Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.
Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged attacker who already holds an interactive or authenticated session on a Windows host to trigger an out-of-bounds read in the compositor and elevate to a higher-integrity context. CVSS 3.1 rates it 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): no user interaction or remote reach is required, but the local authenticated session is a hard prerequisite, which confines exposure to hosts where an attacker has already gained an initial foothold. Microsoft has released patch builds for all affected servicing branches and there is no public exploit code identified at time of analysis; CISA SSVC records Exploitation: none and Automatable: no, making this a credible but not emergency-grade priority rather than an actively exploited Windows elevation-of-privilege bug.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows a low-privileged user who already has code execution on the host to trigger an out-of-bounds read in the compositor and, per the assessed CVSS vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H), achieve high confidentiality, integrity and availability impact in DWM's more privileged context. Every default installation of the affected Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025 builds - including Server Core - carries the vulnerable component, but the flaw is not remotely reachable and requires an existing local foothold as an authenticated user. No public exploit code has been identified at time of analysis and CISA's SSVC records no observed exploitation, making this a post-compromise escalation step rather than an initial-access vector; Microsoft has shipped patched builds and a fix is available via the MSRC update guide.
Local privilege escalation in the Windows Bind Filter Driver (BindFlt), a kernel-mode component shipped by default across supported Windows client and server editions, lets an already-authenticated low-privileged attacker trigger a heap-based buffer overflow and gain elevated (SYSTEM) code execution on the host. Exploitation requires a pre-existing local foothold - the CVSS vector is AV:L/PR:L/UI:N - so this is a post-compromise escalation primitive rather than a remotely reachable entry point, and it carries a high technical impact (total loss of confidentiality, integrity and availability on the affected machine). No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', so this is a credible but not emergency-tier patching priority; Microsoft has released fixed builds for every affected edition and organizations should fold them into normal cumulative-update cycles, prioritizing multi-user and high-value hosts.
Local privilege escalation in the Microsoft Windows Kernel lets an attacker who already holds authenticated, low-privileged local code execution on a target host elevate to SYSTEM-level rights by triggering a use-after-free memory corruption condition. The flaw affects a broad range of unpatched Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - and Microsoft has published a fixing update via its MSRC advisory. No public exploit code or active exploitation has been identified at time of analysis: CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', so this is a genuine but moderate-priority, patch-now issue rather than a top-tier emergency.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker with low-privileged local access to gain SYSTEM-level privileges by triggering a heap-based buffer overflow. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction (UI:N), and is not remotely reachable or automatable at scale per CISA SSVC (Automatable: no). Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none).
Local privilege escalation in the Windows WebDAV component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to escalate to a higher-integrity context, with the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating total loss of confidentiality, integrity and availability and no further user interaction required. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations. Exploitation requires a pre-existing local foothold, making this an escalation primitive rather than an initial-access vector; CISA's SSVC assessment records exploitation as "none" and automatable as "no", and no public exploit code has been identified at time of analysis, so this is a plausible but not top-tier priority. A vendor patch is available from Microsoft via the MSRC Security Update Guide.
Local privilege escalation in the Windows Storage Spaces Controller lets an attacker who already holds a low-privileged, authenticated session on an affected Windows host trigger a use-after-free and run code at a higher integrity level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction and no remote reachability - the foothold is the barrier, not the exploitation itself. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis; patched vendor builds (e.g., Windows 11 24H2 at 10.0.26100.9711 or later, Windows Server 2025 at 10.0.26100.33650 or later) are not exploitable, so the practical risk sits with unpatched, already-compromised or insider-accessible endpoints and servers.
Double free in the Windows Hyper-V hypervisor component allows an authenticated local attacker to corrupt memory in a privileged context and elevate to SYSTEM on affected Windows 11 (23H2, 24H2, 25H2, 26H2) and Windows Server 2022/2025 hosts, including Server Core installations, with the Hyper-V role present. Exploitation requires that the attacker already hold local code execution on the host (CVSS AV:L/PR:L, no user interaction), so this is a privilege-escalation primitive rather than a remote entry point, and hosts without the Hyper-V role are not exposed. No public exploit code or active exploitation has been identified at time of analysis - CISA SSVC reports exploitation none and automatable no - and vendor patches are available, making this a genuine but second-tier priority relative to remotely reachable or actively exploited Hyper-V flaws.
