Type confusion (CWE-843) in Microsoft Office enables local code execution across multiple Office product lines when a user opens a crafted file. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. With high confidentiality, integrity, and availability impact and user-interaction-only as the sole prerequisite, the vulnerability presents meaningful risk in phishing and malicious-document delivery scenarios. No public exploit identified at time of analysis, though a vendor patch is available.
Heap-based buffer overflow in Microsoft Office allows local code execution across a wide range of Office versions on both Windows and macOS when a victim opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms that no privileges are required - only that a user interacts with malicious content - making this practically reachable via phishing or drive-by document delivery despite the local attack vector. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in Windows DHCP Server affects all major Windows Server releases from 2012 through 2025, as well as Windows 10 versions 1607 and 1809. An authorized low-privileged local attacker can exploit a symlink-following flaw (CWE-59) during DHCP Server file access operations to gain full control (C:H/I:H/A:H) over the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Privilege escalation via untrusted search path (CWE-426) in Windows Narrator Braille affects multiple Windows 10, Windows 11, and Windows Server builds, allowing a locally authenticated attacker to elevate from standard user to higher privileges. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity once local access is established, with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but a vendor-released patch is available and should be applied promptly.
Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows Server and client platforms, allowing a locally authenticated low-privilege user to elevate to SYSTEM-level access by invoking a critical RDS function that lacks proper authentication enforcement (CWE-306). The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available for all affected versions.
Privilege escalation in Windows Remote Desktop Services (RDS) via a missing authentication check (CWE-306) allows a locally authenticated, low-privileged user to gain SYSTEM or administrator-level access on the target machine. The vulnerability affects an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - multiplying the organizational exposure. No active exploitation is confirmed by CISA KEV and no public exploit code is identified at time of analysis, though the low attack complexity (AC:L) and absence of required user interaction make the technique straightforward once a local foothold is achieved.
Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, allowing a locally authenticated low-privilege attacker to elevate to full SYSTEM-level control. The root cause is CWE-306 - a critical RDS function entirely lacking an authentication gate - meaning any low-privilege account holder can invoke it without proper authorization. Microsoft has released patches across all affected product lines, though no public exploit code or CISA KEV listing was present in the available intelligence.
Privilege escalation in Windows Remote Desktop Services (RDS) exploits a missing authentication check for a critical internal function, allowing a locally authenticated attacker to gain SYSTEM-level or equivalent elevated privileges. Affected platforms span Windows 10, Windows 11, and Windows Server 2019 through 2025, covering a broad swath of modern Microsoft deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed patch availability and low attack complexity make rapid patching urgent.
Privilege escalation in Windows DHCP Server allows a locally authenticated attacker to gain SYSTEM-level privileges by exploiting a symlink/link-following flaw (CWE-59). Affected products span Windows Server 2012 through Windows Server 2025 and Windows 10 (1607/1809), all receiving patches in this advisory cycle. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and broad version coverage make this a meaningful patching priority for any Windows Server environment running the DHCP Server role.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Local privilege escalation in Windows Installer (msiexec) enables an authenticated low-privileged user to trigger a heap-based buffer overflow, potentially achieving SYSTEM-level code execution across a broad range of Windows client and server platforms spanning over a decade of releases. Affected systems include Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the exposure surface extensive across enterprise and consumer deployments. No public exploit identified at time of analysis and no active exploitation confirmed via CISA KEV; vendor-released patches are available through the Microsoft Security Response Center.
Local privilege escalation in the Windows SMB Client on Windows 11 version 26H1 enables a low-privileged authorized attacker to gain SYSTEM-level control via a heap-based buffer overflow (CWE-122). The CVSS 7.8 (High) score reflects low attack complexity and no user interaction required once local access is established, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch raising build to 10.0.28000.2704 is available from Microsoft.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.
Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.
