Skip to content
ThreatCluster

Two High-Risk Windows Vulnerabilities Disclosed on October 13, 2026

First seen 14 Oct 2026, 20:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 21:33 UTC

On October 13, 2026, two significant vulnerabilities were published affecting Windows systems. CVE-2026-85908 is a heap-based buffer overflow in the Windows Win32K component, allowing local privilege escalation by authorized attackers, with a CVSS score of 7.8. CVE-2026-83785 involves a use-after-free flaw in the Windows COM+ Event System Service, also permitting local privilege escalation, rated at 7.0. Both vulnerabilities are currently marked with an unknown status regarding exploitation. Microsoft has released advisories for both vulnerabilities, urging users to apply patches. The vulnerabilities affect various Windows versions, but specific affected versions were not detailed in the articles.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-13
CVE-2026-85908 published
Heap-based buffer overflow in Windows Win32K allows local privilege escalation. CVSS score: 7.8.
Cve
2026-10-13
CVE-2026-83785 published
Use after free in Windows COM+ Event System Service permits local privilege escalation. CVSS score: 7.0.
Cve

More articles in this cluster (4)

Following this threat?

Track CVE-2026-83785 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 4

Common questions

What systems are affected by these vulnerabilities?
Both vulnerabilities affect various versions of Windows, but specific affected versions are not detailed.
What is the current exploitation status?
The exploitation status for both vulnerabilities is currently unknown.
What actions should be taken?
Users should apply the available patches as soon as possible to mitigate risks.