Microsoft Windows 11 26H1 vulnerabilities

CVE-2026-25167 [HIGH] CWE-416 CVE-2026-25167: Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privile Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

CVE-2026-32156 [HIGH] CWE-416 CVE-2026-32156: Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to execute code locally.

CVE-2026-69340 [HIGH] CWE-122 CVE-2026-69340: Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.

CVE-2026-35422 [MEDIUM] CWE-288 CVE-2026-35422: Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized atta Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.

CVE-2026-83855 [HIGH] CWE-191 CVE-2026-83855: Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to de Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.

CVE-2026-83843 [HIGH] CWE-125 CVE-2026-83843: Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker t Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

CVE-2026-24293 [HIGH] CWE-476 CVE-2026-24293: Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attac Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-69328 [HIGH] CWE-426 CVE-2026-69328: Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.

CVE-2026-69587 [HIGH] CWE-476 CVE-2026-69587: Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service ov Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

CVE-2026-69881 [HIGH] CWE-476 CVE-2026-69881: Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service ov Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

CVE-2026-84001 [HIGH] CWE-125 CVE-2026-84001: Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny servic Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network.

CVE-2026-83989 [HIGH] CWE-125 CVE-2026-83989: Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to deny service over a network.

CVE-2026-49787 [HIGH] CWE-770 CVE-2026-49787: Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized atta Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

CVE-2026-50496 [HIGH] CWE-125 CVE-2026-50496: Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.

CVE-2026-54119 [HIGH] CWE-835 CVE-2026-54119: Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unautho Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network.

CVE-2026-70104 [HIGH] CWE-822 CVE-2026-70104: Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to ele Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

CVE-2026-88118 [HIGH] CWE-122 CVE-2026-88118: Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an a Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

CVE-2026-102202 [HIGH] CWE-59 CVE-2026-102202: Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an auth Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

CVE-2026-23673 [HIGH] CWE-125 CVE-2026-23673: Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

CVE-2026-33838 [HIGH] CWE-415 CVE-2026-33838: Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.