Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds low-privileged, authenticated code execution on a Windows host raise their privileges to kernel level. The flaw is an untrusted pointer dereference (CWE-822) in the kernel that can be triggered with low attack complexity and no user interaction, giving high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified and CISA's SSVC assessment records exploitation as none and automatable as no, so this is a credible but not emergency-level priority; the main constraint on attackers is the need for a pre-existing local foothold on an unpatched build.
Local privilege escalation in the Microsoft Windows Win32 kernel subsystem allows an attacker who already holds low-privilege local access on a Windows host to corrupt heap memory and gain SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) rated CVSS 7.8 with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must be authenticated locally (PR:L, AV:L) and needs to run a crafted program that reaches the vulnerable kernel code path, with no user interaction required. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation=none and Automatable=no, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege escalation in Windows Shell allows an attacker who already holds a low-privileged, authenticated account on a Windows host to traverse relative paths and raise their privileges to a higher integrity level (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote or initial-access vector - it requires existing local code execution or account access, but needs no user interaction and is low-complexity once that foothold exists. CISA's SSVC assessment records no observed exploitation and no automatable path, and no public exploit has been identified at time of analysis; vendor patches are available, making this a credible but second-tier prioritization compared with actively exploited or remotely reachable issues.
Local privilege escalation in Microsoft's Windows Backup Engine (CWE-41, path equivalence mis-resolution) allows an authenticated, low-privileged attacker with local access to a Windows host to gain elevated privileges by manipulating a path that the Backup Engine resolves to an equivalent but attacker-controlled location; exploitation requires no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). The attack surface is confined to hosts where an attacker already holds an unprivileged foothold, making multi-user systems, shared workstations, and terminal/RDP-style environments the realistic risk scenario rather than remote perimeter exposure. Microsoft has published fixed builds through the MSRC update guide, and no public exploit identified at time of analysis - no confirmed actively exploited (CISA KEV) status and no publicly available exploit code exists, so this is a credible but not emergency-tier patch-cycle priority.
Arbitrary code execution in Adobe FrameMaker is possible when a user opens a maliciously crafted file, due to a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires user interaction (UI:R) and is local (AV:L), meaning an attacker must deliver the file to the victim, who then opens it; no authentication is needed (PR:N). While no public exploit code has been identified, the issue is rated CVSS 7.8 and is considered a genuine but not emergency-grade priority; Adobe has published a security bulletin (APSB26-172) with remediation guidance.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged access on a target host trigger a heap-based buffer overflow and execute code at a higher integrity level, up to full system rights (CVSS 7.8, AV:L/PR:L/UI:N). Unpatched Windows 10 builds from 1607 through 22H2, Windows 11 builds from 23H2 through 26H2, and Windows Server 2012 through 2025 are affected below the fixed revisions tracked in EUVD-2026-100258. No public exploit code has been identified at time of analysis, but vendor-released patches are available, making this a genuine patching priority for any endpoint or server where an attacker could obtain a local foothold.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker with low-level privileges to exploit a memory corruption flaw and gain higher privileges on affected Windows client and server systems. The vulnerable BITS component is default-enabled and reachable without non-default configuration, but exploitation requires a pre-existing local foothold and no user interaction, with no remote or network vector. Vendor patch is available; no public exploit identified at time of analysis, and the independent assessment rates this as a credible but not emergency-level priority.
Use-after-free in the Windows Kernel allows an authenticated, low-privileged local attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to escalate privileges to SYSTEM-level, delivering high confidentiality, integrity and availability impact as a post-compromise LPE primitive. Affected systems are unpatched builds of Windows 10, Windows 11 and Windows Server 2012 through 2025 that fall below the fixed revisions in the vendor advisory. A vendor patch is available per the Microsoft MSRC update guide; no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.
A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker to gain SYSTEM-level privileges on affected hosts. Exploitation requires an existing foothold with at least low-level user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8); the BITS service runs by default on all supported Windows versions and needs no non-default configuration, so the only real barrier is the local attack vector. The vulnerability spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); Microsoft has released patched builds via the monthly update channel.
