CVE-2026-21517

MEDIUM4.7

JSON export Create alert

Description

Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges locally.

CVSS breakdown

CVSS 3.1

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

E

Unchanged

RL

O

RC

Changed

Affected products

microsoft / Windows App for Mac11.0.0 – 11.3.2

References

VENDOR_ADVISORYhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21517

Updated 32m ago · 8 sources