Local privilege escalation in the Microsoft Windows Graphics Device Interface (GDI) allows an authenticated, low-privileged attacker who already holds a foothold on a host to trigger a buffer over-read (CWE-126) and turn that memory-safety defect into higher privileges, carrying a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every supported Windows client and server edition listed by the vendor is affected, including Server Core installations, but the vector requires the attacker to already have authenticated low-privileged local access (PR:L, AV:L), making this a post-compromise escalation flaw rather than a remotely reachable one, and no user interaction is needed (UI:N). No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation:none and Automatable:no, and a vendor patch is available - collectively this is a credible but not emergency-level priority that should be handled in the normal monthly patch cycle.
Local privilege escalation in the winsqlite3 SQLite component bundled with Windows lets an authenticated low-privileged user on an affected host leverage an out-of-bounds read (CWE-125) to elevate to higher privileges, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because winsqlite3 is a default, always-present core Windows component, no special configuration is required, but the attack is strictly local - the attacker must already be able to execute code or interact with the SQLite library on the machine, so this is a post-compromise escalation rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Certificates component allows an authenticated attacker who already holds a low-privileged session on a Windows host to trigger an untrusted pointer dereference (CWE-822) and gain full control of that system, with high impact to confidentiality, integrity, and availability (CVSS 7.8). Exploitation is strictly local (AV:L), requires low privileges (PR:L) and no user interaction (UI:N), and does not change security scope (S:U), so it is a post-compromise escalation step rather than a remote entry point; default Windows installations carrying the affected component are exposed because no non-default configuration is indicated. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so it is not confirmed actively exploited; Microsoft's update guide is the authoritative remediation reference.
Local privilege elevation in the Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged account on the host to corrupt service memory and run code in a higher-integrity context, with high impact to confidentiality, integrity and availability. Exploitation is authenticated and local only - the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) confirms low privileges are required and that no user interaction or network vector is involved - so an unauthenticated remote attacker cannot reach the flaw. No public exploit has been identified at time of analysis (no CISA KEV listing and no POC reference in the supplied intelligence); Microsoft released a security update through its update guide, and patched version details are documented in the MSRC advisory rather than the NVD entry.
Local privilege escalation in the Windows Update component of default Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 installations lets an attacker who already holds low-privileged local access on a host corrupt heap memory and, per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector, obtain high confidentiality, integrity, and availability impact at a higher privilege context. Exploitation requires the attacker to already possess local, low-privileged authenticated access (PR:L, AV:L) and no user interaction (UI:N); the flaw cannot be reached remotely or by an unauthenticated actor, so it functions as a post-compromise privilege-escalation primitive rather than an initial-access vector. Vendor patches are available from Microsoft and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Windows Installer service allows an authenticated, low-privileged local user to elevate to full SYSTEM privileges on unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 hosts (CVSS 7.8, CWE-122). Exploitation requires the attacker to already hold valid local access and to invoke an MSI/msiexec installer operation that reaches the vulnerable heap-handling code path, so there is no remote or network-facing exposure; CISA SSVC records Exploitation as none and no public exploit was identified at time of analysis. Microsoft has released vendor patches, so residual risk is concentrated on systems still below the fixed build numbers listed in the Microsoft advisory.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an authenticated, low-privileged attacker who already has access to an affected Windows host to trigger a heap-based buffer overflow and elevate privileges. The vulnerability affects numerous unpatched Windows 10, Windows 11, and Windows Server builds and carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, CISA SSVC lists exploitation as none, and our independent assessment rates this as a credible second-tier priority because exploitation requires a pre-existing local foothold.
Local privilege escalation in Microsoft Windows kernel32.dll lets an authenticated attacker with standard user rights trigger a heap-based buffer overflow (CWE-122) and gain code execution at SYSTEM level. Scoring 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires an existing foothold on the host but no user interaction, making it a dependable post-compromise escalation primitive rather than a remote entry point; no special non-default feature must be enabled since the flaw sits in a core DLL present on every affected build. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds for all affected Windows 10, Windows 11, and Windows Server versions tracked under EUVD-2026-99269.
