Mozilla Firefox releases prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5 contain incorrect boundary conditions in the JavaScript engine that let remote attackers corrupt or disclose memory when a user loads attacker-controlled web content. Because the weakness sits in script processing, no credentials or pre-existing privileges are needed - but exploitation is not unattended: the victim must actively browse to a malicious or compromised page with JavaScript enabled (the default), and the vendor rates availability impact as none, so the realistic outcome is memory disclosure/integrity corruption rather than a guaranteed crash or confirmed remote code execution. Publicly available exploit code has not been observed and there is no public exploit identified at time of analysis; CISA KEV does not list this CVE, and EPSS is only 0.16% (4th percentile), so this is a genuine patch-promptly issue rather than an emergency one.
Memory corruption in Mozilla Firefox's JavaScript engine can be triggered when a remote unauthenticated attacker convinces a user to load attacker-controlled JavaScript content, yielding high confidentiality and integrity impact with no availability impact. This is not a zero-click attack; exploitation requires user interaction (UI:R) to render a malicious page, so it depends on social engineering, malvertising, or a compromised site. Mozilla fixed the issue in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5; at time of analysis there is no public exploit identified, and EPSS is very low at 0.16% (4th percentile), indicating a genuine but not emergency-level risk.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Windows Error Reporting (WER) lets an authenticated attacker who already holds a low-privilege foothold - and who can induce a victim to interact with the vulnerable reporting path - corrupt heap memory and elevate privileges, with high impact to confidentiality, integrity and availability. The 8.0 score is driven by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, so this is explicitly not an unauthenticated, no-interaction remote takeover: a prior foothold (PR:L) and user action (UI:R) are both required. Microsoft has shipped fixed builds and CISA's SSVC assessment records Exploitation: none and Automatable: no, so no public exploit has been identified at time of analysis; this is a moderately serious but not top-tier emergency, and the practical risk is further dampened by the mandatory existing authentication and the required user interaction.
Out-of-bounds read in Microsoft Paint 11.x allows an unauthenticated attacker to execute arbitrary code on a target system when the victim opens a specially crafted image file in the vulnerable app. The attack is delivered over a network (e.g., via a downloaded or emailed image), but Paint exposes no network service, so the practical prerequisite is user interaction - opening the file - which, together with the high attack complexity required to turn a memory read into reliable code execution, makes this a moderate-to-high severity client-side issue rather than an urgent emergency. No public exploit has been identified at time of analysis (CISA SSVC reports Exploitation: none, and the flaw is not on CISA KEV), and Microsoft has released a patched version, Paint 11.2605.91.0, so remediation should focus on updating Paint on endpoints that routinely handle images from untrusted sources.
Path traversal in Skype for Business Server allows an authenticated attacker to elevate privileges over the network by exploiting absolute path traversal (CWE-36). Affected versions include Skype for Business Server 2019 CU8 below build 7.0.2046.583, Subscription Edition CU1 below build 7.0.2046.889, and 2015 CU13 below build 6.0.9319.886. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as 'none' with 'Automatable: no', though the required authentication limits real-world risk.
Authentication spoofing in Microsoft Active Directory Federation Services (AD FS) allows an unauthenticated remote attacker to impersonate or spoof identities through the federation service on affected, unpatched Windows builds, yielding high confidentiality, integrity, and availability impact (CVSS 8.1, AV:N/PR:N/UI:N, C:H/I:H/A:H). Only systems that run the AD FS role on Windows Server 2016, 2019, 2022, or 2025 (including Server Core installations) and the corresponding Windows 10 1607/1809 identity builds are exposed, and the service endpoint must be reachable over the network. The high attack-complexity rating and the CISA SSVC assessment (Exploitation: none, Automatable: no) indicate that reliable exploitation depends on specific, hard-to-control preconditions; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV).
