Microsoft Windows 11 26H1 vulnerabilities

CVE-2026-70578 [HIGH] CWE-122 CVE-2026-70578: Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate priv Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally.

CVE-2026-69468 [HIGH] CWE-122 CVE-2026-69468: Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an authorized attacker Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-50472 [HIGH] CWE-122 CVE-2026-50472: Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges loca Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

CVE-2026-83939 [HIGH] CWE-822 CVE-2026-83939: Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

CVE-2026-48575 [HIGH] CWE-693 CVE-2026-48575: Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-48570 [HIGH] CWE-693 CVE-2026-48570: Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-48568 [HIGH] CWE-693 CVE-2026-48568: Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-45588 [HIGH] CWE-693 CVE-2026-45588: Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-32071 [HIGH] CWE-476 CVE-2026-32071: Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an una Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

CVE-2026-69710 [HIGH] CWE-362 CVE-2026-69710: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.

CVE-2026-58529 [HIGH] CWE-125 CVE-2026-58529: Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network.

CVE-2026-27921 [HIGH] CWE-362 CVE-2026-27921: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

CVE-2026-69452 [HIGH] CWE-416 CVE-2026-69452: Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privile Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.

CVE-2026-69451 [HIGH] CWE-416 CVE-2026-69451: Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privil Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges over a network.

CVE-2026-68835 [HIGH] CWE-416 CVE-2026-68835: Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileg Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.

CVE-2026-69358 [HIGH] CWE-908 CVE-2026-69358: Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network.

CVE-2026-100201 [HIGH] CWE-122 CVE-2026-100201: Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevat Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.

CVE-2026-100203 [HIGH] CWE-122 CVE-2026-100203: Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privil Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.

CVE-2026-85791 [HIGH] CWE-122 CVE-2026-85791: Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.

CVE-2026-41108 [HIGH] CWE-122 CVE-2026-41108: Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privile Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.