Microsoft Office Access contains an out-of-bounds read (CWE-125). According to the CVE record, an unauthorized attacker can execute code over a network, and the CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates that no privileges are needed but user interaction is required. The attack path is not confirmed by the vendor; the most likely scenario, based on the vector, is a user opening a crafted Access file.
Microsoft · Office Access
A heap-based buffer overflow in Microsoft Office Access allows remote code execution. Per the CVSS vector (CVSS 3.1 8.8), an unauthenticated attacker can run code over the network, but the victim must interact, for example by opening a crafted Access file or link. Microsoft has released a fix; Unknown whether exploitation has occurred.
Microsoft · 365 Apps
A heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. User interaction is required, for example by opening a crafted file, and attack complexity is high. If exploited, the code runs with the privileges of the user and can affect confidentiality, integrity and availability.
Microsoft · Office Access
A heap-based buffer overflow in Microsoft Office Access, part of Microsoft 365 Apps, Office LTSC 2021 and Office LTSC 2024, allows an unauthorized attacker to execute code over a network. The attack requires a victim to open a crafted file or follow a crafted link, so user interaction is needed. Successful exploitation could lead to full compromise of confidentiality, integrity and availability on the affected system.
Microsoft · Office Access
A heap-based buffer overflow in Microsoft QUIC, the transport implementation used by Windows, .NET and Visual Studio, allows an unauthenticated attacker to execute code over the network. No user interaction or login is required, and the impact is rated total (confidentiality, integrity and availability) with a CVSS score of 9.8. Exposure depends mainly on whether Windows servers or .NET hosts that run QUIC or HTTP/3 services can be reached from untrusted networks.
Microsoft · Microsoft QUIC
An on-premises Microsoft SharePoint Server Subscription Edition is affected by a deserialization flaw (CWE-502) that allows an authorized attacker to execute code over the network. The CVSS vector assumes low privileges and flags a scope change, so any compromised, phished or self-registered account could be used. The risk is highest if SharePoint is reachable from the internet. The public wording does not state the required privilege level, so the ZDI review advises assuming default permissions.
Microsoft · SharePoint Server
A use-after-free vulnerability (CWE-416) in the Windows Search Component allows privilege elevation on affected Windows 10, Windows 11 and Windows Server systems. The NVD record states that an unauthorized attacker can exploit it over the network, while the Zero Day Initiative review describes an authorized local attacker, so the attack prerequisites are not settled. Microsoft's October 2026 update fixes the issue. No public exploitation was found during research.
Microsoft · Windows Search Component
Incorrect default permissions in Windows Server Update Service (WSUS) allow an authorized local attacker to elevate privileges. The attacker needs a local, low-privileged account on the WSUS server, and exploitation requires a user-interaction step and is rated high complexity. The CVSS 3.1 score is 7.5 (High), with high impact on confidentiality, integrity and availability and a scope change.
Microsoft · Windows Server Update Service
A flaw in Windows Schannel, the built-in TLS/SSL library used by Windows services and applications for encrypted connections, allows an unauthenticated attacker to perform spoofing over the network. NVD rates it CRITICAL with CVSS 3.1 base score 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Exposure is highest for Schannel-based services reachable from the internet, such as RDP gateways, IIS, LDAPS or VPN and web front ends, while internal-only exposure is lower. The CNA description contains a stray 'No cwe for this issue' prefix, which appears to be a data-quality artefact.
Microsoft · Windows
A local elevation of privilege vulnerability in ndis.sys, the Windows kernel driver for the Network Driver Interface Specification (NDIS), allows an attacker to run processes in an elevated context. The driver fails to check the length of a buffer before copying memory into it. An attacker must already have local access and be able to run a malicious application. The CVSS vector lists a network attack vector, but the advisory describes a local attack, so treat it as local.
Microsoft · Windows
A use-after-free flaw in the Windows HID Class Driver allows an unauthorized attacker to elevate privileges. The attack requires physical access to the device and high attack complexity, and no prior privileges are needed. Remote exploitation is not possible. Several Windows 10, Windows 11 and Windows Server versions are affected, including Windows 10 Version 1607 and Windows Server 2016.
Microsoft · Windows
Windows 11 version 26H1 is affected by an out-of-bounds write vulnerability in Windows Schannel, the built-in SSL/TLS component. An unauthenticated attacker on the network can execute code on affected systems without user interaction. The attack complexity is high (AC:H), so exploitation requires specific conditions, and the risk is highest for hosts that terminate TLS for network services.
