August 2026 patch — BfsCloseStorage left its enumeration cursor inside a node whose cascading deref could free it from underneath, so the next loop iteration walked AVL links in freed pool.

August 2026 patch — BfsInsertDirectoryEntry memcpy'd the caller-supplied directory entry name straight into a fixed-size slot, so a long name overran the slot into the next entry and pool metadata.

August 2026 patch — HsmiBitmapNORMALOpenOnDisk used the on-disk segment and sub-segment counts straight as loop bounds and array indices, so a crafted cloud-files sync blob overran the per-segment slot array.

August 2026 patch — CClfsLogCcb::Cleanup released the client reservation from a fresh read of the field at release time instead of claiming it once at entry, so a double cleanup returned it twice and corrupted the log accounting.

August 2026 patch — ClfsValidateBlock bound its per-sector stamp walk against one read of the on-disk TotalSectorCount, then re-read that same field from the block buffer on every loop iteration to compute the exit. A block whose TotalSectorCount can change between the bound check and the loop walks off the validated region.

August 2026 patch — bCopyColorPointer walked a source cursor mask for destination-width pixels without consulting the mask's own width, leaking heap bytes into the rendered pointer bitmap.

August 2026 patch — DXGDEVICE::CreateStandardAllocation sized a per-physical-adapter scratch buffer from the adapter count and ran its fill loop without checking that the nonpaged-pool allocation had succeeded, so a failed allocation left the fill writing its fixed 0x60-byte records through a NULL pointer.

August 2026 patch — the battery class driver published a global pointer to a freshly allocated device extension before init finished, then on failure freed the extension without clearing the global.

August 2026 patch — the control-method battery driver published the global AcAdapter pointer, then on adapter-init failure tore the FDO down without clearing it.

August 2026 patch — AFD cached each socket local address as an unlocked pointer plus length; getsockname and bind on two threads raced the read against the clear.

August 2026 patch — IoctlExecutionContextQueueTask copied a user-supplied qword straight into a queued kernel task with no kernel/user address boundary check.

August 2026 patch — UlCalculateFastForwardDataContextSize computed its variable-storage align-up and 0xf0 tail-add in 32-bit with no per-operation wrap check, so a request whose storage count scaled near 2^32 wrapped the +0xf0 add and returned a size smaller than the bytes the caller writes.

August 2026 patch — UlAllocateFastTracker guarded two of the three 32-bit adds that form its variable-header region size and left the third unguarded; separately, its per-CPU lookaside fast path never bounded the body-byte count.

August 2026 patch — DxgkOpenSyncObjectFromNtHandle published the freshly minted per-process DXG sync-object handle to user mode before re-validating its slot under HandleTableLock, so a destroy that retired the slot in between left user mode holding a handle into freed pool; the patch swaps the two steps.

August 2026 patch — UlpCreateInternalResponse built its trailing-region size as a 32-bit sum of a fixed baseline, the UlVariableHeaderSize global and two caller-derived region byte-counts, and tested only the final composite for overflow, so inputs that wrapped the intermediate slipped past the test and undersized the response allocation.

August 2026 patch — UlComputeMultipleKnownHeaderSize summed the per-header byte costs into a 32-bit accumulator in a loop, so a response carrying many known headers could wrap the running total before it was returned to the caller.

August 2026 patch — UlPrepareParsedHeaderRangeResponse used the same 32-bit per-record multiply as its cache-miss twin, so a request whose parsed Range header carried enough elements wrapped the buffer size and overran the response object.

August 2026 patch — UlPrepareCacheMissRangeResponse sized the multipart/byteranges aux space by multiplying a per-range cost by the attacker-controlled Range element count in 32-bit, so a request with enough ranges wrapped the size and overran the buffer.

August 2026 patch — EnabledForAccountCommon had a fall-through that decided RC4 with the static cipher-id byte and never consulted the per-account policy whenever the request flags carried scenario bits.

August 2026 patch — OpenImageIFEOKey opened or created the Image File Execution Options key from kernel mode with OBJ_KERNEL_HANDLE, so the caller token was never evaluated. The Debugger hijack surface was reachable through the driver.

August 2026 patch — eleven ProjFS helpers assumed FltGetStreamContext always sets a context pointer on non-NOT_FOUND status. It doesn't, so a NULL pointer is dereferenced at the context's Generation field.

August 2026 patch — ScmCmCloseCall and the SSTP IOCTL path trusted a raw pointer embedded in the call parameters to find the VC, so a stale or replayed call-params buffer caused a use-after-free.