Local privilege escalation in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged local user to elevate to a higher-integrity context, with a vendor CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only Windows 10, Windows 11, and Windows Server systems running builds older than the fixed revisions listed in the Microsoft advisory are affected; BITS is enabled by default on all editions, so no special configuration is needed to reach the vulnerable code. Exploitation is strictly local (post-compromise escalation, not initial access), no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated attacker with low-privileged local code execution to trigger a heap-based buffer overflow and potentially gain SYSTEM-level privileges. Affected systems span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; exploitation requires an existing local foothold (CVSS 3.1 AV:L/PR:L/UI:N, 7.8 High) and no user interaction. No public exploit was identified at time of analysis, and Microsoft has released patches, making this a credible post-compromise escalation chain component rather than a standalone remote entry point.
A heap-based buffer overflow in the Windows Push Notifications component lets an attacker who already holds a low-privileged local foothold on a Windows host corrupt heap memory and elevate to higher-integrity code execution, with assessed high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local authenticated access - this is a privilege-escalation primitive that must be chained behind a separate initial-access technique, not a standalone remote entry point - but once a foothold exists it is reliable, needs no user interaction, and applies to default client and Server Core installations. Microsoft has published a vendor patch, CISA's SSVC decision framework records no known exploitation and no automatable exploitation, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Microsoft Windows is possible because the COM+ Event System Service dereferences an untrusted pointer (CWE-822), allowing an authenticated attacker who already holds a low-privileged foothold on the host to elevate to SYSTEM. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds listed below the fixed build numbers (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), with a CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and total technical impact per the CISA SSVC assessment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the practical risk is bounded by the requirement for pre-existing interactive local access rather than any remote vector.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated attacker with existing low-privileged code execution (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow (CWE-122) and gain high-confidentiality, high-integrity, high-availability SYSTEM-level control of the host. The service is enabled by default on all affected client and server editions - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025 - so no special configuration is needed, but the primitive cannot be reached remotely or pre-authentication; an attacker must already hold a foothold. There is no public exploit code and no confirmed active exploitation at time of analysis, and CISA SSVC rates exploitation as none with total technical impact, making this a credible but not emergency-tier priority.
A stack-based buffer overflow (CWE-121) in the Windows Client-Side Caching (CSC) service - the component that implements Offline Files caching of network shares - allows an authenticated, low-privileged local attacker to corrupt stack memory inside a service that normally runs with SYSTEM privileges, resulting in full local privilege escalation (CVSS 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). The attack requires a pre-existing local foothold (a standard user account or low-privileged code execution) plus the ability to reach and interact with the CSC service; there is no remote vector and no user interaction needed once local access exists. Exploitation is not confirmed active (CISA SSVC reports Exploitation: none) and no public exploit code has been identified at time of analysis, so this is a genuine but second-tier priority for patching cadence. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Win32K GRFX graphics subsystem lets an attacker who already holds a low-privileged local foothold trigger a heap-based buffer overflow in kernel-mode graphics code and escalate to SYSTEM. All supported Windows client and server editions that ship the affected Win32K components are in scope, including Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; no user interaction is required and no non-default configuration is needed. Microsoft has released fixed builds, and while technical impact is rated total, there is no confirmed active exploitation and no public exploit code identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or wormable threat.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required and attack complexity is low once a foothold exists, but it is not remotely reachable and cannot be triggered by luring a victim to open content. A vendor patch is available from Microsoft (per the MSRC update guide) and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch target for organizations that cannot fully prevent local code execution on endpoints and servers.
Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.
Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) lets an authenticated, low-privileged attacker who already has code execution on a target host elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, but a vendor patch is available and the EPSS-style urgency is driven by the breadth of default-installed, unpatched builds rather than by observed attacks.
Local privilege escalation in OpenSSH for Windows stems from a use-after-free (CWE-416) in the SSH component shipped with supported Windows builds, allowing an authenticated low-privileged user who already holds a foothold on the host to corrupt memory inside the OpenSSH process and elevate to the privileges of that process, with high impact across confidentiality, integrity and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is strictly local: there is no remote or network vector, no user interaction is required, and exploitation presupposes a valid low-privilege account plus the vulnerable OpenSSH for Windows component being installed and in use on an unpatched build. No public exploit code has been identified at the time of analysis, CISA's SSVC decision framework records exploitation as none and the flaw as not automatable, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in the Windows Servicing Stack (SSU) allows an authenticated, low-privileged attacker who already holds a foothold on the host to write a malicious file into a directory the servicing component searches before the legitimate path, yielding SYSTEM-level code execution. The flaw spans the entire supported Windows range - Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core installations - with exploitation requiring only local access and write permission (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and non-automatable, and Microsoft has released fixes, so this is a credible but not emergency-level priority rather than an active threat.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated low-privileged local user to gain SYSTEM-level rights on unpatched hosts, with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting total loss of confidentiality, integrity and availability within the affected machine. Exploitation is not remotely reachable - it requires an existing foothold on the host as an unprivileged user - and there is no public exploit code and no confirmed active exploitation (no CISA KEV listing; SSVC exploitation: none, automatable: no). Microsoft has released vendor patches covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so risk is concentrated in fleets still running builds below the fixed levels listed in the EUVD record.
