CVE-2026-88241

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-882427.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-882439.8Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to execute code over a network.CVE-2026-882447.5Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-882457.8Missing authentication for critical function in Windows Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-882475.5Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information localCVE-2026-882498.8Use after free in Windows Client for NFS allows an unauthorized attacker to execute code over a network.CVE-2026-88254.9The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through oneCVE-2026-882525.5A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors CVE-2026-882556.3Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submisCVE-2026-882575.3Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch functionCVE-2026-882597.5CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with CVE-2026-882608.7Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzco
CVE-2026-88241: High severity, CVSS 7.8 | Vulnix