Remote unauthenticated code execution in Microsoft Exchange Server is possible via a stack-based buffer overflow in affected builds of Exchange Server Subscription Edition RTM, Exchange Server 2019 CU14/CU15, and Exchange Server 2016 CU23, rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Attackers with network reachability to an unpatched Exchange deployment need no credentials and no user interaction, and the assessed impact is total (confidentiality, integrity, and availability all rated High). The high attack complexity component indicates that reliable exploitation depends on conditions outside the attacker's direct control, such as defeating stack protections or reaching a specific vulnerable code path, and CISA SSVC records Exploitation: none and Automatable: no; no public exploit identified at time of analysis, and Microsoft has released fixed builds.
Unauthenticated remote code execution affects the Remote Desktop Gateway service on Windows Server, where a use-after-free memory corruption flaw (CWE-416) can be triggered by a network attacker who can reach the service. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are needed, but exploitation is gated behind high attack complexity - the memory corruption likely requires winning a race condition or arranging a precise heap state, consistent with CISA's SSVC assessment of Exploitation: none and Automatable: no. Only servers with the optional RD Gateway role explicitly installed and internet- or network-reachable are exposed; there is no public exploit identified at time of analysis, and a vendor patch is available.
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Improper authentication in the CSIv2 inbound propagation handler of IBM WebSphere Application Server 8.5 and 9.0 lets remote, unauthenticated attackers bypass authentication and have forged identity data accepted into the server-side security context, with high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is not trivial - it requires network reachability to the CSIv2/IIOP inbound path and a deployment that actually relies on CSIv2 inbound identity propagation, which is what the AC:H metric reflects - and no public exploit identified at time of analysis. IBM has published a vendor fix, so this is best treated as a genuine high-priority issue rather than a drop-everything emergency, with prioritization going to internet- or partner-exposed CSIv2 listeners.
Path traversal in the NVIDIA AIStore for Linux dSort archive extraction component allows a remote attacker to write files outside the intended extraction directory by submitting a dSort job that references an archive (e.g., tar/zip) whose member names contain crafted traversal sequences, yielding arbitrary file creation or overwrite and potentially code execution, information disclosure, data tampering, and denial of service. The vulnerability carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) per the assessed vector, indicating remote reachability and no authentication requirement, but a high attack-complexity rating that reflects the difficulty of reliably crafting the malicious archive and triggering the flaw. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the practical gating factor is network access to the AIStore dSort/API endpoint, which in typical deployments is confined to a trusted ML/training cluster or private network rather than being internet-facing. Because the dSort job-submission path is the attack surface, exposure is primarily amplified where AIStore's API is reachable from untrusted networks, and no user interaction is required.
Unauthenticated path traversal in the target-side object rename handler of NVIDIA AIStore on Linux allows a remote attacker who can reach a target (storage) node directly to write files outside the intended storage directory by supplying a crafted rename destination, resulting in arbitrary file creation or overwrite. NVIDIA rates the issue CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-22), with downstream consequences that could include code execution, privilege escalation, information disclosure, data tampering, and denial of service depending on what the overwritten path controls. Exploitation is constrained rather than trivial: the attacker needs network reachability to a target node - not merely the front-end proxy - and must build a traversal payload the rename handler accepts, so exposure is greatest in flat cluster networks or environments where target ports are directly reachable; no public exploit code and no CISA KEV entry were identified at time of analysis.
Privilege escalation in the Windows Bluetooth A2DP audio-streaming driver allows an attacker who already holds low-privilege authorized access on a host - and who is within Bluetooth radio range - to induce an integer underflow in driver arithmetic and leverage the resulting memory-handling error to gain elevated rights, with high impact across confidentiality, integrity, and availability. The 8.0 High severity rating (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the CISA SSVC assessment of 'total' technical impact, and reflects two important constraints: the attack vector is adjacent-network only and the attacker must already have a foothold on the target, so this is not remote unauthenticated exploitation, and no user interaction is required. Microsoft has released updates through the MSRC update guide, CISA's SSVC exploitation value is 'none', and no public exploit code was identified at time of analysis. Unpatched Windows 10, Windows 11 (through 26H2), and Windows Server 2016 through 2025 builds are affected, but only hosts with Bluetooth enabled and within radio proximity of the attacker are exposed.
Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.
Privilege elevation in Microsoft SQL Server lets an attacker who already holds high-privilege credentials on the instance trigger a stack-based buffer overflow over a network connection and break out of their authorization boundary. Exploitation is constrained: the CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C) and the vendor description both indicate an authorized, highly privileged principal is required, and the AC:H rating means the overflow depends on specific server state, data, or timing rather than trivial input, so it is not reliably repeatable on a first attempt. All affected GDR and CU builds are pre-patch, Microsoft has published a fix via the MSRC update guide, and no public exploit or confirmed active exploitation was identified at time of analysis, so risk is real but conditional rather than a drop-everything emergency.
Security feature bypass in Visual Studio Code allows an unauthenticated local attacker to bypass a security control by convincing a victim to open crafted content, such as a malicious file, folder, or workspace. Exploitation requires local access and user interaction (AV:L/UI:R) with high attack complexity (AC:H), and no public exploit code has been identified at time of analysis. This is a moderate-priority issue rather than a drop-everything emergency, and the CVSS 7.0 score reflects that.
Local privilege escalation in Microsoft Office Click-To-Run arises from a use-after-free memory corruption flaw that lets an attacker who already holds low-privileged local access on a Windows host elevate to higher integrity, with high impact to confidentiality, integrity, and availability. Affected installations include Microsoft 365 Apps for Enterprise (16.0.1 branch), Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; the attack is local-only (AV:L), requires authenticated low-privileged code execution (PR:L), needs no user interaction (UI:N), and carries high attack complexity (AC:H) because of the heap-state/race conditions inherent to reliable use-after-free exploitation. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', so this is a moderate-to-high priority patching item rather than an emergency; a vendor patch is available.
A stack-based buffer overflow in the Microsoft Graphics Component, reachable through Microsoft Office for Android, lets an authenticated attacker who can place a crafted document or graphics object in front of a victim gain code execution in the context of the mobile app, with high impact to confidentiality, integrity, and availability. Only builds from 16.0.1 up to but not including 16.0.20430.20000 are affected, and exploitation requires user interaction - the victim must open or render the malicious file - which materially narrows the practical attack surface despite the 8.0 CVSS score. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; the vendor has published an update-guide entry, so affected organizations should treat this as a credible mid-to-high priority patching item rather than a top-tier emergency.
SQL injection in Microsoft Configuration Manager allows an authenticated low-privilege user who already holds a foothold on an adjacent network segment to inject arbitrary SQL against the site's data tier and elevate privileges, with the changed-scope vector (S:C) indicating impact can cross from the Configuration Manager component into the SQL Server and host it relies on. Exploitation is constrained rather than trivial: the assessed vector requires prior authorization (PR:L), adjacency instead of internet reachability (AV:A), and a high-complexity path (AC:H) with non-trivial timing, state, or configuration preconditions, and CISA's SSVC assessment records Exploitation 'none' and Automatable 'no'. Microsoft has released a fix and no public exploit code was identified at time of analysis, so the 'total' technical impact describes the damage available if the prerequisites are met, not an easily reached or actively exploited condition.
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead to privilege escalation and full compromise of confidentiality, integrity, and availability on the targeted client. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) requires user interaction and high attack complexity, and it indicates low privileges are needed even though the vendor description claims unauthenticated access-this authentication prerequisite is unverified. No public exploit identified at time of analysis.
Authorization bypass in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated, low-privileged user who can reach the cell's management/communication network impersonate an administrator across the entire cell. Because exploitation requires both valid credentials (CVSS PR:L, authenticated) and adjacent-network positioning (CVSS AV:A) rather than open-internet reach, this is a credible mid-to-high priority issue rather than an emergency, although a successful attack yields high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and a vendor patch is available per IBM's advisory.
