CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-78508 is an out-of-bounds read vulnerability in the Windows CD-ROM Driver affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an unauthorized attacker with physical access to the system to disclose information. The vulnerability has a medium severity rating and has been officially fixed in specific Windows updates.

CVE-2026-78515 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A patch is available and has been officially released by Microsoft.

CVE-2026-78502 is an out-of-bounds read vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Multiple affected versions prior to specific fixed releases are identified. An official fix is available from Microsoft.

CVE-2026-77895 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and related Windows versions. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has a high severity rating with a CVSS score of 7.5. Microsoft has released official fixes for all affected versions.

CVE-2026-77893 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows including Windows 10 Version 1607. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has a high severity rating with a CVSS score of 7.5. Official patches have been released by Microsoft to address this issue.

CVE-2026-77891 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker with high privileges to execute code locally on the affected system. The vulnerability has been assigned a CVSS v3.1 score of 6.4, indicating a medium severity level. Microsoft has released official fixes for all affected versions.

CVE-2026-77886 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions involving an out-of-bounds read in the Windows DHCP Server component. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has been officially fixed in multiple Windows versions as listed by Microsoft.

CVE-2026-77887 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and related Windows versions. This flaw allows an authorized attacker with high privileges to execute code locally on the affected system. The vulnerability has been assigned a CVSS v3.1 base score of 6.4, indicating a medium severity level. Official patches have been released by Microsoft to address this issue.

CVE-2026-77503 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and other specified versions. It involves an out-of-bounds read flaw in the Windows NTFS component that allows a local unauthorized attacker to elevate privileges. The vulnerability has been officially fixed in multiple Windows 10 builds and earlier versions. No known exploits are reported in the wild.

CVE-2026-77502 is a high-severity out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and Windows Server. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has been officially fixed in specific Windows builds.

CVE-2026-77501 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions involving an out-of-bounds read in the Windows DHCP Server component. This flaw allows an unauthorized attacker to cause a denial of service over a network. The vulnerability has been officially fixed in multiple Windows builds.

CVE-2026-77498 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and related Windows versions. This flaw allows an unauthorized attacker to cause a denial of service (DoS) over the network by exploiting the vulnerability. The issue has been assigned a high severity with a CVSS score of 7.5. Official patches have been released by Microsoft to address this vulnerability.

CVE-2026-77492 is an out-of-bounds read vulnerability in the Storage Port Driver of Microsoft Windows 10 Version 1607 and related builds. An authorized local attacker can exploit this flaw to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address this issue.

CVE-2026-77491 is an out-of-bounds read vulnerability in Microsoft Office 365 for Mac related to Windows GDI. This flaw allows an unauthorized local attacker to disclose information. The vulnerability affects multiple versions of Microsoft Office 365 for Mac and related Windows builds prior to specific fixed versions. A patch is available and has been officially released by Microsoft.

CVE-2026-70124 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 5.9. Microsoft has released official fixes for all affected versions.

CVE-2026-69930 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and some earlier Windows versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 5.9. Official fixes have been released for all affected versions.

CVE-2026-69929 is an out-of-bounds read vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and some earlier Windows versions. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 5.9. Official patches have been released to address this issue.

CVE-2026-69739 is an out-of-bounds read vulnerability in Microsoft 365 Apps for Enterprise that allows an unauthorized attacker to disclose information over a network. The flaw affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A patch is available from Microsoft to address this issue.

CVE-2026-69734 is an integer overflow or wraparound vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Multiple affected versions prior to specific fixed releases are impacted. Microsoft has released official fixes for this vulnerability.

CVE-2026-69443 is a high-severity out-of-bounds read vulnerability in Microsoft Windows 10 Version 1809 affecting the Azure Attestation service and Device Health Attestation Service. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has been fixed in specific Windows 10 builds.