Heap-based buffer overflow in the Windows exFAT file-system driver (CWE-122) allows a locally authenticated low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) to corrupt kernel heap memory and elevate privileges to SYSTEM. The attacker must already hold a local foothold and be able to get the exFAT driver to parse attacker-controlled file-system metadata, typically by mounting or accessing a crafted exFAT volume such as a removable USB device, ISO/VHD, or disk image; no separate victim interaction is required and there is no remote/network attack path. The issue affects default Windows configurations across Windows 10, Windows 11, and Windows Server releases that support exFAT. Assessment at time of analysis: no public exploit identified, no confirmed active exploitation, and no EPSS signal supplied; Microsoft has published a vendor patch via the MSRC update guide, so this is a genuine but moderate-priority privilege-escalation risk rather than an urgent fire-drill.
Local privilege escalation in the Windows HID Parser Library lets an attacker who already holds low-privileged authenticated access to a Windows host escalate to full system-level control by submitting a malformed HID report descriptor that triggers a CWE-190 integer overflow (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is local-only, requires no user interaction, and no public exploit has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', while rating technical impact as total. Because the vulnerable parser sits on the standard HID input path present in default Windows 10, Windows 11, and Windows Server configurations, the realistic risk is concentrated in multi-user, kiosk, and post-initial-compromise scenarios rather than in remote attack campaigns.
Use-after-free in the Windows Shell lets an authenticated, low-privileged local attacker elevate privileges on unpatched Windows 10, Windows 11 and Windows Server builds, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 7.8, CWE-416). Exploitation is local, requires no user interaction, and is only possible after the attacker already holds code execution under a valid low-privileged account (AV:L/PR:L/UI:N); CISA's SSVC assessment records exploitation as "none" and not automatable, and no public exploit code was identified at time of analysis. Microsoft has released vendor patches, so the fix is a standard update rather than an emergency mitigation, though the total technical impact rating makes prompt patching worthwhile.
Local privilege escalation in the Windows Kernel lets an authenticated attacker who already holds a low-privileged foothold on an affected Windows 10, Windows 11, or Windows Server build corrupt kernel memory and elevate to SYSTEM-level privileges. The defect is a use-after-free (CWE-416) that is reachable on default installations with no user interaction, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); Microsoft has shipped a vendor patch through its Security Update Guide. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as none and Automatable as no, so this should be handled as a standard monthly-patching priority rather than an emergency.
An out-of-bounds read in Windows kernel-mode drivers (CVE-2026-83637, CWE-125, CVSS 7.8) lets an attacker who already holds low-privileged local code execution on a Windows host escalate to full kernel privileges, yielding high confidentiality, integrity, and availability impact. Successful exploitation requires an existing local foothold and an authenticated session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); there is no remote or unauthenticated attack path and no user interaction is needed. No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not automatable), and Microsoft has released vendor patches for all affected Windows 10, Windows 11, and Windows Server editions.
Local privilege escalation in the Windows Smart Card component affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, allowing an attacker who already holds an authenticated local session with low-level privileges to overflow a heap buffer and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); it is not remotely reachable, requires no user interaction, and Microsoft rates exploitation as non-automatable. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV and SSVC both report none), so this is a moderate-priority local privilege escalation that should be remediated through routine patching rather than emergency response, while noting that the technical impact if successfully triggered is total (confidentiality, integrity, and availability of the host).
Privilege elevation in the Microsoft Windows Search Component lets a local attacker who already holds standard user code execution on a Windows host corrupt memory and gain higher-integrity access, ultimately reaching SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required but the attacker must already have a low-privileged foothold on the machine - it cannot be triggered remotely or by an unauthenticated actor, and SSVC rates the issue as non-automatable. No public exploit code was identified at time of analysis and CISA's SSVC data records no exploitation activity, though the total technical impact and the default presence of the Search component across every supported Windows client and server edition make it a valuable post-exploitation step. Microsoft has shipped fixes; the affected build ranges and patched thresholds are published in the MSRC update guide.
