CVE-2026-61932

HighCVSS 7.8/10Last modified Aug 16, 2026

Description

Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-843

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Aug 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-619335.5Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.CVE-2026-619347.8Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-619365.5Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.CVE-2026-619377.8Integer overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.CVE-2026-619387.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-619397.0Use after free in Winlogon allows an authorized attacker to elevate privileges locally.CVE-2026-61948.8A weakness has been identified in Totolink A3002MU B20211125.1046. Affected by this vulnerability is the function sub_410188 of the file /bo CVE-2026-619437.5Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.CVE-2026-619447.1Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.CVE-2026-619456.5Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert all CVE-2026-619466.5Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.CVE-2026-619477.1Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.