August 2026 patch — SessionDisconnect re-issued ChannelConnect for every drained pending connect on a local disconnect, so a Bluetooth peer spamming RFCOMM connects could drive an unbounded retry loop.

August 2026 patch — deleting a ProjFS tombstone during a rename dropped the file context without taking a reference, so the in-memory tombstone could point at freed memory.

August 2026 patch — SDB_RECORD::GetHeader summed a per-record size and a format size directly into a 16-bit field with no overflow check, dropping the high bits and undersizing every downstream buffer.

August 2026 patch — PortPassThroughExValidateNormalizedRequest now sums each offset/length pair in 64-bit and rejects wrapped sums, closing a hole where a 32-bit end-pointer could wrap past every upper-bound check.

August 2026 patch — PGM's send-window advance multiplied retired-message count by per-message size in 32-bit, so a wide enough window wrapped the offset, and the next NAK-driven repair then read past the ring buffer.

August 2026 patch — PGM's repair copy computed its source offset in 32-bit and read the payload length straight out of the source message it had just pointed at, so a crafted NAK read out of the sender's source buffer.

August 2026 patch — UDF mount and verify computed the partition-descriptor pointer with a 32-bit partition-count multiply that wrapped, so a malformed Logical Volume Integrity descriptor on a crafted disc moved the read off the buffer.

August 2026 patch — EHCI_RH_UsbprivRootPortStatus used the caller's ConnectionIndex straight into the port-status register mirror and masked it back, so an out-of-range port number read and wrote kernel memory.

August 2026 patch — PFFOBJ::pPvtDataMatch walked a font's PvtData list and returned the first node whose owner matched, running the process-id test against every node regardless of its category and taking no caller-supplied category argument, so a caller could be handed a node of the other kind and interpret it through the wrong layout.

August 2026 patch — vhdmp's backing-store refcount transition helpers dispatched the AcquireWriteAccess and ReleaseWriteAccess vtable callbacks unconditionally regardless of the store's Type tag, so a VHD whose chain named a type-1 store ran the wrong handler.

August 2026 patch — fifteen DDE-track callbacks trusted a raw handle-table destroy bit instead of re-resolving the DDECONV handle, so a freed and reused handle slot could route dispatch through the wrong object.

August 2026 patch — VhdmpiQueueIoRequest read the parent pointer off the virtual disk and took only the parent's inner rundown when recording a request for prefetch, without first pinning the virtual disk it read that parent from, so a detach during prefetch recording touched freed pool.

August 2026 patch — TrySmuggleHidData pushed a HIDDATA node onto another thread SList at thread exit and cleared pQueuedHidData on the requesting thread instead of on the recorded owning thread, leaving the owner dereferencing a node that had moved.

August 2026 patch — xxxBMPtoDIB only rejected a width times bpp product that fully wrapped 32 bits, so a product in the near-ceiling band passed the guard and wrapped on the row-stride +0x1f, sizing the kernel buffer small while the copy ran large.

August 2026 patch — xxxDIBtoBMP read biSize off the caller buffer and drove the header-parsing helpers with that attacker-controlled size before checking that the buffer even covered biSize bytes, so a short CF_DIB sent the parsers off the end.

August 2026 patch — xxxGetDummyDib recomputed the DIB byte size with a hand-rolled width times bpp times height expression that overflowed on hostile dimensions, and fed the result straight to the kernel allocator.

August 2026 patch — xxxDrawMenuItemText re-validated the menu item across its xxxClientExtTextOutW callback with two field-reading checks (item membership and a +0x58 snapshot) that both still pass after the item's text buffer is swapped mid-callback; nothing compared the caller-passed text pointer that the resumed render dereferences, so the August fix added exactly that comparison.

August 2026 patch KB5121003 (26100.8875 → 26100.9168) — HDEV_DeleteRfontsAndUnloadDeviceFonts read the PDEV inactive-RFONT list head with neither device-font lock held and fed each node to the internally-locking vDeleteRFONT, while the user-reachable EUDC unload path moved those same nodes onto a private list under locks 17/18 and freed them once the locks dropped; the deleter's neighbour mutual-link check still passes on the wrong list, so the RFONT is freed twice. The collect-then-delete fix ships gated behind Feature_Servicing_FixEudcRfontRace, disabled by default.

August 2026 patch — xxxGetDummyPalette read the palette-entry count straight from the clipdata and passed it to CreateDIBPalette without bounding it against the clipdata size, so a forged count walked the palette read off the allocation.

August 2026 patch — Windows NAT now perturbs the TCP sequence number on outbound translation by a per-session random delta, closing the off-path sequence-inference window into NATed flows.