Heap-based buffer overflow in the Windows HID class driver allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM by sending crafted HID input, with a CVSS 3.1 base score of 7.8. The flaw requires local access (PR:L) and cannot be triggered remotely, and no public exploit code or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft Security Response Center advisory.
Local privilege escalation in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows 11 and Windows Server systems. Exploitation requires local interaction with unionfs.sys and cannot be used for remote or initial compromise; the affected unpatched builds include Windows 11 23H2/24H2/25H2/26H2 and Windows Server 2022/2025. Vendor patches are available, no public exploit was identified at time of analysis, and this is a credible but second-tier priority for most environments.
Local privilege escalation in the Windows Geotag Broker component of Microsoft Windows lets an authenticated low-privileged user already running code on a host elevate to a higher-integrity context, with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating high impact to confidentiality, integrity and availability and no user interaction required. Affected systems are unpatched Windows 10, Windows 11 and Windows Server builds below the fixed build numbers published by the vendor, including Server Core installations; exploitation requires local interactive or code-execution access (PR:L, AV:L), so risk is concentrated on multi-user hosts such as RDP/terminal servers, shared workstations and systems where untrusted users can run code. There is no public exploit identified at time of analysis and no CISA KEV listing, and Microsoft has released a vendor patch - this is a patch-priority issue rather than a remotely exploitable emergency.
Local privilege escalation in Windows Kernel-Mode Drivers lets an attacker who already holds low-privileged, authenticated access to a Windows host (CVSS PR:L, AV:L) exploit improper access control (CWE-862) to gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact. Affected builds span Windows 11 24H2, 25H2, 26H1 and 26H2 plus Windows Server 2025 (including Server Core installations); no user interaction is required, but there is no remote or network attack path, so the flaw is a post-compromise escalation primitive rather than an initial access vector. There is no public exploit identified at time of analysis and CISA's SSVC evaluation records exploitation as 'none' with automatable 'no', though technical impact is rated total; EPSS and KEV data were not provided, and a vendor patch is available per Microsoft's advisory.
Local privilege escalation in Microsoft Windows Server Update Service (WSUS) allows an authenticated attacker who already holds a low-privileged foothold on a WSUS-enabled host to escalate to higher privileges, with total impact to confidentiality, integrity, and availability (CVSS 7.8, C:H/I:H/A:H). Only servers with the WSUS role installed are exposed, and only builds below the vendor-supplied fixed levels are affected (e.g., Server 2025 < 10.0.26100.33650, Server 2022 < 10.0.20348.5761, Server 2019 < 10.0.17763.9376, Server 2016 < 10.0.14393.9612, Server 2012 R2 < 6.3.9600.23470, Server 2012 < 6.2.9200.26434, plus Windows 10 1607/1809). There is no remote or unauthenticated path (AV:L/PR:L/UI:N), no public exploit identified at time of analysis per CISA SSVC (Exploitation: none) and no KEV listing; Microsoft has released patches.
Local privilege escalation in the Windows Server Update Service (WSUS) lets an authenticated low-privileged user on a WSUS-enabled host gain elevated privileges, rooted in CWE-1220 (insufficient granularity of access control) and rated 7.8 under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the WSUS role or component to be present on the target and the attacker to already hold local low-privileged access; no user interaction or unusual complexity is needed, but an unauthenticated or purely remote attacker cannot trigger it from this vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with non-automatable characteristics, and vendor patches are available from Microsoft for all affected builds.
Windows Credential Guard does not enforce authentication on a critical function, letting a local, already-authenticated low-privileged user on an affected Windows host perform spoofing (CVSS 7.8, CWE-306). Exploitation is strictly local and requires prior account access to the machine, so exposure is concentrated on multi-user, shared, or already-compromised endpoints running Credential Guard rather than internet-facing systems; the specific function or configuration state involved is not described in the available sources. Microsoft has released fixed builds for Windows 10, Windows 11 and Windows Server, and no public exploit or CISA KEV entry is associated with the CVE at time of analysis; EPSS is 0.30% (22nd percentile), consistent with a moderate, this-week priority rather than emergency response.
