Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows a locally authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows 11 and Windows Server 2025 builds. The CWE-122 flaw resides in the ReFS kernel driver and requires no user interaction, making it a reliable local privilege escalation primitive when combined with any initial-access vector. Microsoft has released patches via MSRC; no public exploit code or active CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access across a wide range of Windows releases spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all fifteen affected product/version combinations via the standard Windows Update channel. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the CVSS AC:L rating indicates reliable exploitation without race conditions, making this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables any locally authenticated standard user to escalate privileges to SYSTEM across virtually all supported Windows 10, Windows 11, and Windows Server editions. The flaw (CWE-122) exploits the service's privileged execution context combined with its exposure to requests from low-privileged user sessions, yielding full confidentiality, integrity, and availability compromise of the host. Microsoft has released patched builds across all affected platforms; no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Privilege escalation to SYSTEM-level in Windows Biometric Service (WinBioSrvc) affects virtually all supported Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authorized local attacker with low-privilege code execution can exploit a heap-based buffer overflow in the biometric service process to achieve full local compromise - gaining high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches across all 15 affected build branches as confirmed by EUVD-2026-73750.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Local privilege escalation in Microsoft's Trace Data Helper (TDH) component - a Windows Event Tracing subsystem library - allows a low-privileged authenticated local user on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 to gain full SYSTEM-level control. The root cause is an out-of-bounds read (CWE-125) that enables disclosure of kernel memory contents sufficient to defeat address-space layout randomization and chain into a full privilege escalation, yielding C:H/I:H/A:H impact. No active exploitation has been identified and no public proof-of-concept is available; Microsoft has released patched builds across all affected OS versions.
Use-after-free memory corruption in the Windows Hello authentication subsystem allows a local, low-privileged authenticated user to escalate privileges to a higher-integrity context across a security boundary. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, with specific patched build numbers published by Microsoft. No public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C, C:H/I:H/A:H) signals that successful exploitation yields full compromise of a more privileged security principal.
Integer overflow in Adobe Photoshop Desktop enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted malicious file. Both the Photoshop 2026 (≤27.6) and Photoshop 2025 (≤26.11.6) release lines are affected. No public exploit code or active exploitation has been identified at time of analysis, but the file-open attack surface is a historically well-worn delivery mechanism for creative-software exploits.
Integer overflow in Adobe Photoshop Desktop's file-parsing logic allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Affected versions span both Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6), covering a broad installed base of creative and enterprise users. No public exploit code or active exploitation has been identified at time of analysis; Adobe has published a fix under advisory APSB26-130.
Integer overflow in Adobe Photoshop Desktop (versions 2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the authenticated user. The flaw is triggered during parsing of a specially crafted file - a social-engineering delivery step is required, as the victim must open the malicious file. Adobe has issued advisory APSB26-130 addressing both affected release lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Integer overflow in Adobe Photoshop Desktop (2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. The attack vector is local (AV:L) with mandatory user interaction (UI:R), making social engineering - phishing with a weaponized design file - the primary delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad and Adobe PSIRT attribution confirm this is a serious file-parsing flaw covered under advisory APSB26-130.
Privilege escalation in the Windows Kernel enables any authenticated local user to gain SYSTEM-level access through a missing authorization check (CWE-862). The vulnerability spans a broad range of actively supported Windows releases - including Windows 10 1809 through Windows 11 26H1 and Windows Server 2019, 2022, and 2025 - making the affected surface extremely wide. Microsoft has released patched builds via the MSRC update guide; no public exploit code or CISA KEV listing is identified at time of analysis.
Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.
Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution at current-user privilege level when a victim opens a crafted PDF or supported file format. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383 across all supported platforms, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation in the wild has been identified at the time of this analysis, but Adobe Acrobat's ubiquity in enterprise document workflows makes this a credible phishing or spear-phishing vehicle.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious document. Affected across both the continuous track (≤26.002.21900) and the classic 2024 track (≤24.001.30383), this is a memory corruption vulnerability rooted in improper object lifecycle management within Acrobat's rendering engine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open attack surface and high impact make this a credible phishing or watering-hole delivery risk.