Local privilege escalation in the Windows NTFS file-system driver (CVE-2026-83567) allows an authenticated attacker who can already execute code on a Windows host to trigger an out-of-bounds read, which Microsoft scores as a full compromise of confidentiality and integrity (CVSS 7.8, C:H/I:H/A:H). Affected builds span essentially the entire supported Windows estate - Windows 10 1607 through 22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - all in default configuration. This is a genuine but not emergency-priority vulnerability: no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has published vendor patches, so the practical risk is bounded by the requirement for pre-existing local authenticated access and the absence of a remote vector.
Local privilege escalation in the Windows Partition Management Driver lets an attacker who already holds a low-privileged local foothold on the host trigger a heap-based buffer overflow in kernel mode and gain full SYSTEM-level code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no network surface are involved - the only prerequisite is authenticated local access and the ability to issue crafted I/O to the driver, which ships by default on every affected Windows build. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a post-compromise escalation and not an initial-access vector; a vendor patch is available.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows a standard user who can get a malformed UDF volume parsed by the kernel to corrupt and then reuse freed heap memory, escaping the sandbox and running code as SYSTEM. Exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no user interaction, but there is no network vector and the attacker must already hold a foothold capable of executing code and triggering UDF parsing. Microsoft has released patched builds via the MSRC update guide; there is no public exploit identified at time of analysis, no evidence of active exploitation (CISA SSVC exploitation: none), and the issue is best handled as a normal patch-cycle priority rather than an emergency.
Local privilege escalation in Microsoft Windows NTFS stems from an out-of-bounds read (CWE-125) that an authenticated attacker who already holds a low-privileged foothold on the host can trigger to reach high-integrity code execution and to read beyond the bounds of a kernel buffer (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw touches the default Windows filesystem, so unpatched Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2012 through 2025 and their Server Core installations are all in scope, but the local attack vector (no remote, unauthenticated reach) confines it to post-compromise escalation rather than an initial access path. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and Microsoft has released vendor patches.
Local privilege escalation in Microsoft Windows Schannel allows an authenticated attacker who already holds low-privileged code execution on a host to leverage a null pointer dereference in the TLS/SSL security provider into full compromise of the machine (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds span Windows Server 2012 and 2012 R2 through Windows Server 2025, plus Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) below the fixed build numbers published by the vendor; because Schannel is present by default in all supported releases, there is no feature toggle that removes the exposure. No public exploit identified at time of analysis, and the local-only vector combined with the prerequisite of an existing foothold makes this a genuine patch-priority item rather than an emergency - though multi-user, terminal-services, and server hosts where untrusted parties can run code warrant scheduling priority.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) allows a locally authenticated attacker to elevate privileges on affected Windows systems. Successful exploitation yields full control of the kernel - confidentiality, integrity and availability impacts are all High (CVSS 7.8, AV:L/PR:L/UI:N) - meaning an attacker who already has low-privileged code execution can escalate to SYSTEM, typically to disable protections or install persistence. The prerequisites are significant: the attacker must already hold local access and valid credentials, and there is no remote vector; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), though CISA's SSVC assessment rates the potential technical impact as total. Affected builds span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025, so patch prioritization belongs in the standard monthly Windows cumulative-update cycle rather than emergency response.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (AFD.sys) lets an attacker who already has low-privileged local code execution on a host obtain elevated (SYSTEM) rights by triggering a type confusion in the kernel driver. The flaw carries CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning the attack is local-only, needs valid low-level credentials or prior code execution, and requires no user interaction; AFD.sys is loaded by default on every supported Windows edition, so no non-default configuration is needed to reach the vulnerable code. It affects a broad set of Windows 10/11 and Windows Server 2012-2025 builds below the patched levels in EUVD-2026-99199; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no. This is a genuine patch-priority item but not an emergency.
Local privilege escalation in Microsoft Windows NTFS lets an authenticated attacker who already has low-privileged code execution on the host escalate to kernel/SYSTEM level by driving the filesystem driver into an untrusted pointer dereference (CWE-822). The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects every listed Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through Server 2025 build below its patched revision, since NTFS is the default Windows filesystem and no non-default configuration is required. There is no public exploit identified at time of analysis and CISA SSVC rates Exploitation=none and Automatable=no; Microsoft has shipped vendor patches, making this a credible but not emergency-level priority.
