CVE-2026-124194ModerateCVSS 6.5Exploited (zero-day)KEVPublic exploitSpoofing A spoofing vulnerability in Microsoft Office Outlook, the mail client of Microsoft 365 Apps and Office LTSC, allows an unauthorized attacker to spoof content over the network. The user interface does not warn users before potentially unsafe actions. According to secondary reporting, opening a crafted message file can make Outlook connect to an attacker-controlled location and leak the user's NTLMv2 hash. Microsoft and CISA report active exploitation, and CISA lists the flaw in its KEV catalog.
Microsoft Office · MSRC
Microsoft Entra Device Registration, part of the cloud identity service Microsoft Entra ID, contains an authorization bypass caused by a user-controlled key (CWE-639). According to the CVE record and the NVD vector (CVSS 3.1: 10.0, Critical), an unauthenticated attacker over the network can elevate privileges without user interaction. NVD analysis is pending and the Microsoft advisory could not be retrieved, so affected services, fix status and exploitation status are unconfirmed.
Azure · MSRC
A heap-based buffer overflow in the Windows Xbox Live Networking Service allows an unauthenticated attacker to execute code over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no login and no user interaction are needed. The affected builds and fixed versions come from the CVE record published by Microsoft; the exact KB numbers and the component's default installation status could not be verified.
Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131096 KB5131087 KB5132061 · MSRC
The Windows Search Component is affected by an out-of-bounds write (CWE-787). According to the CVE description, an unauthenticated attacker can execute code over a network, without user interaction. The CVSS 3.1 score of 9.8 is provided in the CVE record but has not yet been confirmed by the vendor advisory, and the vendor's MSRC page could not be retrieved.
Windows, Windows ESU (Extended Security Updates) · KB5132061 KB5132043 KB5131085 KB5131090 · MSRC
A critical out-of-bounds write vulnerability in the Windows LDAP component allows an unauthenticated attacker to execute code over the network. The CVSS v3.1 base score is 9.8 (CWE-787). Windows LDAP runs on domain controllers and other Windows servers, so a successful attack could compromise authentication across the whole network. At publication the NVD record was still awaiting analysis, and details may change.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A missing authentication check for a critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over the network. The CVSS v3.1 base score is 9.8 (critical), and the CWE is CWE-306. According to the CVE record, the flaw affects Azure OpenAI builds from 1.0.0 up to but not including hyena-infra-build-official/20260923.14. The vendor advisory could not be verified, so the fix status, the technical details and the exact impact are not confirmed.
Azure · MSRC
A heap-based buffer overflow in Microsoft Office Outlook (CVSS 8.8, CWE-122) allows an unauthorized attacker to execute code over the network. Exploitation requires the victim to interact, for example by opening a crafted message file. Microsoft's CNA record lists affected builds of Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, and the fix is part of the November 2026 Patch Tuesday.
Microsoft Office · MSRC
A use-after-free flaw in Microsoft Office Word allows code execution on a victim's system. A remote attacker can exploit it by sending a specially crafted document, so the attack needs no privileges but requires the user to open the file. The CVSS base score is 8.8 (High) and CISA SSVC rates total technical impact.
Microsoft Office · MSRC
Microsoft Office Word contains a use-after-free memory flaw (CWE-416) that allows an unauthenticated attacker to execute code over a network. The attacker needs a user to open a crafted Word file, for example one delivered as an email attachment or download. The vendor and the CISA SSVC assessment rate the impact as total, but no active exploitation or public proof of concept has been found.
Microsoft Office · MSRC
A use-after-free weakness (CWE-416) in Microsoft Office Outlook allows an unauthorized attacker to execute code over the network. According to secondary reports, the attacker would need to send a specially crafted message file and trick the recipient into opening it, so user interaction is required. Exploitation is not indicated for this CVE, and the impact is rated total (CVSS 3.1 base score 8.8).
Microsoft Office · MSRC
A heap-based buffer overflow in Microsoft Word allows an unauthenticated attacker to execute code over the network. Exploitation requires a user to interact, typically by opening a crafted document received by email or download. The CVSS 3.1 score is 8.8 (High), and NVD analysis was still pending at publication.
Microsoft Office · MSRC
A use-after-free vulnerability (CWE-416) in Microsoft Office allows an unauthenticated remote attacker to execute code. Exploitation requires a user to interact, typically by opening a malicious document delivered by email or download. The CVSS base score is 8.8 (HIGH), with high impact on confidentiality, integrity and availability.