Local privilege escalation in the Windows Audio Service lets an authenticated low-privilege user on affected Windows 11 builds (24H2, 25H2, 26H1, 26H2) have attacker-controlled content accepted as trusted, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. Exploitation is local-only and requires an existing foothold (PR:L) with no user interaction (UI:N) and low complexity (AC:L), so escalation is reliable once the attacker is on the host, though limiting factors are the mandatory authenticated local access and the fact that patched builds are not exploitable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
Improper access control in the WebDAV component of Microsoft Windows lets a locally authenticated low-privilege user elevate privileges to full system integrity, giving complete compromise of confidentiality, integrity, and availability on the affected host. Exploitation is strictly local (AV:L) with a valid low-privileged account and no user interaction (PR:L, UI:N); there is no remote or network vector, and the attacker must already hold a foothold on the machine, which caps real-world risk. Microsoft has released a vendor patch, no public exploit code has been identified, and CISA's SSVC assessment records exploitation as "none" and automatable as "no", so this is a genuine but not emergency-level priority. Affected builds are all Windows client and server releases below the fixed build numbers catalogued in EUVD-2026-100091, and hosts that have the WebClient/WebDAV service disabled have a materially reduced attack surface.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authenticated attacker who already holds low-privileged code execution on the host to elevate to a higher-integrity context, with total impact to confidentiality, integrity and availability. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms the flaw is only reachable from a local session by a low-privileged principal, requires no user interaction, and needs no non-default feature to be enabled, so every unpatched build of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 23H2 and Windows Server 2012 through 2025 is exposed once an attacker has a foothold; there is no remote or network-reachable path. CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis; Microsoft has published a fix, making this a credible but not emergency-tier patching priority whose practical abuse case is post-access escalation on already-breached or multi-user hosts.
Local privilege escalation in the Windows Device Install Service lets an authenticated attacker holding only low-level privileges on a host raise their rights to a higher integrity level (CVSS 3.1 base 7.8 High, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is an incorrect authorization check (CWE-863) in a service that normally runs with high privileges, so any standard user who can already execute code - or plug in or trigger a device installation - on an unpatched Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 system is a potential victim; default configurations are affected and no user interaction is needed. Microsoft has published a fix, and there is no public exploit identified at time of analysis and no CISA KEV listing or SSVC exploitation signal, though the SSVC technical impact rating is "total" because successful exploitation yields high confidentiality, integrity, and availability impact within the same security scope.
Local privilege escalation in the Windows Virtual Input component allows an authenticated, low-privileged attacker to gain elevated rights on affected Windows 10, Windows 11 and Windows Server hosts. Exploitation requires an attacker to already hold a local interactive foothold on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and to trigger an improper authorization check in the component (CWE-283, Unverified Ownership); no victim interaction is required and attack complexity is low, so escalation is straightforward once local access exists. A vendor patch is available from Microsoft, no public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with the flaw judged not automatable, indicating it is not suitable for mass, scalable attacks.
Local privilege escalation in Microsoft Windows Modern Device Management (MDM) stems from a critical function that performs no authorization check (CWE-306), letting an attacker who already holds a low-privilege authenticated local account on the host elevate to higher privileges, including SYSTEM. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 (including Server Core) below their respective fixed builds. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confines this to post-compromise escalation - there is no remote network attack path and no user interaction required - and no public exploit code was identified at time of analysis, with CISA SSVC recording exploitation as 'none' and automatable as 'no'.
Local privilege escalation in Windows Group Policy allows an authenticated, low-privileged attacker who already has interactive or code-execution access on a Windows host to elevate privileges to a higher-integrity context. The flaw is an access-control weakness (CWE-862) in how a privileged Group Policy operation is authorized, requiring no user interaction (UI:N) and low attack complexity (AC:L) once a foothold exists, which makes it most impactful on shared multi-user systems such as terminal/RDS servers, VDI hosts, and domain-joined endpoints where untrusted users hold accounts. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is credited as the reporting vendor.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Local privilege escalation in the Windows User Profile Service (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) lets an attacker who already holds valid low-privileged local access redirect privileged file operations through attacker-created symbolic links, junctions, or hardlinks, yielding high-integrity file writes that can be leveraged for SYSTEM-level code execution. Affected are all currently supported Windows client and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations - and default configurations are vulnerable with no special feature needing to be enabled. Vendor-released patches are available from Microsoft; no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so priority should track routine monthly patching rather than emergency response.
