CVE-2026-83578

CriticalCVSS 9.8/10Last modified Oct 16, 2026

Description

Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122CWE-190CWE-191

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-835797.8Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.CVE-2026-83585.4LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same chanCVE-2026-835807.0Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.CVE-2026-835824.7Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally.CVE-2026-835837.8Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.CVE-2026-835847.0Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.CVE-2026-835857.8Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-835867.8Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locallCVE-2026-835877.8Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.CVE-2026-835887.8Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.CVE-2026-835896.1A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login rediCVE-2026-83597.5When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patt
CVE-2026-83578: Critical severity, CVSS 9.8 | Vulnix