NtQueryInformation Token function (ntifs.h) Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in NtQueryInformation Token function (ntifs.h) allows an authorized attacker to elevate privileges locally.

In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally.

Microsoft Word Information Disclosure Vulnerability

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Microsoft Excel Information Disclosure Vulnerability

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

Storvsp.sys Driver Denial of Service Vulnerability

Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Excel Remote Code Execution Vulnerability

Windows Core Messaging Elevation of Privileges Vulnerability

Windows Core Messaging Elevation of Privileges Vulnerability

Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally.

Microsoft Office Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

DirectX Graphics Kernel Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.

Windows Kernel Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Microsoft Excel Remote Code Execution Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Windows Hyper-V Denial of Service Vulnerability

Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.

Windows Storage VSP Driver Elevation of Privilege Vulnerability

Improper input validation in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

Windows Hyper-V Denial of Service Vulnerability

Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.

Qsync Central

A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read sensitive portions of memory. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

Windows Fax Service Remote Code Execution Vulnerability

Windows Fax Service Remote Code Execution Vulnerability