Local privilege escalation in Microsoft's Windows Resource Management (MRM) component lets an authenticated attacker who already holds low-level privileges on a host trigger an integer overflow (CWE-190) and elevate to higher integrity, with full impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote - it requires an existing local foothold - but needs no user interaction and has low attack complexity, so once any code execution or interactive access is obtained on an unpatched build, escalation is straightforward. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds below the vendor's fixed revision levels are affected; there is no public exploit code identified and no confirmed active exploitation (no CISA KEV listing) at time of analysis, although vendor patches are available.
Local privilege escalation in Windows Winlogon (CVE-2026-87699) allows an attacker who already holds an authenticated low-privileged session on a target machine to trigger a heap-based buffer overflow in the Winlogon process and elevate to full SYSTEM-level privileges, yielding high confidentiality, integrity, and availability impact on that host. The flaw affects a broad set of Windows 10, Windows 11, and Windows Server 2012 through Server 2025 builds below the fixed revisions published by Microsoft (for example Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, and Windows Server 2016 below 10.0.14393.9612), and the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N scores it 7.8. There is no public exploit identified at time of analysis, and CISA's SSVC records exploitation as 'none', but the fully local, no-user-interaction attack path makes this an effective post-compromise escalation step for an attacker already present on a host.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to elevate to higher integrity - ultimately SYSTEM-level privileges - by triggering a use-after-free (CWE-416) in the packaging/installation code path, achieving full loss of confidentiality, integrity, and availability for the affected host (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a broad set of supported Windows client and server platforms, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, all default installations of the core OS component. Because the vector requires AV:L and PR:L, this is a post-compromise escalation step rather than an initial-access vector, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; Microsoft has published vendor fixes as part of its monthly security update.
Heap-based buffer overflow in the Windows UPnP Device Host lets a locally authenticated low-privilege user corrupt heap memory inside a privileged Windows service and elevate to higher integrity/system-level privileges. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations; exploitation requires an existing local foothold (CVSS AV:L, PR:L) but no user interaction (UI:N), and successful triggering yields high confidentiality, integrity and availability impact. Per CISA's SSVC assessment exploitation is none and the issue is not automatable, and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-tier privilege-escalation flaw that should be fixed on a normal patch cycle; fixed builds such as 10.0.19044.7807, 10.0.26100.9711 and 10.0.14393.9612 are not vulnerable.
Local privilege escalation in the Windows PCI Bus Driver (pci.sys) lets an attacker who already holds low-privileged local access on a Windows host trigger a heap-based buffer overflow in kernel mode, corrupting pooled kernel memory and achieving high-integrity (SYSTEM) code execution. Affected systems are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below the fixed build numbers published by Microsoft; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H for a score of 7.8, meaning the attacker must already possess local, authenticated low-privileged access and no user interaction is required. CISA's SSVC assessment records exploitation as 'none' and high technical impact, but rates the flaw non-automatable and no public exploit code has been identified at time of analysis - this is a post-compromise privilege-escalation primitive that matters most on multi-user, RDP, VDI and shared-host deployments rather than a remotely reachable mass-exploitation risk.
Local privilege escalation in the Windows StateRepository API lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a use-after-free (CWE-416) in the state store used by the AppX/UWP deployment stack, corrupting memory and gaining higher privileges up to the level of the affected component, with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting total loss of confidentiality, integrity, and availability for the vulnerable component. The issue spans a wide set of Windows 10, Windows 11, and Windows Server builds (per EUVD-2026-100050), and a vendor fix is available per the Microsoft advisory; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Because exploitation is gated on a pre-existing local foothold rather than on any non-default configuration, it should be treated as a post-compromise escalation step rather than a remote entry point, making it a credible but not emergency priority.
