CVE-2026-54996
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized
CVSS
7.0
Alto
EPSS
0.2%
p5
KEV
—
Exploit Today
1
0-100
Publicado: 14 jul 2026 · Última mod.: 20 jul 2026 · CWE-125 · CWE-362
0.2%EPSS · 30 días0.2%
2026-07-152026-07-30
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-667206.5 MED—
——0The GOOSE subscriber component improperly validates the UTC timestamp
field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2
multicast messages. A specially crafted GOOSE frame containing an
undersized timestamp field can trigger a heap out-of-bounds read during
message processing, causing the process to crash and resulting in a
denial-of-service condition.2hCVE-2026-663696.5 MED—
——0The GOOSE parser contains an off-by-one boundary-handling flaw that can
be triggered by a single unauthenticated Layer-2 multicast frame on the
process bus. When specific GOOSE message fields are processed, the
parser advances its internal buffer position incorrectly, resulting in a
heap out-of-bounds read. On affected platforms, this condition reliably
terminates the subscriber process and causes a denial-of-service.19hCVE-2026-663646.5 MED—
——0The GOOSE payload parser contains a boundary handling flaw that can be
triggered by a single unauthenticated Layer 2 multicast frame on the
process bus. When processing specific payload fields, an attacker
controlled inner element length may exceed its enclosing length, causing
the parser to over read by one byte. This out-of-bounds read reliably
terminates the subscriber process, resulting in a denial-of-service
condition.2hCVE-2026-663607.5 ALT—
——0The ISO Presentation layer contains a flaw in the handling of specific
parameters during normal mode negotiation. A missing length check in the
processing of the encoded presentation data allows an attacker
controlled field with a zero length value to trigger a bounded heap over
read. This condition occurs before MMS session establishment, a crafted
TCP/102 connection attempt can trigger the issue. The resulting over
read causes the process to terminate, leading to a denial of service
condition.2hCVE-2026-663496.5 MED—
——0The MMS server connection handler contains a flaw in its processing of
BER-encoded request data. When an MMS confirmed request PDU containing
an extended BER tag is received over an established session, the decoder
may advance its internal buffer incorrectly due to a missing bounds
check. This results in a one byte heap out-of-bounds read and causes the
MMS service process to terminate, leading to a denial-of-service
condition.2hCVE-2026-654216.5 MED—
——0The MMS BER decoder contains a flaw in decoding fixed-width BER fields
(boolean/integer): an attacker-supplied length value is not validated,
causing a read past the end of a heap buffer. This leads to termination
of the MMS service process and a denial-of-service condition.2h