Microsoft Windows 11 Version 26H1 vulnerabilities

CVE-2026-27911 [HIGH] CWE-362 CVE-2026-27911: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

CVE-2026-49787 [HIGH] CWE-770 CVE-2026-49787: Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized atta Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

CVE-2026-54119 [HIGH] CWE-835 CVE-2026-54119: Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unautho Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network.

CVE-2026-50507 [MEDIUM] CWE-306 CVE-2026-50507: Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-45654 [HIGH] CWE-284 CVE-2026-45654: Improper access control in Windows Secure Boot allows an authorized attacker to bypass a security fe Improper access control in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-44812 [HIGH] CWE-190 CVE-2026-44812: Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute c Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVE-2026-44803 [HIGH] CWE-190 CVE-2026-44803: Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute c Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

CVE-2026-57095 [HIGH] CWE-200 CVE-2026-57095: Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally.

CVE-2026-54124 [HIGH] CWE-122 CVE-2026-54124: Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code l Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.

CVE-2026-21232 [HIGH] CWE-822 CVE-2026-21232: Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privilege Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

CVE-2026-25165 [HIGH] CWE-476 CVE-2026-25165: Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate pr Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally.

CVE-2026-23672 [HIGH] CWE-125 CVE-2026-23672: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

CVE-2026-25174 [HIGH] CWE-125 CVE-2026-25174: Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate pr Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate privileges locally.

CVE-2026-32222 [HIGH] CWE-822 CVE-2026-32222: Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate pri Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

CVE-2026-50697 [HIGH] CWE-200 CVE-2026-50697: Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-32076 [HIGH] CWE-125 CVE-2026-32076: Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to elevate pri Out-of-bounds read in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

CVE-2026-34336 [HIGH] CWE-122 CVE-2026-34336: Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

CVE-2026-50441 [HIGH] CWE-822 CVE-2026-50441: Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

CVE-2026-55004 [HIGH] CWE-415 CVE-2026-55004: Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.

CVE-2026-26184 [HIGH] CWE-126 CVE-2026-26184: Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privilege Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.