CWE-122
Un débordement dans le tas corrompt les structures d’allocation et peut mener à l’exécution de code.
- 161
- vulnérabilités suivies
- 19
- critiques
- 27 juillet 2026
- dernière publication
cve
Veille des vulnérabilités
identifiantvulnérabilitésévéritépublié
CVE-2026-51235LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and fuji_rotate() function (src/decoders/fuji.cpp).Analyse NVD en cours Élevée CVSS 8.8 CVE-2026-55971Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.Apache Thrift Critique CVSS 9.8 CVE-2026-56165Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.Analyse NVD en cours Critique CVSS 9.8 CVE-2026-66035libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.Analyse NVD en cours Élevée CVSS 7.5 CVE-2026-66036FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption.Analyse NVD en cours Élevée CVSS 8.8 CVE-2026-66039FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution.Analyse NVD en cours Élevée CVSS 8.8 CVE-2026-66040FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution.Analyse NVD en cours Élevée CVSS 8.8 CVE-2026-49035The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.Analyse NVD en cours Élevée CVSS 8.1 CVE-2026-13072When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.Analyse NVD en cours Élevée CVSS 8.1 CVE-2026-40691In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger than 65504 bytes is shifted forward by 48 bytes inside a buffer of capacity equal to 'msg-buffer-size', writing past the end of the heap allocation. A single malicious encrypted query crashes the resolver and lead to denial of service. This vulnerability needs Unbound to be compiled with DNSCrypt support ('--enable-dnscrypt') and the 'dnscrypt:' clause to be configured and enabled for the listening interfaces.Nlnetlabs Unbound Élevée CVSS 7.5 CVE-2026-61390There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets. Élevée CVSS 7.7 CVE-2026-64830FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.Analyse NVD en cours Élevée CVSS 8.8 CVE-2026-8987Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution.Analyse NVD en cours Critique CVSS 9.4 CVE-2026-35591libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.Analyse NVD en cours Élevée CVSS 7 CVE-2026-41252xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices are not properly validated. A malicious VNC server can exploit this flaw by sending crafted messages with out-of-range values, leading to an out-of-bounds write on the heap. This memory corruption can result in a denial of service (DoS) or potentially allow remote code execution (RCE) prior to authentication. This issue has been fixed in version 0.10.6.1.Neutrinolabs Xrdp Critique CVSS 9.8 CVE-2026-44178xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1.Neutrinolabs Xrdp Élevée CVSS 8.8 CVE-2026-63090ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.Analyse NVD en cours Élevée CVSS 8.8 CVE-2026-64620FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward checks output_length > out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.Analyse NVD en cours Critique CVSS 9.8 CVE-2026-11826OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interface can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value; the value is persisted to mbconfig.cfg and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol at offset 108, dev_address at offset 109, ip_port at offset 210). A 200-byte payload writes 100 bytes past the allocation. The result is heap corruption leading to runtime crash and denial of service of the PLC process control loop, with attacker-controlled overwrite of adjacent configuration fields. The upstream repository was archived on 2026-04-04 and no fix is expected; the vendor has confirmed the issue does not affect OpenPLC Runtime v4. Élevée CVSS 8.8 CVE-2026-53994ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept.Analyse NVD en cours Élevée CVSS 7.5 CVE-2026-13473IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.Analyse NVD en cours Élevée CVSS 8.1 CVE-2026-16118A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.Analyse NVD en cours Élevée CVSS 7.1 CVE-2026-34150Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, a heap buffer overflow in wazuh-analysisd allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing complete loss of SIEM alert processing. The attack exploits the default configuration shipped in the official wazuh/wazuh-docker deployment with default configuration. An attacker can enroll with authd without a password to obtain a valid agent ID and encryption key, connect to remoted over the Wazuh agent protocol, and inject rootcheck events containing {key: value} patterns longer than 30 bytes that trigger a sprintf overflow of a 30-byte buffer in W_JSON_ParseRootcheck, corrupting the heap and crashing wazuh-analysisd so that all alert processing silently stops while the dashboard and API keep showing stale data.Wazuh Élevée CVSS 7.5 CVE-2026-40106Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards (* or ?), the agent allocates a fixed-size heap buffer of 256 bytes (OS_SIZE_256). By creating a registry subkey with a maximum allowed length (255 characters) inside a monitored path, a low-privileged local attacker can force an out-of-bounds write during string concatenation. Since wazuh-agent.exe runs as NT AUTHORITY\SYSTEM, this can lead to a silent Denial of Service (blinding the agent) or potentially Local Privilege Escalation (LPE). This issue has been fixed in version 4.14.5.Wazuh Élevée CVSS 7.8 CVE-2026-48373Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Analyse NVD en cours Élevée CVSS 7.8 CVE-2026-15422The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde. Critique CVSS 9.1 CVE-2026-42533A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.Analyse NVD en cours Élevée CVSS 8.1 CVE-2026-15767Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: High)Google Chrome Élevée CVSS 8.8 CVE-2026-24268NVIDIA TensorRT contains a vulnerability where an attacker might cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to code execution.Nvidia Tensorrt Élevée CVSS 7.8 CVE-2026-24272NVIDIA TensorRT contains a