Microsoft Windows 11 Version 26H1 vulnerabilities

CVE-2026-50298 [MEDIUM] CWE-190 CVE-2026-50298: Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate p Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-49174 [MEDIUM] CWE-306 CVE-2026-49174: Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

CVE-2026-45658 [MEDIUM] CWE-284 CVE-2026-45658: Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feat Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature locally.

CVE-2026-50299 [MEDIUM] CWE-122 CVE-2026-50299: Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to e Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack.

CVE-2026-50374 [MEDIUM] CWE-416 CVE-2026-50374: Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate pr Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges with a physical attack.

CVE-2026-57097 [MEDIUM] CWE-426 CVE-2026-57097: Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-32170 [MEDIUM] CWE-415 CVE-2026-32170: Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

CVE-2026-21530 [MEDIUM] CWE-415 CVE-2026-21530: Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

CVE-2026-40380 [MEDIUM] CWE-122 CVE-2026-40380: Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execu Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.

CVE-2026-32072 [MEDIUM] CWE-287 CVE-2026-32072: Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoof Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally.

CVE-2026-50418 [MEDIUM] CWE-284 CVE-2026-50418: Improper access control in Windows System allows an unauthorized attacker to bypass a security featu Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-25185 [MEDIUM] CWE-200 CVE-2026-25185: Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows a Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-55000 [MEDIUM] CWE-416 CVE-2026-55000: Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges wit Use after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-58543 [MEDIUM] CWE-362 CVE-2026-58543: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges with a physical attack.

CVE-2026-23670 [MEDIUM] CWE-822 CVE-2026-23670: Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an autho Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

CVE-2026-35423 [MEDIUM] CWE-125 CVE-2026-35423: Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a n Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.

CVE-2026-45595 [MEDIUM] CWE-693 CVE-2026-45595: Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to by Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-45608 [MEDIUM] CWE-125 CVE-2026-45608: Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information lo Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information locally.

CVE-2026-49807 [MEDIUM] CWE-200 CVE-2026-49807: Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally.

CVE-2026-50294 [MEDIUM] CWE-497 CVE-2026-50294: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally.