CVE-2026-25179

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1287

Affected software

No affected versions have been published.

Timeline

Published
Mar 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-25184.3The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on tCVE-2026-251805.5Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.CVE-2026-251817.5Out-of-bounds read in Windows GDI+ allows an unauthorized attacker to disclose information over a network.CVE-2026-251847.0Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) aCVE-2026-251855.3Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoofCVE-2026-251865.5Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacCVE-2026-251877.8Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.CVE-2026-251888.8Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent network.CVE-2026-251897.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-25195.3The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameCVE-2026-251907.8Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally.CVE-2026-251918.4The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a