CVE-2026

Api.Msrc.Microsoft • September 11, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Jul 14, 2026

Last updated: Sep 11, 2026

CWE-190: Integer Overflow or Wraparound

CWE-122: Heap-based Buffer Overflow

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Updated an acknowledgement. This is an informational change only.

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affect Windows Services with Elevation of Privileges Two critical vulnerabilities, CVE-2026-61349 and CVE-2026-54124, were disclosed by Microsoft on September 11, 2026. CVE-2026-61349, a use-after-free vulnerability in the Windows Work Folder Service, allows an authorized attacker to elevate privileges to SYSTEM level. CVE-2026-54124, an integer overflow vulnerability in Windows Terminal, enables unauthorized code execution locally. Both vulnerabilities have been acknowledged and updated in Microsoft's advisory. The vulnerabilities affect various Windows services, posing significant risks to users and organizations. Microsoft has released updates to mitigate these issues, and users are urged to apply them promptly. The current status indicates no active exploitation reported as of the latest update. 2 sources 46

CVE-2026

The full story

Extracted Entities

CWE Weaknesses (2)

Platforms (1)