CVE-2026-20806

MediumCVSS 5.5

Published: 14/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

A type confusion vulnerability exists in Windows COM. An authorized attacker can disclose information locally.

Risk Assessment

A local attacker could access confidential information, potentially leading to a confidentiality breach. However, it requires authentication and local access.

Recommendation

Apply the latest Windows security updates. Restrict local access to trusted users.

Other vulnerabilities in Windows COM

CVE-2017-0214High
There is a privilege elevation vulnerability in Windows due to improper input validation before loading type libraries. This affects multiple versions of Windows operating systems, including Windows Server 2008, Windows 7, Windows 8.1, Windows 10, and Windows Server 2016.

Original NVD description (English source)

Access of resource using incompatible type ('type confusion') in Windows COM allows an authorized attacker to disclose information locally.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS