CWE-416: Use After Free vulnerabilities

CVE-2026-85792 is a critical use-after-free vulnerability in the Windows Routing and Remote Access Service (RRAS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows remote attackers to execute arbitrary code on vulnerable systems without requiring user interaction or privileges. The vulnerability has been officially fixed in specific Windows updates.

CVE-2026-85790 is a use-after-free vulnerability in Microsoft QUIC affecting Microsoft Visual Studio 2022 version 17.14 and other related Microsoft products. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity with a CVSS score of 5.9. Official patches have been released to address this issue.

CVE-2026-85375 is a use-after-free vulnerability in the Windows Universal Plug and Play (UPnP) Device Host component affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-85371 is a use-after-free vulnerability in the Network Policy Server component of Microsoft Windows 10 Version 1607. It allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-85372 is a use-after-free vulnerability in the Windows Kernel affecting multiple versions of Microsoft Windows 10, including Version 1607 and later builds. This vulnerability allows an authorized local attacker to elevate privileges. The issue has been officially fixed in specified Windows updates.

CVE-2026-85370 is a use-after-free vulnerability in the WebDAV component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for the affected versions.

CVE-2026-85367 is a use-after-free vulnerability in the Windows Cash Drawer Protocol Provider affecting multiple builds of Windows 10 Version 1607 and related versions. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has been assigned a high severity score and has an official fix available.

CVE-2026-85364 is a use-after-free vulnerability in Windows Installer affecting multiple versions of Microsoft Windows 10, including version 1607 and later builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity score of 7.0 and has been officially fixed in multiple Windows 10 updates.

CVE-2026-85361 is a use-after-free vulnerability in Windows Installer on Microsoft Windows 10 Version 1607 and related versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7. A fix is available in multiple updated Windows versions.

CVE-2026-85357 is a race condition vulnerability in the Windows Phone Service component of Microsoft Windows 11 version 23H2. This flaw allows an authorized local attacker to elevate privileges by exploiting improper synchronization during concurrent execution of shared resources. The vulnerability affects multiple builds of Windows 11 23H2 prior to their respective fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-85354 is a use-after-free vulnerability in Windows Error Reporting on Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7. An official fix is available from Microsoft.

CVE-2026-85352 is a use-after-free vulnerability in the Windows Device Association Service affecting multiple builds of Microsoft Windows 10, including version 1607 and later updates. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-85342 is a use-after-free vulnerability in the Windows Device Association Service affecting multiple builds of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in several Windows 10 builds.

CVE-2026-85332 is a use-after-free vulnerability in the Windows Device Association Service affecting Windows 10 Version 1809 and later builds. It allows an authorized local attacker to elevate privileges. The flaw has been assigned a high severity with a CVSS score of 7.8. Multiple affected versions are fixed in corresponding updates released by Microsoft.

CVE-2026-84020 is a use-after-free vulnerability in the Windows Routing and Remote Access Service (RRAS) affecting Windows 10 Version 21H2 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. A fix has been officially released by Microsoft for all affected versions.

CVE-2026-84019 is a use-after-free vulnerability in the Windows Advanced Rasterization Platform affecting Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7. An official fix is available and has been released in multiple Windows 10 builds.

CVE-2026-84018 is a use-after-free vulnerability in the Windows Print Spooler components affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. An official fix is available and has been released in specific Windows 10 builds.

CVE-2026-84013 is a use-after-free vulnerability in the Windows Telephony Server component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-83922 is a use-after-free vulnerability in Windows Direct Composition affecting Windows 10 Version 21H2 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been officially fixed in multiple Windows 10 builds.

CVE-2026-83917 is a use-after-free vulnerability in the Windows ALPC component affecting Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in multiple Windows 10 versions.