Privilege escalation to SYSTEM-level via a heap-based buffer overflow in the Windows Partition Management Driver affects multiple Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker with low privileges can exploit the CWE-122 heap overflow to achieve full confidentiality, integrity, and availability impact on the local system. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows Power Dependency Coordinator component allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server systems. The flaw (CWE-122) requires only a local account and no user interaction, making it a reliable post-compromise escalation primitive. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the low attack complexity (AC:L) and broad platform coverage across Windows 10 through Server 2025 make patching a priority in any environment where insider threat or malware post-exploitation is a concern.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.
Local privilege escalation in Windows Error Reporting (WER) across virtually all supported Windows releases exploits an out-of-bounds read (CWE-125) to allow a low-privileged authenticated local user to gain SYSTEM-level access with full confidentiality, integrity, and availability impact. The breadth of affected platforms is significant, spanning Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2012 through Server 2025 including Server Core installations. No public exploit code has been identified at time of analysis, and Microsoft has released patches through the standard Windows Update channel.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting low exploitation complexity once a local foothold is established. Microsoft has released patches across all affected build lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in the Windows Compressed Folder built-in ZIP handler allows a locally authenticated standard user to escalate privileges to SYSTEM or Administrator level across a wide range of Windows client and server editions. The vulnerability (CWE-22) exists in the component that processes ZIP archive extraction, enabling crafted archive entries to write files outside the intended extraction directory into sensitive system paths. No public exploit or KEV listing exists at time of analysis, but the low attack complexity and broad version coverage across Windows 10, 11, and Server 2012 through 2025 make this a high-priority patching target in environments where local privilege escalation is a concern.
Privilege escalation in Windows Error Reporting (WER) via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker - holding only standard user privileges - to achieve full system compromise across all current Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity and no interaction requirement, making this an effective land-and-escalate primitive for threat actors with any initial foothold on a target host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Error Reporting (WER) enables a locally authenticated attacker to escalate privileges to SYSTEM or administrative level on affected Windows endpoints and servers. The vulnerability spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the local privilege escalation primitive is highly valuable for post-compromise attackers pivoting from user-level access.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Use-after-free in Windows Shell enables local privilege escalation on Windows 11 and Windows Server 2025, allowing a low-privileged authenticated user to elevate to SYSTEM or equivalent. The CVSS scope change (S:C) indicates the impact extends beyond the exploited shell component to the broader OS. No public exploit code or CISA KEV listing has been identified at this time, but the scope change and high C/I/A triad make patching urgent for environments running affected Windows builds.
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.
Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.
Heap-based buffer overflow in the Win32K kernel subsystem (CWE-122) on Windows 11 and Windows Server 2025 enables a low-privileged local attacker to escalate to SYSTEM-level privileges. Affected builds span Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its Server Core variant, per EUVD-2026-73467. Microsoft has released patches addressing all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Storage affects virtually every supported Windows client and server release, allowing an authorized low-privilege local attacker to gain full SYSTEM-level control without any user interaction. The root cause is CWE-426 (Untrusted Search Path): the Storage component resolves a DLL or executable from a path the attacker can influence, causing elevated-privilege code to load attacker-controlled content. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad platform coverage make this a high-priority patch target.
Type confusion in Windows Performance Monitor enables local privilege escalation across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1. An authenticated local user can exploit the flaw to gain full control over confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, but the breadth of affected versions and the vendor-confirmed patch make this a high-priority patching item.
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Microsoft Account component of Windows 11 and Windows Server 2025 enables local privilege escalation to full system access. An authorized local attacker with standard user-level privileges exploits CWE-122 heap corruption to gain complete control over confidentiality, integrity, and availability of the affected host. Vendor-released patches are available for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
External file path control in Microsoft Office Word enables local code execution with full confidentiality, integrity, and availability impact when a target user opens a specially crafted document. All major Office release tracks are affected across Windows and macOS - Office 2016, 2019, 2021 LTSC, LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit has been identified at time of analysis, and vendor patches are available through the Office security release channel.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation via use-after-free (CWE-416) affects a broad swath of Microsoft Windows Server and Windows 10/11 releases, allowing an authenticated low-privilege attacker to gain SYSTEM-level access without user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local account and no special configuration, making this a practical post-exploitation stepping stone in any multi-user or RDP-exposed Windows environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and Microsoft authorship of the report (secure@microsoft.com) suggest internal discovery and coordinated patch release.
Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Roo-Code's auto-approve shell execution mechanism through version 3.54.0 can be bypassed by exploiting a word-boundary mismatch between the approval gate's shell tokenizer and bash, allowing commands explicitly denied in the user's allowlist to execute silently on the developer's machine. An attacker who can influence the command string reaching the auto-execute pipeline - most plausibly via prompt injection through malicious repository content or crafted AI interactions - prefixes a denied command with an allowlisted token followed by a hash character and separator; the approval gate passes the token as safe while bash interprets the hash as a comment delimiter and executes the trailing denied payload with the agent's full privileges. No public exploit has been confirmed as actively exploited (not in CISA KEV), though a detailed technical writeup is publicly available on GitHub, lowering the barrier for exploitation.
Code injection in n8n's legacy expression engine allows an authenticated user to replace the mutable global JSON.stringify function within expression evaluation, causing subsequent code-generation paths to embed and execute attacker-controlled JavaScript. Affected are all n8n versions prior to 1.123.76 (v1 branch), 2.37.7, and 2.38.2. The vulnerability is confined to the legacy expression engine (isolated-vm-bridge.ts and ExpressionBuilder.ts); the vm expression engine is unaffected. No public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal (CWE-22) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source enables an authenticated high-privilege attacker to escape intended directory restrictions, achieving high integrity impact on files outside the application boundary - with scope change indicating the affected filesystem resources extend beyond the application itself. Affected version lines span Adobe Commerce through 2.4.9-2026-aug, Commerce B2B through 1.5.3-2026-aug, and Magento Open Source through 2.4.9-2026-aug, all addressed in Adobe's August 2026 security release APSB26-138. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Server-Side Request Forgery in XenForo's PayPal REST webhook handler enables unauthenticated remote attackers to coerce the application server into making arbitrary outbound HTTP requests by supplying a crafted certificate URL in webhook request headers. All XenForo versions prior to 2.3.13 are affected due to the absence of scheme, hostname, or allowlist validation on the attacker-controlled URL. The primary exploitation path targets cloud-hosted deployments: the server can be directed to reach the AWS, GCP, or Azure instance metadata service (169.254.169.254), potentially exfiltrating IAM role credentials and enabling lateral movement into cloud infrastructure. No public exploit has been identified at time of analysis, but the attack surface - an unauthenticated POST to a publicly reachable webhook endpoint - makes this highly automatable against cloud-hosted XenForo instances.
Missing authorization in the cvlaunchd daemon of Commvault Cloud allows low-privileged authenticated users to bypass command execution authorization controls, potentially achieving full system compromise across confidentiality, integrity, and availability dimensions. All major Commvault installation components are affected - Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X - across four version branches (11.36, 11.40, 11.44, 11.46). No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment surface and high-impact CVSS profile make patching urgent for enterprise operators.
Session hijacking in SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated remote attacker to assume another authenticated user's session by exploiting an integer underflow that causes a previously buffered request to be reprocessed in the wrong connection context. The attack is constrained by a narrow race-condition timing window requiring a victim session to be in a buffered state simultaneously, limiting mass exploitation but not targeted attacks against high-value SAP landscapes. Successful exploitation yields high confidentiality and integrity impact consistent with full session takeover; no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in Okta Access Gateway's advanced mode datastore configuration exposes backend databases to arbitrary query execution by attackers who hold a valid SAML identity. The gateway interpolates SAML assertion attribute values directly into query strings prior to preparation, bypassing parameterization entirely. The CVSS scope change (S:C) reflects that the primary damage accrues to the configured backend database rather than the gateway itself; no public exploit has been identified at time of analysis.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack path makes this a straightforward DoS primitive against any exposed IPsec endpoint.