Microsoft Office · MSRC
Microsoft Office Outlook contains a remote code execution vulnerability caused by the release of an invalid pointer or reference (CWE-763). According to the CVE record, an unauthenticated attacker can execute code over a network, provided a user interacts with a crafted message; the CVSS 3.1 base score is 8.8. Microsoft fixed the flaw in the November 2026 Patch Tuesday updates. At the time of research it was not marked as exploited in the wild and no public proof of concept was found.
Microsoft Office · MSRC
A heap-based buffer overflow in the Windows Raw Image Extension allows an attacker to execute code over a network. According to the CVSS vector, exploitation requires user interaction, for example opening, previewing or downloading a malicious image file. The CVSS base score is 8.8 (High) with high impact on confidentiality, integrity and availability.
Windows · MSRC
Incorrect authorization (CWE-863) in Active Directory Domain Services (AD DS) allows an authenticated attacker to execute code over the network. AD DS runs on Windows Server domain controllers and governs identity and access for domain-joined systems. The CVSS v3.1 base score is 8.8 (High), with high impact on confidentiality, integrity and availability. Exploitation requires network access and any valid low-privilege domain account.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
Improper input validation in Microsoft Exchange Server allows an authenticated attacker to execute code over the network. The CVSS vector requires low privileges and no user interaction, so any valid account on the server may be enough. Microsoft lists only Exchange Server Subscription Edition RTM as affected, and the CVE is not yet analysed by NVD.
Server software (Exchange, SharePoint …) · KB5133453 · MSRC
A stack-based buffer overflow in Microsoft Excel, part of Microsoft Office, can be exploited by an unauthorized attacker over a network. Exploitation requires a user to open a crafted file, which makes email and file sharing the most likely attack paths. A successful attack could lead to code execution with high impact on confidentiality, integrity and availability. Microsoft rates the flaw as Critical in some release notes, while the CVSS base score is 8.8 (High).
Microsoft Office · KB5002946 · MSRC
A double free memory corruption flaw in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. Exploitation requires a user to interact with the attack, most likely by opening a crafted Office file. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability on the affected system.
Microsoft Office · KB5002946 · MSRC
A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a crafted file, for example one received by email or downloaded from the internet. The CVE is rated CVSS 8.8, was published on 2026-11-10, and NVD analysis is still pending.
Microsoft Office · KB5002946 · MSRC
A heap-based buffer overflow in Microsoft Excel, part of the Office suite, allows an unauthenticated remote attacker to execute code. Per the CVSS vector, the attack needs no privileges but requires a user to interact, for example by opening a crafted file received by email or via file sharing. The affected builds differ per Office edition, including Microsoft 365 Apps, LTSC releases and Mac versions, and Office Online Server may also be affected.
Microsoft Office · KB5002946 · MSRC
A double free vulnerability (CWE-415) in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The attack requires a user to open a malicious workbook, for example one received by email or downloaded from the internet. The vendor-assigned CVSS v3.1 base score is 8.8 (High). No exploitation in the wild and no public proof of concept were found at the time of publication.
Microsoft Office · MSRC
A stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network (CVSS 8.8). The attack requires a user to open a crafted file, such as an Excel attachment or download, and no privileges are needed. Successful exploitation would give the attacker full control over the affected user's system. No exploitation is known at publication.
Microsoft Office · KB5002946 · MSRC
Microsoft Office Excel contains a use-after-free memory corruption flaw (CWE-416). If a user opens a specially crafted Excel file, for example from an email or a download, an unauthorized attacker may be able to execute code in the context of the signed-in user. No authentication is required, but user interaction is. Microsoft released security updates on 10 November 2026.
Microsoft Office · KB5002946 · MSRC
A use-after-free memory flaw in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The attacker needs the victim to open a crafted file, for example an email attachment or a file from a shared drive or web link. Successful exploitation runs code with the rights of the user, so accounts with local admin rights carry higher risk.
Microsoft Office · KB5002946 · MSRC
A heap-based buffer overflow in the Windows Graphic Fonts component allows an unauthorized attacker to execute code over a network. The attack requires a user to take an action, such as opening a manipulated document or visiting a manipulated page. The CVSS base score is 8.8 (High), and the CISA SSVC assessment reports technical impact as total.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A heap-based buffer overflow in Microsoft Office allows an unauthorized remote attacker to execute code on the affected machine. The attack requires that a user opens or processes crafted content, for example a document received by email or downloaded from the internet. The CVSS base score is 8.8 (High), with full impact on confidentiality, integrity and availability of the local system. Microsoft reports no exploitation in the wild and no public proof-of-concept code at the time of writing.
Microsoft Office · MSRC
Microsoft PowerPoint in Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 contains a heap-based buffer overflow (CWE-122). A remote attacker without authentication can execute code over the network, which in practice could give full control over the affected user's session and workstation. The attack requires the user to take an action, such as opening a crafted presentation, but no privileges are needed. The CVSS base score is 8.8 (High).
Microsoft Office · MSRC
A heap-based buffer overflow (CWE-122) in Microsoft Excel, part of Microsoft 365 Apps, Office LTSC and Office for Mac, allows an unauthorized attacker to execute code over the network. The attacker needs a victim to open a crafted workbook, for example one received by email or downloaded from the internet. Successful exploitation would run code in the user's context with high impact on confidentiality, integrity and availability (CVSS 3.1: 8.8).
Microsoft Office · KB5002946 · MSRC
A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The attack requires that a user opens a manipulated file, for example a spreadsheet received by email or download. No privileges and no internet-facing service are needed, and a successful attack could compromise the user's session and data.
Microsoft Office · KB5002946 · MSRC
Microsoft Office Excel contains a heap-based buffer overflow that allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a specially crafted workbook, typically received by email or as a downloaded file, and interacts with affected features. The code runs in the context of the signed-in user. Microsoft has published security updates.
Microsoft Office · KB5002946 · MSRC
A null pointer dereference in the Microsoft Malware Protection Engine, which powers Microsoft Defender, allows an unauthenticated attacker to execute code over a network. According to the CVE record, user interaction is required, for example when the scanning engine processes attacker-supplied content. The engine is present on most Windows endpoints, so SMEs with unmanaged or offline systems are most at risk. Microsoft's own severity rating is not yet confirmed; the CVE record gives CVSS 8.8.
System Center and Defender · MSRC
A heap-based buffer overflow in the Windows Network Connected Devices Auto-Setup Service allows an unauthenticated attacker on the same adjacent network to execute code. No user interaction is required, and the CVSS score is 8.8 (High). The service is not internet-facing, and on Windows 10 it only runs when a user, an application or another service requests it, so exposure depends on whether it is active.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131087 · MSRC
Microsoft Windows Hyper-V contains an untrusted pointer dereference that allows a local attacker to elevate privileges. The attacker needs local access and already has high privileges, typically administrator rights. The CVSS 3.1 base score is 8.2 (High) and the vector includes a scope change, meaning the impact crosses a security boundary.
Windows · KB5132059 · MSRC
The Queue Manager component of Windows Message Queuing (MSMQ) in supported Windows 10, Windows 11 and Windows Server versions contains a heap-based buffer overflow (CWE-122). An unauthenticated attacker on the network can execute code with high impact on confidentiality, integrity and availability, but attack complexity is high. Only systems with MSMQ installed are affected.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A use-after-free flaw (CWE-416) in the Windows Network Address Translation (NAT) component allows an unauthenticated attacker to execute code over the network. The CVSS base score is 8.1, but attack complexity is rated high and no user interaction or credentials are needed. The main risk is for Windows hosts with the NAT function enabled and reachable from untrusted networks, such as servers acting as routers or internet gateways.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A heap-based buffer overflow in Windows Message Queuing (MSMQ) allows an unauthenticated attacker on the network to execute code. The CNA record rates the attack complexity as high, so the attack requires specific conditions. MSMQ is an optional Windows feature, so systems without it installed are not affected.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A flaw in the Windows Remote Procedure Call (RPC) Runtime, a library used by RPC servers and Windows services, fails to verify a cryptographic signature correctly (CWE-347). An unauthenticated attacker on the network can exploit it to execute code, with a CVSS 3.1 base score of 8.1. Exploitation requires high attack complexity, and no user interaction is needed. The vendor has published patches as part of the November 2026 Patch Tuesday.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
Windows Deployment Services (WDS), a Windows Server role, contains a use-after-free flaw (CWE-416). An unauthorized attacker on the network could execute code on an affected server. The CVSS vector rates attack complexity as high and assumes no privileges and no user interaction, but a vendor patch review suggests a low-privileged account may be needed; this is not yet confirmed by Microsoft.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131090 KB5131080 · MSRC
Microsoft's Windows Schannel TLS component contains an observable timing discrepancy (CWE-208). According to the description, an unauthenticated attacker on the network could execute code on affected Windows systems. The attack complexity is high (AC:H), and the CVSS 3.1 base score is 8.1. NVD analysis was still pending at publication.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A race condition (CWE-362, CWE-416) in Windows Internet Information Services (IIS) allows an attacker to execute code remotely over the network. The CVE record rates the CVSS score as 8.1 with high impact on confidentiality, integrity and availability. The CVE record lists no privileges required, but the attack complexity is high and the NVD analysis is still pending.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A double free vulnerability (CWE-415) in the Windows CredSSP component allows a remote attacker to execute code on affected Windows systems. CredSSP handles authentication for remote sessions, such as Remote Desktop with Network Level Authentication and remote management. The CVE description states that no privileges or user interaction are required, but the attack complexity is rated high.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A double free vulnerability (CWE-415) in Windows Message Queuing (MSMQ) allows an unauthenticated attacker to execute code over the network. Exploitation is rated high complexity, and the CVSS base score is 8.1 according to the CNA. The flaw only matters on systems where MSMQ is installed and reachable from untrusted networks.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A double free vulnerability in Windows Message Queuing (MSMQ) allows an unauthorized attacker to execute code remotely over the network. The CVSS vector rates the attack complexity as high and requires no user interaction. Systems without MSMQ installed are not affected, and the MSMQ feature is not enabled by default. Conflicting information exists on whether a low-privileged account is required, so the worse case should be assumed until Microsoft confirms it.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A use-after-free vulnerability (CWE-416) in the Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over the network. No privileges or user interaction are required, but the attack complexity is high. Message Queuing is an optional Windows component, so exposure depends on whether it is installed and reachable.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A heap-based buffer overflow in the Windows Hyper-V virtualization component allows an authorized local attacker to elevate privileges. Successful exploitation can affect confidentiality, integrity and availability, and the scope changes beyond the vulnerable component. The attacker needs local access and valid low-privileged credentials, and attack complexity is high. Systems without the Hyper-V role are not affected.
Windows, Windows ESU (Extended Security Updates) · KB5131090 KB5131096 KB5131080 KB5131077 · MSRC
A time-of-check time-of-use race condition in Windows Hyper-V allows an authorized local attacker to elevate privileges. The attacker must already have a foothold in a guest VM or on the local system and must win a race condition. Hyper-V is not reachable from the internet, but the risk is relevant for hosts with shared or untrusted guest VMs and for endpoints with VBS, Windows Sandbox or WSL2 enabled.
Windows, Windows ESU (Extended Security Updates) · KB5131096 KB5131090 KB5131087 KB5132061 · MSRC
A heap-based buffer overflow in the Windows Trusted Platform Module (TPM) component allows an authorized local attacker to elevate privileges. The attacker needs local code execution or a logon with a low-privileged account first, so the flaw is not directly reachable from the internet. Successful exploitation could lead to full loss of confidentiality, integrity and availability on the affected host.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
A double free vulnerability in Windows Remote Desktop Services allows an authorized local attacker to elevate privileges. The attacker needs a local, low-privileged account and must win a race condition. The flaw is not reachable from the internet, but multi-user RDS session hosts and terminal servers are at greatest risk.
Windows, Windows ESU (Extended Security Updates) · KB5131291 KB5131085 KB5131090 KB5131080 · MSRC
A heap-based buffer overflow in the Windows Graphics Kernel allows an authorized local user with low privileges to elevate privileges on the affected system. Microsoft rates exploitation as high complexity and requires that the affected virtual machine has multiple assigned graphics adapters with differing configurations. An attacker therefore needs prior code execution or a logon on the machine. CVSS base score is 7.8; Microsoft reports no public exploitation at release.
Windows, Windows ESU (Extended Security Updates) · KB5131085 KB5131096 KB5131090 KB5131087 · MSRC
A heap-based buffer overflow in the Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. Exploitation has high attack complexity and requires user interaction, such as opening or previewing a crafted media file. The CVSS 3.1 score is 7.5 (High), while the MSRC page lists the maximum severity as Critical, so the update should be treated as high priority.
Windows, Windows ESU (Extended Security Updates), Microsoft Office · KB5131291 KB5131085 KB5131096 KB5131090 · MSRC
