AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-69609

Microsoft Windows Win32K: out-of-bounds read

Microsoft

CVE-2026-69609 · Published Sep 8, 2026 · updated Oct 30, 2026

Medium5.5
Fix: upgrade to 16.112.26090911 or later (3 fixed versions below)
Microsoft advisory

Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.

Affected versions

PackageAffectedFixed in
Microsoft Office 365 for Mac
Product
>= 1.0.0, < 16.112.2609091116.112.26090911
Microsoft Office LTSC for Mac 2021
Product
>= 16.0.1, < 16.112.2609091116.112.26090911
Microsoft Office LTSC for Mac 2024
Product
>= 16.0.0, < 16.112.2609091116.112.26090911
Microsoft Office for Android
Product
>= 16.0.1, < 16.0.20430.2000016.0.20430.20000

Changes since it was listed

Fixed inNov 3Fixed in: Windows 10 Version 1607 10.0.14393.9512, Windows 10 Version 1809 10.0.17763.9245, Windows 10 Version 21H2 10.0.19044.772 to Microsoft Office 365 for Mac 16.112.26090911, Microsoft Office for Android 16.0.20430.20000, Microsoft Office LTSC for Mac 2021 16.112.26090911
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-125, CWE-193

More Microsoft advisories

All Microsoft
High 8.3Sep 8Microsoft Skype for Business: spoofingCVE-2026-69646fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: cross-site scriptingCVE-2026-69642fixed in 6.0.9319.885 +2High 7.1Sep 8Microsoft Skype for Business: spoofingCVE-2026-66305fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: information disclosureCVE-2026-66306fixed in 6.0.9319.885 +2High 7.5Sep 8Microsoft Skype for Business: integer overflowCVE-2026-66307fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: out-of-bounds readCVE-2026-66308fixed in 6.0.9319.885 +2