CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-85853 is an out-of-bounds read vulnerability in the Windows Desktop Window Manager (DWM) Core Library affecting multiple builds of Windows 10 Version 1607 and later. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. An official fix is available and has been released in specific Windows 10 builds.

CVE-2026-85852 is an out-of-bounds read vulnerability in Windows Management Instrumentation on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. A patch is available from Microsoft to address this issue.

CVE-2026-85847 is an out-of-bounds read vulnerability in Microsoft Windows 10 Version 1607 Print Spooler components. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple Windows 10 builds prior to their respective fixed versions. A patch is officially available from Microsoft to address this issue.

CVE-2026-85837 is an out-of-bounds read vulnerability in the Windows Kernel affecting Microsoft Windows 11 Version 24H2. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and impacts confidentiality, integrity, and availability. Official patches are available and have been released for affected versions.

CVE-2026-85830 is an out-of-bounds read vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to read memory beyond the intended buffer boundaries, potentially disclosing sensitive information. The vulnerability affects multiple Windows 10 versions prior to their respective fixed releases. Microsoft has issued official fixes for all affected versions.

CVE-2026-85821 is an out-of-bounds read vulnerability in the Windows Universal Disk Format File System Driver (UDFS) affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds.

CVE-2026-85816 is an out-of-bounds read vulnerability in the Windows Wi-Fi driver affecting multiple builds of Windows 10 Version 1607 and later. This flaw allows an authorized attacker to disclose information over an adjacent network. The vulnerability has a medium severity rating with a CVSS score of 5.7. Microsoft has released official fixes for all affected versions.

CVE-2026-85815 is an out-of-bounds read vulnerability in the Windows Device Association Service affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-85808 is an out-of-bounds read vulnerability in the Windows Routing and Remote Access Service (RRAS) affecting multiple versions of Microsoft Windows 10. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has been assigned a high severity score of 7.5 CVSS v3.1. Microsoft has released official fixes for all affected versions.

CVE-2026-85797 is an out-of-bounds read vulnerability in the Windows Graphics Device Interface (GDI) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity score of 6.5 and has been officially fixed by Microsoft in specific updates.

CVE-2026-85794 is an out-of-bounds read vulnerability in the Windows Routing and Remote Access Service (RRAS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to locally disclose information. The vulnerability has been assigned a medium severity with a CVSS score of 5.5. Official patches have been released to address this issue.

CVE-2026-85374 is an out-of-bounds read vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to disclose sensitive information by reading memory outside the intended bounds. The vulnerability has a medium severity rating and has been officially fixed by Microsoft in specific updated versions.

CVE-2026-85369 is an out-of-bounds read vulnerability in Windows Hyper-V on Microsoft Windows 10 Version 21H2. It allows an authorized local attacker with high privileges to elevate their privileges further. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. A patch is available and has been officially released by Microsoft.

CVE-2026-85356 is a high-severity vulnerability in the Windows Volume Manager Extension Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. It allows an authorized local attacker to perform an out-of-bounds read, which can lead to privilege escalation. The vulnerability has been officially fixed in several Windows updates.

CVE-2026-85337 is an out-of-bounds read vulnerability in the Remote Desktop Client component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has been assigned a CVSS v3.1 base score of 6.5, indicating a medium severity level. Official patches have been released to address this issue in multiple Windows 10 builds.

CVE-2026-85338 is an out-of-bounds read vulnerability in the Microsoft Graphics Component affecting Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7.8. Official patches have been released to address this issue.

CVE-2026-85353 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds involving an out-of-bounds read in the Windows Print Spooler components. This flaw allows an unauthorized attacker to disclose information over a network. The issue affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-85334 is an out-of-bounds read vulnerability in the Windows Message Queuing Queue Manager component of Microsoft Windows 10 Version 1607 and other specified versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a high severity rating with a CVSS score of 7.5. Microsoft has released official fixes for the affected versions.

CVE-2026-85336 is an out-of-bounds read vulnerability in the Windows Device Association Service affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-85331 is an out-of-bounds read vulnerability in the Windows Device Association Service affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Official patches have been released to address this issue.