KB5099540: CVEs fixed (Windows update (KB))

KB5099540 fixes 7 tracked CVEs. Affected systems and fixed versions.

CVE-2026-56190 CRITICAL 9.8 UPGRADE UPGRADE Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.
CVE-2026-56188 CRITICAL 9.8 UPGRADE UPGRADE Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server
CVE-2026-50447 CRITICAL 9.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a n
CVE-2026-42990 CRITICAL 9.8 UPGRADE UPGRADE Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a ne
CVE-2026-50518 CRITICAL 9.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a netwo
CVE-2026-56159 CRITICAL 9.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a netwo
CVE-2026-56155 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Applies to