HIGHVulnerability
Verified
Global

CISA KEV: Microsoft Windows Ancillary Function Driver for WinSock — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Analysis

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA Known Exploited Vulnerabilities catalog on 2026-08-11. Remediation due: 2026-08-25.

Indicators of Compromise (1)

CVE (1)
CVE-2026-68820
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Aug 11, 2026. Verified by: CISA.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-73053 — SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in th...

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.

CVE-2026-73053
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-73052 — SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and...

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.

CVE-2026-73052
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-73050 — SiYuan versions before v3.7.4 fail to validate or escape the color field in attr...

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.

CVE-2026-73050
NIST NVD