Privilege escalation via heap-based buffer overflow in Windows Message Queuing (MSMQ) allows a locally authenticated attacker with low privileges to gain SYSTEM-level access across a wide range of Microsoft Windows desktop and server editions. The flaw, classified as CWE-122, spans from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature update channels, making it broadly relevant in enterprise environments where MSMQ is deployed. Patch is available from Microsoft via the MSRC update guide; no public exploit or CISA KEV listing has been identified at the time of analysis.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to achieve full system compromise via a heap-based buffer overflow. Confirmed affected across a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 all versions. No public exploit identified at time of analysis and no CISA KEV listing; however, the low attack complexity combined with universal Windows platform coverage makes this a meaningful post-exploitation or insider-threat vector.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects a broad spectrum of Windows client and server releases, from Windows Server 2012 through Windows 11 25H2. An authenticated local attacker can exploit this flaw with low complexity and no user interaction to achieve full SYSTEM-level privileges (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, but the low-complexity local exploitation profile - combined with the near-universal deployment footprint of Windows - makes this a high-priority patch for both endpoint and server environments.
Heap-based buffer overflow in the Windows Device Association Service allows a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server releases. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025, making this a high-coverage local privilege escalation. No public exploit identified at time of analysis, but vendor patches are available and should be applied immediately given the low attack complexity.
Privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged local attacker to gain SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The root cause is CWE-416 (Use After Free), a memory-safety flaw in the MDM component where a freed memory object is dereferenced, enabling controlled memory corruption that can redirect execution to attacker-supplied code. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV entry is identified at time of analysis.
Privilege escalation via use-after-free in the Windows Telephony Service (TAPI) allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access across a broad range of Windows desktop and server releases. The vulnerability affects Windows 10, Windows 11 (all current feature releases), and Windows Server 2012 through 2025, representing near-universal coverage of supported and legacy Microsoft platforms. No public exploit identified at time of analysis; vendor-released patches are available via Microsoft Update.
Privilege escalation via heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) affects virtually the entire Microsoft Windows product portfolio, from legacy Server 2012 through Windows 11 25H2 and Server 2025. A locally authenticated, low-privileged attacker can trigger memory corruption in ring-0 kernel space, resulting in full SYSTEM-level privilege acquisition on the target host. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches across all affected product lines via the MSRC update guide.
Windows Storage in multiple Windows 11 and Windows Server releases contains a heap-based buffer overflow that allows any locally authenticated low-privilege user to escalate to SYSTEM-level access with no user interaction required. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this is a straightforward, low-complexity privilege escalation once an attacker has a local foothold - covering Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025. Microsoft has released patches across all affected product lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Windows Remote Desktop Services stems from a heap-based buffer overflow (CWE-122) that an authorized local attacker can exploit to gain full SYSTEM-level control of the affected host. The vulnerability spans an exceptionally wide range of Microsoft Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the aggregate patch surface very large across enterprise fleets. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Local privilege escalation in Windows HTTP.sys enables authenticated local attackers to gain SYSTEM-level access across a sweeping range of Windows client and server releases, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An integer overflow in the kernel-mode HTTP driver triggers a heap-based buffer overflow (consistent with both the CWE-122 classification and the vendor-applied 'Heap Overflow' tag), allowing an attacker with an existing low-privilege local foothold to corrupt kernel heap structures and achieve full code execution as SYSTEM. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the extremely broad affected surface and low attack complexity make timely patching a high priority for enterprise environments.
Privilege escalation via use-after-free in the Windows Bind Filter Driver affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing a locally authenticated attacker to gain SYSTEM-level privileges. The memory corruption flaw (CWE-416) is triggered through the kernel-mode filter driver component, yielding full confidentiality, integrity, and availability impact per CVSS. SSVC signals no confirmed exploitation and non-automatable attack path; a vendor patch is available and should be prioritized given the total technical impact rating.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables any standard authenticated local user to gain full SYSTEM-level control across a wide range of Windows 10, Windows 11, and Windows Server deployments. The vulnerability arises from a type confusion condition in the DWM Core Library - though the CWE-122 classification and vendor tags ('Heap Overflow', 'Buffer Overflow') indicate the confusion likely manifests through or triggers a heap-based memory corruption primitive. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows USB Driver (CWE-122) affects a broad range of Microsoft Windows client and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authenticated local attacker with low privileges can exploit this kernel-mode heap corruption to achieve full system compromise - gaining complete confidentiality, integrity, and availability over the affected host. Microsoft has released patches across all affected versions via the MSRC advisory; no public exploit has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Display Enhancement Service allows a local low-privileged attacker to gain SYSTEM-level control across a broad swath of Windows desktop and server releases. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes patching a meaningful operational priority.