Use-after-free in the Windows Message Queuing (MSMQ) Queue Manager lets a locally authenticated, low-privilege attacker execute arbitrary code on the host, with the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating full loss of confidentiality, integrity and availability once the flaw is triggered. Exploitation is constrained: the MSMQ feature is not part of a default Windows installation, so the Queue Manager service must be deliberately deployed, and per the assessed vector the attacker must already hold local low-privilege access - there is no remote or anonymous path and no user interaction is needed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and this is assessed as a plausible but not top-tier priority because local-only access, prior authentication and the optional non-default MSMQ component collectively narrow realistic exposure to hosts where MSMQ is intentionally enabled and an attacker already has a foothold.
Privilege escalation in the Windows kernel-mode drivers lets an authenticated attacker who already holds low-privileged local code execution on a host trigger a heap-based buffer overflow and elevate to SYSTEM-level rights. Affected are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds below their respective patched revisions. This is strictly a post-compromise local escalation (CVSS 3.1 7.8, AV:L/PR:L/UI:N) with no remote or network-facing attack surface; no public exploit code has been identified at time of analysis and there is no KEV listing, so it should be treated as a high-value chaining primitive rather than an initial-access vector.
Local privilege escalation in the Microsoft Windows Search Component (CWE-122 heap-based buffer overflow) allows an attacker who already holds a low-privileged, authenticated local foothold on a Windows host to corrupt heap memory and achieve high-impact code execution. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming the flaw is not remotely triggerable and needs no victim interaction, but does require the attacker to already be running code locally. Affected builds span Windows 10, Windows 11, and Windows Server 2012 through 2025; Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker who already holds a low-privilege foothold on a Windows host to leverage an externally-controlled format string and reach full SYSTEM-level code execution. Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the only meaningful barrier is the local, authenticated prerequisite: it is not remotely reachable and requires no user interaction. Our independent assessment rates this a credible but not top-tier priority, and no public exploit code has been identified at time of analysis; the vendor has released a patch.
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on a vulnerable build to trigger an out-of-bounds read that the vendor rates as full-impact (C:H/I:H/A:H) on confidentiality, integrity, and availability. Only pre-patch builds of Windows 11 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core), are affected; patched builds are not exploitable, so this functions as a post-compromise escalation step rather than an initial access vector. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS 7.8 (HIGH) score and the low-privilege local prerequisite make it a realistic follow-on step after a workstation or server foothold, and Microsoft has released fixes.
A use-after-free in the Windows Kernel lets an authenticated, low-privileged local attacker escalate to kernel-level (SYSTEM) privileges on affected Windows 11 and Windows Server 2025 builds. Exploitation requires an existing local foothold on the host and cannot be triggered remotely, so it functions as a post-compromise privilege-escalation step rather than an initial-access vector; no user interaction is required and attack complexity is low (CVSS 7.8, AV:L/PR:L/UI:N). Microsoft has released fixes that raise the kernel build numbers listed in the advisory, and no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Modern Device Management (MDM) component allows an authenticated low-privileged user who already has code execution on a Windows host to gain SYSTEM-level privileges by triggering a use-after-free in the MDM code path. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning it is not remotely reachable, requires no victim interaction, and depends on the attacker already holding a local foothold; successful exploitation also requires winning the heap-reuse race to reclaim the freed object. Consistent with our independent assessment this is a moderate-priority local escalation issue, and no public exploit identified at time of analysis; Microsoft has released patches through its update guide.
Local privilege escalation in the Microsoft Windows Wired AutoConfig Service (dot3svc) allows an attacker who already holds a low-privileged authenticated session on a Windows host to elevate to SYSTEM-level privileges by triggering a double-free memory corruption in the service. The flaw (CWE-415, CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) affects the full range of supported Windows 10, Windows 11, and Windows Server releases enumerated in the EUVD data, including Server 2012 through Server 2025. Microsoft has published a vendor patch (MSRC update guide for CVE-2026-85829); CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis, so this is a post-access escalation risk rather than a wormable or remote-entry issue.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.
Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows TCP/IP driver lets an attacker who already holds low-privileged code execution on a host trigger a heap-based buffer overflow and obtain SYSTEM-level rights, with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect affects an unusually broad range of supported builds - Windows 10 versions 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core installations. Microsoft has released a vendor patch, and there is no public exploit code and no confirmed active exploitation at time of analysis (CISA KEV does not list it; CISA SSVC records exploitation as 'none'). Because the flaw is local and requires an existing foothold, it is best treated as a post-compromise escalation primitive rather than a remotely reachable network flaw despite the TCP/IP component name.
Local privilege escalation in Microsoft Windows Installer (msiexec/msiserver) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/SYSTEM-level code execution with full confidentiality, integrity, and availability impact. The flaw affects essentially the entire supported Windows client and server estate documented by EUVD, from Windows 10 1607, Windows Server 2012 and 2012 R2 through Windows 11 26H2 and Windows Server 2025, and is exploitable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U, base 7.8). Because it is strictly local (AV:L) it cannot be reached across the network, and with CISA's SSVC recording Exploitation=none and Automatable=no, and no public exploit code identified at time of analysis, this is a credible second-stage escalation step for an attacker who has already landed on the box rather than a mass-exploitation or initial-access vector.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds a low-privileged foothold on a host trigger a heap-based buffer overflow (CWE-122) and elevate to a higher-privileged context, with full impact to confidentiality, integrity, and availability within the same security scope (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and requires no user interaction once local access is obtained, so it is primarily a post-compromise escalation primitive rather than an initial-access vector. It affects a broad range of Windows 10, Windows 11, and Windows Server editions up to specific build numbers, and no public exploit has been identified at time of analysis (CISA SSVC exploitation: none); Microsoft has published a vendor fix that closes the vulnerable heap-allocation code path on patched builds.
Local privilege escalation in the Windows Volume Manager Extension Driver (volmgrx) lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger an out-of-bounds read and escalate to full control of the machine, carrying a CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected driver ships by default across an unusually wide range of releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025, and Microsoft has published fixes through its MSRC Update Guide. Exploitation requires a pre-existing local foothold and cannot be triggered remotely, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates it Exploitation: none and Automatable: no, making this a moderate post-compromise hardening priority rather than an emergency.
Local privilege escalation in the Windows USB Video Driver allows an authenticated attacker holding a low-privileged account on the target host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/kernel-level code execution. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below their respective fixed versions, per the vendor's affected-version data. Exploitation is local-only (AV:L/PR:L/UI:N), so it requires pre-existing code execution on the host and is not remotely reachable; no public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and there is no KEV listing, making this a credible but moderate-priority privilege-escalation issue rather than an emergency. Microsoft has released patches ("Available from vendor") and all affected builds have published fixed version numbers.
Local privilege escalation in the Windows Device Association Service allows a low-privileged authenticated user to achieve arbitrary code execution with SYSTEM privileges via a use-after-free (CWE-416) memory corruption flaw. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025, with no public exploit identified and no confirmed active exploitation according to available intelligence. The vulnerability requires local access and low-privilege credentials, making it a post-compromise escalation primitive rather than a remotely exploitable entry point.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Heap-based buffer overflow (CWE-122) in the Windows Servicing Stack component allows an authenticated, low-privileged local attacker to elevate privileges to full system rights on unpatched Windows client and server builds. Exploitation is not a standalone remote entry point: the attacker must already have local code execution on the host (CVSS vector AV:L/PR:L/UI:N), and CISA's SSVC assessment rates the attack as non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. Vendor fixes have been released as updated SSU build numbers across all affected branches (for example Windows 11 24H2 fixed at 10.0.26100.9711, Windows Server 2025 at 10.0.26100.33650, and Windows 10 1809 / Server 2019 at 10.0.17763.9376).
Local privilege escalation in the Windows EAPHost Service (the Extensible Authentication Protocol host component) allows an attacker who already holds an authenticated, low-privilege local session to trigger an out-of-bounds write and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is a post-foothold step requiring local code execution and valid credentials, not remote network access; no user interaction is needed and complexity is low. Microsoft has released fixes covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and at time of analysis no public exploit code has been identified and CISA SSVC records exploitation as none, making this a credible patch-now item rather than an emergency.