Local privilege escalation in Windows Update enables an attacker who already holds a low-privileged local session to elevate to higher privileges by injecting special command elements into data processed by the Windows Update servicing component (CWE-77 command injection). This affects multiple Windows 11 releases (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025, including Server Core, up to the fixed builds enumerated in Microsoft’s advisory, with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing local foothold and valid low-privileged credentials, and no public exploit has been identified at time of analysis; vendor patches are available.
Information disclosure in Visual Studio Code stems from a path traversal flaw (CWE-22) that allows an attacker holding a low-privileged position and delivering crafted content to read files outside the intended workspace boundary once a victim opens that content. Versions from 1.0.0 up to but not including 1.141.1 are affected, and exploitation is not autonomous: the CVSS vector requires user interaction (UI:R) for the victim to open the malicious workspace, repository, or project folder, along with the privilege level indicated by PR:L, while impact is confined to confidentiality (C:H) with no integrity or availability effect. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis; at CVSS 6.8 this is a moderate-severity information-disclosure issue rather than a drop-everything emergency, and the vendor has published an update guide with patch availability.
Local privilege escalation in Windows Error Reporting allows an authenticated attacker holding a low-privileged account on the host to raise their privileges to SYSTEM-level by supplying crafted input containing argument delimiters to the reporting component (CWE-88 argument injection). Affected are unpatched Windows 10 (21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025 installations below the vendor's fixed build levels. Successful exploitation yields high confidentiality, integrity and availability impact, but the attack is strictly local with a prior-authentication prerequisite (AV:L, PR:L, UI:N, AC:L), so it functions as a post-compromise escalation step rather than an initial-access vector; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Assigned Access (kiosk mode) allows an authenticated, low-privileged local user to inject and execute code in a higher-integrity context, yielding full loss of confidentiality, integrity, and availability on the affected host (CVSS 3.1 base 7.8). Exploitation is constrained: the attacker must already hold authorized local logon (PR:L), the host must be one where an administrator has explicitly configured Assigned Access, and there is no network vector and no victim interaction (AV:L/UI:N). No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and Microsoft has shipped fixed builds, so this is a credible but not emergency-level priority.
Local privilege escalation affecting Microsoft Windows builds that ship the vulnerable Python component allows an authenticated, low-privileged local user to elevate to SYSTEM-level rights, resulting in full loss of confidentiality, integrity, and availability on the host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely exploitable and requires a pre-existing foothold or valid local account on an unpatched build, with no user interaction needed once that access exists; there is no public exploit identified at time of analysis and no CISA KEV entry, so exploitation is currently a post-compromise escalation concern rather than a remote mass-exploitation risk. Patches are available from Microsoft for all listed Windows 10, Windows 11, and Windows Server builds, and systems at or above the fixed build numbers (for example Windows 11 24H2 at 10.0.26100.9711 or Windows Server 2022 at 10.0.20348.5761) are not exposed.
Local privilege escalation in Windows Performance Monitor (CWE-94 code injection) lets an attacker who already holds authenticated low-privileged access to a Windows host run code in a higher-privileged context, yielding full confidentiality, integrity and availability impact on that machine at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected builds include Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through Server 2025 (Server Core variants included) below their respective fixed build numbers. The attack is local-only and requires no victim interaction, so it is a post-compromise escalation path rather than an initial-access vector; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, though CISA rates the technical impact as total. Vendor patches are available from Microsoft via the MSRC update guide.
Swann Communications SWIFI-SE2KIC cameras running firmware 2.0.22 and earlier expose their live video stream without any authentication check, allowing anyone who can reach the device over the local network to view the video feed using no credentials and no user interaction. The vulnerability is rated CVSS 4.0 base 5.9 by the originating CNA, while our independent assessment scores it CVSS 3.1 5.9 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact only and unaffected integrity or availability. Exploitation is constrained by the need for network adjacency to the camera (same LAN or Wi-Fi network); there is no default internet-facing vector, and no CISA KEV listing or public exploit code was identified at time of analysis, so this is a medium-severity information-disclosure issue whose risk is driven by access requirements rather than exploit difficulty.
