CWE-416: Use After Free vulnerabilities

CVE-2026-96308 is a use-after-free vulnerability in Windows Installer affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity score of 7.8 and has been officially fixed by Microsoft in several updates.

CVE-2026-96307 is a use-after-free vulnerability in Windows Installer on Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-96305 is a use-after-free vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity with a CVSS score of 7. A fix has been officially released by Microsoft for all affected versions.

CVE-2026-96302 is a use-after-free vulnerability in Windows Installer affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A patch addressing this issue is officially available from Microsoft.

CVE-2026-96244 is a use-after-free vulnerability in the Windows Internal System User Profile component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for multiple affected Windows 10 builds to address this issue.

CVE-2026-96223 is a use-after-free vulnerability in Windows Hyper-V on Microsoft Windows 11 Version 24H2. It allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 11 24H2 prior to specific fixed versions. A high-severity CVSS 3.1 score of 7.8 reflects the potential for complete confidentiality, integrity, and availability impact. Microsoft has released official patches to address this issue.

CVE-2026-96216 is a use-after-free vulnerability in the Windows Kernel affecting Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score of 7.0 CVSS v3.1. Official patches have been released to address the issue in multiple affected Windows 10 builds.

CVE-2026-88178 is a critical use-after-free vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code remotely over a network without user interaction or privileges. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Microsoft has released official fixes in versions 16.114.26101123, 16.0.14334.20974, and 16.0.17932.21056. No known exploits are currently reported in the wild.

CVE-2026-70276 is a use-after-free vulnerability in Microsoft Office Click-To-Run within Microsoft 365 Apps for Enterprise. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and affects specific versions prior to fixed releases. Official patches are available from Microsoft to address this issue.

CVE-2026-70102 is a use-after-free vulnerability in the Windows Spaceport.sys driver affecting Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-70134 is a use-after-free vulnerability in the Windows Event Tracing component of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A fix has been officially released by Microsoft for multiple affected Windows 10 versions.

CVE-2026-70045 is a use-after-free vulnerability in Windows Work Folders on Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score and has been officially fixed in multiple Windows 10 builds.

CVE-2026-70013 is a use-after-free vulnerability in the Windows iSCSI component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity score of 8.1 and has been officially fixed in several Windows updates.

CVE-2026-70038 is a use-after-free vulnerability in the Windows iSCSI component affecting multiple versions of Microsoft Windows 10, including version 1607 and others. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.1. Official patches have been released to address this issue.

CVE-2026-69977 is a use-after-free vulnerability in the Quality Windows Audio/Video Experience (QWAVE) service on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7. A fix is available and has been officially released by Microsoft.

CVE-2026-88146 is a race condition vulnerability in the Windows Background Intelligent Transfer Service (BITS) on Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has a high severity rating and has been officially fixed by Microsoft in multiple Windows 10 builds.

CVE-2026-88107 is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver affecting multiple versions of Microsoft Windows 10, including Version 1809. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in several Windows 10 builds.

CVE-2026-88106 is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver affecting multiple builds of Windows 10 Version 1809 and later. An authorized local attacker can exploit this flaw to elevate privileges on the affected system. The vulnerability has a high severity rating and is addressed by official patches released by Microsoft.

CVE-2026-88102 is a critical use-after-free vulnerability in the Windows Failover Cluster component of Microsoft Windows Server 2019. This flaw allows an unauthorized attacker to execute code remotely over a network without any user interaction or privileges. The vulnerability affects specific builds of Windows Server 2019 prior to the fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-88100 is a use-after-free vulnerability in the Windows Storage Spaces Controller component of Microsoft Windows 11 Version 24H2. It allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity score of 7.8 and has been officially fixed by Microsoft in specific Windows 11 builds.