Privilege escalation via integer underflow in Windows HTTP.sys (the kernel-mode HTTP protocol stack) allows an authenticated local attacker to gain SYSTEM-level access on a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. The flaw is rooted in an integer wraparound condition (tagged by the reporter as a heap overflow mechanism) in the HTTP.sys kernel driver, enabling full compromise of confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Privilege escalation via heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged local attacker to gain full SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans virtually all supported Windows versions, from Windows 10 1809 and Server 2019 through Windows 11 26H1 and Server 2025. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and broad platform coverage make this a credible post-exploitation privilege escalation primitive for threat actors who have already obtained a local foothold.
Broken access control in Ghost Foundation Ghost 5.x enables any authenticated Author-role user to delete posts owned by other users, including content published by Editors and Administrators. The authorization failure originates in the post model's permissible() cascade, where the combined isAuthor-and-isDestroy condition is not handled, causing the guard to fall through and approve the deletion. No public exploit code has been identified at time of analysis, but the low attack complexity and minimal privilege requirement mean the flaw is trivially abusable by any Author-role account holder on the platform.
Broken access control in BadChoice Handesk (all versions through 2026-07-10) permits any authenticated agent to modify, escalate, or corrupt ticket records belonging to teams they have no membership in, by directly targeting the TicketsController@update endpoint. The endpoint performs neither an authorize() policy check nor a team-scoped ownership validation, meaning a low-privilege agent account is the only barrier to cross-team data tampering. No public exploit has been identified at time of analysis, but exploitation requires only a valid agent credential and a single crafted HTTP request, making this a low-friction privilege abuse risk in any multi-team deployment.
Cross-team lead record overwrite in BadChoice Handesk (all versions through 2026-07-10) is exploitable by any authenticated agent via the LeadsController@update endpoint, which performs no team-ownership authorization check. The Lead model's $guarded property is set to an empty array, disabling Laravel mass-assignment protection and allowing the attacker to set any column value on any lead record regardless of team boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:L/AC:L vector makes this trivially exploitable by any insider or compromised agent account in a multi-team deployment.
SAML authentication bypass in PicketLink's Service Provider signature validation allows a network-accessible attacker with low privileges to forge a SAML response and authenticate as any principal with any role on the protected application. The flaw, rooted in CWE-347 (Improper Verification of Cryptographic Signature), arises because the signature check vacuously passes when the SAML response contains zero matching assertion elements, giving the attacker full control over identity and role claims presented to the SP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact on confidentiality and integrity make this a critical authentication control failure.
Privilege escalation in Windows Desktop Window Manager (DWM) Core Library via a use-after-free memory corruption flaw allows a locally authenticated, low-privileged attacker to achieve full SYSTEM-level code execution. Affected systems span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core), representing a broad cross-section of the active Microsoft OS estate. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide version coverage make patching a near-term priority.
Privilege escalation in the Windows Remote Access Connection Manager (RASMAN) service enables a low-privileged local attacker to achieve SYSTEM-level access through a heap-based buffer overflow. Affecting Windows 10 (from version 1809), Windows 11 (through version 26H1), Windows Server 2019 through Server 2025, this vulnerability requires only a valid local user account and no user interaction. Microsoft has released patches via MSRC; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Privilege escalation via use-after-free in the Windows Kernel affects Windows 11 (versions 23H2, 24H2, 25H2, and 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to elevate to SYSTEM-level control. The CWE-416 root cause combined with high attack complexity (AC:H) indicates exploitation likely requires precise timing or race-condition engineering rather than a trivial one-shot trigger. Vendor patches are available via MSRC; no active exploitation has been confirmed by CISA KEV at time of analysis.
Local privilege escalation in the Windows Kernel affects Windows 11 (23H2 through 26H1) and Windows Server 2025, exploitable by any authenticated local user to gain SYSTEM-level access. The root mechanism is a use-after-free condition triggered through a race condition in kernel memory management, classified under CWE-362. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis; however, the kernel-level impact (C:H/I:H/A:H) makes it a high-priority patch target in enterprise and server environments.
Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 installations. The flaw (CWE-416) involves kernel memory mismanagement where freed memory can be accessed under specific high-complexity timing conditions, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all affected versions.