Local privilege escalation in Windows Application Information Services (appinfo) allows an authenticated local user to gain SYSTEM-level privileges through a use-after-free memory corruption flaw (CWE-416). Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, plus Windows Server 2025 and its Server Core variant - all current, widely-deployed Microsoft platforms. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and full CIA impact (C:H/I:H/A:H) make this a high-priority patch for any environment where untrusted or low-privileged users have local access.
Heap-based buffer overflow in the Windows Sensor Data Service enables a locally authenticated, low-privileged attacker to fully compromise a target Windows system by escalating to SYSTEM-level privileges. Affecting Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across dozens of specific build ranges, exploitation requires no user interaction and low complexity once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, but SSVC classifies technical impact as total; Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Telephony Service (TAPISRV) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases spanning Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability carries a CVSS 7.8 score with low attack complexity, meaning exploitation is straightforward once local access is established, making it an effective second-stage tool in a broader attack chain. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected build lines.
Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system-level impact when a victim opens a specially crafted Excel file. The flaw (CWE-122) resides in Excel's file parsing logic, where malformed input causes a heap memory region to be overwritten, redirecting execution flow. No public exploit has been identified at time of analysis, and the vulnerability has not appeared in CISA's Known Exploited Vulnerabilities catalog, though the Microsoft Security Response Center has issued an advisory.
Type confusion (CWE-843) in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms the attack is file-based: no attacker privileges are required, but the target user must open a malicious document, making this a high-impact phishing-delivery vector. No public exploit code and no CISA KEV listing are identified at time of analysis, but the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a critical priority for organizations where Excel is deployed.
Untrusted pointer dereference in Microsoft Office Excel enables local arbitrary code execution when a user opens a crafted document. The flaw (CWE-822) allows an attacker who can deliver a malicious file to achieve full code execution with high confidentiality, integrity, and availability impact on the victim's system. No public exploit has been identified at time of analysis, and Microsoft has not listed this in CISA's Known Exploited Vulnerabilities catalog.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted file, granting full confidentiality, integrity, and availability compromise of the affected system. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a document-triggered exploit requiring no attacker privileges but demanding victim interaction - a profile consistent with malicious email attachment or drive-by download campaigns. No public exploit code or CISA KEV listing has been identified at time of analysis, though Excel's ubiquity makes this a high-value target class.
Type confusion (CWE-843) in Microsoft Office Excel enables local code execution by an unauthenticated attacker when a victim opens a specially crafted Excel document. The CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a file-borne attack requiring user interaction but no attacker privileges, with full High/High/High C/I/A impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the memory corruption tag suggests the type confusion leads to exploitable heap or stack corruption.
Heap-based buffer overflow in Microsoft Office Access enables local code execution across Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise when a victim opens a specially crafted database file. The flaw, rooted in CWE-122, yields full High/High/High impact on confidentiality, integrity, and availability (CVSS 7.8), making successful exploitation equivalent to arbitrary code execution in the user's security context. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches via the Office Security Releases channel.
Stack-based buffer overflow in Microsoft Office Access enables a local unauthenticated attacker to achieve arbitrary code execution when a victim opens a specially crafted Access database file. Affected products span Microsoft Access 2016 (32-bit and 64-bit), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit has been identified at time of analysis, and a vendor-released patch is available through the Microsoft Security Response Center.