Local privilege escalation in the Windows Direct Composition (dcomp) compositor lets a low-privileged, already-authenticated local attacker drive a use-after-free (CWE-416) and gain high-integrity code execution (C:H/I:H) on affected Windows 10, Windows 11 and Windows Server builds. Exploitation is post-foothold only: the CVSS vector (AV:L, PR:L, UI:N) requires the attacker to already hold local code execution, so this is not a remotely reachable entry point and no user interaction is needed once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is a patch-now local escalation rather than a drop-everything emergency; fully patched systems at or above the fixed builds are unaffected.
Heap-based buffer overflow in Microsoft Windows Hyper-V allows a locally positioned, authenticated attacker to execute code that crosses the hypervisor isolation boundary, escaping from a guest virtual machine into the host (parent) partition. Exploitation requires the attacker to already have low-privileged code execution inside a guest VM on the affected host, and the high attack complexity rating indicates an additional hurdle such as a race window or a precise heap layout, so a successful overflow is not deterministic. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and no automatable path, though a vendor patch is available and the technical impact of a successful escape is total. Only unpatched builds below the fixed thresholds (for example Windows Server 2025 below 10.0.26100.33650 and Windows 11 24H2 below 10.0.26100.9711) are affected.
Local privilege escalation in Microsoft Windows Media Foundation allows an attacker who already holds a low-privileged, authenticated local account to drive the media decoding pipeline into a heap-based buffer overflow and corrupt memory in a higher-privileged context. The issue is rated 7.8 (AV:L/AC:H/PR:L/UI:N, scope unchanged in our independent assessment) and per that vector is neither remote nor unauthenticated, and needs no victim interaction - the practical barriers are the local-access prerequisite and the high attack complexity of controlling the heap layout. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this is a genuine patch-priority item rather than an emergency; vendor patches are available per Microsoft's update guide.
Local privilege escalation in Windows Desktop Window Manager allows a low-privileged attacker who already has code execution on a host to corrupt DWM's heap and escalate to a higher-integrity, SYSTEM-level context. Microsoft rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing local foothold under a valid account (PR:L) attained through local interaction with DWM (AV:L), with no victim user interaction (UI:N) and low attack complexity, making it a straightforward post-compromise escalation step rather than a remotely reachable flaw. Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26Hx) and Windows Server 2019/2022/2025 builds below the fixed versions are affected; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are available. This is a credible operational priority but not a mass-exploitation emergency.
Local privilege escalation in the Windows Graphics Kernel allows an attacker who already holds low-privileged code execution on a target host to elevate to SYSTEM through a use-after-free (CWE-416) memory corruption flaw in the kernel-mode graphics subsystem. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is authenticated in the sense that the attacker must already have a local foothold; no user interaction is required and there is no remote or network vector, so this is a post-compromise escalation primitive rather than an initial access path. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2025 (including Server Core installations); no public exploit code has been identified at time of analysis, EPSS is low at 0.27% (17th percentile), CISA SSVC records no known exploitation, and a vendor patch is available.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
A use-after-free in the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService) lets an attacker who already holds a low-privileged local session elevate privileges on the affected host, with high impact to confidentiality, integrity and availability. Microsoft scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the affected service ships enabled by default across the listed Windows 10, Windows 11 and Windows Server 2019 build ranges, so exposure depends almost entirely on whether untrusted users can obtain interactive or code-execution access to the machine. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a credible but not emergency-tier patch priority rather than an actively exploited emergency; the limiting factor is the local attack vector, since there is no network-reachable exploitation path.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds a foothold on a Windows host to escalate to SYSTEM-level privileges by triggering a heap-based buffer overflow (CWE-122). The flaw carries a CVSS 3.1 base score of 7.8 on a strictly local vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no victim interaction and no network path are required, but the attacker must already be able to run code or hold a valid session on the target. Microsoft has published fixed builds covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and no public exploit has been identified at time of analysis (SSVC exploitation: none, Automatable: no); this is a credible moderate-priority privilege-escalation issue rather than a remote-exploitation emergency.
Local privilege escalation in the Windows Kernel (CWE-190 integer overflow or wraparound) lets an attacker who already holds a low-privileged authenticated session on a target host elevate to kernel-level code execution, with high impact to confidentiality, integrity, and availability. Exploitation is local-only and unauthenticated remote paths do not exist: the CVSS vector (AV:L/PR:L/UI:N) confirms a valid low-privileged local account is required and no user interaction is needed once that foothold exists, so this is an escalation primitive that must be chained behind a separate initial-access or credential-compromise step. All unpatched supported Windows 10, Windows 11 (including 23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 builds listed in the EUVD data are affected; there is no public exploit identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and a vendor patch is available. This is a credible mid-to-high priority patch item, not an alarmist one.
