| CVE-2026-70572 | Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-73003 | Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-72991 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-77901 | Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-77895 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-78451 | Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack. | medium | |
| CVE-2026-83940 | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-83951 | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-78464 | Time-of-check time-of-use (toctou) race condition in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-78517 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-72973 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-72963 | Use after free in Windows Modern Execution Server allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-71348 | Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack. | medium | |
| CVE-2026-69929 | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network. | high | |
| CVE-2026-69727 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-69626 | Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | medium | |
| CVE-2026-69688 | Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-67631 | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | critical | |
| CVE-2026-69625 | Heap-based buffer overflow in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-69587 | Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-69559 | Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. | medium | |
| CVE-2026-66307 | Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-69865 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. | critical | |
| CVE-2025-47330 | Transient DOS while parsing video packets received from the video firmware. | medium | |
| CVE-2026-20937 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-69295 | Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69374 | Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network. | medium | |
| CVE-2026-69372 | Out-of-bounds read in Windows Network File System allows an authorized attacker to deny service over a network. | medium | |
| CVE-2026-69359 | Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69394 | Heap-based buffer overflow in Windows Audio Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-69461 | Stack-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-69443 | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. | high | |
| CVE-2026-69504 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-69611 | Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-72935 | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | medium | |
| CVE-2026-71343 | Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to execute code locally. | high | |
| CVE-2026-69678 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-69291 | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-68843 | Use after free in Microsoft Office Word allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-25258 | Memory corruption while processing IOCTL calls for escape operations. | high | |
| CVE-2026-34328 | Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-49799 | Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. | medium | |
| CVE-2026-56650 | Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-55139 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | low | |
| CVE-2026-55138 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-50394 | Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-50439 | Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. | critical | |
| CVE-2026-63518 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-63519 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-68793 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | high | |
