CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-70294 is an out-of-bounds read vulnerability in the Windows Win32 Kernel Subsystem affecting Windows 10 Version 1607 and other versions. This flaw allows an authorized local attacker to disclose information. The vulnerability has been assigned a CVSS 3.1 base score of 5.5 (medium severity). Official patches have been released to address this issue.

CVE-2026-70292 is an out-of-bounds read vulnerability in the Windows Win32 Kernel Subsystem affecting multiple versions of Microsoft Windows 10, including Version 1607. It allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating and has been officially fixed in specific Windows 10 updates.

CVE-2026-70208 is an out-of-bounds read vulnerability in the Windows HTTP.sys component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity rating and has been officially fixed by Microsoft in specific updates.

CVE-2026-70201 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows Server 2012 and later. This flaw allows an authorized attacker with local access to cause a denial of service condition. The vulnerability has been assigned a medium severity rating with a CVSS score of 5.5. Microsoft has released official patches that address this issue in specific fixed versions.

CVE-2026-70211 is an out-of-bounds read vulnerability in Microsoft Office 365 for Mac that allows an authorized local attacker to disclose information. The flaw exists in the Windows Win32 Kernel Subsystem component. It has a medium severity with a CVSS score of 5.5. Official patches are available and have been released in multiple versions.

CVE-2026-70074 is an out-of-bounds read vulnerability in the Windows DNS component affecting multiple versions of Microsoft Windows 10, including Version 1607. The flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. This vulnerability has a medium severity rating and has been officially fixed by Microsoft in specific updates.

CVE-2026-69999 is an out-of-bounds read vulnerability in Windows Update affecting Microsoft Windows 11 version 23H2. It allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official fixes have been released in multiple Windows 11 builds to address this issue.

CVE-2026-97755 is a high-severity out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. Multiple affected versions prior to specific fixed releases are impacted. Microsoft has issued official fixes for this vulnerability.

CVE-2026-97014 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information. The vulnerability affects certain versions prior to 16.0.14334.20974 and 16.0.17932.21056. An official fix is available from Microsoft.

CVE-2026-97744 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized local attacker to disclose information. The vulnerability has a medium severity score of 5.5 and requires user interaction to exploit. Official patches have been released by Microsoft to address this issue.

CVE-2026-97005 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released by Microsoft to address this issue.

CVE-2026-96928 is an out-of-bounds read vulnerability in the Windows NTFS component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-96867 is an out-of-bounds read vulnerability in the Windows NTFS component affecting multiple versions of Microsoft Windows 10, including Version 1607 and later builds. This flaw allows an authorized local attacker to execute arbitrary code. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-96861 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 affecting the Network Device Enrollment Service (NDES). It involves an out-of-bounds read (CWE-125) that can be exploited by an unauthorized attacker to cause a denial of service over a network. The vulnerability affects multiple Windows 10 builds and related versions, with official fixes available in specified updated versions.

CVE-2026-96860 is an out-of-bounds read vulnerability in the Windows USB Print Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5 and has been officially fixed in several Windows updates.

CVE-2026-96859 is an out-of-bounds read vulnerability in the Windows Imaging Component affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity rating and has been officially fixed in several Windows 10 builds.

CVE-2026-96862 is an out-of-bounds read vulnerability in the Windows Spaceport.sys driver affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-96866 is a high-severity out-of-bounds read vulnerability in the Network Device Enrollment Service (NDES) component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability affects multiple Windows 10 builds and earlier Windows versions, with official fixes released by Microsoft.

CVE-2026-96314 is an out-of-bounds read vulnerability in the Windows Audio Service affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-96306 is an out-of-bounds read vulnerability in the Windows Sysmain Service affecting multiple versions of Microsoft Windows 10, including Version 1607 and later builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.