CVE-2026-23668

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-236698.8Use after free in RPC Runtime allows an authorized attacker to execute code over a network.CVE-2026-23676.4The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'a CVE-2026-236705.7Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feat CVE-2026-236717.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allow CVE-2026-236727.8Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability CVE-2026-236737.8Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.CVE-2026-236747.5Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-236788.8Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute CVE-2026-236795.5libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a ma CVE-2026-23687.1An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptin CVE-2026-236814.3Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific functi CVE-2026-236834.3SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in es