Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Information disclosure in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, allowing a locally authenticated low-privileged attacker to read sensitive system information that should remain within an authorized control sphere. The vulnerability (CWE-497) requires no user interaction and is limited to local attack vectors with no integrity or availability impact. Microsoft has released patches addressing all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Microsoft COM for Windows leaks sensitive information through error messages on a wide range of Windows 10, Windows 11, and Windows Server versions, allowing a locally authenticated attacker with standard user privileges to read high-confidentiality data. The flaw is rooted in CWE-209 (error message content exposure), where COM subsystem error paths disclose internal state that should not be visible to unprivileged callers. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing all affected builds.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local integrity tampering in the Windows Speech component via a confused deputy (CWE-441) flaw allows an authenticated low-privileged attacker to cause unintended actions on behalf of a higher-privileged process or service, resulting in unauthorized file or system state modification. Affected scope spans Windows 10 (version 1607 through 22H2), Windows 11 (versions 23H2 through 25H2/26H1), and Windows Server 2016 through 2025, making remediation surface broad. Microsoft has released patches; no public exploit identified at time of analysis.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Buffer over-read in the Windows NTFS filesystem driver allows a local low-privileged authenticated attacker to disclose sensitive information from kernel or process memory without modifying system state. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this is a local, low-complexity attack requiring only standard user privileges. No active exploitation has been observed (not in CISA KEV), and no public proof-of-concept exploit is identified at time of analysis. Microsoft has released patches covering the full range of affected Windows client and server versions.
Windows Defender Firewall Service on a broad range of Windows client and server editions exposes protected files or directories to low-privileged local attackers (CWE-552), enabling sensitive information disclosure. A local attacker holding a standard user account can access firewall service files - potentially including policy configuration, rule data, or service-level secrets - that should be restricted to privileged processes. Microsoft has released patches across the full affected version range; no public exploit has been identified at the time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Symlink following in Windows UPnP Device Host (upnphost) allows a locally authenticated, low-privileged attacker to redirect the service's file access operations through crafted symbolic links or junctions, disclosing the contents of otherwise inaccessible files. The vulnerability spans an unusually wide set of affected Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - indicating a systemic deficiency in how the UPnP host service resolves paths before file access. Microsoft has released corrective patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to a backup archive file (`example.7z`) in ningzichun's Student Management System exposes sensitive application data to any network attacker. The Backup Handler component stores or serves this archive at a predictable location without access control, enabling direct retrieval of backup contents that may include database dumps, student records, or application credentials. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the project maintainer has not responded; no patched release exists.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20090) allows an authenticated low-privileged attacker to inject malicious scripts into SharePoint pages, enabling spoofing attacks against users who view the compromised content. The CVSS vector (PR:L/UI:R/C:H/I:H) indicates victim interaction is required and that impact may extend to session token exposure or impersonation within the SharePoint context. No public exploit code has been confirmed and no active exploitation is listed in CISA KEV at time of analysis.
Heap-based buffer overflow in Adobe Acrobat Reader (versions ≤26.002.21900 and Acrobat 2024 ≤24.001.30383) allows an attacker to disclose sensitive memory contents by delivering a crafted PDF file to a victim. The overflow is triggered during file parsing and results in out-of-bounds read of heap memory, enabling confidentiality compromise without integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the requirement for victim user interaction.
Out-of-bounds read in Adobe Acrobat Reader (≤26.002.21900) and Acrobat 2024 (≤24.001.30383) exposes sensitive process memory when a victim opens a specially crafted PDF file. The vulnerability stems from CWE-125, an out-of-bounds read, allowing an attacker who delivers a malicious document to obtain memory contents that could facilitate ASLR bypass or exfiltrate in-memory data such as document content or credentials. No public exploit has been identified at time of analysis; exploitation requires user interaction via file opening.
Out-of-bounds read in Adobe Acrobat Reader and Adobe Acrobat (all editions through version 26.002.21900, and Acrobat 2024 through 24.001.30383) enables sensitive process memory disclosure when a victim opens a specially crafted document. Rooted in CWE-125 improper bounds enforcement during file parsing, the flaw leaks adjacent memory contents including potential pointers or cached sensitive data. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Use-after-free in Adobe Acrobat Reader and Acrobat exposes sensitive heap memory contents when a victim opens a specially crafted PDF file. The vulnerability affects Acrobat and Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, with confidentiality impact rated High by Adobe PSIRT. No public exploit code has been identified at time of analysis, and exploitation requires the victim to open a malicious file.
Use After Free (CWE-416) in Adobe Acrobat and Acrobat Reader permits sensitive memory disclosure when a victim opens a maliciously crafted document. Affected versions span Acrobat and Acrobat Reader ≤26.002.21900 and Acrobat 2024 ≤24.001.30383. The memory-corruption primitive exposes heap contents - potentially including credentials, key material, or in-process data - but the CVSS vector confirms no integrity or availability impact, making this a pure information-disclosure issue. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read (CWE-125) in Adobe Acrobat and Acrobat Reader - versions up to 26.002.21900 and Acrobat 2024 up to 24.001.30383 - allows disclosure of sensitive process memory when a victim opens a specially crafted document file. The confidentiality impact is rated high (C:H), meaning leaked memory contents could include pointers, session data, or other in-process secrets, though there is no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-141 addressing the issue.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader exposes sensitive process memory to attackers who can deliver malicious PDF files. Affected versions include Acrobat Reader and Acrobat 2024 up to 26.002.21900 and 24.001.30383 respectively. Exploitation requires a victim to open a crafted file, but no system privileges are needed - the barrier is solely user interaction, making phishing and email-borne delivery effective vectors.