vulnerability where an attacker might cause an overflow to a heap-based buffer. A successful exploit of this vulnerability might lead to code execution.Nvidia Tensorrt Élevée CVSS 7.8 CVE-2026-42975Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.Microsoft Windows 10 1607 Élevée CVSS 8.8 CVE-2026-42990Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 CVE-2026-47471NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer overflow. A successful exploit of this vulnerability might lead to information disclosure, data tampering, or denial of service. Élevée CVSS 7.5 CVE-2026-48269Premiere Pro is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Premiere Pro Élevée CVSS 7.8 CVE-2026-48339Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.Adobe Bridge Élevée CVSS 7.8 CVE-2026-48564Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.8 CVE-2026-49164Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 CVE-2026-49172Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 CVE-2026-49175Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 21h2 Élevée CVSS 7.8 CVE-2026-49178Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.Microsoft Windows 10 1607 Élevée CVSS 8.8 CVE-2026-49184Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-49790Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege VulnerabilityMicrosoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-49793Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-49796Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-49797Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-49800Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 CVE-2026-50301Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.Microsoft 365 Apps Élevée CVSS 7.8 CVE-2026-50308Integer underflow (wrap or wraparound) in Windows NTFS allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50309Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50313Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50327Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.Microsoft Windows 11 24h2 Élevée CVSS 7.8 CVE-2026-50330Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to elevate privileges over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 CVE-2026-50332Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50336Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 24h2 Élevée CVSS 7.8 CVE-2026-50347Heap-based buffer overflow in Windows Data dll allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50362Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50363Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50370Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.Microsoft Windows 10 1607 Élevée CVSS 8.8 CVE-2026-50372Buffer over-read in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7 CVE-2026-50375Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 CVE-2026-50380Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.6 CVE-2026-50386Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50407Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50417Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50447Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 CVE-2026-50448Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50461Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50471Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50477Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50480Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50482Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50484Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 CVE-2026-50489Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50494Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50499Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 CVE-2026-50518Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.Microsoft Windows 10 1607 Critique CVSS 9.8 CVE-2026-50655Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-50670Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 CVE-2026-50675Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Microsoft 365 Apps Élevée CVSS 7.8 CVE-2026-50679Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.Microsoft Windows 11 24h2 Élevée CVSS 7.8 CVE-2026-50680Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 CVE-2026-50683Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges over an adjacent network.Microsoft Windows 10 1607 Élevée CVSS 8 CVE-2026-50692Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 8.8 CVE-2026-50696Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.Microsoft Windows 10 1809 Élevée CVSS 7.5 CVE-2026-54109Integer overflow or wraparound in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-54115Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-54122Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 8.4 CVE-2026-54124Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.Microsoft Terminal Élevée CVSS 7.8 CVE-2026-54986Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-54987Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-54990Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.Microsoft Windows 11 24h2 Élevée CVSS 8.8 CVE-2026-54992Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1607 Élevée CVSS 7.8 CVE-2026-54993Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.Microsoft Windows 10 1809 Élevée CVSS 7.8 CVE-2026-55005Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.Microsoft Exchange Server Élevée CVSS 8.8 CVE-2026-55010Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.Microsoft Minecraft Bedrock Dedicated Server Critique CVSS 9.8 CVE-2026-55012Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.Microsoft Malware Protection Engine Élevée CVSS 7.8 CVE-2026-55017Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.Microsoft 365 Apps Élevée CVSS 7.8 CVE-2026-55029Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Microsoft 365 Apps Élevée CVSS 7.8 CVE-2026-55033Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.Microsoft 365 Apps Élevée CVSS 7.8 CVE-2026-55037Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.Microsoft 365 Apps Élevée CVSS 7.8 Les 100 plus récentes.