A heap-based buffer overflow in the Windows Network File System (NFS) Server role lets an attacker who already holds local, low-privileged authenticated access on a Windows host execute code in a higher-privileged context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Exploitation is constrained by prerequisites: the optional NFS Server / Services for NFS feature must actually be installed and enabled - it is absent from default Windows installations - and the attacker must already be on the box with valid low-privilege credentials; no user interaction is required. Vendor-released patches exist for all listed Windows client and server builds, no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), so this is a moderate-to-serious patching priority rather than a top-tier emergency. Defenders should note the scoring discrepancy flagged in the independent assessment: NFS is a network-facing service, yet Microsoft scored the vector as LOCAL - confirm via the MSRC advisory whether any network-adjacent trigger path exists beyond the local vector.
Local privilege escalation in the Windows Update Service lets an authenticated attacker with low-level local access (CVSS PR:L/AV:L) corrupt heap memory to gain SYSTEM-level code execution on unpatched Windows client and server builds. The flaw is a heap-based buffer overflow (CWE-122) that requires no user interaction and no special configuration, since the Windows Update Service is enabled by default; exploitation cannot be automated or performed remotely, and no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft Windows OLE allows an attacker who already holds low-privileged authenticated access on a host to drive a heap-based buffer overflow by inducing the vulnerable component to process a crafted OLE object, resulting in code execution at a higher integrity level with complete loss of confidentiality, integrity, and availability (CVSS 7.8, CWE-122). The issue spans a wide set of unpatched Windows client and server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025; vendor fixes are available and no public exploit code was identified at time of analysis. Because the attack is local (AV:L), requires existing credentials (PR:L), needs no victim interaction (UI:N), and is classified as non-automatable with exploitation 'none' under CISA's SSVC framework, it is a second-tier, post-compromise escalation primitive rather than a remote or wormable threat.
Local privilege escalation in the Windows Kernel allows an authenticated low-privilege attacker with existing code execution on a target host to trigger a heap-based buffer overflow and elevate privileges in kernel mode. Affected default installations include Windows 10, Windows 11 21H2 through 26H1, and Windows Server 2019/2022/2025 builds below the vendor-patched build levels. No public exploit identified at time of analysis and CISA SSVC reports no exploitation; a vendor patch is available.
Local privilege escalation in the Windows Kernel allows a low-privileged, authenticated attacker who already holds code execution on a target host to trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM-level privileges. The vulnerability is strictly local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so it provides no remote or network path and is only useful as a post-compromise escalation step rather than an initial access vector. There is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with 'Automatable: no', because the attacker must already have a local foothold; Microsoft has published patched builds for the affected Windows 11 and Windows Server releases.
Local privilege escalation in Microsoft's Windows Client for NFS allows an authenticated low-privileged attacker who already has code execution on a host to elevate to higher privileges (assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8). Exploitation requires the optional 'Client for NFS' feature to be installed and reachable from the attacker's context, so default installations without that component are not affected, and there is no remote or network-facing attack path. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis; Microsoft has released fixes via its update guide (MSRC advisory for CVE-2026-70113), and the issue is tracked as CWE-190 integer overflow or wraparound.
Heap-based buffer overflow in the Microsoft Windows Storage Spaces driver (Spaceport.sys) allows an authenticated, low-privileged local user to execute code in kernel context and elevate privileges, carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already hold a session on the target host, so this is best treated as a post-compromise privilege-escalation step rather than a remote entry point, and no user interaction is required beyond the existing local session. Vendor-released patches exist for all affected Windows 10, Windows 11 and Windows Server builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none". Compared with network-facing, pre-authentication bugs this rates as a credible but not emergency-tier priority: patch it on a normal cycle, but prioritize systems where untrusted or low-privileged users can obtain local interactive sessions.
