[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-85358 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85359 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85341 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85342 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85343 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85352 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85353 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-85354 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85334 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-85336 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. | |
| CVE-2026-85337 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-85338 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85339 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | |
| CVE-2026-85340 | 13 Oct 2026 | CVSS 7.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85329 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to… | |
| CVE-2026-85331 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information over a network. | |
| CVE-2026-85332 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85333 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized… | |
| CVE-2026-85327 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85328 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85319 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service… | |
| CVE-2026-85320 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Use of uninitialized resource in Windows Print Spooler Components allows an authorized attacker to disclose information locally. | |
| CVE-2026-85321 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows Server 2012 R2Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service… | |
| CVE-2026-85322 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a… | |
| CVE-2026-85323 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 10 Version 1607Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network. | |
| CVE-2026-85324 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a… | |
| CVE-2026-84017 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-84018 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-84019 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-84020 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-85318 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-84011 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 version 23H2Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally. | Fix |
| CVE-2026-84012 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-84013 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-84014 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-84015 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-84016 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83933 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 21H2Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose… | |
| CVE-2026-83934 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-83935 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-84007 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows Server 2012Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attacker to disclose information over a network. | Fix |
| CVE-2026-84008 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-84008 - .NET Denial of ServiceInefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-84009 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1809Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally. | Fix |
| CVE-2026-83927 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83928 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-83929 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-83930 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83931 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | |
| CVE-2026-83932 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83922 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83923 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1809Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-83924 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83925 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally. | |
| CVE-2026-83926 | 13 Oct 2026 | CVSS 4.4 | Microsoft Windows 10 Version 1809Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-83916 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Double free in Windows Error Reporting allows an authorized attacker to execute code locally. | |
| CVE-2026-83917 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83918 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83919 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally. | |
| CVE-2026-83920 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83921 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83910 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-83911 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83912 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83913 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83914 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-83915 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83905 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information… | |
| CVE-2026-83906 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 11 version 23H2Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | |
| CVE-2026-83907 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 21H2Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information… | |
| CVE-2026-83908 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Release of invalid pointer or reference in RPC Runtime allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83909 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to… | |
| CVE-2026-83900 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83901 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83902 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83903 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83904 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | |
| CVE-2026-83899 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83898 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | |
| CVE-2026-83896 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83897 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to… | Fix |
| CVE-2026-83891 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-83892 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | |
| CVE-2026-83893 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker to… | Fix |
| CVE-2026-83895 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthorized attacker to elevate privileges with a physical attack. | Fix |
| CVE-2026-83884 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | |
| CVE-2026-83885 | 13 Oct 2026 | CVSS 5.6 | Microsoft Windows 11 Version 24H2Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally. | Fix |
| CVE-2026-83886 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83887 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | |
| CVE-2026-83888 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-83889 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-83876 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83877 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Integer overflow or wraparound in HID Parser Library allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83879 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker… | Fix |
| CVE-2026-83881 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83882 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83883 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83872 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Incorrect conversion between numeric types in Windows TCP/IP allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83873 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-83874 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-83875 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. |
Page 7 of 19