CVE-2026-32083

HighCVSS 7.0/10Last modified Oct 14, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Apr 14, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-320845.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information lo CVE-2026-320855.5Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an authorized attacker to disclose inform CVE-2026-320867.0Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows CVE-2026-320877.0Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.CVE-2026-320885.7Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthori CVE-2026-320897.8Use after free in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally.CVE-2026-32096.3A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the CVE-2026-320907.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech Brokered Api allows an authori CVE-2026-320917.0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an una CVE-2026-320937.0Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows CVE-2026-320946.5Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for CVE-2026-320955.4Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which brow