Local privilege escalation in the Microsoft Windows Storage Spaces driver (Spaceport.sys) lets an authenticated, low-privileged attacker who already has code execution on a host corrupt kernel memory and obtain SYSTEM-level rights. The defect is a use-after-free (CWE-416) that is locally reachable with low attack complexity and no user interaction, and it affects Windows 10, Windows 11 and Windows Server builds below the fixed versions enumerated in the vendor update. No public exploit code has been identified and CISA's SSVC decision data records no exploitation activity, so this is a genuine but second-tier patching priority relative to any actively exploited issue in the same release cycle.
Local privilege escalation in the Windows Rich Text Edit Control (the riched20/msftedit engine used by WordPad, Outlook, and many applications that render Rich Text Format content) lets an attacker who already holds authenticated low-privileged access on a Windows host trigger a heap-based buffer overflow and obtain higher-integrity code execution. Exploitation requires the attacker to invoke the control with attacker-controlled rich-text content (CVSS PR:L, UI:N), so it is a post-compromise escalation primitive rather than a remote or unauthenticated path; SSVC rates the technical impact as total but flags the issue as not automatable, meaning reliable mass exploitation is unlikely, and no public exploit was identified at time of analysis. Microsoft has published a vendor fix, so the residual risk is concentrated on unpatched Windows 10, Windows 11, and Windows Server builds where a low-privileged foothold already exists.
Integer underflow in the Windows Kerberos authentication component allows a locally authenticated attacker to elevate privileges on an affected host, giving full control over confidentiality, integrity, and availability of the machine. Exploitation requires a prior foothold: the attacker must already hold a valid low-privileged local account (PR:L, AV:L), and no user interaction is needed once that access exists; the flaw is not remotely reachable and SSVC rates it non-automatable, so it cannot be driven at mass or wormable scale. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but a vendor patch is available from Microsoft and should be applied to the extensive list of affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in Microsoft Windows OLE allows an authenticated attacker who already holds a low-privileged foothold on a host to corrupt heap memory through crafted OLE object handling and execute code at a higher integrity level, matching the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). Scope is limited to unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by EUVD; because the vector is local-only with PR:L, the flaw is not remotely reachable and cannot be triggered against a default configuration by an outside party. CISA SSVC rates exploitation as "none" and automatable as "no", there is no public exploit identified at time of analysis, and Microsoft has shipped fixes via its Update Guide, making this a credible but not emergency-level priority.
Local privilege escalation in Windows SmartScreen allows an attacker who already holds a low-privileged interactive session on a Windows host to corrupt memory through a type-confusion condition and elevate to a higher-integrity context, with full loss of confidentiality, integrity, and availability if successful. Exploitation is local only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8): there is no remote or network vector, and the attacker must first establish code execution on the target before triggering the flaw. Microsoft has released fixes, and CISA's SSVC review rates exploitation as none observed and not automatable, so this is best treated as a manual post-compromise escalation step rather than a mass-exploitation threat; no public exploit code or KEV listing is associated with the CVE at time of analysis.
A heap-based buffer overflow in the Windows Resilient File System (ReFS) driver (refs.sys) allows a locally authenticated, low-privileged attacker to corrupt kernel heap memory and elevate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already have a foothold on the host plus the ability to feed attacker-controlled input through the ReFS code path, which in practice means a ReFS-formatted volume must be present or mounted for the driver to process that input. Vendor patches are available per the Microsoft advisory, and no public exploit code has been identified at time of analysis (SSVC: Exploitation none, Automatable no); CISA's SSVC framing rates technical impact as total if successfully triggered, but the local-only, authenticated prerequisite and the non-default status of ReFS keep real-world urgency moderate.
Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an authenticated low-privileged user with an existing local foothold to corrupt heap memory in the host-side WSL components and cross a security boundary to gain elevated code execution, rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122). The attack is entirely local - there is no network vector - and it requires the optional WSL feature to already be installed and enabled on an affected Windows 10, Windows 11 or Windows Server build, which meaningfully limits the exposed population since WSL is not present by default. Microsoft has published a fix through the MSRC update guide and there is no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as none and automatable as no.
