A low-privileged local attacker can trigger a double free in Windows Hyper-V and elevate to SYSTEM. Microsoft released the official fix on October 14, 2026.
A normally executable PE32+ file could drive Ghidra's x64 chained-unwind parser into uncontrolled recursion, exhausting the Java stack during import.
Five runtime-validated vulnerabilities across privileged service trust, RPC command execution, kernel-monitor control, nonpaged-pool pressure, and telemetry controls.
A UTF-16 mapped path could expand beyond a fixed destination after UTF-8 conversion, causing an invalid-argument fast fail. The submitted fix bounds and terminates the copy.
A confirmed CWE-415 double free allows an authorized local attacker with low privileges to gain SYSTEM. Microsoft rates the issue Important at CVSS 3.1 7.8 and released official fixes on October 14, 2026.
Three distinct local denial-of-service vulnerabilities caused by kernel memory-safety faults in a Windows networking component.
Instruction-decoder inconsistencies and analysis seams around overlapping instruction streams.
Parser failures while processing adversarial binaries, including a code-execution vulnerability.
Loader bugs exercised through malformed binary input, including denial-of-service behavior.