The other two zero-days were publicly disclosed: a .NET Framework untrusted-search-path bypass (CVE-2026-108398, found by James Forshaw of Google Project Zero) that can defeat Windows Defender Application Control and run unauthorised code within protected processes, and a MessagePack-CSharp denial-of-service flaw (CVE-2026-92707).