Local privilege escalation in Microsoft Windows Hyper-V lets an authenticated, low-privileged attacker who already has code execution on a host with the Hyper-V role enabled trigger a use-after-free in a Hyper-V component and gain SYSTEM-level code execution (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U with C:H/I:H/A:H). Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022, and 2025 including Server Core installations; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none with Automatable: no, so risk is concentrated on multi-tenant, shared, or virtualization hosts where untrusted low-privilege principals already run. Microsoft has released fixes through the standard Windows cumulative update channel (MSRC advisory CVE-2026-70023, mirrored in ENISA EUVD-2026-100338), and administrators of Hyper-V hosts should treat this as a priority local escalation patch rather than a remote emergency.
Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.
Local privilege escalation in Microsoft Windows NTFS (CVE-2026-70010) allows an authenticated, low-privileged user to corrupt kernel heap memory via crafted NTFS filesystem operations and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) in the in-kernel NTFS driver, rated CVSS 7.8 (HIGH) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attacker must already hold a local foothold on the host but needs no user interaction and faces low attack complexity. Exploitation is not remotely reachable over the network, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none'; patch availability is confirmed through the Microsoft MSRC update guide.
Local privilege escalation in the Windows IP Over USB Service (IpOverUsbSvc) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to overflow an integer value and consequently gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability. Affected builds span Windows 10 (21H2/22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2022/2025 according to the EUVD version ranges, although the vulnerable service ships with developer/SDK and device-debugging tooling rather than being enabled on default installations. Exploitation requires local access and the service to be installed and running, so the practical fleet at risk is developer and debugging workstations; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and a vendor patch is available.
Local code execution and information disclosure on patched-but-not-updated Windows hosts can result from an out-of-bounds read in the Windows Overlay Filter (WOF), a kernel-mode filesystem filter driver that services compressed and overlay file operations. Affected are Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 in both full and Server Core installations below the builds listed in the vendor update matrix. Exploitation requires a pre-existing local, authenticated foothold with at least low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) - remote, unauthenticated attack is not possible - and no public exploit code has been identified at time of analysis, with SSVC recording Exploitation=none and Automatable=no, placing this in the post-compromise privilege-escalation and information-leak class rather than a wormable emergency. A vendor patch is available and should be applied through the standard Microsoft monthly servicing channel.
Elevation of privilege in the Windows Overlay Filter (WOF) driver allows an attacker who already holds a low-privileged local foothold on a supported Windows host to run code at SYSTEM level by triggering an integer overflow/wraparound during a filter operation. Exploitation is local-only and requires authenticated code execution at low privilege (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) with no user interaction; CISA's SSVC assessment records Exploitation=none and Automatable=no, so there is no public exploit identified at time of analysis. Vendor patches exist for every affected SKU, which materially lowers residual risk for organizations that have applied current servicing updates.
Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.
Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.
Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.
Code execution in the Windows Overlay Filter (WOF) driver lets a locally authenticated attacker trigger an out-of-bounds memory read and, per Microsoft's severity rating, achieve code execution with high confidentiality, integrity and availability impact on unpatched machines. The flaw (CVE-2026-69942, CWE-126, CVSS 7.8 / AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing local foothold and low-privileged credentials, so it is a post-compromise privilege-escalation issue rather than an initial access vector, affecting Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core) below their fixed build levels. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit identified at time of analysis; Microsoft has released a fix, so exposure is confined to systems that have not yet installed the current cumulative update.
Local privilege escalation in the Windows Spaceport.sys Storage Spaces kernel driver allows an authenticated attacker who already has the ability to execute code as a low-privileged user on an affected host to gain full SYSTEM-level privileges. An integer overflow/wraparound in the driver's handling of size or index values lets a crafted request corrupt kernel memory, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All unpatched Windows 11 releases from 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) installations with the driver loaded at defaults are in scope, but exploitation is not automatable per SSVC, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Local privilege escalation in the Windows Kernel lets an attacker who already holds low-privileged authenticated code execution on a host trigger a heap-based buffer overflow (CWE-122) and obtain high confidentiality, integrity, and availability impact, effectively reaching SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms the flaw is not remotely reachable and requires no user interaction, making it a post-foothold escalation primitive on unpatched Windows 10, Windows 11, and Windows Server builds. No public exploit code identified at time of analysis, vendor-released patches are available, and the practical limiting factor for defenders is that an adversary must first obtain a local foothold on the target host.
