CWE-416: Use After Free vulnerabilities

CVE-2026-81971 is a race condition vulnerability in the Windows NTFS component of Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has been assigned a high severity score of 7.0 CVSS v3.1 and affects multiple Windows 10 versions prior to specific fixed releases.

CVE-2026-69596 is a use-after-free vulnerability in the Windows Program Compatibility Assistant Service affecting multiple builds of Windows 10 Version 1607 and later. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7. Microsoft has released official fixes for all affected versions.

CVE-2026-69765 is a use-after-free vulnerability in the Windows Storport Miniport Driver on Microsoft Windows Server 2025. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects Windows Server 2025 versions from 10.0.26100.0 up to but not including 10.0.26100.33650. An official fix has been released by Microsoft to address this issue.

CVE-2026-69736 is a race condition vulnerability in the Windows Credential Manager affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has a high severity rating and has been officially fixed in various Windows 10 builds.

CVE-2026-70237 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. An official fix is available and has been released for all affected versions.

CVE-2026-70236 is a use-after-free vulnerability in the Windows Win32 Kernel Subsystem affecting multiple versions of Microsoft Windows 10, including version 1607 and later builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity with a CVSS score of 7. A fix is officially available in multiple updated Windows 10 builds.

CVE-2026-70209 is a use-after-free vulnerability in the Windows Win32 Kernel Subsystem affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score of 7.0 CVSS v3.1. Official patches have been released to address this issue across all affected versions.

CVE-2026-70230 is a use-after-free vulnerability in the Windows Audio Service on Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity score and has been officially fixed by Microsoft in multiple Windows 10 versions.

CVE-2026-70201 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows Server 2012 and later. This flaw allows an authorized attacker with local access to cause a denial of service condition. The vulnerability has been assigned a medium severity rating with a CVSS score of 5.5. Microsoft has released official patches that address this issue in specific fixed versions.

CVE-2026-70144 is a use-after-free vulnerability in the Windows Win32 Kernel Subsystem affecting Windows 11 version 23H2. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity with a CVSS score of 7. An official fix is available in multiple updated Windows 11 builds.

CVE-2026-70067 is a use-after-free vulnerability in the Windows Win32 Kernel Subsystem affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-70066 is a use-after-free vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. A fix has been officially released by Microsoft for all affected versions.

CVE-2026-70006 is a use-after-free vulnerability in the Remote Desktop Client component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 versions prior to specific fixed releases. A high-severity CVSS 3.1 score of 7.5 has been assigned. Official patches have been released by Microsoft to address this issue.

CVE-2026-70004 is a use-after-free vulnerability in the Remote Desktop Client component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official fixes addressing this issue.

CVE-2026-70012 is a use-after-free vulnerability in the Remote Desktop Client component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has issued official fixes for all affected versions.

CVE-2026-69998 is a use-after-free vulnerability in the Remote Desktop Client component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability has a high severity rating with a CVSS score of 7.5. Microsoft has released official fixes for all affected versions.

CVE-2026-69992 is a use-after-free vulnerability in Microsoft Windows Remote Desktop Services affecting multiple Windows 10 versions including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 7.5 and has been officially fixed in multiple Windows 10 builds.

CVE-2026-69994 is a use-after-free vulnerability in the Remote Desktop Client component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 versions prior to specific fixed releases. Microsoft has issued official fixes for the affected versions.

CVE-2026-69991 is a use-after-free vulnerability in the Remote Desktop Client component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. A high-severity CVSS 3.1 score of 7.5 reflects the potential for remote code execution with high impact on confidentiality, integrity, and availability. Official patches have been released by Microsoft to address this issue.

CVE-2026-69996 is a use-after-free vulnerability in the Remote Desktop Client component of Microsoft Windows 10 Version 1607 and other specified versions. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity rating with a CVSS score of 7.5. Microsoft has released official fixes for all affected versions.