CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-69308 is an out-of-bounds read vulnerability in Microsoft Standard XPS on Windows 10 Version 1607 and related builds. It allows an authorized local attacker to disclose information. The vulnerability has a medium severity score of 5.5 and has been officially fixed by Microsoft in specific updates.

CVE-2026-69312 is an out-of-bounds read vulnerability in the Windows NTFS component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating and has been officially fixed in several Windows updates.

CVE-2026-69303 is an out-of-bounds read vulnerability in the Push Message Routing Service of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to disclose information by reading memory outside the intended bounds. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. A patch is available from Microsoft to address this issue.

CVE-2026-69295 is a high-severity vulnerability in the Windows USB Driver affecting multiple Windows 10 versions including Version 1607. It allows a locally authorized attacker to perform an out-of-bounds read, which can lead to privilege escalation. The issue has been officially fixed in specific Windows updates.

CVE-2026-69286 is an out-of-bounds read vulnerability in the Windows USB Audio Class driver (usbaudio.sys) affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating and has been officially fixed in several Windows 10 builds.

CVE-2026-68891 is an out-of-bounds read vulnerability in Microsoft Standard XPS on Windows 10 Version 1607 and related versions. It allows an authorized local attacker to disclose information. The vulnerability has been assigned a medium severity with a CVSS score of 4.7. Microsoft has released official fixes for affected versions.

CVE-2026-68898 is an out-of-bounds read vulnerability in the Windows iSCSI component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has a medium severity rating and has been officially fixed in specific Windows updates.

CVE-2026-69265 is an out-of-bounds read vulnerability in the Windows NTFS component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. An official fix is available from Microsoft.

CVE-2026-68874 is an out-of-bounds read vulnerability in the Windows Program Compatibility Assistant Service affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 5.7. Official patches have been released to address this issue.

CVE-2026-68780 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to disclose information over a network. The vulnerability affects multiple versions of Microsoft SQL Server 2017, 2019, 2022, and 2024 prior to specific fixed releases. This issue has a medium severity rating with a CVSS score of 6.5. An official fix is available from Microsoft.

CVE-2026-68779 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to disclose information over a network. The flaw affects multiple versions of SQL Server 2017, 2019, 2022, and 2024 prior to specific fixed releases. The vulnerability has a medium severity rating with a CVSS score of 6.5. An official fix is available from Microsoft.

CVE-2026-68778 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to disclose information over a network. The flaw affects multiple versions of SQL Server 2017, 2019, 2022, and 2024 prior to specific fixed builds. It has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily on confidentiality. Microsoft has released official fixes for all affected versions.

CVE-2026-68777 is an out-of-bounds read vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to disclose information over a network. The flaw affects multiple versions of SQL Server 2017, 2019, 2022, and 2024 builds prior to specific fixed versions. Microsoft has released official patches to address this vulnerability.

CVE-2026-56198 is an out-of-bounds read vulnerability in the Microsoft Trace Data Helper component of Windows 11 Version 24H2. It allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity score of 7.8 and affects specific builds of Windows 11 Version 24H2 prior to the fixed versions. Microsoft has released official fixes for this issue.

CVE-2026-84001 is an out-of-bounds read vulnerability in the Windows Key Distribution Center component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has been assigned a high severity with a CVSS score of 7.5. Microsoft has released official fixes for all affected versions.

CVE-2026-72937 is an out-of-bounds read vulnerability in the Storage Port Driver component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.

CVE-2026-67636 is a critical out-of-bounds read vulnerability in Microsoft SQL Server 2019 (CU 32) that allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions of SQL Server 2019, 2022, and 2024 branches prior to specific fixed releases. Microsoft has issued official patches to address this flaw.

CVE-2026-78518 is a high-severity out-of-bounds read vulnerability in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code remotely over a network. Multiple versions prior to fixed releases are affected. An official fix is available from Microsoft.

CVE-2026-67389 is an out-of-bounds read vulnerability in Microsoft SQL Server 2022 (CU 26) that allows an authorized attacker to disclose information over a network. The flaw affects multiple versions prior to specific fixed releases. A patch is available from Microsoft to address this issue.

CVE-2026-78513 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A patch is available and has been officially released by Microsoft.