CVE-2026-0390

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-807

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.9060
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.8644
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.7184
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.7184
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.9060
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.9060
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.8644
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.8644
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.5020

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0390Vendor Advisory

Timeline

Published: Apr 14, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-03916.5User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoof CVE-2026-03927.3eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or CVE-2026-03936.5The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to in CVE-2026-03945.3When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added CVE-2026-03964.3An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where CVE-2026-03974.3When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard in CVE-2026-03985.3Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.CVE-2026-03994.9Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking CVE-2026-04004.9A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.CVE-2026-04014.9A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.CVE-2026-04024.9A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall.CVE-2026-04038.0An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command