Microsoft Windows 11 Version 26h1
242 CVEs affecting Microsoft Windows 11 Version 26h1. Latest disclosed: 2026-05-20. Critical: 2, High: 194.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41096 | Critical | 9.8 | 2026-05-12 | Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network. |
CVE-2026-33824 | Critical | 9.8 | 2026-04-14 | Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. |
CVE-2026-40403 | High | 8.8 | 2026-05-12 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally. |
CVE-2026-34329 | High | 8.8 | 2026-05-12 | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-32157 | High | 8.8 | 2026-04-14 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2026-32225 | High | 8.8 | 2026-04-14 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-26167 | High | 8.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-25188 | High | 8.8 | 2026-03-10 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent network. |
CVE-2026-25177 | High | 8.8 | 2026-03-10 | Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a netw… |
CVE-2026-24283 | High | 8.8 | 2026-03-10 | Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-23669 | High | 8.8 | 2026-03-10 | Use after free in RPC Runtime allows an authorized attacker to execute code over a network. |
CVE-2026-21255 | High | 8.8 | 2026-02-10 | Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally. |
CVE-2026-21510 | High | 8.8 | 2026-02-10 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-21513 | High | 8.8 | 2026-02-10 | Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-32162 | High | 8.4 | 2026-04-14 | Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-32091 | High | 8.4 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an unauthorized attacker… |
CVE-2026-32221 | High | 8.4 | 2026-04-14 | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. |
CVE-2026-40415 | High | 8.1 | 2026-05-12 | Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. |
CVE-2026-33827 | High | 8.1 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code o… |
CVE-2026-26111 | High | 8.0 | 2026-03-10 | Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |