CVE-2025-50170

Technical details about CVE-2025-50170 are not publicly provided in the supplied connected documents. The CVE entry notes local privilege escalation via Windows Cloud Files Mini Filter Driver. Monitor for updates from Microsoft and security advisories.

CVE-2025-53140

CVE-2025-53140 is a Windows Kernel Transaction Manager use-after-free vulnerability that could allow a locally authenticated attacker to elevate privileges. It affects the Kernel Transaction Manager component of Windows; root cause is a use-after-free flaw enabling local privilege escalation. The...

CVE-2025-53800

CVE-2025-53800 is a local privilege escalation in the Microsoft Graphics Component. The Initial Description notes privilege elevation for an authorized attacker, but does not provide technical details on the vulnerable subcomponent, root cause, affected versions, exploit vectors, or exact impact ...

CVE-2025-54113

Summary: CVE-2025-54113 affects Windows Routing and Remote Access Service (RRAS) and is described as a heap-based buffer overflow that allows a remote attacker to execute code over the network. The NCSC advisory lists CVE-2025-54113 with a CVSS v3.1 base score of 7.5 and impact of executing code,...

CVE-2025-55694

CVE-2025-55694 affects the Windows Error Reporting service. The root cause is improper access control, enabling an authenticated local attacker to elevate privileges on affected Windows systems. Public documentation confirms the issue and links to Microsoft update guidance (KB5066780 and related ...

CVE-2025-62456

CVE-2025-62456 is a remote code execution vulnerability in the Windows Resilient File System (ReFS) caused by a heap-based buffer overflow. An authenticated attacker could run arbitrary code over the network on affected Windows systems. The NVD entry and Microsoft advisories confirm this CVE targ...

CVE-2025-62470

CVE-2025-62470 is a heap-based buffer overflow in the Windows Common Log File System (CLFS) Driver that enables a locally authenticated attacker to escalate privileges. The vulnerability affects the CLFS driver in Windows, with local access required and high impact on confidentiality, integrity, ...

CVE-2026-20839

CVE-2026-20839 : Improper access control in the Windows Client-Side Caching (CSC) Service may allow an authorized local attacker to disclose information. The CVSSv3.1 vector indicates a local attack with low complexity and low privileges required, but with high confidentiality impact (C:H, I:N, A...

CVE-2026-20873

CVE-2026-20873 describes a race-condition in Windows Management Services that enables local privilege escalation by an authorized attacker. The issue affects Windows Management Services components and is documented in Microsoft security updates as part of January 2026 patching. Microsoft KBs KB50...

CVE-2026-21525

CVE-2026-21525 is a Windows Remote Access Connection Manager (RasMan) Denial of Service vulnerability caused by a NULL pointer dereference. An unauthenticated, locally-initiated attacker can trigger a crash of RasMan, impacting availability. Connected sources confirm this as a local DoS issue, wi...

CVE-2026-25169

Technical details about CVE-2026-25169 are not provided in the supplied documents. No affected products, vulnerable components, impact, or remediation are specified here. Monitor for updates.

CVE-2026-27912

CVE-2026-27912 is a Windows Kerberos elevation-of-privileges vulnerability described in connected sources as an improper authorization issue that allows an authorized attacker to obtain elevated entitlements over an adjacent network. The vulnerability is categorized under Windows Kerberos with an...

CVE-2026-33096

CVE-2026-33096 is an out-of-bounds read vulnerability in Windows HTTP.sys that can cause Denial-of-Service over the network. Public references confirm the issue and note that Microsoft has fixed the vulnerability in April 2026 security updates. Affected software is Windows (HTTP.sys component); t...

CVE-2026-34340

CVE-2026-34340 : Use-after-free in the Windows Projected File System can allow an authorized local attacker to elevate privileges. The provided documents identify the affected component as Windows Projected File System and state the root cause as a use-after-free, with a CVSS v3.1 base score of 7...

CVE-2026-34350

CVE-2026-34350 describes a null pointer dereference in the Windows Storport Miniport Driver that enables a remote attacker to cause a denial of service over the network. The vulnerability is documented with CVSS 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (base score 6.5, MEDIUM) and is network-explo...

CVE-2026-41108

CVE-2026-41108 is a heap-based buffer overflow in the Microsoft Windows DNS Client that allows an authorized, local attacker to perform privilege escalation. Affected component: Windows DNS client functionality (DNS resolution path); root cause: heap-based overflow leading to elevation of privile...

CVE-2026-42916

The CVE-2026-42916 entry describes an Integer underflow in the Windows NT OS Kernel that enables local privilege escalation for an authorized attacker. Affected: Windows NT OS Kernel (kernel-level component). Root cause: wrap/underflow during arithmetic in the kernel. Impact: high across confiden...

