A use-after-free flaw in the Microsoft QUIC transport of Windows 11 and Windows Server allows an unauthenticated remote attacker to execute code. The attacker only needs to send crafted network traffic to an affected service that uses QUIC. The CVSS base score is 9.8 (critical), and the risk depends on whether QUIC services (UDP 443) are enabled and reachable from untrusted networks.
Windows · KB5126655 KB5126653 KB5127648 KB5126646
A heap-based buffer overflow in Microsoft QUIC, the transport implementation used by Windows, .NET and Visual Studio, allows an unauthenticated attacker to execute code over the network. No user interaction or login is required, and the impact is rated total (confidentiality, integrity and availability) with a CVSS score of 9.8. Exposure depends mainly on whether Windows servers or .NET hosts that run QUIC or HTTP/3 services can be reached from untrusted networks.
Windows, Developer tools (.NET, Visual Studio …) · KB5126655 KB5126653 KB5127648 KB5126646
A heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an unauthenticated attacker to execute code over the network. The flaw is triggered when the affected driver processes a specially crafted print job or packet sent to an affected print service. CVSS 3.1 rates it 9.8 (critical) with low attack complexity and no user interaction required, and CISA SSVC rates the technical impact as total.
Windows, Windows ESU (Extended Security Updates) · KB5127648 KB5126646 KB5126835 KB5126836
A heap-based buffer overflow in the Microsoft PostScript Printer Driver of Windows allows an unauthenticated attacker to execute code over the network. The CVSS score is 9.8 (critical). Exploitation requires no user interaction, for example by sending a specially crafted print job or packet to an affected print service.
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651
A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated remote attacker to execute code on the affected system. According to Microsoft's CVE record, the attack requires no privileges and no user interaction, and Microsoft lists the Reading Pane as the trigger vector, so a crafted email may be sufficient. The CVSS base score is 9.8 (Critical). Microsoft has released security updates; no exploitation has been reported so far.
Microsoft Office
A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated attacker to execute code remotely over the network, with a CVSS 3.1 base score of 9.8 (critical). Microsoft's exploitability data rates it as unproven, and it is not publicly disclosed or known to be exploited. Research notes indicate that a crafted email may be triggered in the Reading Pane without user interaction, but Microsoft has not confirmed this preview vector, so the attack conditions remain partly unverified.
Microsoft Office
An untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. According to Microsoft, the Reading Pane (Preview Pane) is an attack vector, so a user may not need to open a malicious document. CVSS 9.8 (Critical); Microsoft and CISA SSVC assess automatable exploitation as possible, but no exploitation has been reported.
Microsoft Office
Microsoft Azure App Service is affected by a missing authentication flaw (CWE-306) in a critical function. An unauthenticated attacker on the network could execute code, which would have a total impact on confidentiality, integrity and availability. Microsoft states that it has fully mitigated the issue on its platform, so customers have no action to take.
Azure
Microsoft Dataverse, the data platform behind Microsoft business applications, contains a deserialization flaw (CWE-502) that allows deserialization of untrusted data. According to the CVSS vector, an unauthenticated attacker with network access could execute code without user interaction, with a CVSS base score of 9.8. Microsoft states that the vulnerability has already been fully mitigated on its side and that no customer action is required.
Microsoft Dynamics
A stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. The vulnerability is rated critical (CVSS 9.8). Per the research notes, a specially crafted email may trigger code execution through the Preview Pane without the recipient opening or clicking anything; no authentication is required.
Microsoft Office
A use-after-free memory flaw (CWE-416) in Microsoft Office PowerPoint allows an unauthenticated attacker to execute code remotely over a network. Per the CVE record, the attack needs no login and no user privileges, and the CVSS base score is 9.8 (critical). Sources disagree on the attack path: Microsoft describes crafted presentations processed by an Office Online service, while CrowdStrike lists the Preview Pane as a vector, so a crafted file delivered by mail, download or a web-based Office service should be treated as a plausible risk.
