CVE-2026-70157: Heap-based buffer overflow in Windows System Information Console
- Severity
- 9.8 (CRITICAL)
- Vendor
- MICROSOFT
- Patch status
- Unknown
- Published
- 2026-10-13T19:19:29.030
- Modified
- 2026-10-13T19:30:09.283
Why it matters
Critical vulnerability requiring immediate validation against your environment.
Recommended admin actions
- Prioritize validation immediately due to critical CVSS severity.
- Treat internet-facing systems as higher priority.
Technical summary
Heap-based buffer overflow in Windows System Information Console allows an unauthorized attacker to execute code over a network.
View the official NVD record for CVE-2026-70157
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
2241 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-89111 |
The SAP Cloud SDK for Python
Reporter: CNA
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-97229 |
GitLab PATCH
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-65162 |
NVIDIA AIStore for Linux
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2024-34323 |
an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-55675 |
docs
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-94603 |
podman PATCH
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-103849 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-110130 |
Dockhand PATCH
Reporter: DISCLOSURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-96012 |
IBM Db2 Mirror for i 7.4, 7.5, and 7.6
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-96119 |
IBM
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-89107 |
SAP
Reporter: CNA
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-89110 |
SAP
Reporter: CNA
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-106042 |
Xtraction PATCH
Reporter: 3C1D8AA1-5A33-4EA4-8992-AADD6440AF75
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-109412 |
Neurons Patch for Intune PATCH
Reporter: 3C1D8AA1-5A33-4EA4-8992-AADD6440AF75
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-77459 |
argo-cd PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-109575 |
Data Plane API EE PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-90920 |
IBM
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-87689 |
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-53709 |
MCP Context Forge is an MCP gateway and administrative platform PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69227 |
A flaw in Portal for ArcGIS
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-106173 |
FortiSIEM
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-100202 |
Use after free in Windows Message Queuing Queue Manager
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-100219 |
Use after free in Microsoft QUIC
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-100222 |
Heap-based buffer overflow in Network Policy Server (NPS)
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-102210 |
Heap-based buffer overflow in Windows Text Shaping
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-105010 |
Use after free in Microsoft Windows Search Component
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-105016 |
Heap-based buffer overflow in Microsoft QUIC
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69634 |
Heap-based buffer overflow in Windows iSCSI
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69639 |
Heap-based buffer overflow in Windows Libarchive
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69705 |
Out-of-bounds write in Windows iSCSI
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69883 |
Use after free in Windows iSCSI
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69886 |
Heap-based buffer overflow in Windows Imaging Component
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70024 |
Stack-based buffer overflow in Windows Internet Information Services
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70096 |
Heap-based buffer overflow in Windows Rich Text Edit Control
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70147 |
Heap-based buffer overflow in Microsoft PostScript Printer Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70153 |
Heap-based buffer overflow in Microsoft PostScript Printer Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70157 |
Heap-based buffer overflow in Windows System Information Console
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70242 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70291 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70300 |
Untrusted pointer dereference in Microsoft Office Word
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83517 |
Heap-based buffer overflow in Microsoft Windows Media Foundation
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83519 |
Heap-based buffer overflow in Windows Error Reporting
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83578 |
Integer underflow (wrap or wraparound) in Windows PowerShell
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83693 |
Heap-based buffer overflow in Windows Error Reporting
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83748 |
Heap-based buffer overflow in Windows Error Reporting
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83770 |
Heap-based buffer overflow in Windows Text Shaping
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83780 |
Use after free in Windows CCFFilter Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83782 |
Heap-based buffer overflow in Windows Shell
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83862 |
Use after free in Windows Network Load Balancing
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83869 |
Integer underflow (wrap or wraparound) in DNS Server
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83910 |
Windows 10 Version 1607
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83935 |
Heap-based buffer overflow in Microsoft XML
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-84015 |
Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85792 |
Remote Code Execution in Windows Routing and Remote Access Service (RRAS)
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85806 |
Integer underflow (wrap or wraparound) in Network Policy Server (NPS)
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85809 |
Remote Code Execution in Windows Routing and Remote Access Service (RRAS)
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85814 |
Heap-based buffer overflow in Microsoft Windows Media Foundation
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85928 |
Heap-based buffer overflow in Windows Volume Manager Extension Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-88102 |
Use after free in Windows Failover Cluster
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-88156 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-88178 |
Use after free in Microsoft Office PowerPoint
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-92909 |
ADOBE
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96096 |
Heap-based buffer overflow in Windows Media Player
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96113 |
Heap-based buffer overflow in DNS Server
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96219 |
Windows 10 Version 1809
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96320 |
Heap-based buffer overflow in Windows DHCP Server
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96864 |
Double free in Microsoft Failover Cluster Virtual Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96909 |
Heap-based buffer overflow in Windows BitLocker
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96924 |
Untrusted pointer dereference in Windows OLE
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96934 |
Use after free in Windows DHCP Server
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97016 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97749 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97805 |
Out-of-bounds read in Windows Partition Management Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97814 |
Heap-based buffer overflow in Windows Text Shaping
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97815 |
Heap-based buffer overflow in Windows Error Reporting
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97816 |
Windows 10 Version 1809
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-82101 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82103 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82110 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-109705 |
MOZILLA PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-109707 |
MOZILLA PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-104192 |
Dragonfly is an in-memory data store built for modern application workloads PATCH
Reporter: SECURITY-ADVISORIES
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-55183 |
rclone-manager PATCH
Reporter: SECURITY-ADVISORIES
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-108929 |
NR268
Reporter: CNA
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63350 |
the user’s browser session and perform PLC operations
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63353 |
Affected devices do not properly sanitize comment fields contained in imported trace files
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63354 |
imported CSV trace files
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-74040 |
Wazuh PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-74041 |
Wazuh 4.14.3 PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-105445 |
DOCKER
Reporter: SECURITY
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-88092 |
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core
Reporter: SECURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2025-71429 |
GPT-SoVITS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109566 |
Rapyd Admin from 9.0.0 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109569 |
sandboxed.sh
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-44828 |
Qexo PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109758 |
a Node.js 24/Express deployment
Reporter: SECURITY
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109109 |
WL-WN530BE1-A
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109110 |
WL-WN592AX6
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109520 |
iGameCenter
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-77099 |
Commvault Cloud PATCH
Reporter: 050066FD-A2F9-4F32-AB5D-4C53F48BC333
|
9.3
CRITICAL
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.