Type confusion (CWE-843) in the Windows DHCP Server service allows unauthenticated remote attackers to crash the service, causing a denial of service across affected Windows Server deployments. The flaw spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 builds 1607 and 1809 that run the DHCP Server role. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Uncontrolled memory consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows unauthenticated remote attackers to terminate a .NET host process by submitting a small, specially crafted YAML OpenAPI document containing nested anchors and aliases. The attack exploits a 'billion laughs' style amplification at the boundary between SharpYaml's directed acyclic graph representation and System.Text.Json.Nodes.JsonNode materialization: because a JsonNode cannot be shared across parents, each alias must be deep-copied independently, yielding k^N allocations for N nested anchor levels each referenced k times. No public exploit has been identified at time of analysis, but SSVC confirms the attack is automatable, meaning tooling can deliver it at scale once a payload is known.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows a remote unauthenticated attacker to crash the service over a network, resulting in denial of service for all DHCP-dependent clients on the affected segment. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 1607 and 1809, and reflects Microsoft's own reporting (secure@microsoft.com). No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack surface and widespread deployment of Windows DHCP in enterprise environments elevate operational impact.
Out-of-bounds read in the Windows DHCP Server service enables unauthenticated remote attackers to crash the service via crafted network packets, causing denial of service across any network segment served by the affected host. The flaw (CWE-125) spans Windows Server 2012 through 2025 - a thirteen-year product range - on systems where the DHCP Server role is actively installed. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Race condition exploitation in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows any local non-privileged process to perform improper GPU memory operations, yielding kernel-level sensitive information disclosure or denial of service. All three driver families are affected across broad version ranges spanning multiple major release trains - Bifrost from r12p0, Valhall from r19p0, and 5th Gen from r41p0 - covering a large installed base of Mali GPU-equipped devices. No public exploit or active exploitation has been confirmed at time of analysis; the low EPSS score (0.11%, percentile 1%) reflects limited observed exploitation interest.
Command allowlist bypass in Roo-Code through version 3.54.0 enables execution of shell commands that users explicitly denied from auto-approval. The vulnerability stems from the shell command parser's failure to recognize the bash pipe operator `|&` as a command separator - a crafted pipeline prefixed with an allowlisted command followed by the stderr-redirecting pipe and a denied command passes parser validation while bash executes the entire pipeline, including the denied component, with full agent privileges on the developer's workstation. A public proof-of-concept writeup exists on GitHub; no active exploitation has been confirmed by CISA KEV.
Unauthenticated adjacent-network host takeover in ASUS Control Center Express Agent exposes critical management functions without any authentication check (CWE-306), allowing any attacker with network adjacency to directly connect to the agent and fully control the host. The attack is contingent on the host having an active login session at the time of exploitation. No public exploit code has been identified at time of analysis, but the unauthenticated nature and high CIA impact make this a meaningful risk in environments where ASUS Control Center is deployed across managed workstations or servers.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (2016 through 365 Apps for Enterprise and LTSC 2024) enables an unauthenticated remote attacker to disclose sensitive memory contents over a network, per the provided CVSS vector. Affected products span both perpetual-license and subscription editions across x64 and x86 architectures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Multi-factor authentication bypass in XenForo before 2.3.13 allows a network-accessible authenticated attacker who knows a target account's password to complete login as that user without possessing their registered passkey. The WebAuthn assertion handler performs a global credential lookup that accepts any registered passkey - including the attacker's own - without verifying the credential belongs to the user whose session is pending, nullifying the passkey TFA layer. Both public forum and admin control panel (ACP) login paths are vulnerable. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Unauthenticated remote denial-of-service in the Windows DHCP Server service across a broad range of Windows Server builds (2012 through 2025) stems from a type confusion flaw (CWE-843) in packet-processing logic. A network-adjacent or remote attacker can send a malformed DHCP packet that causes the server process to access a resource using an incompatible type, crashing the DHCP service and halting IP address assignment for all dependent clients. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, but the zero-authentication requirement and broad version footprint make this a practical target.
Type confusion (CWE-843) in the Windows DHCP Server service allows an unauthenticated remote attacker to crash the service, causing denial of service across the network. The flaw affects all major Windows Server generations from Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809, wherever the DHCP Server role is active. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Type confusion (CWE-843) in the Windows DHCP Server service enables unauthenticated remote attackers to crash or deny service to the DHCP daemon over the network. The flaw spans Windows Server 2012 through 2025 and Windows 10 builds where the DHCP Server role is installed. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.5 AV:N/AC:L/PR:N/UI:N vector signals straightforward, low-complexity network exploitation requiring no authentication.