Local privilege escalation in the Windows Perception Simulation Service allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). The flaw is not remotely reachable: the attacker must first establish a foothold on the machine and be able to interact with the service so that the vulnerable memory is freed and then reused under attacker control. Exploitation reliability depends on winning the memory-reclamation race, and the Perception Simulation Service (a Windows Holographic / mixed-reality component) must be present and active in the target configuration for the vulnerable code path to be exercised. Affected builds span Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H2, and Windows Server 2019, and a vendor fix is available; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis.
Local security feature bypass in Windows UEFI (CVE-2026-49785) allows an authenticated attacker who already holds a low-privileged account on the host to defeat a boot/UEFI-related security feature, with the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) reflecting high confidentiality, integrity and availability impact once that local foothold exists. Exploitation is not remote and requires no user interaction, but it does require pre-existing local access and an account on the system; there is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as "none" with automation as "no", so this is a moderate-priority local hardening issue rather than an emergency. A vendor patch is available from Microsoft via the MSRC Security Update Guide, and the affected build ranges span most supported Windows client and server releases, including Server 2012 through Server 2025.
A heap-based buffer overflow in the Windows Kernel lets a local attacker who already holds low privileges on a host escalate to higher integrity - potentially SYSTEM - with no user interaction required. Every unpatched build across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 is affected by default, since the flaw sits in the kernel itself rather than an optional feature. There is no public exploit identified at time of analysis and no indication of active exploitation (CISA SSVC exploitation: none), and EPSS is low at 0.33% (25th percentile), but a successful trigger yields full confidentiality, integrity and availability impact, so Microsoft's fix should be scheduled in this week's patch cycle.
Local privilege escalation in the Windows 11 Virtualization-Based Security (VBS) Enclave allows an attacker who already holds low-privileged, authorized code execution on a host to trigger an integer overflow (CWE-190) and gain full control over confidentiality, integrity, and availability of that machine. Only unpatched Windows 11 builds 23H2, 24H2, 25H2, 26H1, and 26H2 with VBS enabled are affected; the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms a local-only, post-compromise escalation with no user interaction and no remote exposure. Vendor-released patches are available from Microsoft, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an attacker who already holds authenticated, low-privilege code execution on a host to corrupt heap memory inside a highly privileged VBS component and elevate to full machine control (CVSS 7.8, C:H/I:H/A:H). Only unpatched Windows 11 24H2/25H2/26H1/26H2 builds and Windows Server 2025 (including Server Core) below the vendor's fixed build numbers are affected, and exploitation requires local access (AV:L) with low privileges (PR:L) and no user interaction (UI:N). No public exploit code has been identified at time of analysis and CISA SSVC records no known exploitation, making this a credible but not emergency-tier priority; Microsoft has released patched builds, so remediation is straightforward for managed fleets.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthenticated attacker to execute arbitrary code locally when a user opens a specially crafted workbook. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 before version 16.0.14334.20974, and Microsoft Office LTSC 2024 before version 16.0.17932.21056. Exploitation requires user interaction (UI:R) to open the malicious file; no public exploit identified at time of analysis, and the issue is considered a credible patch-priority item rather than an emergency. Code execution occurs in the context of the user opening the file, so a low-privilege user context limits downstream impact.
Opening a specially crafted document in an affected Microsoft Word build triggers a heap-based buffer overflow that lets an attacker execute code in the context of the user who opened the file. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, and Microsoft 365 Apps for Enterprise installations older than the current fixed release. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attack requires the victim to open the malicious file, but no attacker credentials or prior privileges are needed; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Local privilege escalation in the Windows Error Reporting (WER) component of supported Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-level authenticated local access to elevate to a more privileged context on the same host. The flaw is a weak-authentication defect (CWE-1390) in WER that is locally exploitable with low complexity, no user interaction, and no special preconditions beyond an existing foothold, which is what drives the 7.8 base score. Microsoft has published a fix through its regular update channel (MSRC update guide), and at time of analysis there is no public exploit identified and CISA SSVC records exploitation as none, so this is a patch-now hardening item rather than an urgent emergency-mitigation case.
Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.
