Summary
Ein Angreifer kann mehrere Schwachstellen in Microsoft PowerToys, Microsoft Power Apps und Microsoft Apps ausnutzen, um erweiterte Berechtigungen – einschließlich Administratorrechte – zu erlangen, beliebigen Code auszuführen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.
Product
Microsoft PowerToys ist eine Sammlung von Dienstprogrammen für fortgeschrittene Benutzer, die das Windows-Erlebnis anpassen und optimieren.
Microsoft Power Apps ist eine Plattform zur Entwicklung von Low-Code-Anwendungen für Web und mobile Geräte.
Microsoft bietet in der Apps-Produktfamilie zahlreiche Anwendungen für mobile Endgeräte an.
Vulnerabilities 6
-
Critical 9.9
Microsoft Bookings Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
-
High 8.0
Microsoft Power Apps Remote Code Execution Vulnerability
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
-
High 7.3
Microsoft PowerToys Elevation of Privilege Vulnerability
External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
-
High 7.0CVE-2026-83844 Public exploit
Windows Paint Remote Code Execution Vulnerability
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code locally.
-
Medium 5.5CVE-2026-83681 Public exploit
Microsoft PowerToys Tampering Vulnerability
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
-
Medium 5.3
MessagePack: Nested arrays can blow past buffer length limits
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] …
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-102315
-
#1
Initiale Fassung
References
-
Microsoft Leitfaden für Sicherheitsupdates
https://msrc.microsoft.com/update-guide/
-
Microsoft Security Advisory CVE-2026-92707
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-92707
-
Microsoft Security Advisory CVE-2026-96188
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96188
-
Microsoft Security Advisory CVE-2026-83681
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83681
-
Microsoft Security Advisory CVE-2026-70213
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70213
-
Microsoft Security Advisory CVE-2026-94510
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94510
-
Microsoft Security Advisory CVE-2026-83844
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844