CVE-2026-108407

HighCVSS 7.8/10Last modified Nov 10, 2026

Description

Out-of-bounds read in Windows GDI allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1084085.5Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.CVE-2026-1084095.5Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to discloCVE-2026-108416.5IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTCVE-2026-1084105.5Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.CVE-2026-1084118.8Heap-based buffer overflow in Windows ODBC Driver allows an unauthorized attacker to execute code over a network.CVE-2026-1084127.8Heap-based buffer overflow in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally.CVE-2026-1084137.0Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.CVE-2026-1084147.0Use after free in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-1084156.8Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with CVE-2026-1084166.8Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with CVE-2026-1084176.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-1084186.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
CVE-2026-108407: High severity, CVSS 7.8 | Vulnix