KB5099538: CVEs fixed (Windows update (KB))

KB5099538 fixes 10 tracked CVEs. Affected systems and fixed versions.

• CVE-2026-57092 CRITICAL 9.9 UPGRADE UPGRADE Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.
• CVE-2026-56190 CRITICAL 9.8 UPGRADE UPGRADE Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
• CVE-2026-56188 CRITICAL 9.8 UPGRADE UPGRADE Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server
• CVE-2026-50447 CRITICAL 9.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a n
• CVE-2026-50429 HIGH 8.2 UPGRADE UPGRADE Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.
• CVE-2026-42990 CRITICAL 9.8 UPGRADE UPGRADE Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a ne
• CVE-2026-50518 CRITICAL 9.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a netwo
• CVE-2026-50509 HIGH 7.8 UPGRADE UPGRADE Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker
• CVE-2026-56159 CRITICAL 9.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a netwo
• CVE-2026-56155 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Applies to

• Windows 10 Version 1809 for 32-bit Systems · fixed in 10.0.17763.9020
• Windows 10 Version 1809 for x64-based Systems · fixed in 10.0.17763.9020
• Windows Server 2019 · fixed in 10.0.17763.9020
• Windows Server 2019 (Server Core installation) · fixed in 10.0.17763.9020

← Back to latest CVEs