Local privilege escalation in Microsoft Windows Direct Composition lets an attacker who already holds a low-privileged, authenticated foothold on the host trigger a use-after-free (CWE-416) and execute code at a higher integrity level, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because exploitation requires local, authenticated access with low privileges and cannot be reached remotely or by an unauthenticated attacker, realistic risk is concentrated in post-compromise, local-malware, and malicious-insider scenarios; CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis. Vendor-released patches exist for every affected Windows client and server branch, so exposure is primarily a patch-latency problem rather than an emergency remote threat.
Local privilege escalation in the Windows Win32 kernel subsystem lets an authenticated attacker who already has a low-privileged foothold on a Windows host elevate to SYSTEM-level privileges. Exploitation requires existing local code execution (CVSS AV:L/PR:L) but needs no user interaction and is low-complexity, so the flaw is best understood as a post-access escalation step rather than a remotely reachable bug; Windows 11 24H2 below build 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807 and the other enumerated SKUs are affected. Intelligence does not indicate active exploitation (CISA SSVC Exploitation: none) and no public exploit code has been identified at time of analysis, though CISA's SSVC assessment rates technical impact as total and the flaw is rated High (7.8) for confidentiality, integrity and availability.
Local privilege escalation in Windows Storage Spaces allows an authenticated standard user to trigger a heap-based buffer overflow in the Storage Spaces Controller and gain elevated code execution on affected Windows 10, Windows 11, and Windows Server hosts. The flaw is not remotely reachable and requires prior local access (CVSS AV:L/PR:L), so it is most relevant as a post-compromise escalation step; EPSS is 0.26% and no public exploit has been identified at time of analysis. Microsoft has released updates for the affected Windows builds.
Arbitrary code execution in Adobe FrameMaker is possible via a heap-based buffer overflow (CWE-122) that is triggered when the victim opens a specially crafted file. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (score 7.8) indicates the flaw is local to the desktop application, requires user interaction, needs no prior authentication, and gives the attacker only the privileges of the user who opens the document. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the main risk is social engineering against FrameMaker users.
Heap-based buffer overflow in Adobe FrameMaker (CWE-122) lets an attacker achieve arbitrary code execution in the context of the user who opens a crafted FrameMaker document. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no prior authentication or privileges are needed, but exploitation depends on the victim opening an attacker-supplied file, and code runs only with that user's rights due to unchanged scope. Impact is therefore bounded by the victim's privilege level and by successful social engineering; there is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited.
Heap-based buffer overflow in the Microsoft Internet Messaging API (IMAPI, delivered by the inetcomm component) allows an attacker who already holds a low-privileged authenticated session on a Windows host to run arbitrary code in the context of the vulnerable component. The scored vector is strictly local (AV:L, PR:L, UI:N, S:U), so a prior foothold or valid credentials on the machine are a hard prerequisite and no user interaction is required once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is already available, making this a credible but not emergency-tier patching priority.
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on the host to elevate to SYSTEM-level privileges by winning a timing-sensitive use-after-free in kernel memory. The flaw affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025 builds below their respective patched build numbers; there is no remote or network path and no user interaction is required, but exploitation demands an existing local foothold and an account (PR:L) plus a non-trivial race condition (AC:H), so success is not guaranteed. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the SSVC assessment records exploitation as 'none'; the CISA SSVC technical impact is rated 'total', and vendor patches are available.
A local privilege escalation vulnerability in the Windows Storage VSP (Virtual Storage Provider) driver allows a low-privileged, authenticated attacker with existing code execution on a Windows host to elevate to SYSTEM-level privileges by triggering a use-after-free race condition in the driver. The flaw affects a broad range of Windows client and server platforms, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2016 through Windows Server 2025, and carries a CVSS 3.1 score of 7.8. Exploitation is difficult because it depends on winning a race condition (AC:H) and the CISA SSVC assessment rates it as not automatable with no known exploitation, so no public exploit code or active in-the-wild abuse has been identified at time of analysis.
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.
