By weakness (CWE)

CWE-197: related vulnerabilities

CVEs classified under CWE-197. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

4 published vulnerabilities

• CVE-2026-40404HIGH 7.8

  A flaw in Windows' Universal Disk Format (UDF) file system driver allows a logged-in user to gain elevated privileges on their machine. An attacker with basic user access can exploit a memory corruption issue in the UDFS driver to execute code with system-level permissions, potentially taking full control of the affected computer. This is a local-only vulnerability—attackers cannot exploit it remotely—but it represents a significant post-compromise escalation path and a serious risk in multi-tenant or shared-access environments.

• CVE-2026-40409HIGH 7.8

  A flaw in Windows' Universal Disk Format (UDF) file system driver allows a user with standard local access to gain elevated privileges on their machine. An attacker with a user account can craft specially formatted UDF media or manipulate UDF structures to trigger the vulnerability and execute code with system-level permissions. This is a local elevation-of-privilege issue—it requires prior access to the system but bypasses privilege boundaries to reach administrative capabilities.

• CVE-2026-44823HIGH 7.8

  Microsoft Office Excel contains a numeric truncation bug that can allow an attacker to run malicious code on a user's computer. The flaw is triggered when a user opens or works with a specially crafted Excel file, making it a local-execution risk. Since no authentication is required and user interaction (opening a file) is the only barrier, this poses a meaningful threat to organizations where Excel is widely used.

• CVE-2026-6679HIGH 7.5

  A memory corruption flaw exists in wolfSSL's DTLS 1.3 implementation that allows an unauthenticated remote attacker to crash affected services. The vulnerability stems from incorrect math when calculating the size of a data structure, resulting in a smaller buffer being allocated than needed. When the code then writes data into this undersized buffer, it corrupts adjacent memory and triggers a denial of service. This can happen before the connecting peer has proven its identity, making it exploitable by anyone on the network.