CVE-2026-41088

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published
May 12, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-410899.8Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.CVE-2026-41094.3The Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access oCVE-2026-410909.3Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to CVE-2026-410917.8Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locCVE-2026-410927.8Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally.CVE-2026-410948.8Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over CVE-2026-410957.8Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.CVE-2026-410969.8Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.CVE-2026-410976.7Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-410988.4Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to peCVE-2026-41106.1The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in thCVE-2026-411004.4Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.
CVE-2026-41088: High severity, CVSS 7.8 | Vulnix