Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 17,903 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 6 hours ago Checked every 6 hours
All vendor sources Official source

17,903 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2025-1220
LowCVSS 3.7

Null byte termination in hostnames

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 php 8.1.33-1 on CBL Mariner 2.0, azl3 php 8.3.23-1 on Azure Linux 3.0, cbl2 php 8.1.32-1 on CBL Mariner 2.0, azl3 php 8.3.29-1 on Azure Linux 3.0
Fixed versions8.1.33-1
Vendor guidance

CBL-Mariner Releases

CVE-2025-1220
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-11839
LowCVSS 3.3

GNU Binutils prdbg.c tg_tag_type return value

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 binutils 2.41-9 on Azure Linux 3.0, azl3 binutils 2.41-10 on Azure Linux 3.0, cbl2 binutils 2.37-17 on CBL Mariner 2.0, cbl2 binutils 2.37-19 on CBL Mariner 2.0
Fixed versions2.41-11, 2.37-20
Vendor guidance

CBL-Mariner Releases

CVE-2025-11839
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-26160
HighCVSS 7.8

Remote Desktop Licensing Service Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Fixed versions10.0.28000.1836, 10.0.17763.8644, 10.0.20348.5020, 10.0.19044.7184
Vendor guidance

Install KB5083768. Install KB5082123. Install KB5082142. Install KB5082200. Install KB5082063. Install KB5083769. Install KB5082052. Install KB5082060. Install KB5082198. Install KB5082127. Install KB5082126.

CVE-2026-26160
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-26159
HighCVSS 7.8

Remote Desktop Licensing Service Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8644, 10.0.20348.5020, 10.0.19044.7184, 10.0.19045.7184
Vendor guidance

Install KB5082123. Install KB5082142. Install KB5082200. Install KB5082063. Install KB5083769. Install KB5082052. Install KB5082060. Install KB5082198. Install KB5082127. Install KB5082126. Install KB5083768.

CVE-2026-26159
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-33827
CriticalCVSS 8.1

Windows TCP/IP Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8644, 10.0.20348.5020, 10.0.19044.7184, 10.0.19045.7184
Vendor guidance

Install KB5082123. Install KB5082142. Install KB5082200. Install KB5082063. Install KB5083769. Install KB5082052. Install KB5082060. Install KB5083768. Install KB5082198. Install KB5082127. Install KB5082126.

CVE-2026-33827
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-33826
CriticalCVSS 8.0

Windows Active Directory Remote Code Execution Vulnerability

Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.

Affected productsWindows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022 (Server Core installation)
Fixed versions10.0.17763.8644, 10.0.20348.5020, 10.0.26100.32690, 10.0.25398.2274
Vendor guidance

Install KB5082123. Install KB5082142. Install KB5082063. Install KB5082060. Install KB5082198. Install KB5082126.

CVE-2026-33826
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-33115
CriticalCVSS 8.4

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021 for 64-bit editions
Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.108.26041219
Vendor guidance

Click to Run Release Notes

CVE-2026-33115
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-33114
CriticalCVSS 8.4

Microsoft Word Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021 for 64-bit editions
Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.108.26041219
Vendor guidance

Click to Run Release Notes

CVE-2026-33114
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-32190
CriticalCVSS 8.4

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems
Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.108.26041219, 16.0.5548.1000
Vendor guidance

Click to Run Release Notes Install KB5002859.

CVE-2026-32190
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-65018
HighCVSS 7.1

LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

Mariner

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8644, 10.0.20348.5020, 10.0.19044.7184, 10.0.19045.7184
Vendor guidance

Install KB5082123. Install KB5082142. Install KB5082200. Install KB5082063. Install KB5083769. Install KB5082052. Install KB5082060. Install KB5083768. Install KB5082198. Install KB5082127. Install KB5082126.

CVE-2025-65018
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2025-64720
HighCVSS 7.1

LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

Mariner

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8644, 10.0.20348.5020, 10.0.19044.7184, 10.0.19045.7184
Vendor guidance

Install KB5082123. Install KB5082142. Install KB5082200. Install KB5082063. Install KB5083769. Install KB5082052. Install KB5082060. Install KB5083768. Install KB5082198. Install KB5082127. Install KB5082126.

CVE-2025-64720
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-33822
HighCVSS 6.1

Microsoft Word Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Affected productsMicrosoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024
Fixed versionshttps://aka.ms/OfficeSecurityReleases, 16.108.26041219
Vendor guidance

Click to Run Release Notes

CVE-2026-33822
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-33116
HighCVSS 7.5

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

Affected products.NET 10.0 installed on Mac OS, .NET 10.0 installed on Linux, .NET 8.0, .NET 8.0 installed on Windows
Fixed versions10.0.6, 8.0.26, 9.0.15, 4.8.4801.0
Vendor guidance

Install KB5086095. Install KB5086096. Install KB5086097. Install KB5082411. Install KB5082403. Install KB5082414. Install KB5082427. Install KB5082426. Install KB5082413. Install KB5082400. Install KB5082402. Install ...

CVE-2026-33116
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-33104
HighCVSS 7.0

Win32k Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8644, 10.0.20348.5020, 10.0.19044.7184, 10.0.19045.7184
Vendor guidance

Install KB5082123. Install KB5082142. Install KB5082200. Install KB5082063. Install KB5083769. Install KB5082052. Install KB5082060. Install KB5083768. Install KB5082198. Install KB5082127. Install KB5082126.

CVE-2026-33104
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-33101
HighCVSS 7.8

Windows Print Spooler Elevation of Privilege Vulnerability

Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows Server 2022, 23H2 Edition (Server Core installation)
Fixed versions10.0.26100.32690, 10.0.26200.8246, 10.0.25398.2274, 10.0.26100.8246
Vendor guidance

Install KB5082063. Install KB5083769. Install KB5082060. Install KB5083768.

CVE-2026-33101
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources