Fixes 39 records
Priority CRITICAL 89
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.79622 · Published 2026-05-12 · Fixed in 6.2.9200.26079, 6.3.9600.23181 +5 CWE-121
Priority MEDIUM 41
Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00931 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-416
Priority MEDIUM 41
Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.02665 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-122
Priority MEDIUM 41
Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01187 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-401
Priority MEDIUM 40
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
CVSS 3.1HIGH 8.8· Local · Low privileges · No interaction · EPSS 0.00427 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-122
Priority MEDIUM 40
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00461 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-122
Priority MEDIUM 40
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.01838 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-122
Priority LOW 37
Windows TCP/IP Denial of Service Vulnerability
CVSS 3.1HIGH 7.1· Local · No auth · No interaction · EPSS 0.00331 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-476
Priority LOW 37
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00532 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-122
Priority LOW 36
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00298 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-416
Priority LOW 36
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00304 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-122
Priority LOW 36
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00273 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-191
Priority LOW 36
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00249 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-416
Priority LOW 36
Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00304 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-122
Priority LOW 36
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0032 · Published 2026-05-12 · Fixed in 6.2.9200.26079, 6.3.9600.23181 +5 CWE-122
Priority LOW 36
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.01647 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-416
Priority LOW 36
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00314 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-843
Priority LOW 36
Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00326 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-122
Priority LOW 36
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00249 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-416
Priority LOW 36
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00298 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-190
Priority LOW 36
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00304 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-190
Priority LOW 36
Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00398 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-415
Priority LOW 36
Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00272 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-284
Priority LOW 35
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00205 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-362
Priority LOW 35
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00154 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-362
Priority LOW 35
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.
CVSS 3.1HIGH 7.5· Adjacent network · No auth · No interaction · EPSS 0.00297 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-362
Priority LOW 33
Windows TCP/IP Denial of Service Vulnerability
CVSS 3.1HIGH 7.4· Adjacent network · No auth · No interaction · EPSS 0.00528 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-476
Priority LOW 33
Windows TCP/IP Denial of Service Vulnerability
CVSS 3.1HIGH 7.4· Adjacent network · No auth · No interaction · EPSS 0.00401 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-476
Priority LOW 33
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.0029 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-362
Priority LOW 32
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00226 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-416
Priority LOW 32
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00261 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-416
Priority LOW 32
Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00199 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-415
Priority LOW 32
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.0019 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-362
Priority LOW 32
Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.
CVSS 3.1MEDIUM 6.7· Local · Low privileges · User interaction · EPSS 0.00319 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-415
Priority LOW 32
Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.
CVSS 3.1MEDIUM 6.7· Local · Low privileges · User interaction · EPSS 0.00319 · Published 2026-05-12 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5556.1000 +14 CWE-415
Priority LOW 30
Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.
CVSS 3.1MEDIUM 6.2· Physical · High privileges · No interaction · EPSS 0.00462 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-122
Priority LOW 30
Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00614 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-288
Priority LOW 26
Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00747 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-125
Priority LOW 20
Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.
CVSS 3.1MEDIUM 4.4· Local · Low privileges · No interaction · EPSS 0.00204 · Published 2026-05-12 · Fixed in 10.0.14393.9140, 10.0.17763.8755 +12 CWE-284