Integer underflow (CWE-191) in Adobe Acrobat Reader allows an attacker to disclose sensitive process memory contents by tricking a victim into opening a crafted PDF or Acrobat file. Affected across all current Acrobat 2024 (≤24.001.30383) and Acrobat/Acrobat Reader continuous-track (≤26.002.21900) releases. No active exploitation confirmed in CISA KEV; no public exploit code identified at time of analysis, though Adobe-class memory disclosure flaws are frequently chained with code execution primitives.
Out-of-bounds read in Adobe Acrobat Reader and Acrobat (Continuous Track ≤26.002.21900; Classic 2024 Track ≤24.001.30383) allows an attacker to disclose sensitive memory contents from a victim's process by delivering a crafted PDF file that the victim must open. The flaw is rooted in CWE-125 and carries a CVSS 5.5 score reflecting its local, user-interaction-dependent attack vector with high confidentiality impact but no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis.
Uncontrolled resource consumption in Adobe Acrobat Reader and Acrobat 2024 enables application-level denial of service when a victim opens a specially crafted document. Affecting Acrobat Reader up to version 26.002.21900 and Acrobat 2024 up to 24.001.30383, the flaw (CWE-400) allows a malicious file to exhaust system resources and crash or freeze the application. Adobe has released patches via advisory APSB26-141; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker to inject malicious script into page output, enabling spoofing attacks against other users. Successful exploitation requires the victim to interact with attacker-controlled content but can result in high confidentiality and integrity impact within the victim's SharePoint session context. Microsoft has released patch version 16.0.20326.20090 addressing this flaw, reported internally via secure@microsoft.com.
Permanent local denial-of-service in Android's PackageInstallerService allows a low-privilege local attacker to irreversibly disable an affected device through a logic error in the createSessionInternal session-creation path. Affected releases are Android 16-qpr2 and Android 17, as confirmed by Google's September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the monthly Android security update.
Persistent local denial of service in Android's VoiceInteractionManagerService affects versions 14 through 17 via resource exhaustion in the initForUserNoTracing method. A low-privilege local attacker - such as a malicious installed app - can exhaust system resources without any user interaction, rendering the device persistently unavailable. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with limited real-world exploitation interest.
Persistent denial-of-service in Android's WifiNetworkSuggestionsManager affects versions 15 through 17, including 16-QPR2. The `add` method in WifiNetworkSuggestionsManager.java fails to enforce resource consumption limits (CWE-400), allowing a low-privileged local application to exhaust system resources and render the device unresponsive or degraded without any user interaction. No confidentiality or integrity impact exists; the risk is purely availability-based, but the 'persistent' characterization implies the DoS survives reboots or normal recovery paths.
Permanent local denial of service in Android's GameManagerService affects devices running Android 14 through 16-qpr2, exploitable by any low-privilege application without user interaction. The vulnerable code path - `parseInterventionFromXml` in `GameManagerService.java` - fails to bound resource consumption during XML parsing of game mode intervention data, allowing a locally installed app to exhaust system resources and render the service permanently unavailable until device reboot. No public exploit has been identified; the September 2026 Android Security Bulletin addresses this vulnerability.
Heap-based buffer overflow in Cesanta mJS up to version 1.26 allows unauthenticated remote attackers to achieve partial memory corruption by supplying crafted JavaScript input that triggers the `skip_spaces_and_comments` tokenizer function in `src/mjs_tok.c`. All release versions from 1.0 through 1.26 are confirmed affected per EUVD-2026-73943. A public proof-of-concept exploit has been disclosed via VulDB, the vendor has not responded to the issue report, and no patch has been released at time of analysis.
Hard-coded database credentials in ningzichun Student Management System expose MySQL connection secrets in the publicly accessible GitHub repository, allowing any attacker who reads the source to authenticate directly to the backend database. The vulnerability resides in config/database.php where mysqli_connect() is called with literal credential strings (CWE-259), affecting all commits up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Publicly available exploit code exists (E:P per the CVSS 4.0 supplemental); the project maintainer has not responded to the responsible disclosure issue.
Authentication bypass in aircheng-org iWebShop-5 (all versions 5.0-5.15) allows unauthenticated remote attackers to access the seller management panel by manipulating the `Name` parameter in the `Login` function of `controllers/systemseller.php`. A public exploit exists (referenced via GitHub issue #6), and SSVC confirms automatable exploitation with partial technical impact. The vendor has not responded to responsible disclosure, and no patch is available.
Buffer over-read (CWE-126) in Microsoft Word's document parsing code allows local disclosure of in-process memory when a victim opens a specially crafted file. All currently-supported Office release lines on Windows - 365 Apps for Enterprise, Office 2019, 2021, 2024 LTSC, and Word 2016 standalone - are affected across both x86 and x64 architectures. No public exploit code has been identified, and SSVC rates exploitation as 'none' with technical impact 'partial', consistent with the moderate CVSS 5.5 rating.
Buffer over-read (CWE-126) in Microsoft Office Word allows local information disclosure when a user opens a specially crafted document, exposing process memory contents with high-confidentiality impact. Affected builds span Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across both x86 and x64 architectures. No public exploit has been identified at time of analysis, SSVC rates exploitation as none and the attack as non-automatable, and vendor patches are available for all affected product lines.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.