Arbitrary code execution in Adobe Substance 3D Sampler 6.0.3 and earlier is possible because a stack-based buffer overflow (CWE-121) is triggered when the application parses a specially crafted file, with any code executed inheriting the privileges of the current user. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) shows no privileges are required, but the attack is not network-reachable: the attacker must first deliver the malicious file and rely on the victim opening it in the application. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuinely moderate-risk desktop issue rather than a top-priority emergency, though the high confidentiality, integrity, and availability impact on the user's session justifies prompt patching.
Local privilege escalation in the Windows Mobile Broadband (WWAN) component on Windows 11 allows an authenticated, low-privileged attacker to gain elevated privileges. The flaw is caused by incorrect permission assignment (CWE-732) on a critical resource, affecting default installations of Windows 11 24H2, 25H2, 26H1, and 26H2 below their respective patched revisions. No public exploit identified at time of analysis; exploitation requires local access and a low-privileged session, making it a post-compromise escalation vector.
Local code execution in the Windows Universal Disk Format File System Driver (UDFS) affects all supported Windows 10, Windows 11, and Windows Server editions when the driver parses a malformed UDF volume. Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so a crafted or corrupted UDF-formatted optical disc or UDF/ISO image file must be mounted or read on the target host before the flaw can be reached; a successful trigger provides full confidentiality, integrity, and availability impact within the kernel context. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, and our independent assessment rates this as a credible but not emergency-tier priority given the mandatory local foothold and physical/media-adjacent delivery path.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in Microsoft Windows DWM Core Library allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows hosts by triggering an out-of-bounds read (CWE-125) in the desktop compositor. The flaw is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and affects a broad set of Windows 10, Windows 11, and Windows Server builds, including Server Core; no user interaction is required. Microsoft has released a vendor patch, and no public exploit was identified at time of analysis, so patching and reducing untrusted local code execution are the primary risk-reduction steps.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated local user who already has low-privileged code execution on a Windows host to elevate their privileges (CVSS 7.8 HIGH, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-125 out-of-bounds read). Affected are unpatched Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H2) and Windows Server 2019/2022/2025 installations, including Server Core builds, since the DWM Core Library is present and active by default on every supported installation. Exploitation status: no public exploit identified at time of analysis, CISA SSVC rates Exploitation as none and Automatable as no, and the attack is per-host, requires prior local code execution, and is not remote or network-facing; a vendor patch is available and hosts updated to the fixed builds are not affected.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library lets an attacker who already holds low-privileged, authenticated code execution on a Windows host trigger an out-of-bounds read inside a higher-integrity compositing component, and the resulting memory-safety failure can be leveraged to execute code in the DWM security context and escape the attacker's original privilege level. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction and no non-default configuration, and affects every supported Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025 build, including Server Core installations. Vendor-released patch builds are available via the Microsoft Security Response Center update guide; no public exploit code has been identified at time of analysis and CISA's SSVC evaluation records exploitation as none, so this is a post-compromise escalation primitive rather than an initial-access or remote vector.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvr) lets an attacker who already holds low-privilege code execution on a Windows 10 or Windows 11 host corrupt memory and elevate to a higher-integrity context. The defect is a use-after-free (CWE-416) triggered through the per-user DVR/broadcast service, and it carries a CVSS 3.1 base of 7.8 under the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction and unchanged scope but high confidentiality, integrity, and availability impact once the service context is abused. This is a purely local escalation primitive, not a remote entry point: no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no', though technical impact is rated 'total'.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege escalation in the Microsoft Windows Fax and Scan Service lets an authenticated low-privileged user on the host trigger a heap-based buffer overflow (CWE-122) and gain code execution at a higher integrity level, including SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a local foothold and valid credentials but needs no user interaction and faces low attack complexity; hosts where the Fax and Scan Service is disabled, removed, or unreachable by standard users are not exposed. Per CISA SSVC the exploitation status is "none" and the issue is not automatable, and no public exploit code has been identified at time of analysis - this is a credible but second-tier patch-priority item rather than an active emergency.
Privilege escalation in the Windows Storage Spaces Controller allows an authenticated attacker with existing low-privileged local code execution to corrupt kernel heap memory and elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a heap-based buffer overflow (CWE-122) reachable locally with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it functions as a post-compromise escalation primitive rather than a remote entry point; prior local access and valid credentials are required. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released fixed builds across all affected branches.