulnerability in the Windows Cloud Files Mini Filter Driver that allows an authorized local attacker to elevate privileges . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexity but...

CVE-2026-69303

CVE-2026-69303 is an out-of-bounds read in the Push Message Routing Service (Microsoft), rated CVSS 5.5 (MEDIUM) . An authorized attacker with low privileges can exploit this locally to disclose information, with no integrity or availability impact. CISA's SSVC assessment indicates no known explo...

CVE-2026-69609

CVE-2026-69609 is an out-of-bounds read in the Windows Win32k kernel driver that allows a local, low-privileged attacker to disclose information without user interaction. The vulnerability is classified as an Information Disclosure issue with a CVSS 3.1 score of 5.5 (Medium) , reflecting limited ...

CVE-2026-69781

CVE-2026-69781 is a memory management flaw in the Windows DHCP Client , caused by a missing release of memory after its effective lifetime. An unauthorized attacker can exploit this to cause a denial of service over an adjacent network . The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:A/AC...

CVE-2026-73008

CVE-2026-73008 is an information disclosure vulnerability in Windows Biometric Service . It allows a locally authenticated attacker with low privileges to expose private personal information to an unauthorized actor, resulting in high confidentiality impact with no integrity or availability impac...

CVE-2026-77502

CVE-2026-77502 is an out-of-bounds read in Windows DHCP Server that allows an unauthorized attacker to cause denial of service over a network. The vulnerability requires no prior authentication or user interaction, and carries a CVSS 3.1 score of 7.5 (HIGH) with high impact to availability. No co...

CVE-2026-69416

CVE-2026-69416 is a buffer over-read in Windows DHCP Server that allows an authorized attacker with low privileges on an adjacent network to cause a denial of service , with high availability impact and no confidentiality or integrity impact (CVSS 3.1: 5.7 MEDIUM ). CISA assesses exploitation as ...

CVE-2026-69504

CVE-2026-69504 is an out-of-bounds read in Windows NTFS that allows a local, authenticated attacker to disclose information . The vulnerability scores CVSS 3.1 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges required, no user interaction, and high confidentiality impact bu...

CVE-2026-69692

CVE-2026-69692 is a use-after-free flaw in the Windows Audio Service that allows an authorized local attacker to elevate privileges . Microsoft rates it CVSS 3.1: 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexity, low privileges requir...

CVE-2026-77896

The Windows Remote Desktop Client is affected by an integer overflow or wraparound vulnerability. This flaw allows an unauthorized attacker to perform a denial of service (DoS) attack over a network. While the CVSS scores vary between 6.5 and 7.5 depending on the source, they consistently indicat...

CVE-2026-69315

Windows License Manager is affected by an information disclosure vulnerability (CVE-2026-69315) where sensitive system information is exposed to an unauthorized control sphere, allowing an authorized local attacker to disclose information. The vulnerability requires low privileges and local acces...

CVE-2026-69513

CVE-2026-69513 is a heap-based buffer overflow in Windows Error Reporting that allows an authorized attacker to perform a local privilege elevation . The CVSS 3.1 score is 7.8 (HIGH) with a vector of local attack, low complexity, low privileges required, no user interaction, and high impact to co...

CVE-2026-69618

CVE-2026-69618 is an out-of-bounds read in the Windows SMB Client that allows an authorized local attacker to disclose information . The CVSS 3.1 score is 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges required, and high confidentiality impact but no integrity or availabi...

CVE-2026-77895

CVE-2026-77895 is an out-of-bounds read vulnerability in Windows DHCP Server that allows an unauthorized attacker to cause denial of service over a network . The CVSS 3.1 score is 7.5 (HIGH) with a vector of network access, low complexity, no privileges required, and no user interaction, resultin...

CVE-2026-68895

CVE-2026-68895 is a numeric truncation error in Internet Storage Name Service (iSNS) that allows an authorized, local attacker to disclose information. The flaw yields a CVSS 3.1 score of 5.5 (Medium) with high confidentiality impact but no integrity or availability impact, requiring low privileg...

CVE-2026-68897

A heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to escalate privileges locally . The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexity, low required privileg...

CVE-2026-69308

Microsoft Standard XPS is affected by an out-of-bounds read that allows an authorized, local attacker to disclose information . The vulnerability requires low privileges and no user interaction, with a CVSS 3.1 score of 5.5 (MEDIUM) (C:H/I:N/A:N). CISA's SSVC assessment rates exploitation as none...

CVE-2026-69367

An out-of-bounds read in Microsoft Standard XPS allows an authorized local attacker to disclose information. The CVSS v3.1 score is 5.5 (Medium) , with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N , indicating that exploitation requires local access, low privileges, no user interaction, and re...

CVE-2026-69617

CVE-2026-69617 is an out-of-bounds read vulnerability in the Windows Resilient File System (ReFS) component that allows an authorized local attacker to escalate privileges . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting the high complexity and l...

CVE-2026-69296

A use-after-free vulnerability in Windows Device Association Service allows an authorized attacker to escalate privileges over a network. The flaw requires low privileges, user interaction, and high attack complexity, yielding a CVSS 3.1 score of 7.1 (HIGH) with full impact on confidentiality, in...

CVE-2026-69572

CVE-2026-69572 is an out-of-bounds read vulnerability in the Windows SMB Client that allows an authorized attacker (low privileges) to disclose information over a network . The CVSS 3.1 score is 5.7 (Medium) with vector AV:N/AC:L/PR:L/UI:R, indicating a network attack with low complexity, low req...

CVE-2026-72985

A heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker with physical access to escalate privileges, potentially compromising confidentiality, integrity, and availability (CVSS 6.8, MEDIUM). The vulnerability requires no prior privileges or user interaction, but...

CVE-2026-78451

CVE-2026-78451 is an untrusted pointer dereference in the Microsoft Windows SCSI Class System File that enables an unauthorized attacker to escalate privileges via a physical attack vector (CVSS AV:P). The vulnerability carries a CVSS 3.1 base score of 6.8 (Medium) with high impact to confidentia...

CVE-2026-69527

An out-of-bounds read vulnerability in the Windows USB Mass Storage Class Driver allows an authorized local attacker to disclose information. The CVSS v3.1 score is 5.5 (Medium) with a local attack vector, low privileges required, and high confidentiality impact. CISA's SSVC assessment indicates ...

CVE-2026-70562

CVE-2026-70562 is a double free vulnerability in the Windows Audio Service that allows a low-privilege (authorized) local attacker to elevate privileges . The CVSS 3.1 score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , reflecting a local attack vector with high complexity. No e...

CVE-2026-71353

CVE-2026-71353 is a double free vulnerability in Windows Routing and Remote Access Service (RRAS) that allows an authorized local attacker to elevate privileges. The vulnerability requires local access with low privileges , has high attack complexity , and needs no user interaction , yielding a C...

CVE-2026-83980

CVE-2026-83980 is a heap-based buffer overflow in the Windows Biometric Service that allows a local, low-privilege attacker to escalate privileges without user interaction. The CVSS 3.1 score is 7.8 (HIGH) , with high impact on confidentiality, integrity, and availability. The vulnerability is ra...

CVE-2026-83981

A heap-based buffer overflow in Windows Biometric Service allows an authorized (low-privilege) local attacker to elevate privileges , with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 7.8 HIGH ). The attack requires local access , low privileges , and no user intera...

CVE-2026-69275

CVE-2026-69275 is a use-after-free vulnerability in the Kernel Streaming WOW Thunk Service Driver that allows an authorized attacker to escalate privileges locally. The CVSS 3.1 score is 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector , high complexity...