CWE-416: Use After Free vulnerabilities

CVE-2026-69740 is a high-severity use-after-free vulnerability in Windows Hello on Microsoft Windows 11 version 23H2. It allows an authorized local attacker to elevate privileges without user interaction. The flaw affects multiple builds of Windows 11 23H2 and has been officially fixed in specific updated versions.

CVE-2026-69712 is a high-severity use-after-free vulnerability in the Windows Key Distribution Center component of Microsoft Windows Server 2012 and related versions. It allows an authorized attacker to execute arbitrary code remotely over a network. The vulnerability affects multiple Windows Server builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-69730 is a critical use-after-free vulnerability in the Windows DNS component affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network without user interaction. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Microsoft has released official fixes for all affected versions.

CVE-2026-69775 is a use-after-free vulnerability in the Windows DWM Core Library affecting Windows 11 version 23H2. It allows an authorized attacker to elevate privileges over a network. The vulnerability has a high severity score of 7.1 and has been officially fixed in specific Windows 11 builds.

CVE-2026-69838 is a use-after-free vulnerability in the Windows Print Spooler components affecting Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in multiple Windows 10 builds.

CVE-2026-69735 is a use-after-free vulnerability in the Windows Broadcast DVR User Service affecting Windows 10 Version 1607 and later builds up to specified patched versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed by Microsoft in multiple updates.

CVE-2026-69896 is a use-after-free vulnerability in Windows Error Reporting on Microsoft Windows 11 Version 24H2 that allows a local authorized attacker to elevate privileges. The flaw affects specific builds prior to fixed versions and has a high severity rating with a CVSS score of 7. An official fix is available from Microsoft.

CVE-2026-69757 is a use-after-free vulnerability in the Windows TCP/IP stack affecting Windows 10 Version 1809 and later builds. This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability has been assigned a high severity score of 7.1 and has been officially fixed by Microsoft in multiple Windows 10 builds.

CVE-2026-69889 is a use-after-free vulnerability in the Windows Bluetooth Service on Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7.0. Official fixes have been released by Microsoft for all affected versions.

CVE-2026-69711 is a use-after-free vulnerability in the Windows Device Association Service affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7. An official fix is available and has been released for all affected versions.

CVE-2026-69693 is a use-after-free vulnerability in the Windows Device Association Broker service affecting multiple builds of Windows 10 Version 1607 and later. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score of 7.0 and has been officially fixed in specific Windows 10 builds.

CVE-2026-69648 is a use-after-free vulnerability in the Windows Notification component of Microsoft Windows 10 Version 21H2. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 10 21H2 prior to specific fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-69645 is a use-after-free vulnerability in Windows Message Queuing affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7. A fix is available and has been officially released by Microsoft.

CVE-2026-69605 is a use-after-free vulnerability in the Microsoft Install Service on Windows 10 Version 21H2. It allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 10 21H2 prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-69540 is a use-after-free vulnerability in the Windows Audio Service on Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score of 7.0 and has been officially fixed in multiple Windows 10 versions.

CVE-2026-69574 is a use-after-free vulnerability in the Windows Device Association Service affecting Windows 10 Version 1809 and later builds up to specified patched versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed by Microsoft in multiple Windows 10 builds.

CVE-2026-69524 is a use-after-free vulnerability in Active Directory Domain Services on Microsoft Windows 10 Version 1607 and related versions. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity score of 8.1 and affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-69539 is a use-after-free vulnerability in Microsoft Windows Remote Desktop Services affecting multiple Windows 10 versions including 1607 and later builds. An authorized attacker with low privileges can exploit this flaw over a network to execute arbitrary code, potentially leading to full system compromise. The vulnerability has a high severity rating and has been officially fixed in specific Windows updates.

CVE-2026-69525 is a critical use-after-free vulnerability in Microsoft Windows 10 Version 1607 and other specified versions. It affects Windows Remote Desktop Services and allows an unauthorized attacker to execute code remotely over a network without user interaction. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. Official patches are available for all affected versions.

CVE-2026-69516 is a use-after-free vulnerability in the Connected Devices Platform Service (Cdpsvc) on Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7. An official fix is available and has been released for all affected versions.