Heap-Based Buffer Overflow RCE in Windows Print Spooler Components (CVE-2026-85877)
CVE-2026-85877 is a heap-based buffer overflow (CWE-122) in the Windows Print Spooler components, fixed by Microsoft in its September 2026 Patch Tuesday release. A remote, unauthenticated attacker can trigger the flaw by sending crafted input to the Print Spooler service over the network, though the CVSS vector (UI:R) indicates some form of user interaction is required for successful exploitation. If exploited, the attacker gains arbitrary code execution on the target system, with the CVSS base metrics indicating high impact to confidentiality, integrity, and availability. Any Windows system with the Print Spooler service enabled is affected; the available data does not enumerate specific vulnerable Windows versions or builds. There is currently no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns only a 0.4% probability of exploitation within the next 30 days (37th percentile).
· Microsoft Windows Print Spooler Components (Windows systems with the Print Spooler service enabled)mass
Use-After-Free RCE in Windows Message Queuing (MSMQ)
CVE-2026-83997 is a use-after-free (CWE-416) vulnerability in Microsoft's Windows Message Queuing (MSMQ) service that permits an unauthenticated, remote attacker to execute arbitrary code over the network. It is triggered when the MSMQ service processes specially crafted network traffic that causes memory to be used after it has been freed, with the high attack-complexity rating (AC:H) indicating the attacker likely needs to win a timing or state race to land the free-then-use condition. Successful exploitation yields code execution in the context of the MSMQ service, with high confidentiality, integrity, and availability impact, meaning an attacker could take over the affected host. Only Windows systems that have the optional Message Queuing (MSMQ) feature installed and running are exposed, since MSMQ is not enabled by default on most Windows installations and is typically found on legacy application and queuing servers. There is no evidence of exploitation so far: the flaw is not in CISA's KEV, no public proof-of-concept is known, EPSS is 0.5% (42nd percentile), and the two actively exploited zero-days mentioned in September 2026 Patch Tuesday headlines are separate issues fixed in the same release.
· Microsoft Windows Message Queuing (MSMQ) - Windows releases with the optional Message Queuing feature installed and runninglarge
Local Privilege Elevation via Heap Buffer Overflow in Windows Biometric Service
CVE-2026-83978 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the built-in component that handles fingerprint, face, and other biometric authentication on Windows. An attacker who already has a standard (low-privileged) account on the machine can trigger the flaw locally, with no user interaction required, causing memory corruption in the service. Successful exploitation allows the attacker to elevate privileges on the local host, gaining high confidentiality, integrity, and availability impact — a classic local privilege escalation to administrative/SYSTEM-level access. Anyone running the affected Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1) client builds, or Windows Server 2016, 2019, 2022, or 2025, is in scope, and because the Biometric Service ships with Windows by default the exposure spans essentially the entire installed base on those branches. As of the September 2026 Patch Tuesday release (which fixed 973 vulnerabilities and two other actively exploited zero-days), no public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and its EPSS of 0.3% (25th percentile) points to low near-term exploitation risk.
· Microsoft Windows 10 1607 1607 · Microsoft Windows 10 1809 1809mass
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
· microsoft windows 10 1607 · microsoft windows 10 1809—
Heap Buffer Overflow in Windows Biometric Service Enables Local Privilege Escalation
CVE-2026-83985 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WbioSrvc) on supported Windows 10, Windows 11, and Windows Server releases. A local, already-authenticated user with low privileges and no user interaction can trigger the overflow via a crafted request or operation handled by the service. Successful exploitation yields elevated privileges on the local host, with high impact on confidentiality, integrity, and availability — effectively a full local compromise. Any organization or individual running the listed Windows 10/11 client versions or Windows Server 2016–2025 is exposed, though exploitation requires local code execution first. The flaw is not in CISA KEV, has no known public PoC, a modest 0.3% EPSS, and is believed unexploited; it was addressed in Microsoft's September 2026 Patch Tuesday release, which fixed 973 vulnerabilities (two of them already-exploited zero-days, though not this one).
· microsoft Windows 10 1607, 1809, 21H2, 22H2 · microsoft Windows 11 23H2, 24H2, 25H2, 26H1mass
Use-After-Free Privilege Escalation in Windows Biometric Service
CVE-2026-83979 is a use-after-free flaw (CWE-416) in the Windows Biometric Service, the component that handles fingerprint, facial, and other biometric authentication on Windows. An attacker who is already authorized on the machine with low privileges can trigger the bug, presumably by sending crafted input to the service that causes memory to be used after it has been freed. Successful exploitation allows local elevation of privileges, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected range spans mainstream Windows 10 and Windows 11 client releases plus Windows Server 2016 through 2025, covering nearly the entire currently supported Windows estate. As of the September 2026 Patch Tuesday disclosure there is no CISA KEV listing, no known public proof-of-concept, and EPSS estimates only a 0.3% chance of exploitation within 30 days; the flaw is not identified as one of the two zero-days actively exploited that month.
