CVE-2026-35416

HighCVSS 7.0/10Last modified Nov 11, 2026

Description

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
May 12, 2026
Last modified
Nov 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-354177.8Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.CVE-2026-354187.0Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-354195.5Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.CVE-2026-35428.8Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memoCVE-2026-354207.8Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-354217.8Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.CVE-2026-354226.5Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over aCVE-2026-354235.4Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.CVE-2026-354247.5Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny sCVE-2026-354257.2Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.CVE-2026-354289.6Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to CVE-2026-354294.3User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform
CVE-2026-35416: High severity, CVSS 7.0 | Vulnix