CVE-2026-20821

MediumCVSS 6.2/10Last modified Jul 30, 2026

Description

Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jul 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208227.8Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2026-208235.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information lo CVE-2026-208245.5Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally.CVE-2026-208254.4Improper access control in Windows Hyper-V allows an authorized attacker to disclose information locally.CVE-2026-208267.0Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsys CVE-2026-208275.5Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker CVE-2026-208284.6Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical atta CVE-2026-208295.5Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally.CVE-2026-20839.8A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file /delete_post.p CVE-2026-208307.0Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc)CVE-2026-208317.0Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate CVE-2026-208327.8Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability