[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-85900 | 13 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Fix |
| CVE-2026-85901 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85902 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85869 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85870 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85871 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85872 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85873 | 13 Oct 2026 | CVSS 6.5 | Microsoft Skype for Business Server 2015 CU13Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-85874 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally. | |
| CVE-2026-85863 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85864 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper privilege management in Python allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85865 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-85866 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1809Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information… | |
| CVE-2026-85867 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85868 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85856 | 13 Oct 2026 | CVSS 7.1 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to execute code over an adjacent network. | |
| CVE-2026-85857 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. | |
| CVE-2026-85858 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85859 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to deny service over a network. | |
| CVE-2026-85860 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85861 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85849 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges… | |
| CVE-2026-85850 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 26H1Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85851 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85852 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. | |
| CVE-2026-85853 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85854 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85855 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85841 | 13 Oct 2026 | CVSS 6.6 | Microsoft Windows 10 Version 1607Use after free in Windows DHCP Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-85842 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85843 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85846 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Web Account Manager allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85847 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-85848 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85833 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85834 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85835 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 Version 24H2Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally. | |
| CVE-2026-85836 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85837 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85840 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network. | |
| CVE-2026-85828 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85829 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85830 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally. | |
| CVE-2026-85831 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to disclose information locally. | |
| CVE-2026-85832 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85822 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85823 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85824 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85825 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85826 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85827 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85815 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-85816 | 13 Oct 2026 | CVSS 5.7 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disclose information over an adjacent network. | Fix |
| CVE-2026-85817 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-85818 | 13 Oct 2026 | CVSS 9.0 | Microsoft Windows 11 version 23H2Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. | Fix |
| CVE-2026-85820 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85821 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-85808 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-85809 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | Fix |
| CVE-2026-85810 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85811 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network. | Fix |
| CVE-2026-85812 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 21H2Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-85814 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-85802 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85803 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85804 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85805 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network. | Fix |
| CVE-2026-85806 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-85807 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85795 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Text Services Framework allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85796 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Numeric truncation error in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85797 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-85798 | 13 Oct 2026 | CVSS 7.2 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. | Fix |
| CVE-2026-85799 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-85800 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85790 | 13 Oct 2026 | CVSS 5.9 | Microsoft Security Advisory CVE-2026-85790 - .NET Information DisclosureUse after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-85791 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85792 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | Fix |
| CVE-2026-85793 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose… | Fix |
| CVE-2026-85794 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-85372 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85373 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85374 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-85375 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85376 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85377 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85367 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85368 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85369 | 13 Oct 2026 | CVSS 8.2 | Microsoft Windows 10 Version 21H2Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85370 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in WebDAV allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85371 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85361 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85362 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85363 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code ExecutionInteger overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-85364 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85365 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85366 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85355 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges… | |
| CVE-2026-85356 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85357 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to… |
Page 6 of 19