Threats affecting pkg:generic/wolfssl

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows TPM allows an authorized attacker to elevate privileges locally.

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.

Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.

CVE-2026-122475 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving an untrusted pointer dereference in the Windows Storage Spaces Controller. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-122474 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Windows Security Account Manager on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to bypass a security feature remotely over a network. The vulnerability has a medium severity rating with a CVSS score of 5.9. Official patches have been released to address this issue in multiple Windows 10 builds.

CVE-2026-122297 is a vulnerability in Microsoft Windows 10 Version 1607 involving the use of an uninitialized resource in the Kernel Transaction Manager. This flaw allows an authorized local attacker to disclose sensitive information. The issue affects multiple Windows 10 builds prior to specific fixed versions. A patch is available from Microsoft to address this vulnerability.

CVE-2026-122183 is an out-of-bounds read vulnerability in the Windows Kernel affecting Windows 10 Version 1607 and later builds up to specific patched versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been officially fixed by Microsoft in multiple updates.

CVE-2026-122182 is a vulnerability in Microsoft Windows 10 Version 1607 and later versions where improper link resolution before file access in Windows Maps allows an authorized local attacker to elevate privileges. The flaw is identified as CWE-59 (Link Following). It affects multiple specific Windows 10 builds prior to their respective fixed versions. A patch is available from Microsoft to address this issue.

CVE-2026-122179 is a heap-based buffer overflow vulnerability in Windows Internet Connection Sharing (ICS) affecting multiple builds of Windows 10 Version 1607 and related versions. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7.0. Official patches have been released by Microsoft to address this issue.

CVE-2026-122177 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving improper link resolution before file access in the iSCSI component. This flaw allows an unauthorized attacker over a network to elevate privileges by exploiting link following behavior. Multiple Windows 10 builds prior to specific fixed versions are affected. An official fix is available from Microsoft.

CVE-2026-122176 is a heap-based buffer overflow vulnerability in the Windows SMB component affecting multiple builds of Windows 10 Version 1607 and related versions. It allows an authorized attacker to execute code remotely over a network. The vulnerability has a high severity CVSS score of 8.8 and has been officially fixed in specific Windows 10 builds.

CVE-2026-122175 is a use-after-free vulnerability in Windows Autopilot on Microsoft Windows 11 version 26H1. It allows an authorized local attacker to elevate privileges. The vulnerability affects Windows 11 builds from 10.0.28000.0 up to but not including 10.0.28000.3501. A patch is available in version 10.0.28000.3501.

Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network.

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Insufficient granularity of access control in Windows IKE Extension allows an authorized attacker to perform spoofing locally.