Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Local privilege escalation in the Windows Connected User Experiences and Telemetry service (DiagTrack/utcsvc) exposes a use-after-free memory condition allowing an authenticated local attacker to achieve full SYSTEM-level control. The vulnerability carries CVSS 7.0 with AC:H, indicating a race-condition or timing-dependent trigger that elevates exploitation difficulty but does not preclude reliable use in post-breach scenarios. Microsoft has released patched builds across all affected Windows client and server SKUs; no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Local privilege escalation in the Windows Modern Execution Server component allows an authenticated low-privileged attacker to gain full system control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases from build 10.0.14393 through 10.0.28000. Microsoft has released patched builds addressing the flaw; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS AC:H rating suggests exploitation requires precise timing or specific memory state conditions.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Remote Access Connection Manager (RACM) exploits a use-after-free memory corruption flaw to allow an authorized low-privileged user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft platforms - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it widely applicable across enterprise environments. Microsoft has released patches addressing the flaw; no public exploit code or CISA KEV listing is present at time of analysis, though the CVSS AC:H rating suggests reliable exploitation requires a race-condition timing window.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated user to achieve full system compromise via a use-after-free memory corruption flaw. Affected builds span Windows 10, Windows 11 (multiple feature versions), Windows Server 2019, 2022, and 2025, with fixed build numbers published by Microsoft. No public exploit identified at time of analysis, and the high attack complexity (AC:H) reflected in the CVSS 7.0 score indicates exploitation requires meeting specific memory-state conditions, likely a race condition or precise heap layout.
Heap-based buffer overflow in the Windows Defender Firewall Service (mpssvc) allows an authenticated local attacker holding only standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability spans every major Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, covering both client and server deployments. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Privilege escalation in the Windows Display Enhancement Service (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a locally authenticated low-privileged attacker to gain elevated privileges through exploitation of a double-free memory corruption flaw (CWE-415). The vulnerability requires local access and high attack complexity, reflecting the precision required to reliably trigger and exploit heap corruption. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Privilege escalation in the Windows AF_UNIX Socket Provider allows a local low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans virtually all supported and some legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it extremely broad in scope. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-complexity local exploitation bar and the completeness of C:H/I:H/A:H CVSS impact make this a meaningful privilege-escalation risk in multi-tenant, shared, or endpoint environments.
Privilege escalation in Windows Audio Service across all current Windows releases exploits a double-free memory corruption condition (CWE-415) to allow a low-privileged local user to gain full system control. The flaw spans Windows 10, 11, and every supported Windows Server generation from 2012 through 2025. Microsoft has released patches as part of its update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) on Windows 11 and Windows Server 2025 is possible through a use-after-free (CWE-416) memory corruption flaw exploitable by a low-privileged authenticated user. The CVSS 7.0 vector (AV:L/AC:H/PR:L) indicates the attack requires local access and elevated complexity - consistent with a race condition or specific timing requirement to win the freed-memory reuse - but no user interaction once staged. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in Windows Media on all supported Microsoft Windows desktop and server releases allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory condition (CWE-416). The CVSS AC:H metric indicates exploitation is non-trivial, consistent with a race condition or complex heap-manipulation sequence required to reliably control freed memory. A vendor patch is available across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation via use-after-free in the Win32K kernel subsystem affects multiple Windows 11 and Windows Server 2025 builds, allowing a locally authenticated low-privileged attacker to achieve full SYSTEM-level access. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including its Server Core variant. No public exploit has been identified at time of analysis, though the high C:H/I:H/A:H impact combined with the kernel attack surface makes this a meaningful post-exploitation and lateral-movement primitive in multi-user or RDP-exposed environments.
Use-after-free in the Windows Bluetooth Port Driver enables a local low-privileged attacker to escalate privileges, potentially reaching SYSTEM-level access across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-416) requires high attack complexity, consistent with timing-dependent memory corruption exploitation typical of UAF flaws in kernel-mode drivers. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Accounts Control exploits a use-after-free (CWE-416) condition, allowing an authorized but low-privileged local attacker to gain full system-level privileges across a wide range of Windows desktop and server versions. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires local authenticated access and high attack complexity, consistent with UAF race-condition exploitation. Microsoft has released patches covering Windows 10, Windows 11, and Windows Server 2016 through 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Credential Providers allows a local, low-privileged authenticated attacker to gain full system control on Windows 11 and Windows Server 2025. The CWE-416 flaw exists in the credential provider subsystem, which handles authentication UI interactions; triggering the UAF condition (AC:H) under the right timing yields C:H/I:H/A:H impact. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows 11 and Server 2025 builds.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Use-after-free in the Windows Device Association Service enables a local low-privileged attacker to escalate to full system-level privileges across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability stems from improper memory management in the service responsible for pairing devices, where a freed memory region can be reused to redirect execution. Microsoft has released patches addressing all affected builds; no public exploit or CISA KEV listing is recorded at time of analysis, though the high-complexity (AC:H) requirement means reliable exploitation demands careful timing or race-condition abuse.
