Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave exposes authenticated local attackers to full system compromise via an untrusted pointer dereference (CWE-822). Affected platforms include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both standard and Server Core configurations, with Microsoft confirming a patch is available. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (AC:L) makes post-access escalation straightforward for any attacker holding a standard local session.
Privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver exposes multiple Windows 10, Windows 11, and Windows Server 2025 builds to local SYSTEM-level compromise through CWE-822 untrusted pointer dereference. A low-privileged local attacker can craft an IOCTL that causes the driver to dereference an attacker-controlled pointer value in kernel context, yielding full system takeover. Microsoft has released patched builds across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Graphic Fonts subsystem allows any low-privileged, authenticated local user to gain SYSTEM-level access via a use-after-free memory corruption flaw (CWE-416). The vulnerability spans the full breadth of supported and legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it an enterprise-wide concern. No public exploit code or CISA KEV listing is identified at time of analysis, though the broad attack surface across all modern Windows versions elevates its remediation priority significantly.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Enterprise App Management allows a low-privileged authenticated local attacker to gain full control over an affected system via improper handling of insufficient permissions (CWE-280). The vulnerability spans a wide swath of Microsoft's Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it broadly relevant to enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected versions.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated, low-privileged attacker to gain full system-level control without additional user interaction. The root cause is CWE-862 (Missing Authorization): the MDM component fails to enforce authorization checks on operations that should require elevated privileges, enabling an attacker who already has local access to escalate to SYSTEM or equivalent. No public exploit code has been identified at time of analysis, but the low complexity and broad Windows footprint make this a meaningful patching priority.
Local privilege escalation in the Windows Data Sharing Service Client (DsSvc) enables a low-privileged authenticated local user to gain SYSTEM-level access across a sweeping range of Windows 10, Windows 11, and Windows Server releases. The root cause is CWE-862 (Missing Authorization): the service client fails to enforce authorization checks on operations that should be restricted to higher-privilege callers, allowing a standard user account to invoke privileged service operations without additional conditions. Vendor-released patches are available via Microsoft's update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. Affected versions span both the Photoshop 2025 line (≤26.11.6) and Photoshop 2026 line (≤27.6), covering a broad install base of creative and enterprise users. No public exploit has been identified at time of analysis, though the file-based delivery mechanism makes phishing or watering-hole distribution a natural attack path.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) affects authorized standard users across a sweeping range of Windows 10, Windows 11, and Windows Server versions from 2016 through 2025. A low-privileged local attacker can trigger the CWE-122 heap overflow to achieve full SYSTEM-level control (C:H/I:H/A:H) without user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the ubiquity of the affected platform and the low attack complexity make this a meaningful post-access privilege escalation primitive.
Privilege escalation in the Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to gain SYSTEM-level access via a heap-based buffer overflow. Affecting 15 distinct Windows client and server builds spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw requires only a standard user account and no interaction from any other user. Microsoft has released patched builds across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated standard user to escalate privileges to SYSTEM on a broad range of affected Windows desktop and server editions. The flaw (CWE-122) requires only low-privilege local access with no user interaction, making it an attractive post-compromise escalation primitive. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated user to gain full system control via an integer overflow or wraparound (CWE-190). Affected versions span Windows 10, Windows 11, and Windows Server 2016 through 2025, with Microsoft providing patched builds across all affected product lines. No public exploit code or CISA KEV listing was identified at time of analysis, but the low attack complexity and absence of user-interaction requirement make this a high-value post-compromise escalation primitive.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows a locally authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows 11 and Windows Server 2025 builds. The CWE-122 flaw resides in the ReFS kernel driver and requires no user interaction, making it a reliable local privilege escalation primitive when combined with any initial-access vector. Microsoft has released patches via MSRC; no public exploit code or active CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM on a wide range of Windows and Windows Server releases. The affected component handles ONC RPC data serialization for NFS operations; triggering the overflow requires only an existing local session and no user interaction. Microsoft has released build-specific patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access across a wide range of Windows releases spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all fifteen affected product/version combinations via the standard Windows Update channel. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the CVSS AC:L rating indicates reliable exploitation without race conditions, making this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables any locally authenticated standard user to escalate privileges to SYSTEM across virtually all supported Windows 10, Windows 11, and Windows Server editions. The flaw (CWE-122) exploits the service's privileged execution context combined with its exposure to requests from low-privileged user sessions, yielding full confidentiality, integrity, and availability compromise of the host. Microsoft has released patched builds across all affected platforms; no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Privilege escalation to SYSTEM-level in Windows Biometric Service (WinBioSrvc) affects virtually all supported Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authorized local attacker with low-privilege code execution can exploit a heap-based buffer overflow in the biometric service process to achieve full local compromise - gaining high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches across all 15 affected build branches as confirmed by EUVD-2026-73750.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Local privilege escalation in Microsoft's Trace Data Helper (TDH) component - a Windows Event Tracing subsystem library - allows a low-privileged authenticated local user on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 to gain full SYSTEM-level control. The root cause is an out-of-bounds read (CWE-125) that enables disclosure of kernel memory contents sufficient to defeat address-space layout randomization and chain into a full privilege escalation, yielding C:H/I:H/A:H impact. No active exploitation has been identified and no public proof-of-concept is available; Microsoft has released patched builds across all affected OS versions.
Use-after-free memory corruption in the Windows Hello authentication subsystem allows a local, low-privileged authenticated user to escalate privileges to a higher-integrity context across a security boundary. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, with specific patched build numbers published by Microsoft. No public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C, C:H/I:H/A:H) signals that successful exploitation yields full compromise of a more privileged security principal.
Integer overflow in Adobe Photoshop Desktop enables arbitrary code execution at the privilege level of the logged-in user when a victim opens a specially crafted malicious file. Both the Photoshop 2026 (≤27.6) and Photoshop 2025 (≤26.11.6) release lines are affected. No public exploit code or active exploitation has been identified at time of analysis, but the file-open attack surface is a historically well-worn delivery mechanism for creative-software exploits.
Integer overflow in Adobe Photoshop Desktop's file-parsing logic allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. Affected versions span both Photoshop 2025 (≤26.11.6) and Photoshop 2026 (≤27.6), covering a broad installed base of creative and enterprise users. No public exploit code or active exploitation has been identified at time of analysis; Adobe has published a fix under advisory APSB26-130.
Integer overflow in Adobe Photoshop Desktop (versions 2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the authenticated user. The flaw is triggered during parsing of a specially crafted file - a social-engineering delivery step is required, as the victim must open the malicious file. Adobe has issued advisory APSB26-130 addressing both affected release lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Integer overflow in Adobe Photoshop Desktop (2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. The attack vector is local (AV:L) with mandatory user interaction (UI:R), making social engineering - phishing with a weaponized design file - the primary delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad and Adobe PSIRT attribution confirm this is a serious file-parsing flaw covered under advisory APSB26-130.