CVE-2026-108132

HighCVSS 7.0/10Last modified Oct 23, 2026

Description

Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1081337.8Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locallCVE-2026-1081347.0Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-1081357.0Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges CVE-2026-1081367.8Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-108147.0A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rCVE-2026-108156.3A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects someCVE-2026-1081515.3Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows CVE-2026-1081567.1LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts tCVE-2026-1081578.1Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to CVE-2026-1081586.5plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting particiCVE-2026-1081597.5AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackCVE-2026-108167.5Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with manag