Use-after-free (UAF) in Adobe Acrobat Reader allows arbitrary code execution in the context of the authenticated local user when a victim opens a specially crafted malicious PDF or document file. Affected versions span Acrobat 2024 (≤24.001.30383) and both Acrobat and Acrobat Reader (≤26.002.21900), making the exposure broad across the current release track. No public exploit or active exploitation has been confirmed at time of analysis, but the file-based delivery vector makes this class of vulnerability routinely weaponized via phishing campaigns.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted PDF file. Affected versions include Acrobat Reader and Adobe Acrobat up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit code or active exploitation has been identified at time of analysis, but the ubiquity of Acrobat Reader across enterprise environments and the reliable code-execution impact make patching a high priority.
Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.
Integer overflow in Adobe Acrobat Reader and Acrobat (all editions through 26.002.21900) and Acrobat 2024 (through 24.001.30383) enables arbitrary code execution within the context of the victim's user account. The flaw is triggered when a user opens a specially crafted PDF file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, but the high CIA impact and wide deployment footprint make patching a priority.
Type confusion (CWE-843) in Adobe Acrobat Reader and Acrobat 2024 allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Multiple product lines are affected, including Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383. No public exploit or CISA KEV listing has been identified at time of analysis, but the ubiquity of Acrobat Reader and routine delivery of PDFs via phishing make this a realistic and high-priority patching target.
Double Free memory corruption in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the victim user when a malicious PDF or document file is opened. Affected versions span Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. Adobe PSIRT has published advisory APSB26-141 confirming the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in Adobe Photoshop Desktop allows arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted malicious file. Affected versions span both the Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6) release lines. Adobe's PSIRT has released advisory APSB26-130 addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in Adobe Photoshop Desktop enables arbitrary code execution in the context of the victim's user account when a malicious file is opened. Both the 2025 branch (through version 26.11.6) and the 2026 branch (through version 27.6) are confirmed affected per Adobe's EUVD entry and APSB26-130 advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-open trigger and high CVSS C/I/A ratings make this a credible phishing-delivery vector in creative and design environments.
Local privilege escalation in Android 17's telephony stack allows a low-privileged app to achieve arbitrary code execution without user interaction. The logic error in the serviceClassExists method of InCallController.java (CWE-693, Protection Mechanism Failure) enables an attacker with local shell or app access to elevate privileges to those of the telecom service process, gaining full read, write, and execution control. No public exploit exists at time of analysis, and SSVC assesses exploitation as none, though the technical impact is rated total.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat allows arbitrary code execution in the context of the opening user when a victim opens a specially crafted malicious file. All versions of Acrobat Reader and Adobe Acrobat through 26.002.21900, and Acrobat 2024 through 24.001.30383, are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the file-based delivery mechanism and full C:H/I:H/A:H impact make this a material risk for organizations with unpatched deployments.
Out-of-bounds write (CWE-787) in Adobe Acrobat and Acrobat Reader enables arbitrary code execution in the current user's context when a victim opens a specially crafted malicious file. All continuous-track versions through 26.002.21900 and Acrobat 2024 versions through 24.001.30383 are affected, per Adobe PSIRT and EUVD-2026-74193. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction to deliver and open a malicious document.
Out-of-bounds write in Adobe Acrobat and Acrobat Reader allows arbitrary code execution in the current user's context when a victim opens a specially crafted file. Affected are Acrobat 2024 versions through 24.001.30383 and Adobe Acrobat/Acrobat Reader through 26.002.21900, per Adobe APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the ubiquity of Acrobat as an attack surface and the RCE-grade impact make this a priority patch.
Out-of-bounds write in Adobe Acrobat Reader and Acrobat (Continuous track through 26.002.21900; Classic 2024 track through 24.001.30383) enables arbitrary code execution in the context of the victim user. The CWE-787 memory corruption flaw is triggered when a specially crafted document is opened, placing this squarely in the document-weaponization threat category common to PDF toolchains. Adobe PSIRT has issued advisory APSB26-141; no public exploit code or CISA KEV listing has been identified at time of analysis.