Local privilege escalation in the Android kernel's KVM IOMMU subsystem allows a low-privileged user to gain full kernel control via a use-after-free condition in kvm_iommu_map_sg (iommu.c). The root cause is a missing permission check that enables memory to be accessed after it has been freed, allowing an unprivileged local process to achieve read/write/execute control over the kernel. No public exploit has been identified at time of analysis, but Google's September 2026 Android Security Bulletin confirms the issue and provides a kernel patch via android.googlesource.com.
Local privilege escalation in Android's MountRegistry component across Android 14, 15, 16, and 16-qpr2 allows a low-privileged process to achieve full device compromise via a buffer overflow in the forEachLine function of MountRegistry.cpp. The flaw triggers an out-of-bounds read that can corrupt adjacent memory, enabling an attacker to elevate from a sandboxed app or low-privilege process to a higher system privilege level without any user interaction. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total.
Local privilege escalation in Android 17's STMicroelectronics NCI (NFC Controller Interface) driver allows a low-privileged local process to gain full system-level control via a missing bounds check in `stpropnci_process_std()` of `stpropnci_std.cc`. The missing input validation triggers a CWE-120 buffer overflow, achieving C:H/I:H/A:H impact with no user interaction required. No public exploit has been identified at time of analysis per SSVC exploitation status 'none,' though the SSVC Technical Impact is rated 'total.'
Heap buffer overflow in Android's HEVC decoder (`ihevcd_get_tu_data_size` in `ihevcd_utils.c`) enables local privilege escalation across Android 14 through Android 17 with no additional execution privileges or user interaction required. A low-privileged attacker - such as a malicious application - can craft HEVC video input that triggers an out-of-bounds write on the heap, corrupting adjacent memory structures and ultimately gaining elevated device privileges. No public exploit code has been identified at time of analysis, and SSVC currently rates active exploitation as none, though the technical impact is classified as total.
Out-of-bounds write in Android's openLogicalChannel function across multiple telephony-related files enables local privilege escalation on Android 16 and 17 without requiring elevated permissions or user interaction. An attacker running as a low-privileged app can supply oversized input to a missing bounds check, corrupting adjacent memory and achieving full C:H/I:H/A:H system impact per CVSS. No public exploit has been identified at time of analysis; SSVC rates technical impact as total while exploitation status remains none.
Local privilege escalation in Android 16, 16-QPR2, and 17 stems from improper input validation in the AppendCommentLine function of AnnotationProcessor.cpp. A low-privileged local attacker can exploit this CWE-20 flaw without user interaction to achieve full confidentiality, integrity, and availability impact, consistent with a complete privilege escalation on the device. Google's Android Security Bulletin for September 2026 (2026-09-01) addresses this issue; the description's explicit 'supply chain risk' framing is atypical and suggests the vulnerable code participates in a build or annotation-processing pipeline where malicious input could propagate into compiled artifacts.
Heap-based buffer overflow in parseParts of PduParser.java enables local privilege escalation across Android 14 through 17 (including Android 16-QPR2). A low-privileged process on the device can trigger an out-of-bounds read via a malformed PDU, corrupting heap memory to achieve full confidentiality, integrity, and availability compromise without requiring user interaction. No public exploit code or KEV listing has been identified at time of analysis.
Local privilege escalation in Android 17 and Android 16-qpr2 stems from integer overflow vulnerabilities across multiple code locations, enabling out-of-bounds writes. A low-privileged local process or application can exploit these flaws without additional execution privileges or user interaction to gain full control over the device. No public exploit has been identified at time of analysis, and SSVC signals no current exploitation activity, but technical impact is rated total.
Local privilege escalation in Android's runtime image writer (WriteImageToDisk, runtime_image.cc) allows a low-privileged local process to tamper with files through a logic error, potentially gaining full system control. Affected versions span Android 14 through Android 17, including the Android 16-QPR2 branch, making this a broad-impact flaw across the current and future Android release train. No public exploit has been identified at time of analysis, and SSVC indicates exploitation is currently none, but the Technical Impact rating of 'total' underscores the severity if exploited.
