2515 matches found
CVE-2026-61346
CVE-2026-61346 describes a use-after-free in the Windows Graphics Kernel that can allow an authorized local attacker to elevate privileges. The available documents confirm the vulnerable component is the Windows Graphics Kernel and indicate a local, high-impact risk (CVSSv3.1: AV=L/AC=H/PR=L/UI=N...
CVE-2026-62757
Summary: CVE-2026-62757 involves Windows Schannel with improper verification of cryptographic signatures, allowing a network-borne attacker to bypass a security feature. The impact is described as a security feature bypass over the network, with a medium base score (CVSS 3.1: 5.3) and high confid...
CVE-2026-62888
Summary: CVE-2026-62888 is a Windows vulnerability described as a use-after-free in the Windows DWM Core Library that enables a locally authenticated attacker to elevate privileges. The CVSSv3.1 base metrics indicate a high impact (C/H, I/H, A/H) with local attack vector, low attack complexity, a...
CVE-2024-49093
CVE-2024-49093: Windows Resilient File System (ReFS) Elevation of Privilege vulnerability. Affected: ReFS on Windows. Root cause and exploit details are not fully disclosed in the provided documents; the CVSSv3.1 vector from the initial entry indicates LOCAL attack vector, LOW attack complexity, ...
CVE-2025-21237
CVE-2025-21237 is a Windows Telephony Service Remote Code Execution vulnerability. Exploitation could allow remote code execution via the Telephony Service; CVSS v3.1 base score 8.8 (HIGH) with network access, user interaction required. Affected products are Windows components where Telephony Ser...
CVE-2025-21247
CVE-2025-21247 is a MapUrlToZone security bypass in Windows. Description: Improper resolution of path equivalence allows a network attacker to bypass a security feature. CVSS: 3.1, Network attack, Low complexity, No privileges required, User interaction required, Confidentiality impact Low; Integ...
CVE-2025-21313
CVE-2025-21313 corresponds to a Windows SAM Denial-of-Service vulnerability. The connected sources identify the affected component as Windows Security Account Manager (SAM) and classify the impact as Denial of Service (DoS) with CVSS v3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Expl...
CVE-2025-24056
CVE-2025-24056 is a heap-based buffer overflow in the Windows Telephony Server that allows a network-based attacker to execute arbitrary code on affected systems. The issue is described as remote code execution with network access (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and a base score of 8.8 (HIG...
CVE-2025-24069
CVE-2025-24069 is an out-of-bounds read in the Windows Storage Management Provider that permits an authorized local attacker to disclose information. Affected component: Windows Storage Management Provider. CVSS: Local attack, Low privileges required, no user interaction, Confidentiality impact H...
CVE-2025-26639
CVE-2025-26639 is a Windows USB Print Driver elevation-of-privilege vulnerability caused by an integer overflow/wraparound in the driver. The issue can be triggered locally by an authorized user with low privileges and no user interaction, potentially allowing a takeover of SYSTEM-level rights. M...
CVE-2025-26688
CVE-2025-26688 is a stack-based buffer overflow in Microsoft Virtual Hard Disk that enables a locally authenticated attacker to elevate privileges. The vulnerability is labeled as “Obtaining Increased Entitlements” (CVSS v3.1 base score 7.8). Connected sources corroborate the affected product (Mi...
CVE-2025-29831
Technical details about CVE-2025-29831 (affected product, root cause, patch) are not provided in the supplied documents. Monitor for updates and refer to the official vulnerability entry for authoritative information.
CVE-2026-26151
CVE-2026-26151 describes insufficient UI warnings in Windows Remote Desktop that can enable a network attacker to spoof a remote session. The NVD entry lists a CVSS v3.1 base score of 7.1 (HIGH) with network access, no privileges required, user interaction required, and impact to confidentiality ...
CVE-2026-32183
CVE-2026-32183 is a Windows Snipping Tool vulnerability that allows local execution of arbitrary code due to improper neutralization of special elements in a command (command injection). Affected component: Snipping Tool on Windows. Impact per sources: Executing (remote) code with high confidenti...
CVE-2026-42983
CVE-2026-42983 is a Windows vulnerability described across multiple sources as a use-after-free in the DWM Core Library that allows an authorized, local attacker to elevate privileges. The issue is identified consistently in Microsoft’s MSRC page and NVD records; no public exploit details or defa...
CVE-2026-61928
An issue affecting Windows Hello : sensitive information is stored in cleartext, allowing an authorized local attacker to tamper with the system. The CVSSv3.1 vector indicates a local, low-complexity attack requiring low privileges with a high integrity impact (I:H). Base score 5.5 (Medium). No e...
