CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-80073 is an out-of-bounds read vulnerability in Microsoft Office Outlook within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 (medium severity) and affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. Microsoft has released official fixes for the affected versions.

CVE-2026-80079 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple versions prior to specific fixed releases. A patch is available and has been officially released by Microsoft.

CVE-2026-67645 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to disclose information over a network. The flaw affects multiple versions of SQL Server 2017 and later releases. Microsoft has issued official fixes for all affected versions. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

CVE-2026-67624 is an out-of-bounds read vulnerability in Microsoft SQL Server 2019 (CU 32) that allows an authorized attacker to disclose information over a network. The vulnerability affects multiple versions of SQL Server 2019, 2022, and 2024 branches prior to specific fixed builds. It has a medium severity rating with a CVSS score of 6.5. An official fix is available from Microsoft.

CVE-2026-78503 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A patch is available and has been officially released by Microsoft.

CVE-2026-67369 is an out-of-bounds read vulnerability in Microsoft SQL Server 2025 (CU8) that allows an authorized attacker to disclose information over a network. The flaw affects specific versions prior to 17.0.4085.5 and 17.0.1135.8. Microsoft has released official fixes for this vulnerability.

CVE-2026-78454 is an out-of-bounds read vulnerability in the Windows CD-ROM Driver affecting multiple builds of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity score of 5.5 and has been officially fixed in specific Windows 10 builds.

CVE-2026-78452 is an out-of-bounds read vulnerability in the Microsoft Windows SCSI Class System File affecting Windows 10 Version 1809 and later builds up to specific fixed versions. This flaw allows an unauthorized attacker with physical access to the system to disclose information. The vulnerability has a medium severity rating and has been officially fixed by Microsoft in several Windows 10 builds.

CVE-2026-78455 is an out-of-bounds read vulnerability in the Xbox component of Microsoft Windows 10 Version 1607. This flaw allows an unauthorized attacker with physical access to the device to disclose sensitive information. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for all affected versions. The CVSS v3.1 base score is 4.3, indicating a medium severity level.

CVE-2026-78441 is an out-of-bounds read vulnerability in Windows OLE DB component of Microsoft SQL Server 2017 (CU 31). It allows an unauthorized attacker to disclose information over a network. The vulnerability affects specific versions of Microsoft SQL Server 2017 and 2019 before certain fixed releases. A patch is available and has been officially released by Microsoft.

CVE-2026-69562 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an unauthorized attacker to disclose information over a network. The flaw affects multiple versions prior to specific fixed releases. A patch is available from Microsoft to address this issue.

CVE-2026-77911 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Microsoft has issued an official fix addressing this issue in versions 16.113.26091433 and 16.0.5569.1002.

CVE-2026-72999 is an out-of-bounds read vulnerability in the Windows USB Hub Driver affecting multiple builds of Windows 10 Version 1607 and later. This flaw allows an unauthorized attacker with physical access to the device to elevate privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. Microsoft has released official fixes for all affected versions.

CVE-2026-72976 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows an authorized attacker to locally disclose information. The vulnerability affects multiple versions prior to specific fixed releases. A patch is available and has been officially released by Microsoft.

CVE-2026-72975 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 (medium severity) and affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-72977 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Microsoft has released official fixes addressing this issue in multiple versions of the affected software.

CVE-2026-69568 is an out-of-bounds read vulnerability in the Windows Storage Spaces Controller affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker with low privileges to disclose sensitive information. The vulnerability has been assigned a medium severity with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-69490 is an out-of-bounds read vulnerability in the Windows USB Mass Storage Class Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker with physical access to elevate privileges on the affected system. The vulnerability has been assigned a CVSS v3.1 score of 6.8, indicating a medium severity level. Microsoft has released official fixes for all affected versions.

CVE-2026-69334 is a heap-based buffer overflow vulnerability in the Windows Volume Manager Extension Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity rating and has been officially fixed in specific Windows updates.

CVE-2026-72942 is an out-of-bounds read vulnerability in the Windows Spaceport.sys driver affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 (medium severity) and has been officially fixed by Microsoft in specific updates.