· Microsoft Windows 10 1607 (builds prior to the September 2026 security updates) · Microsoft Windows 10 1809 (builds prior to the September 2026 security updates)mass
Heap Buffer Overflow in Microsoft Graphics Component Enables Local Code Execution
CVE-2026-84000 is a heap-based buffer overflow (CWE-122) involving an integer-overflow condition (CWE-190) in the Microsoft Graphics Component. An attacker who is already authorized on the machine with low privileges can trigger the overflow locally, with no user interaction required per the CVSS vector (AV:L/AC:L/PR:L/UI:N). Successful exploitation yields local code execution with high impact on confidentiality, integrity and availability (C:H/I:H/A:H), consistent with an elevation-of-privilege outcome on the affected system. Any supported Windows system containing the Graphics Component is affected, and Microsoft addressed the flaw among the 973 vulnerabilities fixed in the September 2026 Patch Tuesday release. Exploitation has not been observed: the bug is not on CISA's KEV, no public proof-of-concept is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.
· Microsoft Graphics Component (shipped with Windows client and server editions)mass
Local Privilege Escalation via Heap Overflow in Windows Biometric Service
CVE-2026-83974 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the Windows component that handles fingerprint, face, and other biometric authentication data. A local attacker who already holds valid low-privilege credentials can send crafted input to the service, overrunning a heap buffer and corrupting adjacent memory without any user interaction. Successful exploitation allows the attacker to elevate privileges, gaining high-level (typically SYSTEM) access with full confidentiality, integrity, and availability impact on the host. Any system running an affected Windows 10 or Windows 11 branch or an affected Windows Server release is in scope; the Biometric Service is present by default on these platforms, with exposure most relevant on systems where biometric logon (Windows Hello) is configured. As of the September 2026 Patch Tuesday release, there is no known public proof-of-concept, the flaw is not on the CISA KEV list, and EPSS puts 30-day exploitation probability at only 0.2% (16th percentile).
· microsoft Windows 10 1607 (LTSC/Long-Term Servicing branch) 1607 · microsoft Windows 10 1809 1809mass
Out-of-bounds Read in Windows Kerberos KDC Enables Network Denial of Service
CVE-2026-84001 is an out-of-bounds read (CWE-125) in the Windows Key Distribution Center (KDC), the Kerberos authentication component built into Windows. An unauthorized, remote attacker can trigger it by sending specially crafted network requests to the KDC service, causing the service to read beyond allocated memory. According to the CVSS vector, the impact is availability-only (C:N/I:N/A:H): the attacker gains denial of service, not code execution, data theft, or tampering, though taking down the KDC on domain controllers can disrupt Kerberos authentication for an entire Active Directory domain. Any Windows system running the KDC is affected, chiefly Windows domain controllers and servers, although the specific affected Windows version ranges are not enumerated in the available data. There is no known public proof-of-concept, the CVE is not in CISA's KEV catalog, and its EPSS probability of ~0.6% suggests exploitation risk is currently low; the fix shipped in Microsoft's September 2026 Patch Tuesday release.
· Microsoft Windows (Key Distribution Center / Kerberos KDC service, primarily on Windows domain controllers and servers)mass
Use-After-Free Local Privilege Escalation in Windows Kernel (CVE-2026-85360)
CVE-2026-85360 is a use-after-free (CWE-416) memory-safety flaw in the Windows kernel. An attacker with valid low-privileged local access must execute code that triggers the flawed kernel memory handling (rated high attack complexity, suggesting a timing- or race-sensitive trigger), causing the kernel to reference freed memory. Successful exploitation elevates the attacker's privileges locally, typically to SYSTEM, giving full control of the affected machine. It affects a broad range of supported Windows 10 and Windows 11 client builds as well as Windows Server 2012 through 2022, so nearly any Windows endpoint or server in an organization's fleet may be in scope. No public proof-of-concept, no CISA KEV listing, and a low EPSS (0.2%, 14th percentile) indicate exploitation is not known at publication, though the flaw was disclosed amid Microsoft's September 2026 Patch Tuesday, which fixed 973 vulnerabilities including two exploited zero-days.
· microsoft Windows 10 1607 · microsoft Windows 10 1809mass