Microsoft November patches fix 1,090 flaws, one Outlook bug exploited
CVE-2026-124194 can leak an NTLMv2 hash if a user opens a crafted Outlook file; ZDI flags 30 wormable bugs.
78
CVE-2026-95962
Use-after-free RCE in Windows Virtual Filtering Platform
- CVSS 3.1
- 9.0 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A use-after-free flaw in Windows Virtual Filtering Platform (VFP) lets an unauthorized attacker execute code over the network, with no user interaction required. Successful exploitation can affect confidentiality, integrity, and availability beyond the vulnerable component. Microsoft has not listed affected builds or a fixed version.
What to do: Apply Microsoft's update for CVE-2026-95962 when it is available. No workaround is stated.
| Product | Affected |
|---|---|
| Microsoft Windows Virtual Filtering Platform (VFP) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in Windows Virtual Filtering Platform (VFP) allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-416
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
2 storiesMicrosoft patches 1,259 flaws, including exploited Outlook bug
Opening a crafted message can leak an NTLMv2 hash without Outlook’s usual warning.
78