Heap-based buffer overflow in Microsoft Office Excel allows a local attacker to execute arbitrary code with the privileges of the victim user by convincing them to open a specially crafted Excel file. The vulnerability spans a wide range of currently supported Office releases - Excel 2016 through Microsoft 365 Apps for Enterprise, plus Office for Mac editions - making the attack surface broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has issued patches across all affected channels.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024 editions, including Mac variants. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in Microsoft Excel's file-parsing engine allows code execution when a victim opens a specially crafted workbook. Affected builds span Excel 2016 through Office LTSC 2024 and their Mac equivalents, making the exposure broad across both perpetual-license and subscription deployments. No public exploit code has been identified at time of analysis, but Microsoft has released patched builds for all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Office Excel's file-parsing engine enables local code execution when a victim opens a specially crafted spreadsheet. Affects a wide range of Microsoft Office products from version 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, on both Windows and Mac platforms. No public exploit identified at time of analysis, but the low attack complexity combined with full confidentiality, integrity, and availability impact makes phishing-delivered document lures a realistic and proven delivery vector.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span nearly every current Office release line - Excel 2016, Office 2019, Office LTSC 2021 and 2024 (Windows and Mac), Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office Online Server. An attacker who tricks a user into opening a malicious workbook can achieve full code execution at the victim's privilege level, with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution at the current user's privilege level when a victim opens a specially crafted workbook file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024 across both Windows and Mac platforms, making the potential victim population extremely large. Microsoft has released patches via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook, affecting all major Office product lines from Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. The vulnerability carries a CVSS 7.8 score reflecting high CIA impact against the Office process, with mandatory user interaction (opening the malicious file) as the sole prerequisite. Microsoft has released patches for all supported versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution across all major Office release tracks when a victim opens a maliciously crafted spreadsheet file. The vulnerability is rooted in improper heap memory management during Excel's file parsing routines (CWE-122), resulting in full compromise of confidentiality, integrity, and availability on the victim system. No public exploit code has been identified at time of analysis, but the breadth of affected versions - spanning Office 2016 through Microsoft 365 and Mac variants - makes this a high-priority patch target for enterprise environments.
Heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM on a wide range of Windows and Windows Server releases. The affected component handles ONC RPC data serialization for NFS operations; triggering the overflow requires only an existing local session and no user interaction. Microsoft has released build-specific patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Heap-based buffer overflow in Windows Deployment Services (WDS) allows a locally authenticated low-privileged attacker to execute arbitrary code, effectively achieving local privilege escalation on affected Windows Server and Windows 10 systems. The flaw spans a wide range of Microsoft server OS versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809. No public exploit identified at time of analysis, but Microsoft has released patches via the standard update mechanism.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Privilege escalation in Windows Installer affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, allowing a locally authenticated low-privileged attacker to gain full SYSTEM-level control by exploiting improper validation of integrity check values (CWE-354). The CVSS vector (AV:L/PR:L) confirms local exploitation requiring only a standard user account, with no user interaction needed once access is established. No public exploit has been identified at time of analysis, but Microsoft has released patches for all affected builds.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Active Directory Certificate Services (AD CS) on Windows enables an authenticated low-privileged user to gain full system control (C:H/I:H/A:H) without user interaction. The root cause is CWE-116 - improper encoding or escaping of output - within the AD CS component, which Microsoft has patched across a broad range of Windows 10 and Windows Server releases from 2012 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this straightforward to exploit once an attacker has local access.
Heap-based buffer overflow in the Windows Audio Service (AudioSrv/audiosrv.dll) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM level on affected Windows 10, Windows 11, and Windows Server installations. The vulnerability is confirmed by Microsoft's Security Response Center (secure@microsoft.com) and affects a broad range of supported Windows releases from build 1809 through the latest 26H1 branch. Patches are available across all affected product lines. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Windows Hello across Windows 10 and Windows 11 allows an authorized low-privileged attacker to gain full system-level control via a race condition in the authentication subsystem. The vulnerability (CWE-362) exploits improper synchronization of concurrent operations within Windows Hello, requiring only local access and low privileges but no user interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Hello across multiple Windows 10 and 11 versions allows an authorized low-privileged local attacker to gain full system control via a double-free memory corruption vulnerability (CWE-415). Affected builds span Windows 10 21H2/22H2 through Windows 11 26H1. Microsoft has released patched builds via the standard update channel. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow in the Windows MIDI Service Module enables a local authenticated attacker on Windows 11 to escalate privileges, with full confidentiality, integrity, and availability impact in the compromised process scope. Affected builds span three servicing tracks - 24H2, 25H2, and 26H1 - with fixed builds published by Microsoft through MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) across virtually every supported Windows platform exploits an absolute path traversal flaw (CWE-36) to elevate a standard authenticated user to full system control. An attacker with a low-privilege local session can supply a crafted absolute path to the WER subsystem, escaping its intended directory and accessing or overwriting privileged system resources, achieving complete confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L). No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the extremely wide affected product surface spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 makes this a high-urgency patching item.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in the Windows Universal Disk Format File System (UDFS) kernel driver enables a low-privileged local user to escalate privileges to SYSTEM across a broad swath of Windows releases spanning Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw resides in the filesystem driver responsible for reading UDF-formatted volumes (optical media, some removable storage), and exploitation requires only a standard user account with no user interaction. Microsoft has released patches through the update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Search Component exposes virtually the entire Windows ecosystem - from legacy Server 2012 to Windows 11 26H1 - to full system compromise by any low-privileged local user. The flaw stems from an incorrect type conversion or cast (CWE-704) within the Search Component, allowing an attacker with a standard user session to escalate to SYSTEM-level privileges without user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches covering all affected build lines.