Microsoft SharePoint Server Subscription Edition is affected by an observable-discrepancy weakness (CWE-203) that allows an authenticated, low-privileged user with network access to compare response content, timing, or error signals and use those differences to extract protected information and tamper with server-side data. Scope is limited to SharePoint Server Subscription Edition, and exploitation is not remote-unauthenticated: the attacker needs a valid account and must meet conditions outside their direct control (high attack complexity), so the issue is situational rather than mass-exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV not applicable; SSVC reports Exploitation: none, Automatable: no, Technical Impact: total), so the surrounding signals indicate limited real-world urgency for this moderate-severity issue.
Local code execution in Microsoft Graphics Component is enabled by a heap-based buffer overflow, triggered when a user opens or renders an attacker-supplied image or document; the attack vector is local (AV:L) and requires user interaction (UI:R), with no authentication required of the attacker (PR:N). Successful exploitation runs in the context of the user who opened the file, so a low-privilege victim limits immediate impact to that account unless chained with a separate privilege-escalation exploit. No public exploit identified at time of analysis, and the provided data does not indicate CISA KEV active exploitation; this is a genuine patch-priority issue despite not being the maximum-severity class.
Local privilege escalation in the Windows Update component allows an authenticated local user to elevate privileges on an affected, unpatched host by abusing improper link resolution before a privileged file access (CWE-59). All currently supported Windows 11 client branches are impacted - 23H2, 24H2, 25H2, 26H1 and 26H2 - along with Windows Server 2025, including the Server Core installation option. Exploitation requires the attacker to already hold a local account and the ability to place a symlink, hard link or junction in a path the Update service processes, with no user interaction and low attack complexity; no public exploit has been identified at time of analysis, and Microsoft has released fixes via its monthly update channel (MSRC advisory for CVE-2026-69673).
Heap-based buffer overflow in the Windows Event Tracing (ETW) subsystem allows a local attacker to achieve arbitrary code execution by supplying a crafted file or trace payload that a user then opens or processes. Affected builds span the modern Windows client and server families - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) indicating no privileges are required but that the victim must be tricked into processing the malicious content, giving the attacker the victim's own privileges at high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; this is a genuine but second-tier priority, addressed by vendor-released patches rather than emergency mitigation.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows a local attacker to elevate privileges on affected Windows hosts by supplying a crafted media file that the logged-in user opens, previews, or otherwise has parsed by the platform's media pipeline. Successful exploitation is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-122), yielding high confidentiality, integrity, and availability impact; because the vector is local with a user-interaction prerequisite, the attacker must first land the file on the target and induce the user to process it, which makes this a credible but interaction-gated escalation path rather than a network-facing exploit. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available, and fully updated builds (those at or above the version thresholds enumerated in the EUVD affected-version data) are not affected. Despite being an LPE rather than an RCE, the no-privilege prerequisite, low complexity, and full three-property impact keep this a legitimate prioritization candidate in environments where media files are routinely handled.
Elevation of privilege in the Windows Update servicing component allows an authenticated local attacker with low-level privileges to gain full SYSTEM-level control of the host by influencing a file name or path consumed by a privileged Update operation (CWE-73). The flaw is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is not remotely reachable and requires a pre-existing local foothold, but once that foothold exists the escalation is low-complexity, requires no user interaction, and yields high confidentiality, integrity, and availability impact. CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor patch is available. Affected systems include Windows 11 23H2, 24H2, 25H2, 26H1, and 26H2, plus Windows Server 2025 (including Server Core installations) running builds below the fixed thresholds.
Local privilege escalation in the Windows Update component allows an authenticated, low-privileged user who already holds a foothold on the host to gain SYSTEM-level code execution by planting a malicious DLL or executable in a directory consulted through an untrusted search path (CWE-426). Only specific pre-patch builds are affected: Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core installations). Per the available intelligence this is not known to be actively exploited (no CISA KEV listing, SSVC exploitation value 'none') and no public exploit code has been identified at time of analysis; the EPSS signal is not provided, and the prerequisite local account and writable search-path location confine this to post-compromise escalation rather than initial access, making it a genuine but second-tier priority.
