Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. The CVSS vector (AV:L/PR:N/UI:R) confirms the attack requires no system privileges but does require user interaction - the classic malicious-document delivery pattern. Full confidentiality, integrity, and availability compromise results, making this a high-severity threat against any organization reliant on Excel for document workflows. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted workbook, resulting in full compromise of confidentiality, integrity, and availability on the local system. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no attacker privileges are required, though user interaction - opening the malicious file - is a hard prerequisite. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue is confirmed by Microsoft's Security Response Center via secure@microsoft.com.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. The attack requires no privileges from the attacker but does require user interaction - consistent with a malicious document delivery vector - and carries high impact across confidentiality, integrity, and availability. No active exploitation (KEV) or public exploit code has been identified in the provided intelligence at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted Excel file. An unauthenticated attacker (per CVSS PR:N) delivers a malicious document that triggers the overflow upon interaction (UI:R), achieving full confidentiality, integrity, and availability compromise on the victim system. No public exploit or KEV listing has been identified at time of analysis, though the attack pattern is well-understood and document-based Excel exploits have a long operational history.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution on the victim's local machine when a specially crafted Excel file is opened. The vulnerability carries a CVSS base score of 7.8 with high confidentiality, integrity, and availability impact, affecting the victim's user-level security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, reducing immediacy compared to actively exploited file-format parsing flaws.
Out-of-bounds read in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook file. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms file-based delivery requiring victim interaction, achieving full confidentiality, integrity, and availability impact on the compromised host. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Microsoft Office enables local code execution when a user opens a specially crafted document, affecting multiple product lines including Office 2016 through Microsoft 365 Apps for Enterprise. The vulnerability carries a CVSS 7.8 (High) score and achieves full confidentiality, integrity, and availability compromise on the victim system. No public exploit code has been identified at time of analysis, and Microsoft has released patches via the standard Office Security Releases channel.
Local privilege escalation in Windows User-Mode Power Service (UMPS) affects a broad swath of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authenticated low-privileged local user can exploit insufficient access control granularity (CWE-1220) in UMPS to elevate privileges, achieving full confidentiality, integrity, and availability impact consistent with SYSTEM-level access. No public exploit identified at time of analysis, but Microsoft has released patches across all affected build lines, making this a high-priority patching item for organizations running any of the 19 affected Windows configurations identified in EUVD-2026-56638.
Local privilege escalation in Windows Installer (msiexec) affects virtually the entire modern Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 - via an incorrect authorization flaw (CWE-863). An attacker with low-privilege authenticated local access can exploit the broken authorization check within the Installer service to elevate to SYSTEM-level privileges, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code has been identified at time of analysis, though Microsoft has released patches across the full affected version matrix per MSRC advisory.
Privilege escalation in Windows App Installer (the App Installer component of Windows Package Manager, aka winget) allows an authenticated local attacker with standard user privileges to fully compromise confidentiality, integrity, and availability of the affected system. The flaw stems from improper privilege management (CWE-269), meaning the application fails to correctly enforce privilege boundaries during its operations. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as 'none', and EPSS sits at only 0.33% (26th percentile) - but the SSVC technical impact rating of 'total' reflects the severity of a successful local privilege escalation to full system control.
Sandbox escape in Cursor IDE for macOS (versions prior to 3.0.0) allows a malicious or prompt-injected AI agent operating in Auto-Run Sandbox mode to break container isolation by invoking the Dev Containers CLI to launch a privileged Docker container that mounts the host's virtiofs0 virtual filesystem. This grants the agent unrestricted read and write access to the user's entire home directory and enables arbitrary command execution at the user's privilege level - all without any additional permission prompt to the user. No public exploit code has been identified at time of analysis; a vendor-released patch is available as version 3.0.0.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.
Stack-based buffer overflow in Windows Installer enables local privilege escalation across a wide range of Microsoft Windows desktop and server editions. An authenticated low-privileged local user can exploit the flaw (CWE-121) to achieve SYSTEM-level code execution, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and broad affected surface spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025 make this a high-priority patching target.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem enables a locally authenticated attacker to elevate privileges to SYSTEM-level access across a broad range of Windows client and server releases. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact upon successful exploitation with low attack complexity once local access is established. Microsoft has released patches per MSRC advisory CVE-2026-62754; no public exploit code has been identified and the vulnerability has not appeared in the CISA KEV catalog at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Kerberos affects the full breadth of supported Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025. An attacker holding a valid low-privilege local account can trigger a heap corruption condition in the Kerberos implementation to achieve complete confidentiality, integrity, and availability impact on the compromised host - effectively gaining SYSTEM-level control. Vendor-released patches with exact fixed build numbers are available via Microsoft MSRC; no public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Projected File System (ProjFS) via an integer overflow allows an authenticated local user to gain full SYSTEM-level control over the affected host. The flaw spans a wide range of actively supported Windows releases - from Windows 10 21H2 through Windows 11 26H1, and both Windows Server 2022 and 2025 - making it a broadly applicable post-compromise escalation primitive. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds addressing the vulnerability.