CVE-2026-65799
CVE-2026-65799 is an integer overflow or wraparound vulnerability in the Windows DNS service that allows an authorized local attacker to elevate privileges . The FSTEC BDU further characterizes the root cause as a buffer overflow in dynamic memory . Microsoft rates it CVSS 6.7 (MEDIUM) with high ...
CVE-2026-69586
CVE-2026-69586 is a critical (CVSS 9.8) integer overflow or wraparound vulnerability in Microsoft Windows PDF that allows an unauthorized attacker to execute code over a network with no privileges required and no user interaction. The attack vector is network-based with low complexity , yielding ...
CVE-2024-43638
CVE-2024-43638 is a Windows USB Video Class System Driver Elevation of Privilege vulnerability. The connected sources corroborate a Windows USB Video Driver component as the affected area and indicate that mitigations are released via Microsoft security updates (e.g., November 2024 updates/KBs). ...
CVE-2025-21347
CVE-2025-21347 is linked to the Windows Update Stack and is described in the connected NCSC advisory as a Denial-of-Service vulnerability. The CVE entry in that document assigns a base CVSS-like severity of 6.0 and notes that Microsoft has updates available to fix the issue. The mode of the vulne...
CVE-2025-21371
CVE-2025-21371 is a remote code execution vulnerability in Windows Telephony Service. Connected documents identify the affected component as Windows Telephony Service and annotate the CVE with a high severity (CVSS v3.1: 8.8, NETWORK attack, no privileges required, user interaction required, C/H/...
CVE-2025-26665
CVE-2025-26665 affects Windows UPnP Device Host (upnphost.dll). The issue is described as sensitive data stored in memory that is not properly locked, enabling a local attacker with authorized access to obtain increased entitlements (privilege escalation). Connected sources corroborate the impact...
CVE-2026-58626
CVE-2026-58626 is a Windows Remote Desktop Services use-after-free vulnerability that can allow an authenticated attacker to execute arbitrary code over the network. The CVE is rated CVSS v3.1 base score 8.8 (High) with Network attack, Low attack complexity, Privileges Required: Low, User Interac...
CVE-2026-62698
The CVE-2026-62698 entry concerns a numeric truncation error in Microsoft Digest Authentication. The vulnerability is described as enabling a locally authenticated attacker to achieve privilege elevation (base score 7.8, CVSS 3.1, LOCAL, LOW privileges required, NONE user interaction, HIGH impact...
CVE-2026-69408
CVE-2026-69408 is an integer overflow or wraparound in Microsoft Windows Media Foundation that allows an unauthorized, remote attacker to execute code over a network. Microsoft assigned a CVSS 3.1 score of 9.8 (CRITICAL) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation r...
CVE-2024-49075
Technical details for CVE-2024-49075 are not publicly provided in the connected documents. The sources reference Windows Remote Desktop Services DoS but do not specify affected versions, root cause, exploit information, or fixes within this corpus. Monitor for updates.
CVE-2024-49108
CVE-2024-49108 is a Windows Remote Desktop Services remote code execution vulnerability. According to the connected advisories, it is rated high severity (CVSSv3.1 base 8.1) with network access required and no user interaction, and the impact is execution of arbitrary code with high confidentiali...
CVE-2025-21407
According to the provided documents, CVE-2025-21407 is associated with Windows Telephony Service and is listed with a high impact (CVSS 8.80) involving the execution of arbitrary code. The NCSC advisory explicitly catalogs CVE-2025-21407 under Windows Telephony Service with an impact of executing...
CVE-2025-21410
CVE-2025-21410 is a Windows RRAS Remote Code Execution vulnerability. AFFECTED: Windows RRAS component (Routing and Remote Access Service) with exploitation yielding total impact (RCE) on the host. ROOT CAUSE/DETAILS: Not explicitly provided in the documents beyond RRAS RCE naming; exploitation i...
CVE-2025-26664
CVE-2025-26664 is a Windows RRAS vulnerability described as a buffer over-read in Routing and Remote Access Service that can allow an unauthenticated attacker to disclose information over the network. The CVE is listed with a network attack vector, low attack complexity, and no privileges require...
CVE-2025-27729
CVE-2025-27729 is a Windows Shell remote code execution issue described as a use-after-free vulnerability that enables local code execution. The linked sources confirm this affects Windows Shell and related components, with Microsoft providing security updates to remediate the flaw (for example K...
CVE-2026-20857
CVE-2026-20857 affects the Windows Cloud Files Mini Filter Driver. The vulnerability is an untrusted pointer dereference that enables an authorized attacker to elevate privileges locally. Multiple Nessus/NVD/NCSC entries map this CVE to the January 2026 Microsoft security update KB5074109 (Window...
CVE-2026-41096
CVE-2026-41096 is a heap-based buffer overflow in Microsoft Windows DNS that enables remote code execution over the network. The vulnerability affects Windows DNS handling and allows an unauthenticated attacker to execute code remotely (no user interaction). CVSS v3.1 metrics indicate networking ...
