CWE-416: Use After Free vulnerabilities

CVE-2026-88073 is a use-after-free vulnerability in the Windows Graphics Kernel affecting Windows 10 Version 21H2 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 8.8 and has been officially fixed by Microsoft in specific updated versions.

CVE-2026-87713 is a use-after-free vulnerability in the Windows Bluetooth Port Driver affecting multiple Windows 10 versions. This flaw allows an unauthorized attacker on an adjacent network to elevate privileges on the affected system. Microsoft has released official fixes for all impacted versions to address this issue.

CVE-2026-87712 is a use-after-free vulnerability in the Windows Quality of Service (QoS) Packet Scheduler component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8. Official patches have been released to address this issue.

CVE-2026-87691 is a use-after-free vulnerability in Windows Management Services on Microsoft Windows 11 version 23H2. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and affects multiple builds of Windows 11 23H2 prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-85945 is a use-after-free vulnerability in the Windows Kernel affecting Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been officially fixed by Microsoft in multiple Windows 10 updates.

CVE-2026-85934 is a use-after-free vulnerability in the Windows AppX Deployment Service affecting Microsoft Windows 10 Version 1809 and related builds. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7. A fix is available in multiple updated Windows 10 builds.

CVE-2026-85933 is a use-after-free vulnerability in the Windows Print Spooler components affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8. Official patches have been released to address the issue across all affected versions.

CVE-2026-85930 is a use-after-free vulnerability in Windows Image Acquisition on Microsoft Windows 10 Version 21H2. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has a high severity rating and affects multiple Windows 10 builds prior to their respective fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-85926 is a use-after-free vulnerability in the Windows Secure Socket Tunneling Protocol (SSTP) component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity rating with a CVSS score of 8.1. Microsoft has released official fixes for all affected versions.

CVE-2026-85914 is a use-after-free vulnerability in the Windows Embedded Mode Service affecting multiple builds of Microsoft Windows 10 Version 1607 and later updates. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. A fix has been officially released by Microsoft for all affected versions.

CVE-2026-85329 is a race condition vulnerability in Microsoft Account on Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The flaw affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-83710 is a use-after-free vulnerability in the Windows Device Association Service affecting multiple builds of Windows 10, including version 1607 and later updates. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A fix has been officially released by Microsoft for all affected versions.

CVE-2026-70187 is a high-severity use-after-free vulnerability in the Remote Desktop Gateway Service of Microsoft Windows Server 2012 and related versions. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability affects multiple Windows Server builds prior to specific fixed versions. An official patch is available from Microsoft to address this issue.

CVE-2026-70164 is a use-after-free vulnerability in the Windows TCP/IP stack affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A patch is available and has been officially released by Microsoft to address this issue.

CVE-2026-88173 is a use-after-free vulnerability in the Windows Background Intelligent Transfer Service (BITS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.1. Microsoft has released official fixes for all affected versions.

CVE-2026-88161 is a use-after-free vulnerability in the Windows Local Security Authority (LSA) affecting multiple versions of Microsoft Windows 10, including Version 1607 and later builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. An official fix is available and has been released for all affected versions.

CVE-2026-88124 is a use-after-free vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A fix has been officially released by Microsoft for all affected versions.

CVE-2026-87708 is a use-after-free vulnerability in Windows Installer on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 versions prior to specific fixed releases. A patch is available from Microsoft to address this issue.

CVE-2026-88080 is a use-after-free vulnerability in Windows Installer affecting multiple versions of Microsoft Windows 10, including version 1607. An authorized local attacker can exploit this flaw to elevate privileges on the affected system. The vulnerability has been assigned a high severity score of 7.8 and is addressed by official patches provided by Microsoft.

CVE-2026-85918 is a use-after-free vulnerability in the Windows Universal Plug and Play (UPnP) Device Host component affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. An official fix is available from Microsoft.