KB5127648: CVEs fixed (Windows update (KB))

KB5127648 fixes 10 tracked CVEs. Affected systems and fixed versions.

CVE-2026-69673 HIGH 7.8 UPGRADE UPGRADE Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker
CVE-2026-69718 HIGH 7.8 UPGRADE UPGRADE Improper neutralization of special elements used in a command ('command injection') in Windows Update allows a
CVE-2026-69733 HIGH 7.8 UPGRADE UPGRADE Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
CVE-2026-68836 HIGH 7.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally
CVE-2026-69452 HIGH 7.1 UPGRADE UPGRADE Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a
CVE-2026-85790 MEDIUM 5.9 UPGRADE UPGRADE Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-96912 HIGH 7.8 UPGRADE UPGRADE Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96911 HIGH 7.8 UPGRADE UPGRADE Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an
CVE-2026-96914 HIGH 8.8 UPGRADE UPGRADE Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized att
CVE-2026-96913 HIGH 8.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Applies to