Privilege escalation via out-of-bounds read in the Windows Win32K kernel graphics subsystem affects every supported and extended-support Windows client and server release, from Windows Server 2012 through Windows 11 26H1. Any locally authenticated standard user - requiring no elevated permissions or user interaction - can exploit CWE-125 in win32k.sys to obtain SYSTEM-level privileges. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected builds across the Microsoft fleet makes this a broad patching priority regardless of active exploitation signals.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated local attacker to gain SYSTEM-level privileges on affected Windows 11 26H1 systems. The vulnerability is a heap-based buffer overflow in the kernel driver, exploitable by a low-privileged user without any user interaction. No public exploit has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
Heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (CldFlt.sys) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard user account with no user interaction and no special configuration - a reliable post-access escalation primitive. Microsoft has released patches; no public exploit code or CISA KEV listing is present in the provided data.
Privilege escalation via heap-based buffer overflow in Windows Shell affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. A locally authenticated, low-privileged attacker can trigger heap corruption within the Windows Shell component to achieve full SYSTEM-level code execution with no user interaction required and low attack complexity. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows DHCP Client service enables a low-privileged local attacker to elevate privileges to SYSTEM level with full confidentiality, integrity, and availability impact. The flaw spans virtually every supported Windows desktop and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad in any environment where interactive or local logon access is possible. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches via the standard update guide.
Privilege escalation via heap-based buffer overflow in Windows HTTP.sys affects a broad range of Windows 10, 11, and Windows Server releases. An attacker with low-level local access can exploit the CWE-122 flaw in the kernel-mode HTTP driver to achieve full system compromise - High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing this vulnerability across all affected version branches.
Privilege escalation via heap-based buffer overflow in the Windows DHCP Client affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing an authorized local attacker with low-level privileges to gain full SYSTEM-level control. The flaw carries a CVSS base score of 7.8 with high confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, though Microsoft has released patches covering all affected build ranges.
Privilege escalation via an out-of-bounds read in the Windows Win32K kernel subsystem allows a local authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server versions. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects a low-complexity local attack with full C/I/A impact, meaning any low-privileged user or compromised process can exploit this to completely own the host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the 19 affected Windows SKUs spanning Server 2012 through Windows 11 26H1 make this a high-priority patch cycle item - particularly for Remote Desktop and terminal server deployments where untrusted local sessions are common.
Privilege escalation via heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service affects virtually every current and legacy Windows release from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can overwrite heap memory to gain SYSTEM-level code execution on the target host without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; however, Microsoft has confirmed and patched the vulnerability through the MSRC update guide.
Privilege escalation in the Windows Work Folder Service allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free memory corruption flaw rooted in a race condition (CWE-362). The vulnerability affects a wide range of Windows client and server releases from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation; however, technical impact is rated 'total,' indicating full system compromise is achievable if exploited.
Privilege escalation in Windows License Manager exposes a critical authenticated-but-low-privileged local attacker path to full SYSTEM-level control across a wide range of Windows client and server builds. The root cause (CWE-306) is a missing authentication gate on a privileged License Manager function - an authorized standard user can invoke it without satisfying the elevated-privilege check that should protect it. Microsoft has released patches covering Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows RPC API exploits a missing authentication gate on a critical function (CWE-306), enabling any low-privileged authenticated local user to attain SYSTEM-level control across a sweeping range of Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard user account with no user interaction. No public exploit code is identified at time of analysis, and CISA SSVC rates current exploitation status as none, though technical impact is rated total.
OS command injection via the SNMP-handling code path in SonicWall Email Security 10.0.35.8405 and earlier grants a low-privileged, authenticated CLI user root-level code execution on the underlying appliance OS. The restricted CLI fails to sanitize user-supplied input before passing it to SNMP-related system commands, enabling full host compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total technical impact (full confidentiality, integrity, and availability loss) makes this a high priority for any deployment where CLI access is shared or weakly controlled.
OS command injection in SonicWall Email Security (versions 10.0.35.8405 and earlier) allows an authenticated restricted CLI user to execute arbitrary commands as root via a crafted netmask parameter. The CVSS 7.8 score reflects complete confidentiality, integrity, and availability impact despite requiring local CLI access and low-level privileges. No public exploit code exists and CISA SSVC indicates no known exploitation at time of analysis, though successful exploitation yields full appliance compromise.
