Patch Tuesday, January 2026 Edition
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-24932 | Secure Boot Security Feature Bypass Vulnerability | 6.7 | 11% | ||
| CVE-2023-31096 | An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys) | 7.8 | <1% | PoC | |
| CVE-2026-0628 | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious… | 8.8 | 7% | ||
CVE-2026-0892+1 related CVE | Memory safety bugs present in Firefox 146 and Thunderbird 146 | 9.8 group max | <1% | ||
| CVE-2026-20805 | Local Information Disclosure in Microsoft Desktop Windows Manager (CVE-2026-20805) | 5.5 | 7% | KEVPoC | KEV |
CVE-2026-20953+1 related CVE | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally | 8.4 | <1% | ||
| CVE-2026-21265 | Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB | 6.4 | 1% |
From the original article
4 min read at krebsonsecurity.comMicrosoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulnerabilities earned Microsoft’s most-dire “critical” rating, and the company warns that attackers are already exploiting one of the bugs fixed today.
krebsonsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.