Buffer over-read (CWE-126) in the Windows DHCP Server service allows a low-privileged, adjacent-network attacker to crash the DHCP Server process, resulting in denial of service for all clients depending on that server. Affected platforms span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 running the DHCP Server role, all at builds below the vendor-specified patched versions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the adjacent-network and low-privilege constraints substantially bound real-world exposure.
Memory exhaustion in Windows DHCP Server enables an authorized attacker on the adjacent network to crash or degrade the DHCP service via repeated triggering of a CWE-401 memory leak. The vulnerability affects the Windows Server DHCP Server role across Windows Server 2012 through 2025, including Server Core installations. Exploitation requires low-privilege adjacency and results exclusively in availability loss - no confidentiality or integrity impact. No public exploit identified at time of analysis; vendor patch is available.
Memory exhaustion denial-of-service in ASUS Armoury Crate allows a local authenticated user to bypass the kernel-mode driver's authentication mechanism and issue unlimited memory allocation requests, saturating available system memory. The vulnerability is classified CWE-770 (Allocation of Resources Without Limits or Throttling) and is scoped to local availability impact only - no confidentiality or integrity loss occurs. No public exploit code or active exploitation has been identified at time of analysis.
Local denial-of-service in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly invoke the driver's System Management Interrupt (SMI) triggering capability, a function classified under CWE-749 as an exposed dangerous method. Repeatedly calling this function forces the CPU into System Management Mode in rapid succession, producing brief but repeatable system stalls that can escalate into a denial-of-service condition. No public exploit code exists and the vulnerability is not listed in CISA KEV, but ASUS has released a security advisory with an available fix.
Uninitialized kernel memory disclosure through the ASUS Armoury Crate Windows driver allows a local low-privileged user to read sensitive data from previously used kernel buffers. The attacker crafts a malicious IOCTL request that bypasses the driver's built-in security verification mechanism, triggering a read of uncleared memory content (CWE-226). No active exploitation has been identified and no public exploit code is known at time of analysis; risk is bounded by the local access prerequisite and the AC:H complexity of defeating the security check.
Kernel virtual address disclosure in the ASUS Armoury Crate Windows driver enables a local low-privileged user to bypass the driver's IOCTL input verification through a crafted request, obtaining kernel virtual addresses and exposing the kernel memory layout. All versions of Armoury Crate are listed as affected per CPE cpe:2.3:a:asus:armoury_crate:*:*:*:*:*:*:*:*. While direct impact is limited to information disclosure, this class of kernel pointer leak is routinely used to defeat KASLR as a prerequisite step in local kernel privilege-escalation chains; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Missing session authentication on vault unlock and recovery endpoints in moltis-org/moltis allows a remote unauthenticated attacker to attempt vault unsealing using only a stolen vault password or recovery key phrase, bypassing the intended dual-layer session-plus-credential security model. All versions through 20260818.10 are affected; the `/api/auth/*` path was globally allowlisted in `is_public_path()`, which caused the `AuthSession` middleware extractor to be silently skipped for both `vault_unlock_handler` and `vault_recovery_handler`. A proof-of-concept exists and vendor-released fix version 20260819.01 is available.
The Okta Hyperdrive Agent plugin improperly implements SAML authentication verification - when an organization's policy exempts a given user from MFA, the agent returns a success response containing only a bare boolean flag rather than a cryptographically signed SAML assertion. The relying application receives an authentication verdict it cannot verify, creating an exploitable integrity gap in the SSO trust chain. Affected versions span 1.2.0 through below 1.5.2; Okta has released a patch and no public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office PowerPoint exposes process memory contents to a local attacker when a victim opens a specially crafted presentation file. Affected across a wide range of Office versions - PowerPoint 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365/Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor patch is available.
Improper null termination (CWE-170) in Microsoft Office Word's document-processing pipeline allows a local attacker to read beyond a string buffer boundary, disclosing sensitive in-memory data when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and Mac variants across Windows (x64/x86) and macOS. No active exploitation is confirmed (SSVC Exploitation: none; no KEV listing), and Microsoft has released fixed builds across all affected product lines.
Remote code execution in InstantCMS prior to 2.18.2 allows authenticated administrators to execute arbitrary PHP code by abusing the component installer's file upload functionality. The attacker uploads a crafted ZIP archive containing a PHP webshell alongside a custom .htaccess file that overrides the upload directory's default PHP execution prohibition, causing the uploaded PHP files to become executable via direct HTTP request. The vulnerability requires admin-level authentication (PR:H per CVSS), significantly limiting exposure, but full server-side code execution is achievable post-exploitation. No public exploit code has been identified at time of analysis.
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Excel allows a local, unauthenticated attacker to disclose potentially sensitive memory contents by convincing a user to open a specially crafted workbook. Affected builds span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code exists and CISA SSVC rates exploitation as 'none' with partial technical impact, making this a moderate-priority patch-cycle item rather than an urgent emergency.
Out-of-bounds read in Microsoft Excel across Office 2016 through 365 Apps for Enterprise permits a local, unauthenticated attacker to disclose sensitive memory contents when a victim opens a specially crafted spreadsheet file. The vulnerability carries a CVSS 5.5 score reflecting the local delivery requirement and confidentiality-only impact, with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, and vendor patches are available for all major Windows Office editions.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Windows License Manager on multiple Windows 10, 11, and Server editions exposes sensitive system licensing data to locally authenticated low-privileged users due to CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). An attacker with an existing local session can read confidential licensing information — such as activation data, product identifiers, or licensing metadata — without authorization. No public exploit code and no CISA KEV listing have been identified; vendor patches are available for all affected versions, reducing urgency for patched environments.
Use-after-free in the Windows Network Connection Broker service allows a local authenticated attacker to read stale heap memory, disclosing potentially sensitive information. The vulnerability spans every supported Windows client and server release from Windows 10 1607 and Windows Server 2016 through Windows 11 25H2 and Windows Server 2025, making the exposed surface extremely broad. Microsoft has shipped patched cumulative updates for all affected SKUs; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Windows Universal Plug and Play (UPnP) Device Host allows a local authenticated attacker to access private personal information they are not authorized to view. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Microsoft has released patches via the standard update cycle.
Local information disclosure in the Windows MIDI Service Module allows a low-privileged authenticated local user to read sensitive system information outside its intended authorization boundary. Affecting Windows 11 versions 24H2, 25H2, and 26H1, the flaw (CWE-497) enables an attacker already present on the system to extract data that should be inaccessible to their privilege level. Microsoft has released patches for all three affected branches; no public exploit code or active exploitation has been identified.
Sensitive information disclosure in the Windows Program Compatibility Assistant (PCA) Service allows a locally authenticated attacker with standard user privileges to read sensitive data written to log files. Affected systems include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both full and Server Core configurations. No public exploit code or active exploitation has been identified at time of analysis, and vendor-released patches are available via Microsoft's update guide.
Microsoft Office Excel exposes sensitive system information to an unauthorized control sphere (CWE-497), enabling local information disclosure when a victim opens a specially crafted Excel file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC editions on both Windows and Mac. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the C:H CVSS confidentiality rating indicates the quality or quantity of information that can be exfiltrated is significant.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel's file parser allows local information disclosure when a victim opens a specially crafted workbook. Affecting Excel 2016 through Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office Online Server, and multiple macOS Office variants, the vulnerability (CWE-125) exposes process memory with high confidentiality impact but no integrity or availability consequences. Microsoft has released patched builds via MSRC; SSVC confirms no active exploitation and non-automatable delivery, placing this squarely within standard monthly patch-cycle priority.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Sensitive system information disclosure in Microsoft Excel allows a local, unauthenticated attacker to read high-confidentiality data when a victim opens a specially crafted spreadsheet. Affecting Office 2016 through LTSC 2024 on both Windows and Mac, the flaw (CWE-497) exposes internal system data - such as memory layout, environment variables, or path information - to an unauthorized control sphere during file parsing. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in Windows Print Spooler Components exposes local kernel or heap memory to low-privileged authenticated users across multiple Windows 10, Windows 11, and Windows Server releases. An authorized local attacker can trigger the CWE-125 defect to read beyond the bounds of an allocated buffer, leaking sensitive data - with no integrity or availability impact. A vendor-released patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged attacker to disclose kernel-mode memory contents. The vulnerability spans a wide swath of Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface operationally broad. Microsoft has released fixes via the standard update channel; no public exploit code and no active exploitation have been confirmed at time of analysis.
Uninitialized resource use (CWE-908) in Microsoft Excel allows a local attacker to disclose process memory contents when a user opens a specially crafted workbook. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS, with vendor patches released across all Windows builds. No public exploit has been identified and SSVC rates exploitation as none with partial technical impact, placing real-world risk firmly in the moderate range despite the C:H CVSS metric.
Out-of-bounds memory read in Microsoft Excel exposes potentially sensitive in-process memory contents when a user opens a specially crafted workbook. Affects a wide range of Office versions including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office for Mac editions. SSVC assessment rates exploitation as none with non-automatable attack delivery, and Microsoft has released patches addressing all affected branches. No public exploit or CISA KEV listing exists at time of analysis.
Buffer over-read (CWE-126) in Microsoft Office Excel allows a local attacker to disclose potentially sensitive process memory when a user opens a crafted Excel workbook. The flaw spans a broad range of Office versions from 2016 through LTSC 2024, including Microsoft 365 Apps for Enterprise and Mac variants, making the affected footprint very large. No public exploit code or CISA KEV listing has been identified; exploitation depends on social engineering to deliver a malicious file to the local system.
Out-of-bounds read in Microsoft Excel discloses sensitive memory contents when a victim opens a specially crafted Excel file. The vulnerability spans a wide range of affected versions including Excel 2016, Office 2019, LTSC 2021/2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise, making the patch surface broad across enterprise environments. No public exploit or active exploitation has been identified at time of analysis; vendor patch is available via MSRC.
Uninitialized memory disclosure in Microsoft Excel exposes potentially sensitive heap or stack contents when a victim opens a crafted document, allowing an unauthenticated attacker to read process memory with high confidentiality impact. Affected product lines span Excel 2016 through Microsoft 365 Apps for Enterprise and multiple Mac variants, making this a broad-surface vulnerability. No public exploit code and no CISA KEV listing have been identified at time of analysis; SSVC assessment rates exploitation as 'none' with non-automatable delivery, limiting realistic risk to targeted document-delivery campaigns.
Out-of-bounds read in Microsoft Office Excel's file parser allows a local attacker to disclose process memory contents when a victim opens a specially crafted Excel document. Affected across all major release channels including Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac variants. No public exploit has been identified at time of analysis, and SSVC classifies exploitation as none with non-automatable delivery.