CVE-2026-50452

CVE-2026-50452 (Windows Runtime) describes a race condition in Windows Runtime due to improper synchronization on a shared resource. This concurrency flaw can allow an unauthenticated, remote attacker to elevate privileges over the network. The CVE is associated with a high base score (7.0) and n...

CVE-2025-53145

CVE-2025-53145 is tracked as a Windows Message Queuing (MSMQ) remote code execution vulnerability. The connected data list it under Windows MSMQ with impact: Execute code (high severity, CVSS ~8.8/10) and references indicate MSMQ-related fixes were shipped in August 2025 security updates (KBs and...

CVE-2025-55332

CVE-2025-55332 (Windows BitLocker security feature bypass) Affects Windows BitLocker. The vulnerability is described as Improper enforcement of behavioral workflow in Windows BitLocker that could allow an unauthorized attacker to bypass a security feature via a physical attack. Connected sources ...

CVE-2025-55340

CVE-2025-55340 is a Windows Remote Desktop Protocol security feature bypass caused by improper authentication that can enable an authenticated local attacker to bypass a security feature. The vulnerability affects Windows Remote Desktop Protocol and is rated HIGH with a CVSSv3.1 vector of AV:L/AC...

CVE-2025-59215

CVE-2025-59215 is a Windows Graphics Component elevation-of-privilege vulnerability. Multiple sources describe a use-after-free/resource-management error in the Microsoft Graphics Component that can allow an authenticated, local attacker to obtain higher privileges. The NVD entry notes local priv...

CVE-2025-60708

CVE-2025-60708 affects Storvsp.sys driver and, per the NC SC advisories, enables Denial-of-Service via an untrusted pointer dereference. The vulnerability is localized (requires local access) and relates to the Storvsp.sys component in Windows. The provided connected documents confirm the affecte...

CVE-2026-20811

CVE-2026-20811 is a local privilege escalation in Windows Win32K (ICOMP) caused by type confusion. Exploit would grant elevated privileges to an authorized user on the same host. Microsoft’s January 2026 updates address this family of issues (e.g., KB5074109/KB5073457 for affected Windows version...

CVE-2026-20824

CVE-2026-20824 is a Windows Remote Assistance vulnerability described as a protection mechanism failure that enables a local attacker to circumvent a security measure. It is listed with a local attack vector, requiring user interaction, and a high confidentiality impact. Connected sources identif...

CVE-2026-20875

CVE-2026-20875 is a null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) that enables a network-based denial of service. The vulnerability is documented with a CVSS v3.1 base score of 7.5 (Network, Low complexity, No privileges, No user interaction; impact: Avail...

CVE-2026-21255

CVE-2026-21255 is a Windows Hyper-V security feature bypass vulnerability described as improper access control that enables an authorized local attacker to bypass a security feature. Publicly available sources identify Hyper-V as the affected component, with the root cause tied to access-control ...

CVE-2026-25170

Technical details for CVE-2026-25170 are not publicly provided in the supplied documents. Monitor updates from Microsoft and national advisories for affected products, fixes, and confirmed impact.

CVE-2026-25179

CVE-2026-25179 affects the Windows Ancillary Function Driver for WinSock and is caused by improper validation of a specified input type, enabling a locally authenticated attacker to elevate privileges. The entry carries a CVSS v3.1 base score of 7.0 (High) with Local attack, High confidentiality/...

CVE-2026-27926

CVE-2026-27926 is a race-condition elevation-of-privilege vulnerability in the Windows Cloud Files Mini Filter Driver. The issue allows an authorized, locally positioned attacker to escalate privileges via concurrent access to a shared resource. Public details confirm impact as local, with the CV...

CVE-2026-32068

CVE-2026-32068 impacts Windows SSDP service, enabling local elevation of privilege via the Simple Search and Discovery Protocol. The issue is local, requires low privileges, and does not require user interaction. CVSS v3.1 base score 7.0 (HIGH) with HIGH impact on confidentiality, integrity, and ...

CVE-2026-32090

CVE-2026-32090 affects the Windows Speech Brokered API. The vulnerability is an Elevation of Privilege with a CVSSv3.1 base score of 7.8 (HIGH). It is a LOCAL, LOW attack complexity, LOW privileges required, with no user interaction and UNCHANGED scope. The impact is HIGH for confidentiality, int...

CVE-2026-32221

CVE-2026-32221 is a heap-based buffer overflow in Microsoft Graphics Component that allows an attacker to execute code locally. Public sources (NVD, MSRC, and related advisories) confirm this Windows graphics component vulnerability and note that Microsoft has released updates to fix it (e.g., KB...

