Mercredi 14 octobre 2026

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

Use after free in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2016 · Microsoft Windows Server 2016 (Server Core installation)

Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation)

Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1 · Microsoft Windows 11 Version 26H2

Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 R2 · Microsoft Windows Server 2012 R2 (Server Core installation)

Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.

Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1 · Microsoft Windows 11 Version 26H2

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation)

Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022 · Microsoft Windows Server 2025

Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.

Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022 · Microsoft Windows Server 2025

Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.

Microsoft Windows Server 2022

Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1 · Microsoft Windows 11 Version 26H2

Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1 · Microsoft Windows 11 Version 26H2

Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1 · Microsoft Windows 11 Version 26H2

Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation)

Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation)

Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation)

Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation)

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation) · Microsoft Windows Server 2012 R2 · Microsoft Windows Server 2012 R2 (Server Core installation)

Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.

Microsoft Windows Server 2025 · Microsoft Windows Server 2025 (Server Core installation)

Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2

Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.