CWE-362: Race Condition vulnerabilities

CVE-2026-88096 is a race condition vulnerability in the Windows DCOM Server component affecting multiple builds of Windows 10, including Version 1607 and later updates. This flaw allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources.

CVE-2026-71347 is a race condition vulnerability in the Windows Security Center component of Microsoft Windows 10 Version 1607 and later builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has been assigned a CVSS 3.1 base score of 6.4 (medium severity). Microsoft has released official patches that fix this issue in multiple Windows 10 builds.

CVE-2026-85824 is a use-after-free vulnerability in the Windows Composite Image File System affecting Windows 10 Version 21H2 and related builds. An authorized local attacker can exploit this flaw to elevate privileges on the affected system. The vulnerability has been assigned a high severity with a CVSS score of 7. Microsoft has released official fixes for all affected versions.

CVE-2026-85825 is a race condition vulnerability in the Windows Universal Disk Format File System Driver (UDFS) affecting multiple versions of Microsoft Windows 10, including version 1607. This use-after-free flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score and has been officially fixed in specific Windows 10 builds.

CVE-2026-85357 is a race condition vulnerability in the Windows Phone Service component of Microsoft Windows 11 version 23H2. This flaw allows an authorized local attacker to elevate privileges by exploiting improper synchronization during concurrent execution of shared resources. The vulnerability affects multiple builds of Windows 11 23H2 prior to their respective fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-85333 is a race condition vulnerability in the Windows Performance Monitor component of Microsoft Windows 10 Version 1607 and related builds. It allows a locally authorized attacker to elevate privileges due to improper synchronization when concurrently accessing shared resources. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for the affected versions.

CVE-2026-84014 is a heap-based buffer overflow vulnerability in the Windows Device Association Service affecting multiple builds of Windows 10 Version 1607 and related versions. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has a high severity score and has been officially fixed in specific Windows builds.

CVE-2026-83879 is a race condition vulnerability in the Windows Overlay Filter component of Microsoft Windows 10 Version 1607 and related builds. It allows a local authorized attacker to elevate privileges due to improper synchronization during concurrent execution using a shared resource. The vulnerability affects multiple Windows 10 versions prior to specific fixed releases. Microsoft has issued official fixes for the affected versions.

CVE-2026-83868 is a race condition vulnerability in the Microsoft Bluetooth Driver on Windows 10 Version 1809 and related builds. It allows a locally authorized attacker to elevate privileges due to improper synchronization when accessing shared resources. The flaw affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official fixes for all affected versions.

CVE-2026-83775 is a race condition vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when concurrently accessing shared resources. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-83738 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A security update addressing this issue has been officially released by Microsoft.

CVE-2026-83722 is a use-after-free vulnerability in the Microsoft Local Security Authority Server (lsasrv) component of Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A fix is officially available from Microsoft.

CVE-2026-83666 is a race condition vulnerability in Active Directory Certificate Services (AD CS) on Microsoft Windows 10 Version 1607 and related versions. It allows an authorized local attacker to elevate privileges due to improper synchronization when concurrently accessing shared resources. The vulnerability has a high severity rating and has been officially fixed in specific Windows builds.

CVE-2026-69830 is a race condition vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows including Windows 10 Version 1607. It allows an unauthorized attacker to execute code remotely over a network due to improper synchronization when accessing shared resources. The vulnerability has been assigned a high severity with a CVSS score of 8.1. Official patches have been released to address this issue.

CVE-2026-70195 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to disclose information. The vulnerability has been assigned a medium severity with a CVSS score of 4.7. Microsoft has released official fixes for all affected versions.

CVE-2026-70169 is a race condition vulnerability in the Windows Connected Devices Platform Service on Windows 10 Version 1809 and later builds. It allows an authorized local attacker to elevate privileges due to improper synchronization during concurrent execution using a shared resource. The vulnerability has been assigned a high severity rating with a CVSS score of 7. An official fix is available for affected versions.

CVE-2026-70097 is a race condition vulnerability in the Windows Virtualization-Based Security (VBS) Enclave component of Microsoft Windows 11 Version 24H2. This flaw allows an authorized local attacker to perform spoofing due to improper synchronization when concurrently accessing shared resources. The vulnerability has a medium severity with a CVSS score of 5.6 and has been officially fixed in specific Windows 11 builds.

CVE-2026-69935 is a use-after-free vulnerability in the Windows Storage component of Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7.0. Official patches have been released to address this issue in multiple Windows 10 builds.

CVE-2026-69766 is a use-after-free vulnerability in the Windows Storage component of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A patch addressing this issue is officially available from Microsoft.

CVE-2026-69763 is a use-after-free vulnerability in the Windows Storage component of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. An official fix is available from Microsoft, addressing the issue in multiple Windows 10 builds.