CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-83856 is a high-severity out-of-bounds read vulnerability in the Windows Event Logging Service of Microsoft Windows 11 version 23H2. It allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-83797 is a high-severity out-of-bounds read vulnerability in the Windows Partition Management Driver affecting multiple builds of Windows 10 Version 1809 and related updates. This flaw allows an unauthorized attacker to execute code remotely over a network. Microsoft has released official fixes for all affected versions.

CVE-2026-83795 is a heap-based buffer overflow vulnerability in the Windows IKE Extension affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has a high severity rating with a CVSS score of 7.5. Microsoft has released official fixes for all affected versions.

CVE-2026-83794 is an out-of-bounds read vulnerability in the Windows Portable Device MTP Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity with a CVSS score of 5.5. Official fixes have been released for all affected versions.

CVE-2026-83765 is an out-of-bounds read vulnerability in the Windows Desktop Window Manager (DWM) Core Library affecting multiple versions of Microsoft Windows 10. It allows an authorized local attacker to disclose information. The vulnerability has been assigned a medium severity with a CVSS score of 5.5. Official patches have been released to address this issue.

CVE-2026-83747 is an out-of-bounds read vulnerability in Windows Error Reporting affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-83737 is an out-of-bounds read vulnerability in the Windows NTFS component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity with a CVSS score of 5.5 and has been officially fixed in several Windows 10 updates.

CVE-2026-83703 is an out-of-bounds read vulnerability in the Windows Wi-Fi Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to cause a denial of service over an adjacent network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Official patches have been released by Microsoft to address this issue.

CVE-2026-83686 is an out-of-bounds read vulnerability in the Microsoft Windows Search Component affecting multiple Windows 10 versions. It allows an authorized local attacker to disclose information. The vulnerability has a medium severity score of 5.5 and has been officially fixed in specified Windows 10 builds.

CVE-2026-83670 is a high-severity out-of-bounds read vulnerability in the Function Discovery Service (fdwsd.dll) component of Microsoft Windows 10 Version 1607 and other versions. This flaw allows an unauthorized attacker to disclose information over a network without requiring user interaction or privileges. Multiple Windows 10 builds prior to specific fixed versions are affected. Microsoft has released official fixes for all affected versions.

CVE-2026-83668 is an out-of-bounds read vulnerability in the Windows WLAN Service affecting multiple versions of Microsoft Windows 10, including Version 1607. An authorized local attacker could exploit this flaw to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official fixes have been released for all affected versions.

CVE-2026-83651 is an out-of-bounds read vulnerability in Microsoft Office 365 for Mac related to Windows GDI. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity with a CVSS score of 6.5 and has been officially fixed in multiple versions.

CVE-2026-83647 is an out-of-bounds read vulnerability in Active Directory Domain Services on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has a high severity score of 7.5 and affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-83637 is an out-of-bounds read vulnerability in Windows Kernel-Mode Drivers affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been officially fixed in specific Windows updates.

CVE-2026-83567 is an out-of-bounds read vulnerability in the Windows NTFS component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-83508 is an out-of-bounds read vulnerability in the Windows NTFS component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-69454 is a high-severity out-of-bounds read vulnerability in Microsoft Azure Attestation service and Device Health Attestation Service on Windows Server 2019. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects specific builds of Windows Server 2019 prior to the fixed versions 10.0.17763.9376, 10.0.20348.5761, and 10.0.26100.33650. Microsoft has released official patches to address this issue.

CVE-2026-69577 is an out-of-bounds read vulnerability in Microsoft Azure Attestation service and Device Health Attestation Service on Windows Server 2019. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects specific builds of Windows Server 2019 prior to the fixed versions 10.0.17763.9376, 10.0.20348.5761, and 10.0.26100.33650. A patch is officially available from Microsoft to address this issue.

CVE-2026-69471 is a heap-based buffer overflow vulnerability in Windows Installer on Microsoft Windows 10 Version 1607 and other specified versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-70295 is an out-of-bounds read vulnerability in the Windows Win32 Kernel Subsystem affecting multiple versions of Microsoft Windows 10. It allows an authorized local attacker to disclose information. The vulnerability has been assigned a medium severity with a CVSS score of 5.5. Official fixes have been released for all affected versions.