Local privilege escalation in Windows SmartScreen allows an authenticated attacker holding only standard-user rights to trigger a use-after-free in the reputation-checking component and escalate to a high-integrity context on an unpatched host. The flaw is rated CVSS 7.8 (HIGH) with full confidentiality, integrity, and availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is exploitable locally without user interaction but requires an existing low-privileged session, so it functions as a post-compromise escalation step rather than a remote initial-access vector. Affected builds span Windows 11 23H2 through 26H2 and Windows Server 2025; Microsoft has published vendor patches that raise the OS build above the vulnerable thresholds, and no public exploit code was identified at time of analysis.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Local privilege escalation in the Windows Graphics Component lets an attacker who already holds low-privileged, authenticated code execution on a target machine read out-of-bounds memory in a higher-privileged graphics context and convert that foothold into full SYSTEM-level compromise (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H). Every supported Windows build below its patched revision is affected, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025; there is no remote or network-reachable path, so the prerequisite local foothold is the primary limiting factor. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as 'none' with a non-automatable attack, and no vendor patch version gap remains because Microsoft has shipped fixes - making this a moderate-urgency, patch-and-move-on item rather than an emergency one.
Local privilege escalation in the HID Parser Library shipped with Windows lets an attacker who already holds authenticated low-privilege access corrupt heap memory and run code at a higher integrity level through a malformed HID descriptor processed by the default-enabled HID stack. Assessed CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122); the attack is local-only, requires existing low-privilege access and the ability to supply a crafted descriptor (local user context or a malicious/emulated USB or Bluetooth HID peripheral), with no user interaction and low complexity. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with total technical impact, and a vendor patch is available; this is a credible but not emergency-level priority, so remediation should follow the normal monthly patch cadence.
Heap-based buffer overflow in Microsoft Internet Information Services (IIS) on affected Windows builds allows a locally authenticated, low-privileged attacker to elevate privileges to a higher-integrity context, with total technical impact assessed (C:H/I:H/A:H). The issue is reachable only from local access on a host where the IIS role is installed and unpatched - it is not network-exploitable and requires an existing foothold on the machine - so it functions as a post-compromise escalation step rather than a mass-exploitable entry point, and SSVC rates it non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected Windows Server 2012 through 2025 and Windows 10/11 builds.
Local privilege escalation in the Windows Desktop Window Manager (dwm.exe) allows an attacker who already holds an authenticated low-privilege account on the target host to exploit an out-of-bounds read and gain elevated (SYSTEM-level) code execution. All supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions are affected up to their respective fixed builds, and the prerequisite is purely local code execution with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8). No public exploit code or confirmed active exploitation has been identified at the time of analysis and CISA SSVC rates exploitation as none and not automatable, so this is a routine patch-priority item rather than an emergency - but the vendor update should be applied promptly on multi-user, RDP-accessible, and privileged-administration endpoints where a local foothold is easiest to obtain.
Authenticated local code execution in Windows PowerShell affects Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025, where a heap buffer overflow triggered by crafted input lets a low-privilege local user run code at the level of the PowerShell process. CVSS 3.1 rates it 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), and because the vector requires an existing local interactive session, the practical exposure is privilege escalation or post-foothold activity on shared hosts rather than a remote or unauthenticated attack. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has released fixed builds through the MSRC update guide.
Local privilege escalation in the Windows 11 26H1 kernel allows a low-privileged local user to corrupt heap memory and escalate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so an attacker who already holds a foothold as any user or service account can reliably and non-interactively raise their privileges to the highest level on the host. Exploitation is post-compromise, not a remote entry point; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Microsoft has shipped a vendor patch addressing it.
Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows an authenticated attacker with low-privilege code execution to trigger a use-after-free by coaxing the kernel driver into parsing attacker-controlled UDF data, typically via a crafted optical disc, ISO, VHD, or removable volume/image; successful exploitation yields high confidentiality, integrity, and availability impact at SYSTEM level (CVSS 7.8, CWE-416). Default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 are affected below the fixed build numbers listed in the vendor data. There is no remote or unauthenticated path and no drive-by network vector, and no public exploit identified at time of analysis; the primary constraint is that the attacker must already hold a foothold and be able to force UDFS mount/parse operations.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.
Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated low-privileged user to elevate to a high-integrity level (e.g., SYSTEM) via an untrusted pointer dereference (CWE-822), achieving full confidentiality, integrity, and availability impact. Affected systems span a wide range of Windows client and server editions, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025. No public exploit code or active exploitation has been identified at the time of analysis, but a vendor patch is available.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.