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a victim into opening a specially crafted malicious file, exploiting an integer overflow in the application's file parsing logic (CWE-190). The flaw yields full compromise of confidentiality, integrity, and availability within the current user's context, consistent with the CVSS 7.8 score. Adobe has released a patch in version 15.5 per advisory APSB26-94; no public exploit has been identified at time of analysis.
Path traversal in FreeCAD prior to version 1.1.2 allows arbitrary file write to any location accessible to the running user when a crafted .FCStd document is opened. The PropertyFileIncluded::Restore() function in src/App/PropertyFile.cpp processes the file and data attributes from Document.xml without sanitizing directory separators, parent traversal sequences, or absolute paths, meaning a malicious ZIP archive containing a matching FileIncluded XML attribute can direct writes outside the intended transient directory. No public exploit has been identified at time of analysis, but the fix is confirmed released in version 1.1.2 and the vulnerability is straightforward to weaponize given public patch disclosure.
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in the context of the logged-in user when a crafted malicious file is opened. Tagged as Memory Corruption, RCE, and Buffer Overflow by Adobe PSIRT, this is a file-parsing flaw rooted in CWE-787. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, Adobe has released patch version 15.5 via advisory APSB26-94.
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens a specially crafted malicious file, exploiting an out-of-bounds write flaw in the application's file parsing logic. The vulnerability executes at the privilege level of the current user, meaning full compromise of user-accessible data and processes without requiring elevation. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, file-based delivery against creative professionals - a population that routinely opens files from clients, stock libraries, and external collaborators - represents a realistic social-engineering attack surface.
Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user when a victim opens a specially crafted file. All releases from 15.2 through 15.4.1 are confirmed affected; Adobe has released version 15.5 as the fix per advisory APSB26-94. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of a concrete patch release and high CVSS impact warrants prompt remediation for any organization with creative or photography workflows.
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security context of the current user through a maliciously crafted file. The flaw, classified under CWE-787 (Memory Corruption / Buffer Overflow), resides in file-parsing logic and requires no elevated privileges on the attacker's side - only that a victim opens the weaponized file. No public exploit code or active exploitation has been confirmed at time of analysis; vendor-released patch 15.5 is available.
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted file. Tagged as Memory Corruption, RCE, and Buffer Overflow by Adobe PSIRT, the vulnerability carries a CVSS 7.8 (High) rating. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-based attack vector makes it suitable for phishing and malicious download campaigns targeting creative professionals.
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a crafted malicious file is opened. The vulnerability is rooted in improper memory boundary validation during file parsing (CWE-787), yielding full confidentiality, integrity, and availability impact per CVSS. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE-class severity and file-delivery vector make this a meaningful phishing or watering-hole risk for creative professionals.
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in the context of the logged-in user when a specially crafted file is opened. Adobe's PSIRT reported the issue under advisory APSB26-94, and the ENISA EUVD tracks it as EUVD-2026-56829. No public exploit or CISA KEV listing has been identified at time of analysis, though the CWE-787 memory corruption class combined with a confirmed high C/I/A impact triad warrants prompt patching across all affected release branches.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.
DNS rebinding and local-network exposure in the Genkit Developer UI server (default port 4000) allows any attacker-controlled website visited by the developer, or any host on the developer's local network, to invoke POST /api/runAction and execute arbitrary registered Genkit actions, reading full results. The root cause is absent Host header validation combined with the server binding to all network interfaces rather than loopback only. No public exploit or CISA KEV listing has been identified; the upstream fix was merged on 2026-06-18 per GitHub PR #5587 and independently corroborated by a CISA CSAF advisory.
Privilege escalation in the `openvt -u` utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in `authenticate_user()`, which resolves VT ownership via `stat("/proc/<pid>/fd/0")` - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless `login -f root` execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected `kbrequest`/init deployment pattern.
Stored Cross-Site Scripting in Adobe Commerce and Magento Open Source allows a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any privileged user who views the affected page. The changed scope (S:C) is the defining risk amplifier: a successful exploitation targets an administrator or session-holding user whose browser context becomes fully compromised, enabling session hijacking or unauthorized actions without ever requiring admin credentials. No public exploit code has been identified and this CVE is not listed in CISA KEV at the time of analysis.
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.