Windows Device Association Service contains a heap-based buffer overflow (CWE-122) that enables local privilege escalation on a broad swath of Windows client and server editions, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An attacker holding a standard low-privileged local account can exploit this flaw without any user interaction, achieving high impact across confidentiality, integrity, and availability - consistent with full SYSTEM-level compromise. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but Microsoft has released patches and the low attack complexity (AC:L) makes this a reliable privilege escalation primitive once local foothold is established.
Privilege escalation via heap-based buffer overflow in Windows Telephony Service (TAPI) affects virtually all supported Windows client and server builds, from legacy Server 2012 through current Windows 11 25H2 and Server 2025. An authorized local user with standard low-privilege credentials can trigger the heap overflow in tapisrv to achieve SYSTEM-level access. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patches are available across all 19 affected product SKUs per MSRC.
Privilege escalation in the Windows Bind Filter Driver, a kernel-mode component present in Windows 11 and Windows Server 2025, stems from a heap-based buffer overflow that enables a locally authenticated user with standard privileges to gain SYSTEM-level control over the affected host. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core installations, with patched builds confirmed by Microsoft via MSRC advisory CVE-2026-62722. No public exploit has been identified at time of analysis, and the vulnerability has not been added to CISA's KEV catalog.
Privilege escalation via heap-based buffer overflow in Windows Message Queuing (MSMQ) allows a locally authenticated attacker with low privileges to gain SYSTEM-level access across a wide range of Microsoft Windows desktop and server editions. The flaw, classified as CWE-122, spans from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature update channels, making it broadly relevant in enterprise environments where MSMQ is deployed. Patch is available from Microsoft via the MSRC update guide; no public exploit or CISA KEV listing has been identified at the time of analysis.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to achieve full system compromise via a heap-based buffer overflow. Confirmed affected across a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 all versions. No public exploit identified at time of analysis and no CISA KEV listing; however, the low attack complexity combined with universal Windows platform coverage makes this a meaningful post-exploitation or insider-threat vector.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects a broad spectrum of Windows client and server releases, from Windows Server 2012 through Windows 11 25H2. An authenticated local attacker can exploit this flaw with low complexity and no user interaction to achieve full SYSTEM-level privileges (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, but the low-complexity local exploitation profile - combined with the near-universal deployment footprint of Windows - makes this a high-priority patch for both endpoint and server environments.
Heap-based buffer overflow in the Windows Device Association Service allows a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server releases. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025, making this a high-coverage local privilege escalation. No public exploit identified at time of analysis, but vendor patches are available and should be applied immediately given the low attack complexity.
Privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged local attacker to gain SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The root cause is CWE-416 (Use After Free), a memory-safety flaw in the MDM component where a freed memory object is dereferenced, enabling controlled memory corruption that can redirect execution to attacker-supplied code. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV entry is identified at time of analysis.
Privilege escalation via use-after-free in the Windows Telephony Service (TAPI) allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access across a broad range of Windows desktop and server releases. The vulnerability affects Windows 10, Windows 11 (all current feature releases), and Windows Server 2012 through 2025, representing near-universal coverage of supported and legacy Microsoft platforms. No public exploit identified at time of analysis; vendor-released patches are available via Microsoft Update.
Privilege escalation via heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) affects virtually the entire Microsoft Windows product portfolio, from legacy Server 2012 through Windows 11 25H2 and Server 2025. A locally authenticated, low-privileged attacker can trigger memory corruption in ring-0 kernel space, resulting in full SYSTEM-level privilege acquisition on the target host. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches across all affected product lines via the MSRC update guide.
Windows Storage in multiple Windows 11 and Windows Server releases contains a heap-based buffer overflow that allows any locally authenticated low-privilege user to escalate to SYSTEM-level access with no user interaction required. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this is a straightforward, low-complexity privilege escalation once an attacker has a local foothold - covering Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025. Microsoft has released patches across all affected product lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Windows Remote Desktop Services stems from a heap-based buffer overflow (CWE-122) that an authorized local attacker can exploit to gain full SYSTEM-level control of the affected host. The vulnerability spans an exceptionally wide range of Microsoft Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the aggregate patch surface very large across enterprise fleets. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Local privilege escalation in Windows HTTP.sys enables authenticated local attackers to gain SYSTEM-level access across a sweeping range of Windows client and server releases, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An integer overflow in the kernel-mode HTTP driver triggers a heap-based buffer overflow (consistent with both the CWE-122 classification and the vendor-applied 'Heap Overflow' tag), allowing an attacker with an existing low-privilege local foothold to corrupt kernel heap structures and achieve full code execution as SYSTEM. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the extremely broad affected surface and low attack complexity make timely patching a high priority for enterprise environments.