Local privilege escalation in the Windows Update Service allows an authenticated, low-privileged user on Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) or Windows Server 2025 to run code as SYSTEM by placing a malicious module in a directory the service searches ahead of the trusted location (CWE-426 untrusted search path, CVSS 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: an attacker must already hold a local authenticated account with write access to a directory in the service's search order, and CISA's SSVC assessment records exploitation as none, automatable as no and technical impact as total, making this a manual post-compromise escalation rather than a self-propagating or wormable issue. No public exploit code was identified at time of analysis, and Microsoft has published fixing updates through its MSRC Update Guide.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
A use-after-free in the Windows Background Intelligent Transfer Service (BITS) lets an attacker who already holds low-privilege local code execution on a Windows host elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). The service ships by default on every supported Windows client and server edition, but the flaw is a post-compromise escalation primitive rather than an initial-access vector - there is no remote or network-reachable path and no victim interaction is required, so exploitation is limited to hosts where an attacker or malware is already running as a standard user on a pre-patch build. Microsoft has released fixes; no public exploit code or confirmed in-the-wild activity has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no), making this a genuine patch-priority item rather than an emergency. Patched builds are enumerated per Windows version (for example Windows 11 24H2 fixed in 10.0.26100.9711, Windows Server 2022 in 10.0.20348.5761), so only unpatched systems remain exposed.
Heap-based buffer overflow in the Windows Win32K GRFX subsystem allows an authenticated local attacker holding only low privileges to escalate to kernel-level (SYSTEM) code execution, yielding full impact to confidentiality, integrity and availability (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a wide range of unpatched Windows client and server builds - Windows 10 and Windows 11 through 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and works against default configurations because Win32K is a built-in component present on every affected edition. No public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV); because the defect is local-only (AV:L) it cannot be triggered remotely and requires a prior foothold on the host, which makes this a patch-priority issue rather than a remotely weaponizable one.
Local privilege escalation in Windows Direct Composition allows an attacker who already holds standard, low-privilege code execution on a target host to corrupt heap memory in the desktop composition subsystem and elevate to a higher integrity level. Affected builds include Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core), all of which ship the composition component enabled by default with no non-default configuration required. No public exploit code has been identified at time of analysis, CISA's SSVC evaluation records no observed exploitation, and no EPSS estimate was supplied; because exploitation mandates an existing local, authenticated foothold and the flaw cannot be triggered remotely, it is a credible but second-tier priority relative to network-exploitable, actively attacked vulnerabilities.
Local privilege escalation in Microsoft Windows DirectComposition (CWE-122 heap-based buffer overflow) allows an attacker who already holds low-privilege code execution on a target host to corrupt heap memory inside the composition subsystem and elevate to a higher integrity level, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/PR:L/UI:N). DirectComposition is present by default across the affected Windows 10 builds 1607 through 22H2, Windows 11 23H2 through 26H2/26H1, and Windows Server 2016 through 2025, so no special feature enablement is needed - the only prerequisite is a pre-existing local, authenticated foothold with no user interaction required. Microsoft has published fixes that raise each affected branch to its patched build, and CISA's SSVC assessment records exploitation as none, with no public exploit identified at time of analysis; this is a credible but not emergency-tier priority relative to remotely reachable or actively exploited Windows flaws.
Local privilege escalation in the Windows Kernel (heap-based buffer overflow, CWE-122) allows an attacker who already holds low-privileged, authenticated code execution on a host to corrupt kernel pool memory and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local-only with no user interaction required (AV:L/AC:L/PR:L/UI:N), so this is a post-compromise elevation primitive rather than a remote entry point, and because the flaw sits in a core kernel component, default installations of the affected builds are exposed with no special feature or non-default configuration required. Microsoft has published fixed builds through its update guide, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' with a total technical impact, so this is a genuine but not emergency-priority issue.
Local privilege escalation in Windows Input System allows an authenticated low-privileged attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds through a CWE-843 type-confusion condition. The flaw requires local access and low privileges but no user interaction, and Microsoft has issued fixes; no public exploit code or active exploitation has been identified at time of analysis, with CISA SSVC recording exploitation as none.
