CWE-125: Out-of-bounds Read vulnerabilities

CVE-2026-97826 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to disclose information over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-97825 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Microsoft has released official fixes for all affected versions.

CVE-2026-97824 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Microsoft has released official fixes for affected versions.

CVE-2026-97823 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5 (medium severity) and affects multiple Windows 10 builds prior to their respective fixed versions. Microsoft has released official fixes for all affected versions.

CVE-2026-97822 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to disclose information over a network. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official fixes addressing this issue.

CVE-2026-97821 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily affecting confidentiality without integrity or availability impact. Multiple affected versions of Windows 10 are identified, with official fixes available in specific updated builds.

CVE-2026-97820 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to disclose information over a network. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes to address this issue.

CVE-2026-97819 is an out-of-bounds read vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a medium severity with a CVSS score of 6.5 and has been officially fixed in multiple Windows 10 versions.

CVE-2026-97805 is a critical out-of-bounds read vulnerability in the Windows Partition Management Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Microsoft has issued official fixes for all affected versions.

CVE-2026-105007 is a high-severity elevation of privilege vulnerability in Microsoft Windows 10 Version 1607 and related versions. It occurs due to an out-of-bounds read in the Network Driver Interface Specification (ndis.sys) when the driver fails to properly check buffer length before copying memory. Exploitation requires local access and execution of a specially crafted application, potentially allowing an attacker to run processes with elevated privileges. Microsoft has released official fixes that address this vulnerability by improving buffer length validation.

CVE-2026-105004 is an out-of-bounds read vulnerability in the Windows Overlay Filter component of Microsoft Windows 10 Version 1607 and related versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for affected versions.

CVE-2026-103569 is a high-severity out-of-bounds read vulnerability in the Windows IKE Extension affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to disclose information over a network without requiring user interaction or privileges. The vulnerability has been officially fixed in specific Windows 10 builds.

CVE-2026-103553 is an out-of-bounds read vulnerability in the Windows Partition Management Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-69922 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 6.5. Microsoft has issued official fixes in versions 16.0.14334.20878 and 16.0.17932.20934. No known exploits are reported in the wild. Users should apply the official patches to remediate this issue.

CVE-2026-102225 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and other versions, involving an out-of-bounds read in the Windows Text Shaping component. This flaw could allow an unauthorized attacker to execute code remotely over a network. The vulnerability has been officially fixed in multiple Windows 10 builds and earlier versions.

CVE-2026-102198 is an out-of-bounds read vulnerability in the Windows Remote Desktop Protocol affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a medium severity rating with a CVSS score of 5.3. Official patches have been released to address this issue.

CVE-2026-96209 is an out-of-bounds read vulnerability in the Windows Network File System component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score and affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has released official fixes for the affected versions.

CVE-2026-88226 is an out-of-bounds read vulnerability in the Windows Storage Port Driver affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an unauthorized attacker with physical access to the device to disclose information. The vulnerability has a medium severity rating and has been officially fixed in multiple Windows 10 builds.

CVE-2026-69506 is an out-of-bounds read vulnerability in the Windows Key Storage Provider component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to disclose sensitive information by reading memory outside the intended bounds. The vulnerability has a medium severity rating with a CVSS score of 4.7. Microsoft has released official fixes for affected versions.

CVE-2026-96118 is an out-of-bounds read vulnerability in the Windows Graphics Kernel affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has issued official fixes for all affected versions.