Local privilege escalation in the Windows CD-ROM kernel driver (cdrom.sys) enables a standard authenticated user to achieve SYSTEM-level access across virtually all supported Windows versions from Server 2012 through Windows 11 25H2 and Windows Server 2025. The root cause is CWE-125 out-of-bounds read, which in a kernel driver context can expose memory contents and be chained into privilege escalation via kernel structure corruption. Microsoft has released patched builds; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Privilege escalation in the Windows SMB Client component of Windows 11 26H1 allows a locally authenticated attacker with standard user privileges to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability is constrained to local attack vectors, meaning remote unauthenticated exploitation is not possible. Microsoft has released a patch (build 10.0.28000.2954); no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Camera Frame Server Monitor service enables a local authenticated user to elevate privileges to SYSTEM on Windows 11 and Windows Server 2025. Exploitation requires only a standard user account and no user interaction, making it a reliable post-exploitation privilege escalation primitive. Microsoft has released patches addressing all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local user to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server editions. The flaw (CWE-122) resides in the kernel-mode storage driver that handles VHD/VHDX virtual disk images, enabling an attacker with standard user rights to corrupt heap memory and execute arbitrary code in kernel context. No public exploit or active exploitation has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Spaceport.sys, the kernel-mode Storage Spaces driver, allows an authenticated low-privileged local attacker to execute arbitrary code in kernel context, achieving full SYSTEM-level control with no user interaction. The flaw is an out-of-bounds read (CWE-125) in the kernel driver, exploitable across virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patched builds for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Local privilege escalation in Windows Spaceport.sys (the Storage Spaces kernel driver) allows a low-privileged authenticated attacker to achieve full system compromise via a numeric truncation error that triggers a heap-based buffer overflow. The vulnerability affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature updates, with fixed build numbers confirmed by Microsoft through MSRC. No public exploit identified at time of analysis, but the local LPE class in kernel drivers is historically a high-priority target for post-exploitation toolkits.
Command injection in the Windows Program Compatibility Assistant (PCA) Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated low-privilege attacker can inject shell commands through the PCA service's unsanitized input handling (CWE-77), achieving full control of the local system with C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis, but the wide Windows install base and low exploitation complexity make patching high priority.
Privilege escalation in Windows Shell affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to achieve full system compromise with no user interaction required. The root cause is CWE-306 - a critical internal Shell function that lacks an authentication or authorization gate, allowing a standard user account to invoke privileged operations and elevate to SYSTEM. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has issued patches via Windows Update.
Local privilege escalation in Windows Error Reporting (WER) allows a low-privileged authenticated user to gain SYSTEM-level access via a heap-based buffer overflow. The vulnerability affects a wide range of Windows desktop and server editions from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, no-interaction CVSS vector makes this a practical post-exploitation stepping stone.
Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows MIDI Service Module enables local privilege escalation on Windows 11 systems across three major release branches. An authenticated local attacker with standard user privileges (PR:L) can trigger the overflow with low complexity and no user interaction, achieving full SYSTEM-level compromise (C:H/I:H/A:H). Microsoft has released patches covering Windows 11 versions 24H2, 25H2, and 26H1; no public exploit or KEV listing is present at time of analysis.