CVE-2026-49784

Summary: CVE-2026-49784 describes a race condition in the Microsoft Windows App Store caused by concurrent access to a shared resource with improper synchronization. The vulnerability allows an authorized local attacker to elevate privileges. The reported CVSS v3.1 vector is AV:L/AC:H/PR:L/UI:N/S...

CVE-2026-57095

CVE-2026-57095 affects Windows Win32K (Win32k.sys) and is described as an elevation-of-privileges vulnerability due to exposure of sensitive information to an unauthorized actor, enabling local privilege escalation. Public details confirm impact as privilege escalation with local access and a hig...

CVE-2025-55691

CVE-2025-55691 is an elevation-of-privilege flaw in Windows PrintWorkflowUserSvc caused by a use-after-free; it affects Windows Print workflow handling and enables local privilege escalation for authorized users (LOCAL, LOW privileges required, no user interaction). Public references indicate Mic...

CVE-2025-59508

CVE-2025-59508 is reported in Windows Speech as a race-condition in concurrent execution on a shared resource, enabling local privilege escalation for an authorized attacker. The connected NCSC advisory lists Windows Speech CVE-2025-59508 with an impact of obtaining increased rights. Public detai...

CVE-2025-60707

CVE-2025-60707 is described in the connected documents as a use-after-free vulnerability in the Multimedia Class Scheduler Service (MMCSS) that can enable an authorized, local attacker to escalate privileges. The NCSC advisory explicitly associates this CVE with MMCSS and marks the impact as obta...

CVE-2025-62571

CVE-2025-62571 is a Windows Installer Elevation of Privilege vulnerability caused by improper input validation. The CVE affects Windows Installer, enabling an authorized, local attacker to escalate privileges (CVSS v3.1: 7.8, Local, Privileges Required: Low, User Interaction: None). Connected sou...

CVE-2026-24290

CVE-2026-24290 concerns the Windows Projected File System and is an Elevation of Privilege vulnerability. The CVE shows a LOCAL attack vector with LOW privileges required and NONE user interaction, with impacts on confidentiality, integrity, and availability rated as High. The metric set indicate...

CVE-2026-49805

CVE-2026-49805 concerns Windows: an improper access control in the Win32K subsystem could allow a locally authenticated attacker to elevate privileges. Affected software is described as Windows Win32K; the root cause cited is access-control issues within that component. The documents provide the ...

CVE-2026-50297

CVE-2026-50297 is a Windows Win32K local privilege escalation due to improper access control. The vulnerable component is Win32K; the condition allows an authorized attacker to elevate privileges locally. Base impact is high (C, I, A) with local attack vector and no user interaction required beyo...

CVE-2026-50384

CVE-2026-50384 describes a race condition in the Windows Clip Service caused by concurrent execution over a shared resource with improper synchronization. This vulnerability allows a locally authenticated attacker to elevate privileges. The CVSS 3.1 vector is LOCAL, with HIGH impact on confidenti...

CVE-2026-50460

CVE-2026-50460 describes a race-condition in Windows Runtime due to concurrent execution using a shared resource, enabling elevation of privileges over a network. The affected software is Windows Runtime; the root cause is improper synchronization during concurrent access. Reported impact indicat...

CVE-2026-55004

CVE-2026-55004 corresponds to a local privilege-elevation flaw described as a double-free in Microsoft Printer Drivers. The CVSSv3.1 score is 7.8 (High) with local attack vector, low attack complexity, and privileges required, no user interaction, impacting confidentiality, integrity, and availab...

CVE-2026-58533

CVE-2026-58533 is listed as a Windows Remote Desktop Client information-disclosure vulnerability stemming from the use of an uninitialized resource in the Windows RDP client. Connected sources confirm the affected component is the Windows Remote Desktop Client and describe the impact as unauthori...

CVE-2026-58536

CVE-2026-58536 : A use-after-free in Windows Cloud Files Mini Filter Driver allows an authorized local attacker to achieve elevation of privileges. Affected component: Windows Cloud Files Mini Filter Driver. Impact: local privilege escalation with high impact; exploit details are not provided in ...

CVE-2026-62701

CVE-2026-62701 affects the Windows Telephony Service and is caused by a use-after-free in that component. The vulnerability enables a local, authenticated attacker with LOW privileges and NO user interaction to achieve privilege escalation with HIGH impact on confidentiality, integrity, and avail...

CVE-2026-62723

CVE-2026-62723 is a use-after-free vulnerability in Windows Telephony Service that allows an authorized attacker to elevate privileges locally. The NVD entry and CVE records confirm a local exploit path with low privileges required and no user interaction, with a CVSSv3.1 base score of 7.0 (High)...

