CVE-2025-26687

Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Office Windows 10 1507 and 23 more

CVE-2026-25180

Windows Graphics Component Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Office Office For Android and 30 more

CVE-2026-24285

Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Copilot Office Office For Android and 28 more

CVE-2026-40407

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2022-26934

Windows Graphics Component Information Disclosure Vulnerability

Windows Graphics Component Information Disclosure Vulnerability

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office Long Term Servicing Channel and 25 more

CVE-2023-29335

Microsoft Word Security Feature Bypass Vulnerability

Microsoft Word Security Feature Bypass Vulnerability

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office Long Term Servicing Channel and 13 more

CVE-2025-21338

GDI+ Remote Code Execution Vulnerability

GDI+ Remote Code Execution Vulnerability

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Office Office Long Term Servicing Channel Office Macos and 26 more

CVE-2026-41089

Windows Netlogon Remote Code Execution Vulnerability

Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 78.3% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2012 Windows Server 2012 (server Core Installation) Windows Server 2012 R2 and 12 more

CVE-2026-41095

Data Deduplication Elevation of Privilege Vulnerability

Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2012 Windows Server 2012 R2 Windows Server 2012 R2 and 11 more

CVE-2026-40382

Windows Telephony Service Elevation of Privilege Vulnerability

Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-40398

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS 2.7% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-40403

Windows Graphics Component Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-40406

Windows TCP/IP Information Disclosure Vulnerability

Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-40408

Windows WAN ARP Driver Elevation of Privilege Vulnerability

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-40410

Windows SMB Client Elevation of Privilege Vulnerability

Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 26 more

CVE-2026-35424

Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-35423

Windows 11 Telnet Client Information Disclosure Vulnerability

Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-35422

Windows TCP/IP Driver Security Feature Bypass Vulnerability

Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-35421

Windows GDI Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 27 more

CVE-2026-35420

Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2012 Windows Server 2012 (server Core Installation) Windows Server 2012 R2 and 12 more