CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-70247 is a high-severity out-of-bounds read vulnerability in the Windows HTTP.sys component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker with local privileges to execute code on the affected system. The vulnerability has been officially fixed in several Windows 10 builds. No known exploits in the wild have been reported.

CVE-2026-70173 is an out-of-bounds read vulnerability in the Microsoft Windows Search Component affecting multiple versions of Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-70141 is an out-of-bounds read vulnerability in the Microsoft Windows Search Component affecting Windows 10 Version 1607 and other specified versions. It allows an authorized local attacker to disclose information. The vulnerability has been assigned a medium severity with a CVSS score of 5.5. Official patches have been released to address this issue.

CVE-2026-70119 is an out-of-bounds read vulnerability in the Windows DNS component of Microsoft Windows Server 2022. This flaw allows an authorized attacker to execute code remotely over a network. The vulnerability affects specific builds of Windows Server 2022 prior to the fixed versions 10.0.20348.5761 and 10.0.26100.33650. The issue has been officially fixed by Microsoft.

CVE-2026-70166 is an out-of-bounds read vulnerability in the Windows DNS component affecting multiple versions of Microsoft Windows 10, including Version 1607. An authorized attacker can exploit this flaw to cause a denial of service over a network. The issue has been officially fixed in specific Windows updates.

CVE-2026-70135 is an out-of-bounds read vulnerability in the Windows Remote POS Driver affecting multiple builds of Microsoft Windows 10 Version 1607 and later updates. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released by Microsoft to address this issue.

CVE-2026-70126 is an out-of-bounds read vulnerability in the Windows Bluetooth Port Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw could allow an unauthorized attacker to execute code over an adjacent network. The vulnerability has a high severity rating and has been officially fixed by Microsoft in specific updates.

CVE-2026-70063 is an out-of-bounds read vulnerability in the Windows Kernel affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker with low privileges to disclose sensitive information. The vulnerability has a medium severity rating and has been officially fixed by Microsoft in specific updates.

CVE-2026-69974 is an out-of-bounds read vulnerability in the Desktop Window Manager component of Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to disclose information. The vulnerability has a medium severity score of 4.7 and has been officially fixed in multiple Windows 10 builds.

CVE-2026-69967 is an out-of-bounds read vulnerability in the Windows Overlay Filter component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. A patch addressing this issue is officially available from Microsoft.

CVE-2026-69959 is a high-severity out-of-bounds read vulnerability in the Windows Overlay Filter component of Microsoft Windows 10 Version 1607 and related builds. An authorized local attacker can exploit this flaw to execute code with elevated privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes addressing this issue.

CVE-2026-69952 is an out-of-bounds read vulnerability in the Windows Overlay Filter component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity score and has been officially fixed by Microsoft in multiple Windows 10 builds.

CVE-2026-69914 is an out-of-bounds read vulnerability in the Windows AppX Deployment Service affecting multiple builds of Microsoft Windows 10 Version 1809 and later. An authorized local attacker could exploit this flaw to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released by Microsoft to address this issue.

CVE-2026-69867 is an out-of-bounds read vulnerability in SQLite within Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for affected versions.

CVE-2026-108466 is an out-of-bounds read vulnerability in the Windows Kernel affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has been officially fixed in specific Windows 10 builds.

CVE-2026-105726 is an out-of-bounds read vulnerability in Microsoft Defender for Endpoint for Windows. It allows an authorized local attacker to disclose information by reading memory outside of intended bounds. The vulnerability affects versions from 1.0.0.0 up to but not including 4.18.26060.3008. A fix is available in version 4.18.26060.3008. The vulnerability has a medium severity with a CVSS score of 5.5.

CVE-2026-105718 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.8. Microsoft has issued official fixes for this vulnerability in multiple versions of the software.

CVE-2026-94506 is an out-of-bounds read vulnerability in Microsoft Office Access within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 (medium severity) and requires user interaction but no privileges. Official fixes are available in versions 16.0.14334.20974 and 16.0.17932.21056.

CVE-2026-105595 is a high-severity out-of-bounds read vulnerability in Microsoft Office Access within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The issue affects specific versions prior to 16.0.14334.20974 and 16.0.17932.21056. Microsoft has released official fixes for the affected versions.

CVE-2026-102867 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Official patches have been released by Microsoft to address this issue.