CVE-2025-54103

Technical details about CVE-2025-54103 (affected product, vulnerable component, root cause, impact, and patch status) are not provided in the supplied documents. Monitor MSRC updates and NVD for concrete remediation steps.

CVE-2025-60713

CVE-2025-60713 is an elevation-of-privilege flaw in Windows RRAS caused by an untrusted pointer dereference. Public docs confirm local privilege escalation for an authenticated attacker. Affected component is RRAS in Windows; CVSS v3.1 base score 7.8 (High). Remediation is provided via Microsoft’...

CVE-2025-62463

CVE-2025-62463 is a Windows DirectX Graphics Kernel vulnerability where a null pointer dereference in DirectX can allow an authorized local attacker to cause Denial of Service. The CVE is classified as a local, low-privilege, non-user-interaction DoS with a medium base score (6.5) per CVSS 3.1 me...

CVE-2025-62569

CVE-2025-62569 is a Use‑After‑Free vulnerability in the Microsoft Brokering File System that elevates privileges locally for an authenticated attacker. The CVE is categorized with CVSS v3.1 as Local, Low Privileges Required, High Impact (Confidentiality, Integrity, Availability), base score 7.0. ...

CVE-2026-27909

CVE-2026-27909 is a Windows Search Component elevation-of-privilege vulnerability (use-after-free) that could allow an authenticated local attacker to gain SYSTEM privileges. Connected advisories confirm the issue and indicate Microsoft has fixed vulnerabilities across Windows components in April...

CVE-2026-27931

CVE-2026-27931 : Windows GDI contains an out-of-bounds read vulnerability that allows a local, unprivileged attacker to disclose information. Affected component: Windows GDI. Root cause: read past buffer bounds in GDI. Impact: local information disclosure of sensitive data. Exploitation status: n...

CVE-2026-40422

CVE-2026-40422 concerns Windows File Explorer where an uninitialized resource leads to local information disclosure. The affected component is File Explorer; the underlying issue is an uninitialized resource, enabling an authorized user with local access (low privilege, no user interaction) to di...

CVE-2026-49165

The CVE-2026-49165 entry concerns the Microsoft Windows App Store. The connected sources confirm that the vulnerability arises from use of an uninitialized resource, enabling an authorized local attacker to disclose information. Impact is information disclosure with local access; CVSS 3.1 factors...

CVE-2026-49169

CVE-2026-49169 affects Windows DNS Server. The vulnerability is a use-after-free in the DNS Server that enables remote code execution when exploited over a network by an authenticated attacker. Exploitation details are not provided in the supplied documents beyond the CVSS 3.1 score (8.0, HIGH) w...

CVE-2026-50333

CVE-2026-50333 affects Windows Spaceport.sys. The vulnerability is described as missing authentication for a critical function, enabling a locally authenticated attacker to escalate privileges. Affected component is Spaceport.sys; no specific product version, root cause detail, or remediation ver...

CVE-2026-54982

CVE-2026-54982 affects the Windows Reliable Multicast Transport Driver (RMCAST). The issue is an integer underflow in RMCAST that can allow an adjacent-network attacker to execute code on the vulnerable host (remote code execution). CVSS v3.1 indicates high impact with adjacent network exploitati...

CVE-2026-56176

CVE-2026-56176 – Windows Win32K GRFX: Affected component is the Win32K GRFX subsystem. The vulnerability is an out-of-bounds read that allows an authorized local attacker to elevate privileges on Windows. The CVE is backed by multiple sources in connected documents (NVD/NCSC and MS advisories) co...

CVE-2026-57085

CVE-2026-57085 is a Windows Print Spooler vulnerability described as an out-of-bounds read in Print Spooler Components that allows an authorized, local attacker to disclose information. Connected sources confirm the affected component and local disclosure impact, with Microsoft and CVE trackers n...

CVE-2026-58539

CVE-2026-58539 is a Windows Remote Desktop Client/RDP vulnerability described as an out-of-bounds read that could allow an unauthenticated attacker to disclose information over a network. The connected documents corroborate this as a Windows RDP/Remote Desktop Client issue with public advisories ...

CVE-2025-59510

Technical details about CVE-2025-59510 (RRAS in Windows) are not publicly provided in the supplied documents. Monitor for updates from Microsoft regarding affected products, impact, and remediation.

CVE-2025-60706

According to the NCSC advisory, CVE-2025-60706 is a vulnerability in Windows Hyper-V where an out-of-bounds read can allow an authorized local attacker to disclose information (impact: access to sensitive data). The CVE is listed under Windows Hyper-V in the advisory with a CVSS v3.1 base score o...