Local privilege escalation in the Windows Client License Service allows an authenticated low-privileged attacker to gain SYSTEM-level code execution by triggering a use-after-free (CWE-416) with a crafted local process, with high impact to confidentiality, integrity, and availability. Affected are unpatched Windows 10, Windows 11, and Windows Server builds (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2022 below 10.0.20348.5761); exploitation requires pre-existing local low-privileged access (CVSS AV:L/PR:L, UI:N) and no public exploit or active exploitation is identified at time of analysis, with SSVC reporting exploitation: none. This is a credible but not emergency-priority local privilege escalation driven by a post-foothold memory-corruption primitive.
An out-of-bounds read in the Windows NTFS file system driver allows a locally authenticated attacker holding a low-privileged session to execute code with elevated privileges on the affected host. The flaw is triggered when NTFS processes attacker-influenced on-disk structures or volume metadata, giving a crafted or tampered NTFS volume a path to corrupt driver state within kernel context. Impact is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and because the vector is local-only with PR:L this is a privilege-escalation and post-exploitation primitive rather than an initial-access vector; no public exploit code and no confirmed active exploitation were identified at time of analysis. A vendor fix is available, and systems patched to the builds listed by Microsoft are not affected.
Local privilege escalation in Microsoft Windows Storage Spaces is possible through an out-of-bounds read in Spaceport.sys, the kernel-mode driver that backs Storage Spaces and related storage-pool functionality. An attacker who already holds a low-privileged, authenticated session on the host (AV:L, PR:L, UI:N per CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) can reach the driver through local device/IOCTL interaction and trigger the flaw, with high impact to confidentiality, integrity and availability - effectively full system compromise once code execution is achieved. The vulnerability affects essentially all supported Windows client and server branches that ship the driver, and is not remotely exploitable; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, so it is primarily a post-compromise escalation risk rather than an initial-access vector. Microsoft has published a security update (MSRC advisory CVE-2026-96862), tracked in the EU as EUVD-2026-99778.
Local privilege escalation in Windows Management Instrumentation (WMI) through a heap-based buffer overflow allows an authenticated local attacker to elevate privileges on affected Windows hosts. Exploitation requires the attacker to already have low-privileged code execution on the target-this is not remotely exploitable and needs no user interaction (AV:L/PR:L/UI:N). Microsoft has released patches; no public exploit identified at time of analysis (SSVC exploitation: none).
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in Microsoft's Windows Subsystem for Linux (WSL) allows an attacker who already holds low-privileged code execution on a WSL-enabled host to trigger a use-after-free and obtain full control over confidentiality, integrity, and availability (CVSS 7.8, CWE-416). Exploitation is strictly local (AV:L) and requires an existing account or foothold with low privileges (PR:L), but needs no user interaction and has low attack complexity, so a reliable trigger is plausible once the prerequisites are met; hosts where the optional WSL feature is not installed are not exposed. No public exploit code and no confirmed active exploitation have been identified, and Microsoft has released fixed builds for every affected Windows 10, Windows 11, and Windows Server version, so patching is the decisive risk-reduction step.
Local privilege escalation in Windows Installer (msiexec) allows an authenticated local attacker with existing low-privileged code execution to elevate to SYSTEM by triggering a use-after-free memory corruption flaw. The vulnerability affects unpatched Windows 10, Windows 11, and Windows Server builds below the fixed build levels listed in Microsoft's update guidance, including Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Microsoft Windows Win32 kernel subsystem lets an authenticated attacker holding low-privileged access on an affected host corrupt kernel memory via a use-after-free race and escalate to full system privileges. Microsoft rates it CVSS 7.8 (AV:L/PR:L/UI:N, with high confidentiality, integrity and availability impact) and has shipped fixed builds for Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025; no public exploit identified at time of analysis, and CISA's SSVC assessment records no known exploitation and marks the flaw as not automatable, since winning the UAF timing is attacker-dependent rather than reliably scriptable. Because the vector is entirely local and requires prior code execution in a low-privilege context, this is a credible but not emergency-level priority - it matters most as a post-compromise elevation step on unpatched builds.
Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.
Local privilege escalation in Windows Hyper-V allows an authenticated, low-privileged user on a Hyper-V-enabled Windows host to trigger a use-after-free and execute code at a higher integrity level, ultimately reaching SYSTEM-level privileges on the host. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), affecting Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 builds prior to their fixed levels, and is only reachable once the attacker already holds local access on a system where the Hyper-V role is enabled. No public exploit identified at time of analysis, and CISA's SSVC decision framework records exploitation as none with the attack assessed as not automatable.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.