Local privilege escalation in the Microsoft Desktop Window Manager (dwm.exe) allows an authenticated attacker who already holds a low-privileged session to trigger a heap-based buffer overflow and execute code at a higher integrity level, up to SYSTEM, on unpatched Windows 10, Windows 11 and Windows Server 2019-2025 hosts. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the flaw is reachable only through local code execution, requires no user interaction, and functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', though technical impact is rated total, so the vulnerability is a credible but not emergency-tier patch priority.
Local privilege escalation in Windows Direct Composition (the dcomp/DWM compositing subsystem) lets an attacker who already holds low-privileged code execution on a target box corrupt freed memory and elevate to a higher-integrity context, including SYSTEM. Every supported Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2022/2025 build ships the affected component by default, but the CVSS vector (AV:L/PR:L/UI:N) confirms exploitation requires an existing local foothold and no user interaction, making this a post-compromise escalation primitive rather than an initial access vector. With a base score of 7.8 and high confidentiality, integrity and availability impact, it is a credible but not emergency-tier priority: vendor patches are available, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Portable Device File System Driver lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM. The flaw spans an unusually wide set of builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - and carries a vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; the operative constraint is the required local foothold, which makes this a second-stage escalation primitive rather than an entry point.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem allows an authenticated local attacker holding only standard user rights to corrupt kernel heap memory and elevate to full SYSTEM-level privileges on unpatched Windows hosts. The vulnerability is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects a very broad install base, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025, so it functions as a reliable post-compromise escalation primitive rather than an initial-access emergency. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and the CVE is not listed in KEV; Microsoft has released vendor patches with fixed servicing builds for every affected branch.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) lets a locally authenticated attacker holding only low-level privileges elevate their privileges on the host, with full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction or non-default configuration is required because WER is a built-in subsystem present across every affected Windows 10, Windows 11 and Windows Server 2016-2025 SKU, but the flaw is not remotely exploitable: the attacker must already be able to run code locally under a valid low-privilege account. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has published a fix and an advisory entry for the issue, so affected builds below the fixed thresholds should be updated.
Local privilege escalation in the Windows Host Guardian Service component allows an authenticated low-privileged user on an affected Windows build to redirect a privileged file operation and obtain elevated, SYSTEM-level rights, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). The root cause is a link-following weakness (CWE-59): the attacker must already hold a local, authenticated session and be able to create or control symbolic links or junctions that a higher-privileged process then follows. No user interaction is required, CISA's SSVC assessment rates the issue non-automatable (targeted, manual exploitation rather than scalable mass abuse), and no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft has released patches for the affected Windows 10, Windows 11 and Windows Server 2019/2022/2025 builds.
A local privilege-escalation flaw in the Windows Hyper-V hypervisor's file-access path (CWE-59, improper link resolution) allows an attacker who already holds authenticated low-privileged code execution on a Hyper-V-enabled host to have a privileged operation follow an attacker-planted symbolic link, junction, or hard link, resulting in full loss of confidentiality and integrity (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H). Impact is limited to systems where the Hyper-V role is actually installed or enabled, since non-virtualization Windows installs do not expose the vulnerable component; exploitation is not remote and requires a pre-existing foothold. No public exploit was identified at time of analysis and CISA SSVC rates the issue as not automatable, though a vendor patch is available per Microsoft's advisory. Because the escalation yields SYSTEM-level access on virtualization hosts, the effective blast radius is high wherever Hyper-V underpins tenant or workload isolation.
Local privilege escalation in Windows Shell allows an authenticated attacker who already holds low-privileged code execution on a Windows host to elevate to SYSTEM-level rights by supplying a crafted relative path to a privileged shell operation, causing path-traversal sequences to escape the intended directory (CWE-23, CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are default installations of the Windows client and server builds enumerated in the vendor and EUVD data, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core variants. There is no public exploit identified at time of analysis and CISA's SSVC decision framework records exploitation as none with automatable set to no, so this is a patch-priority item rather than an emergency; vendor patches are available and no user interaction is required once the attacker has local access.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authenticated local attacker on a Windows host abuse improper access control in the driver's file-link handling to run code with elevated rights. Exploitation requires the attacker to already hold a valid low-privileged account (CVSS vector PR:L, AV:L) and to reach the container-isolation driver path; no user interaction is needed and attack complexity is low (AC:L), with high confidentiality, integrity and availability impact scored (7.8). Microsoft has published an advisory entry via the MSRC update guide, there is no indication of CISA KEV listing, and no public exploit code was identified at time of analysis - this is a patch-priority issue for Windows container hosts rather than a wormable emergency.