CVE-2026-42987
The CVE-2026-42987 entry concerns a use-after-free in Windows Deployment Services (WDS) that enables an unauthenticated attacker to achieve remote code execution over the network . The associated CVSS 3.1 vector indicates network access, high impact on confidentiality, integrity, and availability...
CVE-2026-59125
Use-after-free in the Virtual Hard Disk (VHD) Miniport Driver can allow an authorized local attacker to elevate privileges. The vulnerability is described as a local privilege escalation with high impact to confidentiality, integrity, and availability. The CVSS vector indicates LOCAL access, user...
CVE-2026-59127
CVE-2026-59127: Affected software is Windows Installer; vulnerability is an integer overflow/wraparound in Windows Installer that enables a locally authenticated attacker to elevate privileges. The issue stems from the overflow in a Windows Installer component, with CVSS v3.1 base score 7.8 (High...
CVE-2026-62908
CVE-2026-62908: A race condition in the Windows Backup Engine allows local privilege escalation by an authorized attacker. Documented impact: high across confidentiality, integrity, and availability (CVSS 3.1 base score 7.0; LOCAL access; HIGH likelihood of impact). Affected component is the Wind...
CVE-2026-69910
Windows Hyper-V is affected by a stack-based buffer overflow that allows an unauthorized attacker to achieve remote code execution over the network without any privileges or user interaction. The vulnerability is rated CVSS 9.8 (Critical) by Microsoft, with high impact to confidentiality, integri...
CVE-2025-21250
CVE-2025-21250 is a Windows Telephony Service Remote Code Execution vulnerability with CVSS 3.1 base score 8.8 (Network, Low attack complexity, No privileges, User interaction required). Connected sources reference the Windows Telephony Service as the affected component and indicate in CIRCL that...
CVE-2025-26672
CVE-2025-26672 is described as a buffer over-read in Windows Routing and Remote Access Service (RRAS) that allows an unauthenticated attacker to disclose information over the network. Connected sources corroborate that RRAS is the affected component and frame the impact as an information disclosu...
CVE-2025-27471
CVE-2025-27471 affects Microsoft Windows Streaming Service. Technical details in connected docs confirm that the vulnerability arises from sensitive data storage in improperly locked memory, enabling a network-based Denial of Service. The CVSS v3.1 base score is 5.9 (Network, High attack complexi...
CVE-2025-32715
CVE-2025-32715 is a vulnerability in the Windows Remote Desktop Client described as an out-of-bounds read that can lead to information disclosure . The connected NCSC advisory lists CVSS v3.1/6.50 with an impact of Access to sensitive data . Exploitation details, affected product versions, and sp...
CVE-2025-33050
CVE-2025-33050 is a denial-of-service issue in Windows DHCP Server. Public details confirm impact to the DHCP Server service enabling denial of network service under network access, with CVSSv3.1 score 7.5 (NETWORK, HIGH). Connected docs indicate Microsoft security updates (KB5061010, KB5060531, ...
CVE-2026-34345
CVE-2026-34345 describes a race condition in the Windows Ancillary Function Driver for WinSock that allows local privilege escalation when a shared resource is improperly synchronized. Connected sources confirm the vulnerability affects Windows components and has been addressed by the May 2026 up...
CVE-2026-50368
CVE-2026-50368 refers to a stack-based buffer overflow in Active Directory Federation Services (AD FS) that allows an unauthenticated attacker to cause a denial of service over the network. The vulnerability arises in the AD FS component and is described in multiple sources as enabling a DS impac...
CVE-2026-61353
CVE-2026-61353 describes a heap-based buffer overflow in the Windows Telephony Service that enables a locally authenticated attacker to achieve privilege escalation . The vulnerability arises from a heap overflow in the Telephony Service component, leading to potential unauthorized system access....
CVE-2026-69524
CVE-2026-69524 is a use-after-free vulnerability in Windows Active Directory Domain Services that allows an unauthorized, network-based attacker to achieve remote code execution without prior authentication or user interaction. Microsoft rates it CVSS 8.1 (HIGH) with high impact on confidentialit...
CVE-2024-38264
CVE-2024-38264 is a Microsoft Virtual Hard Disk (VHDX) Denial of Service vulnerability. The initial entry notes a network-accessible DoS with MEDIUM severity (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Connected Microsoft advisories confirm Windows updates exist to fix this issue (e.g., KB50...
CVE-2024-43631
CVE-2024-43631 is a Windows Secure Kernel Mode elevation of privilege vulnerability. The available connected documents confirm a local, low-complexity flaw that could grant elevated (“high”) impact on confidentiality, integrity and availability if exploited. Microsoft has released multiple update...