CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-96246 is an out-of-bounds read vulnerability in the Network Policy Server (NPS) component of Microsoft Windows 10 Version 1607 and other specified versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a high severity rating with a CVSS score of 7.5. Microsoft has issued official fixes for affected versions.

CVE-2026-96245 is a high-severity out-of-bounds read vulnerability in the Windows Routing and Remote Access Service (RRAS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to disclose information over a network without requiring user interaction or privileges. Microsoft has released official fixes for all affected versions.

CVE-2026-88169 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Official fixes have been released in specific versions of the software.

CVE-2026-88175 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. Microsoft has issued official fixes for affected versions, and patches are available. The vulnerability does not require privileges but does require user interaction to exploit. There are no known exploits in the wild at this time.

CVE-2026-88151 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 6.5. Official fixes have been released by Microsoft in versions 16.0.14334.20974 and 16.0.17932.21056. No known exploits are reported in the wild at this time.

CVE-2026-88153 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity score of 6.5 and requires user interaction to exploit. Official patches have been released to address this issue.

CVE-2026-70263 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 (medium severity) and affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. Microsoft has issued official fixes for this vulnerability.

CVE-2026-70206 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS v3.1 base score of 6.5, indicating a medium severity level. Microsoft has released official fixes for affected versions.

CVE-2026-70044 is an out-of-bounds read vulnerability in Microsoft Windows Media Foundation affecting Windows 10 Version 1607 and other versions. This flaw allows an unauthorized local attacker to disclose information. The vulnerability has a medium severity score of 5.5 and has been officially fixed in multiple Windows 10 builds.

CVE-2026-70011 is an out-of-bounds read vulnerability in the Windows IP Over USB Service affecting Microsoft Windows 10 Version 21H2. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official fixes have been released by Microsoft for multiple affected Windows 10 builds.

CVE-2026-69955 is an out-of-bounds read vulnerability in the Windows Client for NFS component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Microsoft has released official fixes for affected versions.

CVE-2026-69940 is an out-of-bounds read vulnerability in the Windows Client for NFS component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has been assigned a CVSS 3.1 score of 6.5 (medium severity). Microsoft has released official fixes for affected versions.

CVE-2026-88140 is an out-of-bounds read vulnerability in the Windows Key Storage Provider affecting multiple builds of Microsoft Windows 10. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-88070 is an out-of-bounds read vulnerability in the Windows BitLocker component of Microsoft Windows 10 Version 1607 and other versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7.8. Microsoft has released official fixes for affected versions.

CVE-2026-70277 is an out-of-bounds read vulnerability in the Windows Fast FAT Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows a local unauthorized attacker to disclose information. The vulnerability has a medium severity rating and has been officially fixed in various Windows 10 builds.

CVE-2026-70244 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and other specified versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 6.5. Microsoft has released official fixes for all affected versions.

CVE-2026-70210 is a heap-based buffer overflow vulnerability in Windows OLE DB affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to elevate privileges over a network. The vulnerability has a high severity score of 8.8 and has been officially fixed in several Windows updates.

CVE-2026-88159 is a high-severity use-after-free vulnerability in the Windows Background Intelligent Transfer Service (BITS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has been officially fixed in specific Windows 10 builds as listed by Microsoft.

CVE-2026-88158 is an out-of-bounds read vulnerability in Microsoft Digest Authentication affecting multiple versions of Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-85858 is an out-of-bounds read vulnerability in the Windows Win32 Kernel Subsystem affecting Microsoft Windows 11 version 23H2. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in multiple Windows 11 builds.