Local privilege escalation in the Windows Telephony Server (TAPI) allows an authenticated, low-privileged local user to gain elevated rights - potentially SYSTEM - by triggering a use-after-free in the telephony stack. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the EUVD data below the vendor's patched build levels are affected, and because the vulnerable component is present by default, exposure is broad even though the attack is not remote. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier priority: it only becomes dangerous after an attacker has already obtained a foothold on the host and can interact with the TAPI service.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated, low-privileged user who can already execute code on a Windows host to escalate to a higher privilege level, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a numeric type-conversion error (CWE-681) in a component shipped by default in all affected Windows 10, Windows 11, and Windows Server builds, so no non-default feature needs to be enabled; the only meaningful barrier is that the attacker must first obtain local code execution. Per available intelligence there is no CISA KEV listing and no public exploit identified at time of analysis (CISA SSVC exploitation: none), so this is assessed as a credible but not emergency-level priority - a post-compromise chaining primitive rather than a remotely reachable bug - and vendor-released patches are already available for all listed builds.
Heap memory corruption in the Windows Servicing Stack (SSU) allows an attacker who already holds low-privileged, authenticated local access to elevate to SYSTEM-level code execution on unpatched Windows client and server builds. Triggering it requires crafted input being processed by the servicing stack, which corrupts heap memory via a heap-based buffer overflow (CWE-122) and yields total loss of confidentiality, integrity, and availability on the host. Microsoft has released vendor fixes for every affected build family via the MSRC update guide; no public exploit code has been identified at time of analysis, CISA's SSVC decision framework rates exploitation as 'none' and the issue as non-automatable, and this remains a post-compromise privilege-escalation step rather than an initial-access vector.
Local privilege escalation in the Windows Remote Desktop Protocol component lets an attacker who already holds a low-privileged interactive session on an affected host trigger a heap-based buffer overflow and execute code at SYSTEM level, with high confidentiality, integrity, and availability impact. Despite the RDP branding this is not a network-reachable flaw: the assessed vector is AV:L/PR:L/UI:N, so a pre-existing foothold with valid low-privileged credentials is mandatory, and SSVC rates it Automatable=no, meaning scripted mass exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor patches are available for the affected Windows 10, Windows 11 (through 26H2), and Windows Server 2012 through 2025 builds.
Local privilege escalation in Microsoft Windows NTFS allows an authenticated attacker who already holds low-privileged code execution on a host to abuse a use-after-free in the file system driver and obtain SYSTEM-level rights. The vector is strictly local (AV:L, PR:L, UI:N, AC:L) - there is no remote or network-facing path, and no user interaction is required, so once an initial foothold exists the trigger is reliable against default configurations. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but our assessment treats it as a genuine patch-now priority for Windows fleets despite the moderate 7.8 CVSS; the pre-existing local access requirement is the principal limiting factor.
Local privilege escalation in the Windows Universal Disk Format (UDFS) kernel driver allows an already-authenticated, low-privileged user to corrupt kernel memory and gain SYSTEM-level code execution by causing the driver to parse attacker-controlled UDF-formatted data, typically through mounting or accessing a crafted UDF volume such as a malicious ISO or disk image. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with total technical impact across confidentiality, integrity and availability, but it is strictly local - there is no network attack path and no victim user interaction is required beyond the attacker's own action. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best characterized as a post-compromise local-to-SYSTEM escalation primitive rather than an initial-access vector; a vendor patch is available.
A heap-based buffer overflow in the Microsoft Windows Search Component lets an authenticated attacker with existing low-privilege code execution on a Windows host elevate to higher privileges, including SYSTEM, with no user interaction required. The flaw affects a default-present OS feature across Windows 10, Windows 11, and Windows Server 2012 through 2025, and exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) - an attacker cannot reach it remotely, so it functions as a post-compromise escalation step rather than an initial access vector. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not in KEV).