CVE-2025-60719

Technical details about CVE-2025-60719 are not provided in the connected documents. The initial description notes a local privilege elevation in Windows AFD/WinSock, but no vendor/version specifics or fixes are included here. Monitor official advisories for updates.

CVE-2025-62462

CVE-2025-62462 is a Windows ProjFS (Projected File System) Elevation of Privilege vulnerability caused by a buffer over-read, enabling an authorized local attacker to escalate privileges. The CVSS v3.1 base score is 7.8 (HIGH) with LOCAL and LOW privileges required and no user interaction. Connec...

CVE-2025-64680

CVE-2025-64680 affects Windows DWM Core Library. A heap-based buffer overflow allows an authorized, locally authenticated attacker to escalate privileges. The connected advisories/feeds confirm this CVE is part of Microsoft Windows vulnerability fixes and that Windows updates (KBs and security gu...

CVE-2026-21243

CVE-2026-21243 concerns a null pointer dereference in Windows LDAP (LDAP service), enabling a network-auth independent attacker to cause denial of service. The CVSSv3.1 base score is 7.5 (Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Impact: Av...

CVE-2026-32087

Summary (CVE-2026-32087): Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) on Windows can allow an authorized, locally authenticated attacker to elevate privileges. Reported base CVSS v3.1 score: 7.0 (HIGH) with LOCAL attack vector, HIGH impact on confidentiality, integrity, a...

CVE-2026-50669

CVE-2026-50669 is a Windows Telephony Service local privilege-escalation vulnerability caused by concurrent execution over a shared resource without proper synchronization (race condition). The description and connected sources confirm impact as elevation of privileges to local attackers with low...

CVE-2026-54993

CVE-2026-54993 describes a heap-based buffer overflow in Microsoft Windows Media Foundation that could allow a local attacker to execute code on a vulnerable system. The public descriptions in the provided documents identify the affected component as Windows Media Foundation, with the vulnerabili...

CVE-2026-58535

CVE-2026-58535 affects the Windows Remote Desktop Client. The root cause is a use of an uninitialized resource in Windows RDP, enabling an unauthenticated, network-based disclosure of information. Public data from NVD lists CVSS v3.1 base metrics: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base score 7...

CVE-2026-58609

The CVE-2026-58609 entry describes an Out-of-bounds read in the Microsoft Graphics Component that enables local execution of code by an unauthenticated attacker with user interaction. The vulnerability is linked to a local attack vector with high impact to confidentiality, integrity, and availabi...

CVE-2025-62454

CVE-2025-62454 is a heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver that could allow an authorized local attacker to achieve elevated privileges. Connected notes confirm this CVE is mapped to the Windows Cloud Files Mini Filter Driver elevation of privilege vulnerability ...

CVE-2025-62457

CVE-2025-62457 affects the Windows Cloud Files Mini Filter Driver and is described as an out-of-bounds read that enables an authorized attacker to escalate privileges locally. The connected sources corroborate this vulnerability exists in Windows components and list the Cloud Files Mini Filter Dr...

CVE-2025-62472

CVE-2025-62472 affects Windows Remote Access Connection Manager. The issue is described as an elevation of privilege vulnerability caused by use of an uninitialized resource, allowing an authorized local attacker to gain higher privileges. Microsoft’s December 2025 updates (e.g., KB5071501/KB5071...

CVE-2025-62572

CVE-2025-62572 is a Windows vulnerability in Application Information Services causing an out-of-bounds read that enables local privilege elevation for an authenticated attacker. Affected products are Windows components (notably Windows client/server SKUs referenced in the Microsoft advisories). M...

CVE-2026-20821

CVE-2026-20821 is a Windows Remote Procedure Call information disclosure vulnerability that could allow a local attacker to obtain sensitive data. The available description confirms an information disclosure resulting from RPC handling, but the connected documents do not provide vendor-specific p...

CVE-2026-20848

CVE-2026-20848 describes a race condition in Windows SMB Server caused by concurrent execution over a shared resource with improper synchronization. This vulnerability could allow an authorized attacker to elevate privileges over the network. Connected documents confirm the issue is categorized a...

CVE-2026-24293

CVE-2026-24293 describes a null pointer dereference in the Windows Ancillary Function Driver for WinSock that enables an authorized, local attacker to elevate privileges. The vulnerability is identified in Microsoft’s advisory ecosystem and is tracked across multiple feeds (NVD/NCSC/ENISA EUVD) w...

CVE-2026-49807

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-54996

CVE-2026-54996 describes a race condition in the Windows USB Print Driver caused by concurrent access to a shared resource with improper synchronization. An authorized local attacker could elevate privileges. The entry provides CVSS 3.1 base score 7.0 (High) with local attack vector, high impact ...