Opinions, tips, and news orbiting Microsoft
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Continue reading CVE-2026-45605 Windows Bluetooth Service Elevation of Privilege Vulnerability
Improper neutralization of input during web page generation (‘cross-site scripting’) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. Continue reading CVE-2026-45467 Microsoft SharePoint Server Spoofing Vulnerability
Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network. Continue reading CVE-2026-42981 Windows Performance Monitor Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. Continue reading CVE-2026-44824 Microsoft Office Remote Code Execution Vulnerability
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally. Continue reading CVE-2026-42973 Windows Push Notification Information Disclosure Vulnerability
Access of resource using incompatible type (‘type confusion’) in Microsoft Office allows an unauthorized attacker to execute code locally. Continue reading CVE-2026-45456 Microsoft Outlook and Word Remote Code Execution Vulnerability
Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally. Continue reading CVE-2026-42971 Windows Push Notification Information Disclosure Vulnerability
Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally. Continue reading CVE-2026-33828 Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability