CWE-416: Use After Free vulnerabilities

CVE-2026-70215 is a use-after-free vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity score of 8.8 and affects multiple versions prior to fixed releases. Microsoft has issued an official fix for this vulnerability.

CVE-2026-88120 is a high-severity use-after-free vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows Server 2012 and related Windows versions. This flaw allows an unauthorized attacker to execute code remotely over a network. Official patches have been released to address this issue.

CVE-2026-88119 is a high-severity use-after-free vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows Server 2012 and related builds. This flaw allows an unauthorized attacker to execute arbitrary code remotely over the network without user interaction. Microsoft has released official patches that address this vulnerability.

CVE-2026-88117 is a use-after-free vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows Server 2012 and related builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity rating with a CVSS score of 8.1. Microsoft has released official patches that address this issue in specific fixed versions.

CVE-2026-70250 is a high-severity use-after-free vulnerability in the Windows DHCP Client component affecting multiple versions of Microsoft Windows Server 2012 and related Windows versions. This flaw allows an unauthorized attacker on an adjacent network to execute arbitrary code without user interaction. The vulnerability has been officially fixed in specific updates for the affected versions.

CVE-2026-70160 is a use-after-free vulnerability in the Windows Kernel affecting multiple builds of Windows 10, including version 1607 and later updates. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity score and has been officially fixed in specific Windows 10 builds.

CVE-2026-69915 is a use-after-free vulnerability in the Windows NTFS component of Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity with a CVSS score of 7. A fix is officially available in multiple Windows 10 builds.

CVE-2026-88182 is a high-severity use-after-free vulnerability in the Microsoft Windows Search Component affecting Windows 10 Version 1607 and other specified builds. It allows an authorized local attacker to elevate privileges. The vulnerability has been officially fixed in multiple Windows 10 builds as listed by Microsoft.

CVE-2026-88141 is a use-after-free vulnerability in the Windows Kernel affecting Windows 11 version 23H2. It allows an authorized local attacker to elevate privileges. The vulnerability is rated high severity with a CVSS score of 7. An official fix is available in multiple updated Windows 11 builds.

CVE-2026-88139 is a use-after-free vulnerability in the Windows Kernel affecting Microsoft Windows 11 Version 24H2. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and is addressed by official patches released by Microsoft.

CVE-2026-88152 is a use-after-free vulnerability in the Windows Background Intelligent Transfer Service (BITS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8. Official patches have been released to address this issue in the specified fixed versions.

CVE-2026-88121 is a use-after-free vulnerability in the Windows Background Intelligent Transfer Service (BITS) affecting multiple versions of Microsoft Windows 10, including version 1607 and later builds. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity rating with a CVSS score of 8. An official fix is available in specific updated Windows 10 builds.

CVE-2026-88113 is a use-after-free vulnerability in the Windows Broadcast DVR User Service affecting Windows 10 Version 1809 and later builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in multiple Windows 10 builds.

CVE-2026-88109 is a use-after-free vulnerability in Microsoft Office Click-To-Run within Microsoft 365 Apps for Enterprise. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity with a CVSS score of 7.8. Official patches are available in versions 16.0.14334.20974 and 16.0.17932.21056. No known exploits are reported in the wild.

CVE-2026-88134 is a use-after-free vulnerability in the Windows Kernel affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and has been officially fixed in multiple Windows 10 builds.

CVE-2026-88127 is a use-after-free vulnerability in the Windows SMB Server component affecting multiple builds of Windows 10 Version 1607 and later. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7. An official fix is available from Microsoft in specific updated Windows 10 builds.

CVE-2026-88105 is a use-after-free vulnerability in the Windows Broadcast DVR User Service affecting multiple Windows 10 versions. It allows an authorized local attacker to elevate privileges. The flaw is rated high severity with a CVSS score of 7.8. Microsoft has issued official fixes for all affected versions.

CVE-2026-88103 is a use-after-free vulnerability in the Windows Broadcast DVR User Service affecting multiple builds of Windows 10 Version 1809 and later. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-87715 is a use-after-free vulnerability in Windows Installer on Microsoft Windows 10 Version 1607 and other specified versions. It allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score and has been officially fixed by Microsoft in multiple updates.

CVE-2026-87700 is a use-after-free vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.