Microsoft Office
Microsoft has fixed a use-after-free vulnerability (CWE-416) in the Windows DHCP Server role. An unauthenticated attacker with network access can execute code on the server, and the CVSS score is 9.8 (critical). Microsoft rates exploitation as less likely and lists no public disclosure, but DHCP servers reachable from internal segments should be patched as a priority.
Windows, Windows ESU (Extended Security Updates) · KB5126836 KB5126868 KB5126651 KB5126646
A heap-based buffer overflow in Microsoft Office Outlook allows an unauthenticated attacker to execute code over the network, with a CVSS 3.1 base score of 9.8 (critical). Microsoft's advisory and the research notes indicate that a crafted email, processed through the preview pane, may be enough to trigger it without a click. The NVD record was still awaiting analysis in the sources reviewed, so the official scoring should be verified.
Microsoft Office
A double free weakness (CWE-415) in Microsoft Office Outlook allows an unauthenticated remote attacker to execute code. Microsoft rates it Critical (CVSS 9.8) and describes it as network-reachable with no privileges and no user interaction. According to the advisory text cited in the research notes, simply viewing a crafted message in the Reading Pane could trigger it, so email is the main attack path.
Microsoft Office
A heap-based buffer overflow in the Windows Text Shaping component allows an unauthorized attacker to execute code over a network. The vulnerability is rated CVSS 9.8 (critical), and according to the CVSS vector no authentication or user interaction is required. The attack surface is not identified in the sources, so exposure depends on which service processes untrusted input that reaches text rendering.
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651
Missing authorization in Microsoft Azure SRE Agent allows an authorized attacker with low privileges to elevate privileges over the network. Sources differ on the severity: the CVE data used here lists CVSS 8.1 (scope unchanged), while Microsoft's record lists 9.6 (scope changed), so check NVD before reporting a score. Microsoft states that the fix is applied in the cloud and that no customer action is required. Exploitation needs a valid low-privilege account and no user interaction, and the impact depends on what the agent can access.
Azure
Azure Pipelines, Microsoft's CI/CD platform, contains a command injection flaw (CWE-77) that allows an unauthenticated attacker to execute code over the network. According to the CVSS vector, no privileges or user interaction are needed and the impact on confidentiality and integrity is high. Microsoft documents this CVE as a cloud service issue for which no customer action is required; the scope for self-hosted agents and on-premises Azure DevOps Server is unknown.
Developer tools (.NET, Visual Studio …)
A use-after-free flaw (CWE-416) in Microsoft Office Excel allows an attacker to execute code over a network. The attack requires a user to open a crafted Excel file, typically delivered by email or download, and the attacker needs no privileges. CVSS 3.1 base score is 8.8 (High).
Microsoft Office
A heap-based buffer overflow in Microsoft Office Excel, included in Microsoft 365 Apps, Office LTSC 2021 and 2024, Office for Mac and Office Online Server, allows an unauthenticated attacker to execute code over a network. Exploitation requires a user to open a specially crafted Excel file, typically delivered by email or download. Code runs with the rights of the user, so systems where Excel runs with elevated privileges are at greater risk.
Microsoft Office · KB5002928
Microsoft Office Excel contains a use-after-free flaw (CWE-416) that allows an unauthorized attacker to execute code over the network. Exploitation requires that a user opens a crafted Excel file, for example one received by email or downloaded from the internet. Successful exploitation would run code in the context of the user, with high impact on confidentiality, integrity and availability (CVSS 8.8). No public proof of concept and no confirmed in-the-wild exploitation are known.
Microsoft Office
A heap-based buffer overflow in the Windows Media Video Decoder allows an unauthenticated attacker to execute code remotely (CVSS 8.8, CWE-122). User interaction is required, for example by opening or processing crafted media content. Successful exploitation would give the attacker the rights of the logged-in user and could lead to full control of the affected system.