CVE-2026-32222

CVE-2026-32222 is a Windows Win32k elevation-of-privilege vulnerability. The provided data indicate a local exploit path with LOW privileges required and NO user interaction, potentially compromising confidentiality, integrity, and availability (all HIGH). The CVSSv3.1 base score is 7.8 (HIGH) wi...

CVE-2026-33098

CVE-2026-33098 affects Windows container isolation via the FS Filter Driver causing Elevation of Privilege. The advisory indicates a LOCAL attack vector with LOW attack complexity and LOW privileges required, no user interaction, and HIGH impact to confidentiality, integrity, and availability. Th...

CVE-2026-40406

Technical details about CVE-2026-40406 are not publicly available in the provided documents; monitor for updates as additional specifics (affected products, root cause, fixes) may be released.

CVE-2026-41092

CVE-2026-41092 describes an improper access control in Microsoft Kinect that enables a locally authenticated attacker to elevate privileges. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.8 (HIGH). Affected component: Kinect functionality; root cause is insuffic...

CVE-2026-48570

CVE-2026-48570 concerns a protection mechanism failure in Windows Secure Boot that could allow an authorized attacker with HIGH privileges to bypass a security feature locally (local attack, no user interaction). The CVSS 3.1 vector is AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N with a base score of 7.9 ...

CVE-2025-50162

CVE-2025-50162 is a Windows RRAS vulnerability described as a heap-based buffer overflow that allows an authenticated attacker to execute code over the network. The RRAS entry in the Windows vulnerability catalog indicates the impact as execution of random code. Microsoft has released updates add...

CVE-2025-50166

CVE-2025-50166 affects Windows Distributed Transaction Coordinator (MSDTC). The issue is an integer overflow/wraparound in MSDTC that can lead to information disclosure over the network when exploited by an attacker with low privileges and no user interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N...

CVE-2025-53151

CVE-2025-53151 is a Windows Kernel use-after-free local privilege escalation vulnerability. Connected sources indicate the affected component is the Windows Kernel and that exploitation leads to obtaining elevated privileges locally. Microsoft security updates are referenced in the surrounding ad...

CVE-2025-53716

CVE-2025-53716 is a Denial-of-Service vulnerability due to a null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS). The CVE description states an authorized attacker can trigger a network-based DoS without user interaction, with attack vector NETWORK and impact Av...

CVE-2025-53718

Technical details about CVE-2025-53718 are not publicly available in the provided connected documents. No specific product/version/root-cause/impact details are provided here. Monitor future updates from Microsoft and CVE databases for remediation and impact information.

CVE-2025-54091

Technical details for CVE-2025-54091 are not publicly provided in the connected documents. The initial description notes a local privilege elevation via Hyper-V, but no specific root cause, affected products, or fixes are given here. Monitor for updates.

CVE-2025-54105

CVE-2025-54105 describes a race condition in the Microsoft Brokering File System that can enable local privilege escalation by an authorized attacker. Connected sources confirm a Windows-focused vulnerability and indicate remediation via Microsoft hotpatches and September 2025 security updates (K...

CVE-2025-54116

CVE-2025-54116 affects Windows MultiPoint Services with Improper access control that enables local privilege escalation by an authorized user. CVSS 3.1 base score 7.3 (Local, Privilege Required Low, User Interaction Required, High Confidentiality/Integrity/Availability impact). The Connected docu...

CVE-2025-54919

CVE-2025-54919 is linked to Windows Win32K GRFX and is described as a race condition in a shared resource that could allow an authorized, local attacker to execute code. The Connected documents confirm the CVE within Windows Win32K GRFX but do not provide concrete exploit details, affected versio...

CVE-2025-55333

CVE-2025-55333 describes an authentication bypass in Windows BitLocker caused by an incomplete factor comparison, enabling a physical attacker to bypass a security feature. The initial entry notes exploitation status as null and does not specify affected product versions beyond Windows BitLocker;...

CVE-2025-55335

CVE-2025-55335 : A use-after-free in Windows NTFS leading to potential local privilege escalation. The initial entry notes local privileged impact but provides no concrete patch/version or workaround. Connected MSKBs describe OS update releases addressing various issues (KB5066793, KB5066835/7/ e...

CVE-2025-59289

CVE-2025-59289 concerns a double-free condition in Windows Bluetooth Service enabling a locally authenticated attacker to elevate privileges. Public sources within the provided documents confirm this CVE is associated with the Windows Bluetooth Service and is categorized with a high impact (local...