Local privilege escalation in the Windows Secure Socket Tunneling Protocol (SSTP) component allows an authenticated, low-privileged user on an affected host to trigger a heap-based buffer overflow and obtain high-integrity code execution in the context of the vulnerable service (CVSS 7.8, CWE-122). Exploitation requires a pre-existing local foothold with valid low-privileged credentials (AV:L/PR:L) and no user interaction (UI:N), so the flaw functions as a privilege-escalation link in a post-compromise chain rather than a remote entry point; there is no CISA KEV listing and no public exploit code identified at time of analysis. Microsoft has shipped a vendor patch, and ENISA EUVD tracks the issue as EUVD-2026-100095, making this a moderate-but-real priority concentrated on multi-user, RDP/terminal, and Windows Server hosts where untrusted local principals exist.
Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.
Local privilege escalation in the Windows Win32 kernel subsystem lets an attacker who already holds low-privileged code execution on a host escalate to full kernel-level (SYSTEM) privileges on unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and on Windows Server 2025, including Server Core installs. The underlying defect is a use-after-free (CWE-416) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - the access vector is strictly local and the attacker must already be an authenticated user on the machine, so this is a post-foothold escalation rather than a remotely reachable bug, and no user interaction is needed. At time of analysis there is no public exploit code and no public exploit identified at time of analysis, and Microsoft has published vendor patches; exploitation would require reliably winning the object-reuse condition in kernel memory, and a failed attempt is likely to crash the host rather than succeed silently.
Local privilege escalation in Windows Win32K allows an authenticated attacker with low-privileged access to elevate to higher integrity levels by exploiting a use-after-free (CWE-416) condition. Affected systems include a broad range of Windows 10, Windows 11, and Windows Server versions (2016 through 2025); a vendor patch is available. No public exploit code or active exploitation has been identified, and the risk is assessed as credible but not emergency-level.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.
Local privilege escalation in Windows Group Policy lets an authenticated, low-privileged user on an unpatched Windows host overflow heap memory and escalate to SYSTEM-level code execution. The defect is a heap-based buffer overflow (CWE-122) reachable only after the attacker already holds a local foothold - there is no remote vector (AV:L), no user interaction is required (UI:N), and successful exploitation yields full loss of confidentiality, integrity, and availability for the host. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; CISA's SSVC assessment marks the flaw as non-automatable, making it a credible but not emergency-tier patching priority.
Local privilege escalation in Microsoft Windows DirectComposition lets an authenticated attacker who already holds low-privileged code execution on a host trigger a use-after-free in the desktop composition engine and gain code execution at a higher integrity level. Affected are supported Windows client and server builds prior to the fixed builds listed in the vendor advisory, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022 and Windows Server 2025 (including Server Core). No public exploit code has been identified at time of analysis, and CISA's SSVC assessment marks the issue as non-automatable, making this a genuine but non-emergency patching priority rather than a drop-everything emergency.
Local privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged, authenticated session on a vulnerable host gain full SYSTEM-level control by triggering a use-after-free (CWE-416) in kernel memory handling, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The unpatched population covers Windows 10 21H2/22H2, Windows 11 23H2 through 26H2 and Windows Server 2022/2025, with fixes recorded in EUVD-2026-100051 that raise builds such as Windows 11 24H2 to 10.0.26100.9711, Server 2025 to 10.0.26100.33650 and Windows 10 to 10.0.19044.7807. Patch available per vendor advisory; no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with automatability as no, although technical impact is rated total.
Local privilege escalation in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds code execution as any logged-on user to raise privileges to kernel/SYSTEM level. The defect is a use-after-free (CWE-416) in a subsystem present in default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025, requiring no user interaction once a local foothold exists, though it cannot be triggered remotely and grants no initial access on its own. Microsoft has released vendor patches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the assessed CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user to corrupt kernel heap memory and gain full control of the host at SYSTEM level. Exploitation requires the attacker to already hold a foothold on the machine (CVSS AV:L/PR:L, no user interaction), so this is a post-compromise escalation primitive rather than an initial access path. Microsoft has published a vendor fix, CISA's SSVC assessment rates exploitation as 'none' with 'no' for automatable, and no public exploit code has been identified at time of analysis.