Credential forgery via type confusion in the TCG TPM 2.0 reference code (versions through v184) allows a local attacker holding high-privilege access to submit a falsified TPM key - such as an Attestation Key, DevID Key, or TLS authentication key - to a TPM-aware Certificate Authority and receive a legitimate credential for it. With that credential, the attacker can forge subsequent TPM 2.0 attestations, silently undermining the platform integrity guarantees that downstream security controls depend on, including measured boot verification, zero-trust device posture checks, and DevID-based network admission. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.22% at the 13th percentile is consistent with a targeted, post-compromise technique rather than a commodity attack.
SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. No public exploit or active exploitation has been identified at time of analysis, but the CVSS scope change (S:C) signals that successfully decrypted credentials can be used to compromise systems beyond the BI platform itself.
Local privilege escalation in Microsoft Office exploits a command injection flaw (CWE-77) that allows an authenticated local attacker to gain elevated privileges on the affected system. The vulnerability requires only low-level privileges to trigger, making it accessible to any standard user account on a compromised or shared system. No public exploit code or CISA KEV listing is identified at time of analysis, but the high-impact CVSS score and Microsoft's own disclosure warrant prompt patching.
Use-after-free memory corruption in Microsoft Office enables an attacker to execute arbitrary code in the context of the victim user, scoring CVSS 7.8 (High). Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. Exploitation requires a victim to open a specially crafted Office document - a delivery mechanism trivially achieved via phishing - and no public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft Office's ubiquitous enterprise footprint and adversary interest in document-borne malware elevate this beyond a theoretical risk.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/PR:N/UI:R) confirms exploitation requires no prior privileges but depends on user interaction - consistent with a malicious document delivery scenario. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a high-severity concern for any environment running unpatched Excel installations.
Heap-based buffer overflow in Windows Imaging Component (WIC), Microsoft's built-in image processing framework, enables local code execution across virtually every supported Windows client and server release from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. The flaw is triggered when a user opens or previews a specially crafted image file, requiring no prior authentication or elevated privileges, and yields full confidentiality, integrity, and availability impact on the compromised system. Vendor-released patches are available via Microsoft's July 2026 update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Excel enables local arbitrary code execution when a user opens a specially crafted file. The vulnerability (CWE-121) carries a CVSS 7.8 High score, with high confidentiality, integrity, and availability impact upon successful exploitation. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel enables local code execution when a user opens a specially crafted spreadsheet file. The vulnerability (CWE-125) carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability, and is reported directly by Microsoft via the MSRC update guide. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) indicates reliable exploitability once a working exploit is developed.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The vulnerability triggers during file parsing, allowing an attacker who can deliver a malicious document to execute arbitrary code with the privileges of the logged-in user. No KEV listing or public exploit code has been identified at time of analysis, but the local-execution-via-document vector makes this a meaningful phishing and spear-phishing enabler.
Out-of-bounds write (CWE-787) in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file, yielding full confidentiality, integrity, and availability impact at CVSS 7.8. The attack is file-delivery based - typical phishing or drive-by download - requiring no system privileges from the attacker but requiring the victim to open the malicious document. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in Microsoft Office Access enables local code execution when a user opens a specially crafted database file, with full high-impact compromise of confidentiality, integrity, and availability (CVSS 7.8). Affected products span Microsoft Access 2016 through Microsoft 365 Apps for Enterprise and Office LTSC 2024. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Privilege escalation via heap-based buffer overflow in Windows HTTP.sys (a kernel-mode HTTP listener driver) allows a locally authenticated low-privilege attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only local authenticated access with no user interaction and low attack complexity, making this a practical post-compromise escalation primitive. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Local privilege escalation in the Windows DHCP Server service allows a low-privileged authenticated attacker to fully compromise system confidentiality, integrity, and availability through improper symbolic link handling (CWE-59). Affected deployments span Windows Server 2012 through 2025 and Windows 10 1607/1809. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across enterprise server infrastructure make this a credible post-access escalation path.
Privilege escalation in Windows DHCP Server exploits improper symbolic link resolution (CWE-59), allowing an authenticated local attacker with low privileges to fully compromise system confidentiality, integrity, and availability. The flaw affects Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is active. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and no user interaction requirement make this a credible post-compromise escalation path.
