Privilege escalation in Windows Shell on Windows 11 (versions 23H2 through 26H1) and Windows Server 2025 stems from a use-after-free memory corruption flaw (CWE-416). An authenticated local attacker who triggers the race-condition-sensitive bug can achieve full system compromise with C:H/I:H/A:H impact, yielding effective SYSTEM-level control. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has confirmed and patched the issue across all affected builds as documented in EUVD-2026-73549.
Use-after-free in the Windows Device Association Service enables a low-privileged local attacker to escalate to full system control across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw (CWE-416) resides in the service responsible for managing device pairing and trust relationships, and exploitation yields high confidentiality, integrity, and availability impact. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges on the local machine. The flaw spans an exceptionally broad range of Windows client and server releases - from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released targeted patches for all affected build lines; no public exploit code or active exploitation has been identified at time of analysis, though the full CIA:H impact and unchanged scope confirm full local system compromise is the end-state if exploited.
Use-after-free in the Windows Work Folder Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The flaw (CWE-416) requires high attack complexity - consistent with a race condition - and local access, but grants full confidentiality, integrity, and availability impact upon successful exploitation. A vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Audio Service (AudioSrv) exploits a use-after-free condition (CWE-416) to allow an authenticated local attacker to gain SYSTEM-level privileges on unpatched Windows 10, Windows 11, and Windows Server 2019-2025 systems. The attack requires low user privileges and high complexity to execute, consistent with a race condition in the service's memory management. Microsoft has released patches across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Wireless Networking subsystem enables a locally authenticated low-privileged attacker to escalate to full system privileges on a wide range of Windows 10, Windows 11, and Windows Server editions. The vulnerability carries CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation is locally constrained and requires navigating high-complexity timing conditions typical of UAF race conditions, but the resulting impact is complete C/I/A compromise. Microsoft has released patches across all affected release branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) via a use-after-free condition allows an authorized local attacker with standard user privileges to achieve full system compromise (C:H/I:H/A:H). The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server builds, with Microsoft-confirmed patch availability across all listed versions. No public exploit code has been identified at time of analysis, and the AC:H rating indicates exploitation likely requires precise timing or race-condition manipulation, limiting automatable mass exploitation.
Local privilege escalation in Windows Image Acquisition (WIA) through a use-after-free memory corruption flaw allows a low-privileged authenticated local user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch scope significant across virtually all enterprise Windows environments. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity rating (AC:H) suggests reliable exploitation requires precise timing or heap manipulation skill.
Privilege escalation in the Windows Win32K kernel-mode GUI subsystem allows a low-privileged local user to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability affects a broad span of Windows 10, Windows 11, and Windows Server 2019/2022/2025 releases, making it highly relevant to enterprise endpoint and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Privilege escalation in the Windows Bluetooth Service allows a low-privileged local attacker to gain SYSTEM-level access by exploiting a race condition in shared resource handling. Affected versions span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025. Microsoft has released patched builds; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Installer (msiexec) allows a low-privileged authenticated user to gain full SYSTEM-level control by exploiting a race condition on a shared resource during installer operations. The vulnerability is present across a broad swath of Windows desktop and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS High score (7.0) and full C:H/I:H/A:H impact reflect the severity of a successful escalation.
Privilege escalation in the Windows MIDI Service Module on Windows 11 enables a low-privileged local attacker to gain full system control by exploiting a time-of-check time-of-use (TOCTOU) race condition (CWE-367). Affected builds span all three actively supported Windows 11 release tracks - 24H2, 25H2, and 26H1 - and Microsoft has released patches for each. No public exploit code or CISA KEV listing has been identified at time of analysis, so exploitation at scale is not currently confirmed.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Local privilege escalation in the Windows Audio Video Control Transport Protocol (AVCTP) Bluetooth stack allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 systems. The root cause is a use-after-free (CWE-416) in the AVCTP driver, where freed memory is subsequently accessed, enabling controlled memory corruption. No public exploit or CISA KEV listing exists at time of analysis; however, the full C:H/I:H/A:H impact and widespread Windows deployment make this a meaningful patching priority for endpoint and server administrators.
