Multiple CVEs Disclosed for Microsoft Products

On September 8, 2026, Microsoft published advisories for three critical vulnerabilities affecting its products. CVE-2026-54990 is a heap-based buffer overflow in the Remote Desktop Client, allowing unauthorized code execution via a malicious RDP server. CVE-2026-42914 is an out-of-bounds read in Windows Kerberos, enabling authorized attackers to cause denial of service under specific conditions. CVE-2026-44814 involves an out-of-bounds read in the Windows DWM Core Library, which could lead to local information disclosure. The vulnerabilities were released between June and July 2026, with the latest updates provided on September 8, 2026. Successful exploitation of these vulnerabilities requires user interaction or specific configurations. Microsoft has acknowledged these vulnerabilities and provided guidance for mitigation.

Key Points: • CVE-2026-54990 allows remote code execution via malicious RDP servers. • CVE-2026-42914 can cause denial of service under specific conditions. • CVE-2026-44814 may lead to local information disclosure.