CVE-2026-83584

HighCVSS 7.0/10Last modified Oct 17, 2026

Description

Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 17, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-835857.8Use of externally-controlled format string in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-835867.8Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locallCVE-2026-835877.8Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.CVE-2026-835887.8Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.CVE-2026-835896.1A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login rediCVE-2026-83597.5When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL pattCVE-2026-835917.2The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex TrCVE-2026-835927.2The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versioCVE-2026-835937.2The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2026-835958.1AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actionCVE-2026-835968.8A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.CVE-2026-835977.0Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and
CVE-2026-83584: High severity, CVSS 7.0 | Vulnix