Windows update

1. CVE-2026-26017 CoreDNS ACL Bypass

   Information published.

2. CVE-2026-26018 CoreDNS Loop Detection Denial of Service Vulnerability

   Information published.

3. CVE-2026-23868

   Information published.

4. CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath

   Information published.

5. CVE-2026-3381 Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib

   Information published.

6. CVE-2026-3494 MariaDB Server Audit Plugin Comment Handling Bypass

   Information published.

7. CVE-2026-27137 Incorrect enforcement of email constraints in crypto/x509

   Information published.

8. CVE-2026-27138 Panic in name constraint checking for malformed certificates in crypto/x509

   Information published.

9. CVE-2026-27141 Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

   Information published.

10. CVE-2026-27171 zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

    Information published.

11. CVE-2025-58160 Tracing logging user input may result in poisoning logs with ANSI escape sequences

    Information published.

12. Chromium: CVE-2026-3942 Incorrect security UI in PictureInPicture

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

13. Chromium: CVE-2026-3931 Heap buffer overflow in Skia

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

14. CVE-2026-25172 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

    The hotpatch has been re‑released to ensure comprehensive coverage across all affected scenarios. Customers are advised to apply the updated release to ensure full protection.

15. CVE-2026-25173 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

    The hotpatch has been re‑released to ensure comprehensive coverage across all affected scenarios. Customers are advised to apply the updated release to ensure full protection.

16. CVE-2026-26111 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

    The hotpatch has been re‑released to ensure comprehensive coverage across all affected scenarios. Customers are advised to apply the updated release to ensure full protection.

17. Chromium: CVE-2026-3941 Insufficient policy enforcement in DevTools

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

18. Chromium: CVE-2026-3940 Insufficient policy enforcement in DevTools

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

19. Chromium: CVE-2026-3939 Use after free in WebView

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

20. Chromium: CVE-2026-3938 Insufficient policy enforcement in Clipboard

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

21. Chromium: CVE-2026-3937 Incorrect security UI in Downloads

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

22. Chromium: CVE-2026-3935 Incorrect security UI in WebAppInstalls

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

23. Chromium: CVE-2026-3934 Insufficient policy enforcement in ChromeDriver

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

24. Chromium: CVE-2026-3932 Insufficient policy enforcement in PDF

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

25. Chromium: CVE-2026-3925 Incorrect security UI in LookalikeChecks

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

26. Chromium: CVE-2026-3915 Heap buffer overflow in WebML

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

27. Chromium: CVE-2026-3936 Use after free in WebView

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

28. Chromium: CVE-2026-3929 Side-channel information leakage in ResourceTiming

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

29. Chromium: CVE-2026-3928 Insufficient policy enforcement in Extensions

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

30. Chromium: CVE-2026-3927 Incorrect security UI in PictureInPicture

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

31. Chromium: CVE-2026-3926 Out of bounds read in V8

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

32. Chromium: CVE-2026-3924 Use after free in WindowDialog

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

33. Chromium: CVE-2026-3923 Use after free in WebMIDI

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

34. Chromium: CVE-2026-3922 Use after free in MediaStream

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

35. Chromium: CVE-2026-3921 Use after free in TextEncoding

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

36. Chromium: CVE-2026-3920 Out of bounds memory access in WebML

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

37. Chromium: CVE-2026-3919 Use after free in Extensions

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

38. Chromium: CVE-2026-3918 Use after free in WebMCP

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

39. Chromium: CVE-2026-3917 Use after free in Agents

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

40. Chromium: CVE-2026-3916 Out of bounds read in Web Speech

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

41. Chromium: CVE-2026-3914 Integer overflow in WebML

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

42. Chromium: CVE-2026-3913 Heap buffer overflow in WebML

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

43. CVE-2026-0385 Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

    Information published.

44. Chromium: CVE-2026-3930 Unsafe navigation in Navigation

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information.

45. Chromium: CVE-2026-3910 Inappropriate implementation in V8

    This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2021) for more information. Google is aware that an exploit for CVE-2026-3910 exists in the wild.

46. CVE-2026-21257 GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability

    Changes made to the security updates links and information. This is an informational change only.

47. CVE-2026-21256 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

    Changes made to the security updates links and information. This is an informational change only.

48. CVE-2026-23868

    Information published.

49. CVE-2026-3783 token leak with redirect and netrc

    Information published.

50. CVE-2026-1965 bad reuse of HTTP Negotiate connection

    Information published.