CVE-2026-72940 is a heap-based buffer overflow vulnerability in the Windows Schannel component affecting Windows 11 version 23H2 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity rating with a CVSS score of 8.8. Microsoft has released official fixes for all affected versions.
CVE-2026-83952 is a heap-based buffer overflow vulnerability in the Windows Resilient File System (ReFS) component of Microsoft Windows 11 Version 24H2. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating and is addressed by official patches released by Microsoft.
CVE-2026-81355 is a heap-based buffer overflow vulnerability in the Virtual Hard Disk (VHD) Miniport Driver of Microsoft Windows 10 Version 1607 and other versions. This flaw allows an authorized attacker with high privileges to execute code locally, potentially leading to full system compromise. The vulnerability has been assigned a high severity with a CVSS score of 7.5. Official patches have been released by Microsoft to address this issue.
CVE-2026-80075 is a heap-based buffer overflow vulnerability in Windows Work Folders on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Official patches have been released to address this issue in multiple Windows 10 builds.
CVE-2026-80077 is a heap-based buffer overflow vulnerability in the Microsoft Remote Desktop client for Windows Desktop. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability affects versions starting from 1.2.0.0 up to but not including 1.2.7279.0. A high-severity issue with a CVSS score of 8.8, it has been officially fixed in version 1.2.7279.0.
CVE-2026-80074 is a heap-based buffer overflow vulnerability in the Microsoft Remote Desktop client for Windows Desktop. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability affects versions starting from 1.2.0.0 up to but not including 1.2.7279.0. An official fix is available in version 1.2.7279.0. The vulnerability has a high severity rating with a CVSS score of 8.8.
CVE-2026-68786 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (CU 31) and related versions. It allows an authorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.8. Microsoft has released official fixes for affected versions.
CVE-2026-67643 is a critical heap-based buffer overflow vulnerability in Microsoft SQL Server 2022 (CU 26) that allows an unauthorized attacker to execute code remotely over a network. The flaw affects multiple versions prior to specific fixed releases. Microsoft has issued an official fix to address this vulnerability.
CVE-2026-78509 is a critical heap-based buffer overflow vulnerability in Microsoft Office Outlook, part of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code remotely over a network without user interaction. The vulnerability affects multiple versions prior to specific fixed releases. Microsoft has issued official fixes for this vulnerability.
CVE-2026-78517 is a heap-based buffer overflow vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.8. Microsoft has released official fixes for multiple affected versions of the software.
CVE-2026-78510 is a heap-based buffer overflow vulnerability in Microsoft 365 Apps for Enterprise that allows an unauthorized attacker to execute code locally. The flaw affects multiple versions prior to specific fixed releases. Microsoft has issued official fixes for this vulnerability.
CVE-2026-78505 is a heap-based buffer overflow vulnerability in Microsoft 365 Apps for Enterprise that allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions prior to specific fixed releases. Microsoft has issued official fixes for this vulnerability. The CVSS v3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported.
CVE-2026-78511 is a heap-based buffer overflow vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed releases. A high-severity CVSS score of 8.8 reflects the critical impact on confidentiality, integrity, and availability. Microsoft has issued official fixes for the affected versions.
CVE-2026-67384 is an integer overflow or wraparound vulnerability in Microsoft SQL Server 2017 (CU 31) and related versions. This flaw allows an authorized attacker with network access and low privileges to execute arbitrary code remotely. The vulnerability affects multiple versions of SQL Server 2017, 2019, 2022, and later branches prior to specific fixed releases. Microsoft has issued official fixes for all affected versions. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating a significant risk if exploited.
CVE-2026-77907 is a heap-based buffer overflow vulnerability in Microsoft Visual Studio 2026 version 18.9 that allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects versions 18.9.0 through before 18.9.3. An official fix is available in version 18.9.3.
CVE-2026-77904 is a heap-based buffer overflow vulnerability in the Windows Volume Manager Extension Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in specific Windows updates.
CVE-2026-77898 is a heap-based buffer overflow vulnerability in Microsoft 365 Apps for Enterprise that allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity score of 7.5 and affects multiple versions prior to fixed releases. Microsoft has issued official fixes for this vulnerability.
CVE-2026-69285 is a heap-based buffer overflow vulnerability in Microsoft 365 Apps for Enterprise that allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions prior to specific fixed releases. Microsoft has issued official fixes for this vulnerability. The CVSS score is 8.8, indicating high severity.
CVE-2026-72986 is a heap-based buffer overflow vulnerability in the Graphic Fonts component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes addressing this issue.
CVE-2026-69787 is a heap-based buffer overflow vulnerability in the Windows Biometric Service on Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score and has been officially fixed by Microsoft in multiple Windows 10 builds.