Privilege escalation via numeric truncation in Microsoft's Digest Authentication subsystem affects a broad range of Windows releases, from Server 2012 through Windows 11 version 26H1 and Windows Server 2025. An attacker holding a low-privilege local account can exploit a CWE-197 integer type-conversion flaw to achieve full system compromise - the CVSS vector assigns high impact across confidentiality, integrity, and availability with no user interaction required. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; however, Microsoft has released patches for all affected build ranges.
Privilege escalation via heap-based buffer overflow in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds. An attacker with an existing low-privileged local account can exploit this flaw to achieve full SYSTEM-level access, gaining high confidentiality, integrity, and availability impact with no user interaction required. No public exploit has been identified at time of analysis; Microsoft has released patches via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62688.
Command injection in Microsoft Office enables local arbitrary code execution with high impact across confidentiality, integrity, and availability, affecting Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, and LTSC 2024. Exploitation requires a victim to open a specially crafted Office document, after which unsanitized input reaches a command processor without requiring any attacker-side privileges on the target system. No public exploit has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog as of the available intelligence.
Local privilege escalation in Windows DHCP Server exploits improper symbolic link resolution (CWE-59), allowing a low-privileged authenticated local user to gain full SYSTEM-level access across a wide range of Windows Server versions from 2012 through 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires no interaction and only low-level local access, making this a practical post-exploitation escalation tool once an attacker has any foothold on a DHCP Server host. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system impact when a victim opens a maliciously crafted workbook. The root cause is a numeric truncation error (CWE-122) in Excel's file parsing logic, where an integer value is truncated before being used to size a heap allocation, resulting in an undersized buffer that can be overflowed. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, but the high CVSS score of 7.8 and full confidentiality, integrity, and availability impact make this a meaningful risk for organizations relying on Excel file workflows.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a maliciously crafted file. The vulnerability (CWE-122) corrupts heap memory in Excel's parsing logic, allowing an attacker to achieve full control over confidentiality, integrity, and availability of the affected system. No public exploit or active exploitation has been identified at time of analysis, but the CVSS score of 7.8 with high impact across all three CIA triad pillars makes this a meaningful priority for organizations running affected Excel versions.
Stack-based buffer overflow in Microsoft Office enables local arbitrary code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation is local and requires user interaction - most likely triggered by opening a maliciously crafted Office file delivered via phishing or other social engineering. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis, though the high-impact triad (C:H/I:H/A:H) and Microsoft Office's ubiquitous deployment footprint make this a notable patching priority.
Heap-based buffer overflow in Microsoft Office enables arbitrary local code execution when a user opens a specially crafted document. Affected products span seven product lines across Windows and macOS, including Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and their Mac counterparts, all prior to the vendor-released patch. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of the affected install base and the low-complexity exploitation path make this a high-priority patching item.
Local code execution in Microsoft Office is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122), granting the attacker full control over the victim's user session. The vulnerability spans the entire modern Office portfolio - Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, LTSC 2024, and macOS equivalents - making the attack surface exceptionally broad. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches for all affected product lines.
Heap-based buffer overflow in Microsoft Office (365 Apps for Enterprise, Office 2019, Office 2021 LTSC, and Office 2024 LTSC) enables a local attacker with low-privilege credentials to execute arbitrary code with the full confidentiality, integrity, and availability impact of the Office process. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 and requires only local access and a standard user account - no user interaction is needed once the attacker can trigger the vulnerable allocation path. No public exploit code has been identified at time of analysis, and SSVC assessment confirms current exploitation status as none.
Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a crafted file. The vulnerability (CWE-121) is triggered through user interaction with malicious content, requiring no privileges on the target system beyond access to run Excel. No public exploit code or CISA KEV listing is identified at time of analysis, though the high-impact CVSS 7.8 score reflects full compromise of confidentiality, integrity, and availability upon successful exploitation.
Local code execution via heap-based buffer overflow in Microsoft Office affects multiple product lines including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. An integer overflow or wraparound during document parsing leads to an undersized heap allocation (CWE-122), enabling arbitrary code execution at the privilege level of the opening user when a victim opens a maliciously crafted Office file. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, though the full-triad high-impact CVSS score of 7.8 reflects the severity of successful exploitation.