Privilege escalation via use-after-free (CWE-416) in the Windows Web Platform Storage component affects Windows 10, 11, and multiple Windows Server releases. An authenticated local user with standard (low) privileges can exploit a race condition in memory management to achieve full local system compromise - gaining high confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the breadth of affected Windows versions across the enterprise install base makes patch prioritization essential.
Use-after-free (UAF) in the Windows Device Association Broker service enables a local, low-privileged authenticated attacker to escalate privileges to SYSTEM or higher on a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-416) is consistent with a race condition in the Broker's memory management, as reflected by the AC:H metric, and exploitation yields full confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, but Microsoft has released patches across all affected build streams.
Use-after-free (CWE-416) in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to escalate privileges to a higher integrity level on affected Windows systems. The vulnerability spans a wide range of Windows releases from Server 2012 through Windows 11 26H1, and Microsoft has released patches across all affected build lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local attacker to gain full SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server versions. The flaw stems from a use-after-free (CWE-416) condition in a kernel-mode driver, with high attack complexity indicating a likely race condition or specific timing requirement. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Storage Spaces Controller via a use-after-free memory corruption flaw enables an authenticated low-privilege attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability (CWE-416) exists in the Storage Spaces Controller kernel driver; exploiting it yields full confidentiality, integrity, and availability impact on the local system. No public exploit code or active exploitation confirmed at time of analysis, but the breadth of affected Windows versions makes this a broad-footprint local privilege escalation risk.
Use-after-free in the Windows Device Association Service enables a low-privileged local attacker to escalate to full system control across a broad range of Windows 10, Windows 11, and Windows Server releases. The flaw (CWE-416) resides in the service responsible for managing device pairing and trust relationships, and exploitation yields high confidentiality, integrity, and availability impact. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows a low-privileged attacker to gain SYSTEM-level access on unpatched systems via a use-after-free memory corruption bug (CWE-416). The vulnerability spans the entire current Windows ecosystem - from Windows 10 1607 and Server 2012 R2 through Windows 11 25H2 and Server 2025 - making the attack surface extremely broad. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Embedded Mode Service allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access across virtually all supported Windows versions. The memory corruption occurs when the service accesses a previously freed object, enabling an attacker to manipulate heap layout and execute code in a privileged context. No public exploit or active exploitation (KEV) has been identified; Microsoft has released patches via Windows Update, and the AC:H rating reflects the timing-dependent race-condition exploitation typical of UAF primitives.
Privilege escalation in the Windows USB Video Driver (Windows 11 24H2/25H2/26H1 and Windows Server 2025) is enabled by a use-after-free memory corruption flaw in a kernel-mode driver component. A local attacker holding a standard user account can exploit the UAF condition to achieve ring-0 code execution, yielding complete confidentiality, integrity, and availability compromise of the affected system. Microsoft has released patches; no public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem allows a low-privileged local attacker to gain full system control on Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires high attack complexity, consistent with a race-condition-class UAF, but no user interaction is needed once the attacker has local code execution. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released a patch through the standard Patch Tuesday advisory cycle.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Use-after-free in the Windows Bind Filter Driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The flaw (CWE-416) resides in a kernel-mode filter driver, meaning successful exploitation yields full control over the operating system. No public exploit or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the affected builds.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation in Windows Secure Kernel Mode exploits an untrusted pointer dereference (CWE-822) to allow a low-privileged local attacker to elevate to full kernel-level control across a broad range of Windows 10, 11, and Server releases. The Secure Kernel Mode (SKM) context - part of Windows Virtualization-Based Security (VBS) operating at Virtual Trust Level 1 (VTL1) - means successful exploitation bypasses standard OS-kernel isolation, making this structurally more severe than a conventional LPE. No public exploit identified at time of analysis; vendor-released patches are available via Microsoft's July 2026 security update cycle.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Win32K allows an authenticated low-privileged user to gain SYSTEM-level access across virtually all supported and legacy Windows versions. The flaw stems from incorrect authorization checks (CWE-863) in the Win32K kernel-mode subsystem, enabling a local attacker to bypass privilege boundaries with no user interaction required. No public exploit has been identified and CISA's SSVC assessment rates exploitation status as none, though technical impact is rated total - patch deployment is nonetheless warranted given the ubiquity of the affected platform and the historical weaponization of Win32K LPE bugs in targeted intrusion chains.
Local privilege escalation in the Windows Resilient File System (ReFS) Deduplication Service allows a low-privileged authenticated attacker to gain full system control via improper symlink/junction resolution (CWE-59). Affected platforms include Windows Server 2025 and Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires local access and a race condition (AC:H), making this a targeted rather than opportunistic threat; no public exploit or CISA KEV listing exists at time of analysis.
Local privilege escalation in the Windows Kernel across virtually all supported Windows releases exploits a time-of-check time-of-use (TOCTOU) race condition (CWE-367) to elevate from low-privilege user to SYSTEM. An authenticated local attacker wins a race between when the kernel validates a resource and when it uses it, substituting a different object between those two moments. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected versions as part of a coordinated update cycle.