CVE-2026-108134

HighCVSS 7.0/10Last modified Oct 13, 2026

Description

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 13, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1081357.0Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges CVE-2026-1081367.8Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-108147.0A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rCVE-2026-108156.3A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects someCVE-2026-1081515.3Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows CVE-2026-1081567.1LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts tCVE-2026-1081578.1Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to CVE-2026-1081586.5plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting particiCVE-2026-1081597.5AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackCVE-2026-108167.5Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with managCVE-2026-1081607.5AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver maliciousCVE-2026-1081617.5FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers
CVE-2026-108134: High severity, CVSS 7.0 | Vulnix