CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-72952 is a high-severity vulnerability in Microsoft Windows 10 Version 1809 involving an out-of-bounds read in the Spaceport.sys driver. This flaw allows an authorized local attacker to execute code on the affected system. Multiple Windows 10 builds prior to specific fixed versions are impacted. An official fix is available from Microsoft.

CVE-2026-70579 is an out-of-bounds read vulnerability in the Windows Mobile Broadband component of Microsoft Windows 10 Version 21H2. It allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple builds of Windows 10 21H2 and related versions prior to specific fixed releases. A high-severity CVSS score of 7.5 has been assigned. Microsoft has released official fixes for all affected versions.

CVE-2026-70569 is an out-of-bounds read vulnerability in the Windows Spaceport.sys driver affecting Microsoft Windows 11 version 23H2. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and impacts confidentiality, integrity, and availability. Microsoft has released official fixes for multiple affected versions.

CVE-2026-70574 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions. It involves an out-of-bounds read flaw in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-69760 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving an out-of-bounds read in the Windows Kerberos component. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official patch is available from Microsoft to address this issue.

CVE-2026-69895 is an out-of-bounds read vulnerability in the Windows Spaceport.sys driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker with low privileges to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 4.7. Microsoft has released official fixes for all affected versions.

CVE-2026-69679 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to cause a denial of service on an adjacent network. The vulnerability has a medium severity rating and has been officially fixed in specific Windows builds.

CVE-2026-69844 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions. It involves an out-of-bounds read in the Windows Win32K component that allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for all affected versions.

CVE-2026-69803 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and related Windows versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has been assigned a CVSS v3.1 score of 5.9, indicating a medium severity level. Official patches have been released to address this issue.

CVE-2026-69637 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and related Windows versions. This flaw allows an authorized attacker to cause a denial of service on an adjacent network. The vulnerability has been assigned a CVSS v3.1 base score of 5.7, indicating medium severity. Official fixes have been released for all affected versions.

CVE-2026-69715 is a critical out-of-bounds read vulnerability in Windows Direct Show affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a CVSS score of 9.8, indicating high severity with impacts on confidentiality, integrity, and availability. Official patches have been released by Microsoft to address this issue.

CVE-2026-69619 is an out-of-bounds read vulnerability in the Windows exFAT File System affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability has a high severity score and has been officially fixed by Microsoft in specific updates.

CVE-2026-69630 is an out-of-bounds read vulnerability in the Windows Win32K component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-69616 is an out-of-bounds read vulnerability in Microsoft Windows Remote Desktop Services affecting multiple Windows 10 versions including Version 1607. It allows an authorized attacker with local access to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address this issue.

CVE-2026-69617 is a high-severity vulnerability in Microsoft Windows 11 version 26H1 involving an out-of-bounds read in the Windows Resilient File System (ReFS). This flaw allows an authorized local attacker to elevate privileges. The issue affects specific builds before the fixed versions 10.0.28000.2954 and 10.0.26100.33438. An official fix is available from Microsoft.

CVE-2026-69618 is an out-of-bounds read vulnerability in the Windows SMB Client affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-69591 is an out-of-bounds read vulnerability in the NTFS component of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized attacker to disclose information over a network. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. A patch is officially available from Microsoft to address this issue.

CVE-2026-69538 is an out-of-bounds read vulnerability in the Windows Spaceport.sys driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to execute code with elevated privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-69509 is a heap-based buffer overflow vulnerability in the Windows Fax Service on Microsoft Windows 10 Version 1607 and other specified versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score and has been officially fixed by Microsoft in multiple updates.

CVE-2026-69493 is a critical out-of-bounds read vulnerability in the Windows Event Logging Service affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network without user interaction. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Microsoft has released official fixes for all affected versions.