Privilege escalation via use-after-free in the Windows Bind Filter Driver affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing a locally authenticated attacker to gain SYSTEM-level privileges. The memory corruption flaw (CWE-416) is triggered through the kernel-mode filter driver component, yielding full confidentiality, integrity, and availability impact per CVSS. SSVC signals no confirmed exploitation and non-automatable attack path; a vendor patch is available and should be prioritized given the total technical impact rating.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables any standard authenticated local user to gain full SYSTEM-level control across a wide range of Windows 10, Windows 11, and Windows Server deployments. The vulnerability arises from a type confusion condition in the DWM Core Library - though the CWE-122 classification and vendor tags ('Heap Overflow', 'Buffer Overflow') indicate the confusion likely manifests through or triggers a heap-based memory corruption primitive. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows USB Driver (CWE-122) affects a broad range of Microsoft Windows client and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authenticated local attacker with low privileges can exploit this kernel-mode heap corruption to achieve full system compromise - gaining complete confidentiality, integrity, and availability over the affected host. Microsoft has released patches across all affected versions via the MSRC advisory; no public exploit has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Display Enhancement Service allows a local low-privileged attacker to gain SYSTEM-level control across a broad swath of Windows desktop and server releases. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes patching a meaningful operational priority.
Local privilege escalation in Windows Application Information Services (appinfo) allows an authenticated local user to gain SYSTEM-level privileges through a use-after-free memory corruption flaw (CWE-416). Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, plus Windows Server 2025 and its Server Core variant - all current, widely-deployed Microsoft platforms. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and full CIA impact (C:H/I:H/A:H) make this a high-priority patch for any environment where untrusted or low-privileged users have local access.
Heap-based buffer overflow in the Windows Sensor Data Service enables a locally authenticated, low-privileged attacker to fully compromise a target Windows system by escalating to SYSTEM-level privileges. Affecting Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across dozens of specific build ranges, exploitation requires no user interaction and low complexity once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, but SSVC classifies technical impact as total; Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Telephony Service (TAPISRV) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases spanning Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability carries a CVSS 7.8 score with low attack complexity, meaning exploitation is straightforward once local access is established, making it an effective second-stage tool in a broader attack chain. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected build lines.
Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution with full system-level impact when a victim opens a specially crafted Excel file. The flaw (CWE-122) resides in Excel's file parsing logic, where malformed input causes a heap memory region to be overwritten, redirecting execution flow. No public exploit has been identified at time of analysis, and the vulnerability has not appeared in CISA's Known Exploited Vulnerabilities catalog, though the Microsoft Security Response Center has issued an advisory.
Type confusion (CWE-843) in Microsoft Office Excel enables local code execution when a victim opens a specially crafted file. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms the attack is file-based: no attacker privileges are required, but the target user must open a malicious document, making this a high-impact phishing-delivery vector. No public exploit code and no CISA KEV listing are identified at time of analysis, but the full confidentiality, integrity, and availability impact (C:H/I:H/A:H) makes this a critical priority for organizations where Excel is deployed.
Untrusted pointer dereference in Microsoft Office Excel enables local arbitrary code execution when a user opens a crafted document. The flaw (CWE-822) allows an attacker who can deliver a malicious file to achieve full code execution with high confidentiality, integrity, and availability impact on the victim's system. No public exploit has been identified at time of analysis, and Microsoft has not listed this in CISA's Known Exploited Vulnerabilities catalog.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted file, granting full confidentiality, integrity, and availability compromise of the affected system. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a document-triggered exploit requiring no attacker privileges but demanding victim interaction - a profile consistent with malicious email attachment or drive-by download campaigns. No public exploit code or CISA KEV listing has been identified at time of analysis, though Excel's ubiquity makes this a high-value target class.
Type confusion (CWE-843) in Microsoft Office Excel enables local code execution by an unauthenticated attacker when a victim opens a specially crafted Excel document. The CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a file-borne attack requiring user interaction but no attacker privileges, with full High/High/High C/I/A impact. No public exploit code or CISA KEV listing has been identified at time of analysis, though the memory corruption tag suggests the type confusion leads to exploitable heap or stack corruption.
Heap-based buffer overflow in Microsoft Office Access enables local code execution across Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise when a victim opens a specially crafted database file. The flaw, rooted in CWE-122, yields full High/High/High impact on confidentiality, integrity, and availability (CVSS 7.8), making successful exploitation equivalent to arbitrary code execution in the user's security context. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches via the Office Security Releases channel.
Stack-based buffer overflow in Microsoft Office Access enables a local unauthenticated attacker to achieve arbitrary code execution when a victim opens a specially crafted Access database file. Affected products span Microsoft Access 2016 (32-bit and 64-bit), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit has been identified at time of analysis, and a vendor-released patch is available through the Microsoft Security Response Center.
Stack-based buffer overflow in Microsoft Office Access enables local code execution with high impact across confidentiality, integrity, and availability. Affected products span Microsoft Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - all at version 16.0.x or 19.0.x prior to the patched releases. An attacker who can deliver a malicious Access file and induce a local user to open it can achieve arbitrary code execution in the context of that user. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Heap-based buffer overflow in Microsoft Office Access enables local arbitrary code execution with full confidentiality, integrity, and availability impact across several Office product families. The vulnerability, rooted in CWE-122, affects Microsoft Access 2016 (both 32- and 64-bit editions), Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Exploitation requires local access and user interaction - consistent with a malicious database file delivery scenario - and a vendor patch is available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution when a user opens a specially crafted Access database file. Affected products span Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad corporate user base. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.