Local privilege escalation in the Microsoft Windows Graphics Device Interface (GDI) allows an authenticated, low-privileged attacker who already holds a foothold on a host to trigger a buffer over-read (CWE-126) and turn that memory-safety defect into higher privileges, carrying a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every supported Windows client and server edition listed by the vendor is affected, including Server Core installations, but the vector requires the attacker to already have authenticated low-privileged local access (PR:L, AV:L), making this a post-compromise escalation flaw rather than a remotely reachable one, and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation:none and Automatable:no, and a vendor patch is available - collectively this is a credible but not emergency-level priority that should be handled in the normal monthly patch cycle.
Local privilege escalation in the winsqlite3 SQLite component bundled with Windows lets an authenticated low-privileged user on an affected host leverage an out-of-bounds read (CWE-125) to elevate to higher privileges, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because winsqlite3 is a default, always-present core Windows component, no special configuration is required, but the attack is strictly local - the attacker must already be able to execute code or interact with the SQLite library on the machine, so this is a post-compromise escalation rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Certificates component allows an authenticated attacker who already holds a low-privileged session on a Windows host to trigger an untrusted pointer dereference (CWE-822) and gain full control of that system, with high impact to confidentiality, integrity, and availability (CVSS 7.8). Exploitation is strictly local (AV:L), requires low privileges (PR:L) and no user interaction (UI:N), and does not change security scope (S:U), so it is a post-compromise escalation step rather than a remote entry point; default Windows installations carrying the affected component are exposed because no non-default configuration is indicated. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so it is not confirmed actively exploited; Microsoft's update guide is the authoritative remediation reference.
Local privilege elevation in the Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged account on the host to corrupt service memory and run code in a higher-integrity context, with high impact to confidentiality, integrity and availability. Exploitation is authenticated and local only - the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) confirms low privileges are required and that no user interaction or network vector is involved - so an unauthenticated remote attacker cannot reach the flaw. No public exploit has been identified at time of analysis (no CISA KEV listing and no POC reference in the supplied intelligence); Microsoft released a security update through its update guide, and patched version details are documented in the MSRC advisory rather than the NVD entry.
Local privilege escalation in the Windows Update component of default Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 installations lets an attacker who already holds low-privileged local access on a host corrupt heap memory and, per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector, obtain high confidentiality, integrity, and availability impact at a higher privilege context. Exploitation requires the attacker to already possess local, low-privileged authenticated access (PR:L, AV:L) and no user interaction (UI:N); the flaw cannot be reached remotely or by an unauthenticated actor, so it functions as a post-compromise privilege-escalation primitive rather than an initial-access vector. Vendor patches are available from Microsoft and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Windows Installer service allows an authenticated, low-privileged local user to elevate to full SYSTEM privileges on unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 hosts (CVSS 7.8, CWE-122). Exploitation requires the attacker to already hold valid local access and to invoke an MSI/msiexec installer operation that reaches the vulnerable heap-handling code path, so there is no remote or network-facing exposure; CISA SSVC records Exploitation as none and no public exploit was identified at time of analysis. Microsoft has released vendor patches, so residual risk is concentrated on systems still below the fixed build numbers listed in the Microsoft advisory.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an authenticated, low-privileged attacker who already has access to an affected Windows host to trigger a heap-based buffer overflow and elevate privileges. The vulnerability affects numerous unpatched Windows 10, Windows 11, and Windows Server builds and carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, CISA SSVC lists exploitation as none, and our independent assessment rates this as a credible second-tier priority because exploitation requires a pre-existing local foothold.