Privilege escalation in the Windows Bluetooth Service enables a locally authenticated low-privileged user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions. The root cause is a race condition (CWE-362) in shared resource handling within the Bluetooth service, where competing threads can exploit an unsynchronized access window to trigger a privileged operation in the attacker's context. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing exists at time of analysis.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Privilege escalation in Windows Bluetooth Service via a use-after-free (CWE-416) allows a low-privileged local user to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:H/PR:L) indicates the flaw requires local access and elevated attack complexity - consistent with a race condition in Bluetooth service memory management - but yields full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Privilege escalation in Windows Shell allows a locally authenticated attacker with standard user rights to gain full system-level control via external control of a file name or path (CWE-73). Affected platforms span Windows 11 versions 23H2 through 26H1 and Windows Server 2025, all prior to their respective July 2026 patch-cycle builds. Microsoft has released patches via Windows Update; no public exploit code or CISA KEV listing exists at time of analysis, though the C:H/I:H/A:H impact profile makes this a priority for environments where post-initial-access escalation is a concern.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem allows a low-privileged local attacker to gain full system control on Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires high attack complexity, consistent with a race-condition-class UAF, but no user interaction is needed once the attacker has local code execution. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released a patch through the standard Patch Tuesday advisory cycle.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Local privilege escalation in Windows Print Spooler Components (spoolsv.exe) allows an authenticated low-privilege local attacker to achieve full system compromise via a double-free memory corruption flaw. The CVSS vector (AV:L/AC:H/PR:L) indicates exploitation requires local access with low privileges but involves high attack complexity, consistent with a race condition or precise heap-shaping requirement typical of CWE-415 primitives. No public exploit or CISA KEV listing has been identified at time of analysis, though the Print Spooler service has historically been a high-value escalation target (PrintNightmare lineage).
Local privilege escalation in Windows Push Notifications (WPN) exploits a use-after-free (CWE-416) to allow a low-privileged authenticated attacker to achieve full system compromise - confidentiality, integrity, and availability all rated High. The flaw spans Windows 11 (23H2 through 26H1) and Windows Server 2022/2025, with Microsoft confirming patch availability via the MSRC update guide. CVSS AC:H reflects a race-condition timing requirement that raises the exploitation bar above trivial one-shot attacks.
Privilege escalation in the Windows Remote Desktop Gateway Service allows a low-privileged authorized attacker to achieve full system compromise via a double-free memory corruption flaw (CWE-415). Affected systems span Windows Server 2012 through 2025 and select Windows 10 builds where the RD Gateway role is installed. Microsoft has released patches across all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver allows a low-privileged authenticated local attacker to gain SYSTEM-level access across a broad swath of Windows versions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability stems from a use-after-free (CWE-416) condition, a memory safety flaw in the WOW (Windows-on-Windows) 32-to-64-bit thunk layer used by the kernel audio/multimedia streaming subsystem. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Use-after-free in the Windows Bind Filter Driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The flaw (CWE-416) resides in a kernel-mode filter driver, meaning successful exploitation yields full control over the operating system. No public exploit or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the affected builds.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Cross-site request forgery in WatchGuard Dimension's database snapshot creation endpoint allows a remote unauthenticated attacker to trigger unauthorized snapshot operations by luring an authenticated Dimension administrator to visit a malicious web page. The primary risk is availability degradation: repeated forced snapshot creation can exhaust storage or impose significant I/O load on the Dimension appliance (VA:H per CVSS 4.0). No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds memory corruption in Tapdisk, the XAPI toolstack's userspace xen-blkback implementation, allows a malicious guest VM to achieve code execution inside the tapdisk process, which normally runs as root in dom0. CVE-2026-79606 specifically concerns the gcopy_segs[] array: the bounds check incorrectly permits nr_segments values between 12 and 32, causing out-of-bounds writes that corrupt adjacent process memory. All versions of tapdisk are confirmed vulnerable, no mitigations exist, and patches are available via XSA-513.
Out-of-bounds memory corruption in Xen's Tapdisk (userspace xen-blkback) enables a malicious guest VM to achieve code execution within the tapdisk process, which runs as root in Dom0, constituting a full guest-to-host escape. CVE-2026-79605 specifically covers the absent upper bounds check on blkif->last_sect: guest-supplied values greater than 7 trigger reads or writes beyond the mapped grant region. All versions of tapdisk are confirmed vulnerable per XSA-513, no mitigations exist, and patch application is the sole remediation path. No public exploit or CISA KEV listing is identified at time of analysis.
Unbounded memory exhaustion in Xen's OCaml xenstore daemon (oxenstored) allows a malicious or compromised guest VM to trigger a system-wide denial of service by repeatedly sending xenbus reconnect requests without clearing the global watch trie. Each reconnect cycle purges only the per-domain hashtable, leaving stale watch entries to accumulate indefinitely in the global trie. All Xen deployments from 4.6 onwards using the OCaml oxenstored implementation are affected; no public exploit has been identified, but the attack surface is accessible to any guest with standard xenbus connectivity and no mitigations exist.