Microsoft Security Response Center Blog Alerts

CVE-2026-21243 Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

Published February 12, 2026

Null pointer dereference in Windows LDAP – Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.

CVE-2026-21238 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Published February 12, 2026

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-21256 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

Published February 12, 2026

Changes made to the security updates links and information. This is an informational change only.

Chromium: CVE-2026-1862 Type Confusion in V8

Published February 7, 2026

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.

Chromium: CVE-2026-1861 Heap buffer overflow in libvpx

Published February 6, 2026

CVE-2026-0391 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

Published February 6, 2026

User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.