CVE-2026-70044

Microsoft Windows Media Foundation Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-83889

Windows DNS Server Remote Code Execution Vulnerability

Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-70071

Role: DNS Server Tampering Vulnerability

Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more

CVE-2026-69954

Windows Overlay Filter Information Disclosure Vulnerability

Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-69940

Windows Client for NFS Information Disclosure Vulnerability

Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-69949

Windows Client for NFS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-69955

Windows Client for NFS Information Disclosure Vulnerability

Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-85903

Windows Domain Name Service Remote Code Execution Vulnerability

Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-88153

Microsoft Office Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 2 more

CVE-2026-88150

Microsoft Office Word Remote Code Execution Vulnerability

Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 10 more

CVE-2026-88185

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 10 more

CVE-2026-69886

Windows Imaging Component Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-69898

Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 17 more

CVE-2026-88076

Windows Installer Elevation of Privilege Vulnerability

Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-88182

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 24 more

CVE-2026-65674

Microsoft SQL Server Remote Code Execution Vulnerability

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2019 (gdr) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 (gdr) and 6 more

CVE-2026-88172

Microsoft Office Excel Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft Office Ltsc 2021 Microsoft Office Ltsc 2024 and 2 more

CVE-2026-96220

Windows Assigned Access Elevation of Privilege Vulnerability

Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 14 more

CVE-2026-88191

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 24 more

CVE-2026-88188

Windows DWM Core Library Elevation of Privilege Vulnerability

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 18 more