CVE-2026-78459

HighCVSS 7.8/10Last modified Oct 16, 2026

Description

Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-78462.6A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-CVE-2026-784617.4Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypaCVE-2026-784628.8Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a nCVE-2026-784638.8Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized attacker to execute code over a neCVE-2026-784647.0Time-of-check time-of-use (toctou) race condition in Windows MIDI Service Module allows an authorized attacker to elevate privileges locallyCVE-2026-784657.0A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memorCVE-2026-78472.6A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file CVE-2026-784706.5The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficieCVE-2026-784715.4The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and includiCVE-2026-784728.6The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, CVE-2026-784745.3The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its reportCVE-2026-784756.1A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-L
CVE-2026-78459: High severity, CVSS 7.8 | Vulnix