Heap-based buffer overflow in Microsoft Word allows an unauthenticated attacker to execute arbitrary code in the context of the victim when the victim opens a crafted Word document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office LTSC/365 for Mac 2021/2024. Microsoft has released vendor patches; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. User interaction (opening the document) is the primary limiting factor, and code execution is confined to the user's security context (S:U).
A security-feature bypass in Microsoft Word allows an attacker-crafted document to subvert an Office security decision when the file is opened on the local machine, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. No privileges or authentication are required, but the attacker depends entirely on convincing the victim to open the malicious document, so delivery is social-engineering based rather than unattended. This is tracked as CWE-807 (reliance on untrusted inputs in a security decision) and EUVD-2026-100189; no public exploit identified at time of analysis, and Microsoft has published a fix (patch available per vendor advisory).
Code execution in Microsoft Word is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122) in the application's document parsing logic. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): exploitation is unauthenticated and needs no elevated privileges, but it is local in nature and requires the victim to open a malicious file, meaning an attacker must first succeed at social engineering - the SSVC assessment records Exploitation=none, Automatable=no, and there is no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) activity. Successful exploitation yields arbitrary code only in the security context of the user who opened the document, not inherently SYSTEM or administrator, so the practical risk is a workstation-level compromise rather than immediate full host takeover.
Local privilege escalation in the Microsoft PostScript Printer Driver allows a low-privileged user on an affected Windows host to gain elevated code execution by having attacker-controlled PostScript/print-driver data processed on the machine, with the root cause classified as a CWE-121 stack-based buffer overflow and a CVSS base score of 7.8. The vector (AV:L/AC:L/PR:N/UI:R) shows no privileges are required prior to exploitation (PR:N) but local presence is mandatory and the victim must be induced to trigger processing of the malicious data (UI:R); CISA's SSVC assessment records Exploitation=none and Automatable=no, and no public exploit code has been identified at time of analysis. This is a credible but context-dependent post-compromise escalation step rather than a mass-exploitation emergency, and a vendor patch is available.
A heap-based buffer overflow (CWE-122) in the Microsoft PostScript Printer Driver lets a local attacker who persuades a victim to process a crafted PostScript print job or document elevate privileges on affected Windows client and server releases. The flaw requires local access (AV:L) and user interaction (UI:R) but no prior privileges (PR:N), so it is a targeted rather than opportunistic local privilege-escalation vector; CISA SSVC rates it non-automatable with no observed exploitation, and no public exploit code has been identified at time of analysis. Vendor patches are available and, per the assessed impact (C:H/I:H/A:H), successful exploitation gives full code execution in the driver's higher-privileged context.
Local privilege escalation in the Microsoft PostScript Printer Driver allows an attacker who gets a victim to open or print a crafted PostScript payload to trigger a heap-based buffer overflow (CWE-122) and execute code in the context of the affected Windows printing component. The flaw affects a broad range of Windows client and server builds - including Windows 10/11 and Windows Server 2012 through 2025 - that have not been updated to their fixed build revision. Per the CVSS vector the attacker needs no pre-existing account (PR:N), but exploitation is local (AV:L) and requires user interaction (UI:R), a crafted document must be processed on the target, and no public exploit code or active exploitation was identified at time of analysis (CISA SSVC: Exploitation = none, Automatable = no).
Local privilege escalation in Microsoft Windows Search (CWE-59, link following) allows an authenticated low-privileged local user to elevate to a higher-integrity context by manipulating filesystem links that the Windows Search indexing component resolves before accessing a file, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a pre-existing local foothold and the ability to create symbolic links, junctions, or hard links in a location processed by the privileged Search service; no user interaction or network access is needed, and CISA SSVC rates it as not automatable, making this a post-compromise escalation step rather than an initial-access or wormable vector. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has released vendor updates, so affected systems should be patched on the normal monthly cadence rather than treated as an emergency.