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651
A use-after-free vulnerability (CWE-416) in Windows Hyper-V allows an authenticated, low-privileged user to execute code locally. According to Action1, an attacker running code inside a guest VM can affect the Hyper-V host, which could impact all VMs on that host. Exploitation requires an existing foothold inside a guest VM and is not directly reachable from the internet.
Windows, Windows ESU (Extended Security Updates) · KB5126651 KB5126655 KB5126657 KB5126646
A out-of-bounds read in the Windows Text Shaping component affects several Windows 10, Windows 11 and Windows Server versions, including Windows 10 1607 and Windows Server 2016. An unauthenticated attacker who can get a user to open crafted content, such as a document, file or web page, may execute code remotely. The CVSS 3.1 base score is 8.8 (High) and the vector requires user interaction, while Microsoft rates the flaw Critical.
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651
A heap-based buffer overflow in Microsoft Office Visio, part of Microsoft 365 Apps and Office LTSC 2021/2024, allows an unauthorized attacker to execute code over a network. No privileges are required, but a user must interact, for example by opening a malicious Visio file received by email, download or shared drive. The CVSS base score is 8.8 (High).
Microsoft Office
Microsoft Office Visio contains a heap-based buffer overflow that allows code execution over a network. An attacker could run code on the victim's computer, which CVSS rates as a total impact on confidentiality, integrity and availability. The attack requires that a user opens a crafted file, so email attachments and shared files are the main paths.
Microsoft Office
Microsoft Office Visio contains a heap-based buffer overflow that allows remote code execution. Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024 are affected. An unauthorized attacker can execute code over the network, but only if a user opens a specially crafted file, for example one received by email or downloaded from the internet. Microsoft released fixes on October 13, 2026.
Microsoft Office
An out-of-bounds read in Microsoft Excel, part of Microsoft 365 Apps and Office LTSC, allows remote code execution. An attacker can deliver a manipulated Excel file by email or download, and the attack needs no account on the target, but a user must open the file (CVSS 8.8, High). Sources disagree on whether this vulnerability is being exploited in the wild.
Microsoft Office · KB5002928
Microsoft's advisory describes an improper access control flaw in Windows Hyper-V. An attacker with low privileges on a Hyper-V guest VM can run a specially crafted application that causes the Hyper-V host operating system to execute arbitrary code. The CVSS vector rates the attack as local with high impact on confidentiality, integrity and availability. No public exploit or proof of concept was found, and CISA SSVC rates exploitation as none.
Windows, Windows ESU (Extended Security Updates) · KB5126657 KB5126655 KB5126653 KB5127648
An integer overflow or wraparound in the Microsoft Windows Codecs Library allows an unauthenticated attacker to execute code over a network. The affected component is the HEVC Video Extensions, which decode H.265 video. Exploitation requires user interaction, for example opening a crafted media file, according to the CVSS vector UI:R.
Windows
A heap-based buffer overflow in Microsoft Word, part of Microsoft 365 Apps and Office LTSC, allows remote code execution. An unauthenticated attacker can trigger it over the network, but a user must open a malicious document or follow a malicious link. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability of the affected system.
Microsoft Office
A stack-based buffer overflow in Microsoft Office Word (CWE-121) allows an unauthorized attacker to execute code over a network. The attack requires the victim to interact, most likely by opening a crafted document such as an email attachment or a download. The CNA rates the flaw CVSS 8.8 (High); a VulDB entry rates it 5.5 (Medium), and the NVD status is inconsistent across sources.
Microsoft Office
A heap-based buffer overflow in the Microsoft PostScript Printer Driver of Windows allows code execution over the network. The attacker needs valid low-privilege access, but no user interaction is required (CVSS 3.1 8.8). Action1 describes the attack as a crafted network request sent to an affected server, so print servers are most at risk.
