CWE-416: Use After Free vulnerabilities

CVE-2026-69280 is a use-after-free vulnerability in Windows Push Notifications affecting multiple builds of Microsoft Windows 10 Version 1607 and related versions. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has a high severity score and has been officially fixed in specific Windows 10 builds.

CVE-2026-69274 is a use-after-free vulnerability in the Windows Win32K component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability has a high severity rating with a CVSS score of 7.1. Microsoft has released official fixes for all affected versions.

CVE-2026-68886 is a use-after-free vulnerability in the Windows Network Connection Broker component of Microsoft Windows 10 Version 1607 and related builds. An authorized local attacker can exploit this flaw to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-68840 is a race condition vulnerability in the Windows USB Driver affecting multiple Windows 10 versions including 1607 and later builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has a high severity score and has been officially fixed in specific Windows updates.

CVE-2026-68843 is a use-after-free vulnerability in Microsoft Office Word on Windows 10 Version 1607 and related builds. An authorized local attacker can exploit this flaw to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address this issue.

CVE-2026-67385 is a high-severity use-after-free vulnerability in Microsoft SQL Server 2017 (CU 31) and related versions. It allows an authorized attacker with network access to execute arbitrary code. The vulnerability affects multiple SQL Server versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-56172 is a use-after-free vulnerability in the Windows VHD miniport driver affecting multiple builds of Microsoft Windows 10 Version 1809 and later. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-62697 is a use-after-free vulnerability in Windows Push Notifications affecting Microsoft Windows 10 Version 21H2 and related builds. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has a high severity score of 7.8 and impacts confidentiality, integrity, and availability. Microsoft has released official fixes for multiple affected versions.

CVE-2026-62813 is a use-after-free vulnerability in Active Directory Domain Services on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official patches to address this issue.

CVE-2026-56177 is a use-after-free vulnerability in Microsoft Windows 10 Version 1607 and related builds that allows an authorized local attacker to elevate privileges. The flaw affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official patches to address this issue.

CVE-2026-83979 is a use-after-free vulnerability in the Windows Biometric Service on Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official patches to address this issue.

CVE-2026-69573 is a use-after-free vulnerability in the Windows Universal Disk Format File System Driver (UDFS) affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity score and has been officially fixed by Microsoft in specific updates.

CVE-2026-69827 is a race condition vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related versions. It allows an unauthorized attacker to execute code remotely over a network due to improper synchronization when accessing shared resources. The vulnerability affects multiple Windows versions and has been assigned a high severity score. Official patches have been released to address this issue.

CVE-2026-69989 is a high-severity use-after-free vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows versions and has been officially fixed by Microsoft in specific updates.

CVE-2026-80093 is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver affecting multiple builds of Windows 10 Version 1809 and later. An authorized local attacker can exploit this flaw to elevate privileges. Microsoft has released official fixes for all affected versions.

CVE-2026-78523 is a use-after-free vulnerability in the Windows DNS component affecting multiple versions of Microsoft Windows including Windows 10 Version 1607. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has a medium severity rating and has been officially fixed by Microsoft in specific updates.

CVE-2026-77899 is a use-after-free vulnerability in the Windows Security Center component of Microsoft Windows 11 Version 24H2. It allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows versions prior to specific fixed builds. An official fix is available from Microsoft.

CVE-2026-77894 is a race condition vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related versions. It allows a locally authorized attacker to elevate privileges due to improper synchronization when accessing shared resources concurrently. The vulnerability has been assigned a high severity score and has official patches available from Microsoft.

CVE-2026-77505 is a high-severity use-after-free vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related versions. It allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 builds and some earlier Windows versions. Microsoft has released official fixes for all affected versions.

CVE-2026-69579 is a critical use-after-free vulnerability in Windows Message Queuing affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability has a CVSS score of 9.8, indicating a high severity with potential for full system compromise. Official patches have been released to address this issue.