The internet is broken right now.
94 critical CVEs without a fix in the last 48 hours. Somewhere a staging server is public. It always is. 35 more already have a fix that someone still has to apply.
-
CVE-2026-125137
Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
CVE-2026-125134
Use after free in Windows Function Discovery Resource Publication allows an unauthorized attacker to execute code over an adjacent network.
-
CVE-2026-124233
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-124227
Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-124183
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-124185
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-124187
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-124178
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-124179
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-124176
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-124170
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-124174
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123394
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123385
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123388
Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
-
CVE-2026-123389
Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.
-
CVE-2026-123378
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123379
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123380
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123381
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123383
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123384
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123375
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123376
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-123377
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
-
CVE-2026-122518
Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-122984
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
-
CVE-2026-122297
Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.
-
CVE-2026-122194
Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.
-
CVE-2026-122198
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
-
CVE-2026-122183
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
CVE-2026-122175
Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
-
CVE-2026-122176
Heap-based buffer overflow in Windows SMB allows an authorized attacker to execute code over a network.
-
CVE-2026-122179
Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.
-
CVE-2026-122170
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
CVE-2026-122171
Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network.
-
CVE-2026-122172
Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
-
CVE-2026-122173
Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.
-
CVE-2026-122165
Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
-
CVE-2026-122166
Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
-
CVE-2026-122167
Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.
-
CVE-2026-122168
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
-
CVE-2026-121681
Heap-based buffer overflow in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
-
CVE-2026-122162
Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally.
-
CVE-2026-122163
Double free in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.
-
CVE-2026-121677
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-121678
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
-
CVE-2026-121671
Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
CVE-2026-121673
Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally.
-
CVE-2026-120789
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.