Microsoft · Windows 11 26H1
A out-of-bounds read (CWE-125) in the Windows Overlay Filter component allows an authenticated local user to elevate privileges. CVSS 3.1 rates it 7.8 (High) with local attack vector, low privileges required and no user interaction. The main risk is multi-user systems such as terminal servers or hosts where untrusted users or services run code. The CNA record and CISA SSVC data show no known exploitation and no public exploit.
Microsoft · Windows
A heap-based buffer overflow in the Windows HID class driver allows an authorized local user to elevate privileges. Successful exploitation could give an attacker high impact on confidentiality, integrity and availability of the system. The attacker needs a local account with low privileges, so the flaw is not reachable over the network and is mainly a second step after another compromise.
Microsoft · Windows
An untrusted pointer dereference in the Windows kernel of Windows 11 version 26H1 allows an attacker to elevate privileges. Exploitation requires physical access to the device and no user interaction or prior privileges. A successful attack can lead to a full compromise of confidentiality, integrity and availability on the affected system.
Microsoft · Windows 11 26H1
Microsoft QUIC, the transport protocol used by HTTP/3 and Windows services such as IIS and SMB over QUIC, initializes an internal variable with an insecure default value (CWE-453). A remote, unauthenticated attacker can bypass a security feature over the network without user interaction. Attack complexity is high, the scope changes, and the impact is mainly on availability with a limited integrity impact.
Microsoft · QUIC
Active Directory Federation Services (AD FS) contains an open redirect (CWE-601). An unauthenticated remote attacker can send a victim a crafted link that redirects the sign-in flow to an untrusted site, which enables spoofing. The victim must interact, for example by clicking the link. The CNA record rates impact as high confidentiality, with no integrity or availability impact.
Microsoft · Active Directory Federation Services (AD FS)
A use-after-free flaw (CWE-416) in the Remote Desktop Client of Windows allows an unauthorized attacker to execute code over the network. The CVSS vector requires no privileges but user interaction, so a user must take an action such as connecting to a malicious host or opening a crafted RDP file. The CNA record lists many Windows 10, 11 and Server builds, while the CPE data covers only Windows 10 1607, so the exact scope must be confirmed against the MSRC build table.
Microsoft · Windows Remote Desktop Client
A code injection flaw (CWE-94) in the AI assistant integration (GitHub Copilot) of Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthenticated attacker to execute code over a network. Exploitation requires user interaction, for example if an attacker places malicious content in front of Copilot agent mode through indirect prompt injection. Microsoft and NVD rate the flaw CVSS 8.8 (High), while VulDB lists a lower score. Visual Studio is fixed in the October 13, 2026 update; a fixed SSMS build has not been confirmed.
Microsoft · Visual Studio
An out-of-bounds read in the Windows IKE Extension, which handles IPsec key negotiation, allows an unauthenticated remote attacker to disclose information. No user interaction or privileges are required. The highest exposure is on Windows hosts that accept IKE traffic from untrusted networks, such as IPsec or VPN gateways. The CVE does not directly enable code execution or denial of service.
Microsoft · Windows IKE Extension
A race condition in the Windows Credential Providers component allows an authorized local user to elevate privileges. The attacker needs a valid local account and must win a timing-dependent race (high attack complexity), so this is a local escalation step rather than a remote entry point. A successful attack can give full control of the affected system, so the flaw is most relevant on shared workstations, terminal servers and systems where untrusted users or malware may gain local access.
Microsoft · Windows
Research and translation in progress – available shortly.
A use-after-free flaw (CWE-416) in the Windows Broadcast DVR User Service allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege account on the affected host and high attack complexity applies, so the flaw is an escalation step after an initial foothold rather than an internet-facing entry point. The NVD score is CVSS 7.0 (HIGH), while VulDB lists 8.8. No exploitation has been reported.
Microsoft · Windows
Research and translation in progress – available shortly.
A deadlock (CWE-833) in the Windows Routing and Remote Access Service (RRAS) allows an unauthenticated attacker on the network to cause a denial of service. Successful exploitation can interrupt routing and remote access functions, such as VPN endpoints running on Windows servers. The vulnerability has a CVSS 3.1 score of 7.5 (High) and affects availability only, with no confidentiality or integrity impact reported.
Microsoft · Windows Routing and Remote Access Service (RRAS)
