Schwachstellen, die jetzt zählen.

Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. An insecure temporary directory used by Aspire CLI-generated builds can allow a local attacker to influence MSBuild response-file discovery and execute code with the privileges of the developer running the CLI. ## Announcement Announcement for this issue can be…

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.

Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a…

Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network.

Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

Microsoft Developer Tools: Mehrere Schwachstellen

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Microsoft Developer Tools: Mehrere Schwachstellen

Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Developer Tools: Mehrere Schwachstellen

Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally.

Microsoft Developer Tools: Mehrere Schwachstellen

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.

Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.

Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

Double free in Windows Cred SSProvider Protocol allows an unauthorized attacker to execute code over a network.

Use of uninitialized resource in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Use after free in Windows DNS allows an authorized attacker to elevate privileges locally.

Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network.

Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network.

Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network.

Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.