Stack-based buffer overflow in Microsoft Office Access enables local code execution with high impact across confidentiality, integrity, and availability. Affected products span Microsoft Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - all at version 16.0.x or 19.0.x prior to the patched releases. An attacker who can deliver a malicious Access file and induce a local user to open it can achieve arbitrary code execution in the context of that user. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Heap-based buffer overflow in Microsoft Office Access enables local arbitrary code execution with full confidentiality, integrity, and availability impact across several Office product families. The vulnerability, rooted in CWE-122, affects Microsoft Access 2016 (both 32- and 64-bit editions), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Exploitation requires local access and user interaction - consistent with a malicious database file delivery scenario - and a vendor patch is available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution when a user opens a specially crafted Access database file. Affected products span Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad corporate user base. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Type confusion (CWE-843) in Microsoft Office enables local code execution across multiple Office product lines when a user opens a crafted file. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. With high confidentiality, integrity, and availability impact and user-interaction-only as the sole prerequisite, the vulnerability presents meaningful risk in phishing and malicious-document delivery scenarios. No public exploit identified at time of analysis, though a vendor patch is available.
Heap-based buffer overflow in Microsoft Office allows local code execution across a wide range of Office versions on both Windows and macOS when a victim opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms that no privileges are required - only that a user interacts with malicious content - making this practically reachable via phishing or drive-by document delivery despite the local attack vector. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in Windows DHCP Server affects all major Windows Server releases from 2012 through 2025, as well as Windows 10 versions 1607 and 1809. An authorized low-privileged local attacker can exploit a symlink-following flaw (CWE-59) during DHCP Server file access operations to gain full control (C:H/I:H/A:H) over the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Privilege escalation via untrusted search path (CWE-426) in Windows Narrator Braille affects multiple Windows 10, Windows 11, and Windows Server builds, allowing a locally authenticated attacker to elevate from standard user to higher privileges. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity once local access is established, with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but a vendor-released patch is available and should be applied promptly.
Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows Server and client platforms, allowing a locally authenticated low-privilege user to elevate to SYSTEM-level access by invoking a critical RDS function that lacks proper authentication enforcement (CWE-306). The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available for all affected versions.
Privilege escalation in Windows Remote Desktop Services (RDS) via a missing authentication check (CWE-306) allows a locally authenticated, low-privileged user to gain SYSTEM or administrator-level access on the target machine. The vulnerability affects an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - multiplying the organizational exposure. No active exploitation is confirmed by CISA KEV and no public exploit code is identified at time of analysis, though the low attack complexity (AC:L) and absence of required user interaction make the technique straightforward once a local foothold is achieved.
Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, allowing a locally authenticated low-privilege attacker to elevate to full SYSTEM-level control. The root cause is CWE-306 - a critical RDS function entirely lacking an authentication gate - meaning any low-privilege account holder can invoke it without proper authorization. Microsoft has released patches across all affected product lines, though no public exploit code or CISA KEV listing was present in the available intelligence.
Privilege escalation in Windows Remote Desktop Services (RDS) exploits a missing authentication check for a critical internal function, allowing a locally authenticated attacker to gain SYSTEM-level or equivalent elevated privileges. Affected platforms span Windows 10, Windows 11, and Windows Server 2019 through 2025, covering a broad swath of modern Microsoft deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed patch availability and low attack complexity make rapid patching urgent.
Privilege escalation in Windows DHCP Server allows a locally authenticated attacker to gain SYSTEM-level privileges by exploiting a symlink/link-following flaw (CWE-59). Affected products span Windows Server 2012 through Windows Server 2025 and Windows 10 (1607/1809), all receiving patches in this advisory cycle. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and broad version coverage make this a meaningful patching priority for any Windows Server environment running the DHCP Server role.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Local privilege escalation in Windows Installer (msiexec) enables an authenticated low-privileged user to trigger a heap-based buffer overflow, potentially achieving SYSTEM-level code execution across a broad range of Windows client and server platforms spanning over a decade of releases. Affected systems include Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the exposure surface extensive across enterprise and consumer deployments. No public exploit identified at time of analysis and no active exploitation confirmed via CISA KEV; vendor-released patches are available through the Microsoft Security Response Center.
Local privilege escalation in the Windows SMB Client on Windows 11 version 26H1 enables a low-privileged authorized attacker to gain SYSTEM-level control via a heap-based buffer overflow (CWE-122). The CVSS 7.8 (High) score reflects low attack complexity and no user interaction required once local access is established, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch raising build to 10.0.28000.2704 is available from Microsoft.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.
Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.