Local code execution via untrusted pointer dereference in Microsoft Office affects multiple product lines - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and Mac editions - when a victim opens a specially crafted document. The root cause (CWE-822) enables memory corruption through unvalidated pointer values sourced from attacker-controlled file content, yielding full confidentiality, integrity, and availability compromise of the targeted user session. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available through Microsoft Update channels.
Heap-based buffer overflow in Microsoft Office, rooted in an integer underflow during document parsing, enables local code execution with high confidentiality, integrity, and availability impact when a user opens a specially crafted file. All major Office release channels on both Windows and Mac are affected, including Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021/2019/2016, and their Mac equivalents. No public exploit has been identified at time of analysis, but a vendor-released patch is available via the Microsoft Security Response Center.
Local code execution in Microsoft Office stems from an integer overflow that cascades into a heap-based buffer overflow (CWE-122), affecting Office 2016 through LTSC 2024 on both Windows and macOS. An unauthenticated attacker who can convince a target user to open a crafted Office document gains full code execution with the victim's privilege level - achieving high confidentiality, integrity, and availability impact per the CVSS:3.1 AV:L/C:H/I:H/A:H rating. No public exploit code or CISA KEV listing was identified at time of analysis, but the patch is vendor-confirmed and available via Microsoft's Security Update Guide.
Local code execution in Microsoft Office affects all major editions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and their Mac counterparts. The vulnerability is a heap-based buffer overflow (CWE-122) triggered when a user opens a specially crafted document, granting the attacker arbitrary code execution at the victim's privilege level. No public exploit has been identified at time of analysis, and a vendor-released patch is available, making this a high-priority patching target across enterprise Office deployments.
Local code execution in Microsoft Office results from an integer overflow that leads to a heap-based buffer overflow (CWE-122), enabling an attacker to run arbitrary code at the privilege level of the logged-in user. Affected products span multiple Windows and Mac release tracks including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is present in the available data; however, the complete high CIA triad and wide deployment footprint make this a priority patching target.
Stack-based buffer overflow in Microsoft Office (CWE-121) enables local code execution across a broad range of affected builds including Office 2016, 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, LTSC for Mac 2021/2024, and Microsoft 365 Apps for Enterprise. Exploitation requires user interaction - consistent with a maliciously crafted document delivery model - and achieves full confidentiality, integrity, and availability compromise within the Office process context. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via the MSRC advisory.
Privilege escalation via heap-based buffer overflow in the Windows HTTP.sys kernel-mode driver affects Windows 11 (23H2 through 26H1) and Windows Server 2022/2025. An authenticated low-privileged local attacker can exploit this flaw to gain SYSTEM-level privileges on the target machine. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected Windows builds make this a significant patching priority for organizations running vulnerable versions.
Privilege escalation via heap-based buffer overflow in the Windows NTFS driver enables a local authenticated attacker with standard user rights to gain SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans a wide swath of the Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making the aggregate exposure significant. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) mean that a working exploit would be highly reliable once developed.
Privilege escalation via heap-based buffer overflow in the Windows Storage subsystem affects a wide range of Windows 11 and Windows Server 2022/2025 builds. An attacker already holding a standard (low-privileged) local user account can exploit the memory corruption flaw to gain full SYSTEM-level control - no user interaction or elevated starting privileges required beyond basic logon. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this a credible post-access escalation primitive.
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass security controls and gain unauthorized write access to resources outside the application's normal permission boundary. The CVSS scope-change metric (S:C) confirms impact extends beyond the vulnerable component itself, meaning successful exploitation can affect the underlying operating system or adjacent system resources. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make this a credible risk for any internet-exposed or internally accessible ColdFusion deployment.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
PowerPoint's improper input validation (CWE-20) exposes local users to high-impact compromise when a maliciously crafted presentation file is opened, with the official CVSS vector asserting high confidentiality, integrity, and availability impact - a notable divergence from the description's characterization as information disclosure only. The attack requires no attacker privileges but mandates user interaction, fitting a phishing-and-open-file threat model. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.