Heap-based memory corruption in the Windows NetBIOS component lets an authenticated local attacker with only low-privileged code execution elevate to SYSTEM on unpatched hosts. Exploitation requires an existing foothold - a valid local account and the ability to run code on the target - so this is a post-compromise escalation primitive, not a remote or initial-access vector; no user interaction is required (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). Microsoft has released fixes and CISA's SSVC assessment rates exploitation as 'none' and the issue as non-automatable, so despite a total technical impact this rates as a genuine but not emergency-tier priority; no public exploit code was identified at time of analysis.
Local privilege escalation in the Windows Portable Device Enumerator Service (WPDBusEnum) allows an authenticated, low-privileged user on an affected Windows host to redirect a privileged file-system operation and elevate to a higher-integrity context, with high confidentiality, integrity and availability impact (CVSS 7.8, CWE-59 link following). Exploitation is strictly local (AV:L, PR:L, UI:N) and hinges on planting a symbolic link or junction so that a privileged file operation follows it - typically requiring a race to be won, which is why CISA's SSVC rates the issue non-automatable with exploitation observed as none. Microsoft has published a remediating update, and no public exploit identified at time of analysis; no confirmed actively exploited (CISA KEV) status is associated with this issue.
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) allows an authenticated, low-privileged attacker who already has code execution on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to SYSTEM-level privileges by planting a symbolic link, junction, or hardlink at a path the service later resolves during a privileged file operation. The issue is a classic link-following flaw (CWE-59) rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and no user interaction, and the affected service runs by default on all listed builds, so multi-user and shared hosts are the realistic exposure. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing); vendor patches are available, making this a credible operational priority but not an emergency.
Local privilege escalation in the Windows Update component affects Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) running builds prior to the vendor-patched levels. An attacker who already holds authenticated, low-privileged local code execution and can write a file into a directory that Windows Update searches ahead of its trusted location can plant a malicious binary that the service loads, yielding code execution at higher privilege with full impact to confidentiality, integrity and availability (CVSS 3.1: 7.8). The prerequisite local foothold and directory write access limit exposure, and no public exploit identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and the issue as non-automatable. Microsoft has released fixes in its update guide, so fully patched systems are not exploitable.
Local privilege escalation in the Microsoft Windows Search component lets an attacker who already holds low-privilege authenticated access to a Windows host escalate to SYSTEM-level privileges by abusing improper symbolic-link/junction resolution (CWE-59) during a file-access operation. Affected builds span the Windows 10, Windows 11, and Windows Server families (including Server Core installations), as catalogued by ENISA EUVD-2026-100240; the flaw is rated CVSS 7.8 with high confidentiality, integrity, and availability impact, and exploitation requires no user interaction. No public exploit has been identified at time of analysis, CISA SSVC reports exploitation as none and automatable as no, and Microsoft has released vendor patches, so risk is best characterized as a genuine but second-tier priority that is fully addressed by applying the fixed builds.
Link-following flaw in Windows Registry allows an authenticated local attacker with low-privileged code execution to elevate privileges by manipulating symbolic links, junctions, or Registry link objects that a higher-privileged Windows process resolves. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 (including Server Core) at builds below the fixed versions listed in the vendor advisory. No public exploit identified at time of analysis, and this is assessed as a credible but not emergency-level priority; vendor patches are available and should be applied.
Local privilege escalation in the Windows AI component shipped with Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a low-privileged local account to gain SYSTEM-level code execution by planting a malicious DLL in a directory the component searches ahead of a trusted location (DLL search-order hijacking). Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment concurs: exploitation needs a pre-existing authenticated local foothold plus the ability to write to the searched path, with no user interaction and low complexity, so purely remote or unauthenticated attackers cannot trigger it directly. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none' and automatable as 'no', though technical impact is assessed as total once the prerequisite local access is obtained; the vendor has released a patch, and hosts without the Windows AI feature or where untrusted users cannot obtain local accounts face materially lower exposure. This is a credible but not emergency-level priority.