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651
A flaw in Windows Virtualization-Based Security (VBS) Enclave allows a locally authenticated attacker with low privileges to elevate privileges. The attacker can leak data from the target enclave or run code in its context. The attack is local only and requires an initial foothold on the system, so it is mainly a post-compromise risk. NVD rates it CVSS 8.8 (High).
Windows · KB5126651
A use-after-free flaw in Microsoft Office PowerPoint allows an unauthenticated remote attacker to execute code on a vulnerable system. Exploitation requires that a user opens a specially crafted PowerPoint file or previews it, for example in the Preview Pane. Microsoft rates the CVSS score as 8.8 (High) and exploitation as less likely; no active exploitation is confirmed.
Microsoft Office
A use-after-free vulnerability in the Windows DHCP Client of Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 allows an unauthorized attacker to execute code. The attack requires the attacker to be on the same adjacent network segment as the server and needs no privileges or user interaction. Successful exploitation can lead to full compromise of confidentiality, integrity and availability of the affected server.
Windows, Windows ESU (Extended Security Updates) · KB5126835 KB5126836 KB5126868 KB5126651
Windows GDI+, the graphics component of Windows, contains a stack-based buffer overflow (CWE-121). An unauthenticated remote attacker can execute code, but the attack requires a user to take an action, such as opening a crafted file, image or web content. Several Windows 10, Windows 11 and Windows Server versions are affected, including Windows 10 Version 1607 and Windows Server 2016. NVD rates the vulnerability with CVSS 3.1 8.8 (High).
Windows, Windows ESU (Extended Security Updates) · KB5126651 KB5126655 KB5126657 KB5126646
Windows, Windows ESU (Extended Security Updates) · KB5126657 KB5126653 KB5127648 KB5126646
Microsoft Office PowerPoint contains a use-after-free memory flaw (CWE-416) that allows an unauthenticated attacker to execute code on the affected system over the network. Exploitation requires a user to open or preview a crafted PowerPoint file, for example one received by email. Microsoft rates exploit code maturity as Unproven and no exploitation in the wild is known.
Microsoft Office
Microsoft Windows Raw Image Extension contains a heap-based buffer overflow (CWE-122) that allows remote code execution. The extension is a Windows codec that decodes RAW camera files in programs such as File Explorer and Photos. An unauthenticated attacker can exploit it by getting a victim to open or preview a crafted RAW file, which requires user interaction. Microsoft rates the flaw as Critical with CVSS 8.8.
Windows, Browser (Edge)
Windows, Windows ESU (Extended Security Updates) · KB5127648 KB5126646 KB5126651 KB5126657
Microsoft Windows contains an integer overflow or wraparound in the Virtualization-Based Security (VBS) Enclave component, classified as CWE-190 and CWE-122. An authenticated local user with low privileges can exploit it to gain higher privileges, with a CVSS 3.1 base score of 8.8 (High). Exploitation requires that the attacker can already run code on the system. No exploitation is known and the vulnerability has not been publicly disclosed.
Windows, Windows ESU (Extended Security Updates) · KB5126653 KB5127648 KB5126646 KB5127646
A integer overflow or wraparound in the Windows Raw Image Extension component allows an unauthenticated remote attacker to execute code. Exploitation requires a user to open or render a crafted RAW image file, for example from an email attachment, download or shared folder. The official CVSS score is 8.8 (High), with total impact on confidentiality, integrity and availability.
Windows
A heap-based buffer overflow in the Windows Media Foundation component allows an unauthenticated remote attacker to execute code. Exploitation requires that a user opens or processes a crafted media file, which could arrive by email, download or file share. Windows 10 1809 is affected, along with other Windows 10 and 11 versions and Windows Server 2019, 2022 and 2025. CVSS 8.8 (High) per NVD; Microsoft rates it Critical, and no exploitation is known.
