CVE-2026-114165

HEVC Video Extensions Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Hevc Video Extensions Hevc Video Extensions For Licensed Appplications Hevc Video Extensions From Device Manufacturer

CVE-2026-114164

HEVC Video Extensions Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Hevc Video Extensions Hevc Video Extensions For Licensed Appplications Hevc Video Extensions From Device Manufacturer

CVE-2026-105544

.NET Elevation of Privilege Vulnerability

Improper access control in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 14 more

CVE-2026-66801

Microsoft Xbox Remote Code Execution Vulnerability

Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Microsoft Redhat

Products

Microsoft Gdk Multicluster Globalhub

CVE-2026-109467

Azure DevOps Server Remote Code Execution Vulnerability

Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Devops Azure Devops Server 2025

CVE-2026-109463

Windows DNS Remote Code Execution Vulnerability

Deserialization of untrusted data in Windows DNS allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more

CVE-2026-108416

Windows File Server Resource Management Service Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-108415

Windows File Server Resource Management Service Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-108403

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-108424

Windows GDI Information Disclosure Vulnerability

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-108417

Windows Remote Desktop Client Information Disclosure Vulnerability

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 21 more

CVE-2026-108409

Windows Overlay Filter Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-100204

HEIF Image Extensions Remote Code Execution Vulnerability

Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Heif Image Extension

CVE-2026-105590

Windows Active Directory Certificate Services Security Feature Bypass

Improper certificate validation in Windows Active Directory Certificate Services allows an authorized attacker to bypass a security feature over a network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-105589

Windows Wireless Networking Elevation of Privilege Vulnerability

Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more

CVE-2026-105588

Windows DHCP Server Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 and 4 more

CVE-2026-105587

Windows OLE DB Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows OLE DB allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-105586

Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability

Null pointer dereference in Microsoft Windows SCSI Class System File allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more

CVE-2026-105584

Windows Inventory Backup Information Disclosure Vulnerability

Use of externally-controlled format string in Windows Inventory Backup allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 13 more

CVE-2026-105583

Windows DWM Core Library Elevation of Privilege Vulnerability

Release of invalid pointer or reference in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 15 more