Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

This vulnerability was found and addressed by AMD. We are documenting it in the Security Update Guide to encourage customers to install the May 2026 version of Windows as soon as possible. The vulnerability assigned to this CVE is in certain processor models offered by AMD. The mitigation for this

Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.

Improper neutralization of input during web page generation (‘cross-site scripting’) in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.

Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.