Windows, Windows ESU (Extended Security Updates) · KB5126651 KB5126657 KB5126655 KB5126653
An integer underflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network, with a CVSS score of 8.8. The attack requires that a victim opens a crafted Excel file, for example one received by email or downloaded from the internet. Microsoft 365 Apps, Office LTSC and Office for Mac are affected, and Microsoft rates the flaw as critical. No public exploit code and no exploitation in the wild are known.
Microsoft Office · KB5002928
Microsoft Excel in Microsoft 365 Apps and Office for Mac contains a heap-based buffer overflow (CWE-122, CWE-193). An unauthorized attacker can execute code over a network, but a user must open a manipulated spreadsheet, typically from an email or a download. NVD rates the flaw 8.8 (high), with potential full impact on confidentiality, integrity and availability.
Microsoft Office
A stack-based buffer overflow (CWE-121) in Microsoft Office Excel allows an unauthenticated attacker to execute code over a network. User interaction is required (UI:R), so exploitation typically needs a victim to open a malicious spreadsheet received by email, download or web link. Microsoft rates the maximum severity as Critical, while NVD scores it CVSS 3.1 8.8 (High).
Microsoft Office · KB5002928
A use-after-free vulnerability (CWE-416) in Microsoft Office Excel allows an unauthorized attacker to execute code over the network. Exploitation requires that a user opens or previews a manipulated spreadsheet, for example one delivered by email or download. The flaw is not an internet-facing service. Microsoft has released fixes with the October 2026 updates.
Microsoft Office
A heap-based buffer overflow in Microsoft Office Excel, shipped in Microsoft 365 Apps, Office LTSC, Office for Mac and Office Online Server, allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a crafted file, for example one received by email or downloaded from the web. Microsoft rates the flaw with CVSS 8.8; Microsoft and CISA data show no known exploitation in the wild at the time of publication.
Microsoft Office · KB5002928
A out-of-bounds read in Microsoft Office Excel, part of Microsoft 365 Apps and Office, allows an unauthorized attacker to execute code over a network. Exploitation requires a user to take an action, such as opening a crafted Excel file. Server products in the affected list, including SharePoint Server Subscription Edition and Office Online Server, are also listed, and internet-published instances of these need priority attention. Microsoft's exploit maturity rating is unproven and no known exploitation was found at the time of research.
Microsoft Office · KB5002927 KB5002928
A heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. The attack requires that a user opens a crafted file, for example an Excel document received by email or downloaded from the web. Microsoft has released patches; the CVSS 3.1 base score is 8.8 (High), while Microsoft's page lists a Max Severity of Critical.
Microsoft Office · KB5002928
A heap-based buffer overflow in Microsoft Office Excel allows a remote attacker to execute code. Exploitation requires that a user opens a crafted file, for example an email attachment or a downloaded file. The CVSS base score is 8.8 (High), and Microsoft released fixes on 13 October 2026.
Microsoft Office · KB5002928
A use-after-free flaw (CWE-416) in Microsoft Office Excel allows remote code execution. An unauthenticated attacker can exploit it by sending a malicious Excel file, but a user must open the file (UI:R). The CVSS base score is 8.8 (High); Microsoft rates it Critical.
Microsoft Office
Microsoft Office Excel contains a stack-based buffer overflow (CWE-121) that affects Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office 365 for Mac and Office LTSC for Mac 2021 and 2024. An attacker who persuades a user to open a crafted Excel file could execute code on the affected client. The attack needs no privileges but requires user interaction; the CVSS 3.1 base score is 8.8. Microsoft rates exploit code maturity as Unproven, and CISA SSVC records no exploitation.
Microsoft Office
A heap-based buffer overflow in Microsoft Office Excel, shipped in Microsoft 365 Apps, Office LTSC and Office for Mac editions, allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a manipulated Excel file, for example one received by email or downloaded from the internet. Microsoft rates the flaw Critical, the CVSS base score is 8.8 (High), and no exploitation in the wild or public proof of concept has been reported.
Microsoft Office · KB5002928
