Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already holds code execution on a host to corrupt kernel heap memory and obtain SYSTEM-level privileges. The root cause is a heap-based buffer overflow (CWE-122) in the kernel itself, so default installations of supported Windows client and server editions - including Server Core - are affected up to the fixed build thresholds published by Microsoft. No public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with the attack path not automatable, so this is best treated as a post-foothold escalation primitive requiring local access (AV:L, PR:L) rather than an initial-access or remote vector.
Local privilege escalation in the Microsoft Windows Storage Spaces kernel driver (Spaceport.sys) lets an attacker who already holds low-privileged, authenticated code execution on a host read out-of-bounds kernel memory and chain that primitive into full SYSTEM-level control. All supported Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below their respective fixed build numbers are affected; the driver ships by default, so no optional feature must be enabled. There is no public exploit identified at time of analysis (CISA SSVC records Exploitation as 'none' and Automatable as 'no'), and this is not a KEV-listed, actively exploited issue - but the reported CVSS of 7.8 with high confidentiality, integrity and availability impact makes it a credible, moderate-priority escalation target once an attacker has a local foothold. A vendor-released patch is available.
Heap-based buffer overflow in the Microsoft Windows Search component allows an attacker who already holds low-privileged local code execution on a host to elevate to SYSTEM-level privileges. The flaw is reachable only locally (AV:L) and requires authentication (PR:L) with no victim interaction (UI:N), making it a privilege-escalation primitive rather than a remote entry point; it would typically be chained after an initial foothold. Microsoft has released vendor patches and no public exploit code or active exploitation has been identified at time of analysis. This is a credible but not emergency-level priority: the default-enabled Search component is present on a broad range of Windows client and server builds, but exploitation is gated on a pre-existing local foothold.
Local privilege escalation in the Windows MIDI Service Module allows an authenticated attacker with low-level privileges (PR:L) on an affected Windows 11 host to corrupt heap memory and elevate to SYSTEM-level or otherwise higher-integrity execution. The flaw is a CWE-122 heap-based buffer overflow (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) triggered by malformed input delivered to the MIDI service interface; it is local-only, requires an existing foothold, and involves no victim user interaction. There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is a credible but not emergency-tier vulnerability - patch when convenient within normal monthly cycles rather than on an emergency basis. Affected builds are Windows 11 24H2, 25H2, 26H2, and 26H1 below their respective patched builds (10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711, 10.0.28000.3231).
Elevation of privilege in Microsoft Windows Error Reporting lets a locally authenticated, low-privileged attacker escalate to full SYSTEM-level compromise on affected Windows 11 and Windows Server 2025 hosts. The defect is an untrusted pointer dereference (CWE-822) reached when low-privileged code invokes or interacts with the Error Reporting component, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, 7.8) reflects total confidentiality, integrity, and availability impact once triggered. The local-only vector means the flaw cannot be launched remotely and cannot serve as an initial-access vector, and no public exploit has been identified at time of analysis; Microsoft has released fixes for all affected builds.
A use-after-free in the Windows Kernel lets an attacker who already holds local, authenticated low-privileged access on a host escalate to full system-level privileges, yielding high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected platforms are Windows 11 versions 23H2, 24H2, 25H2, and 26H2 plus Windows Server 2025 (including Server Core installation) running builds below the fixed levels. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so this is best treated as a post-compromise escalation primitive that cannot be reached remotely or without prior code execution on the machine. Vendor-released patches are available from Microsoft.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow and escalate to SYSTEM, yielding full loss of confidentiality, integrity, and availability (CVSS 7.8). The vulnerability is reachable only with local access and low privileges (AV:L, PR:L, UI:N) and requires no user interaction, making it a post-compromise escalation primitive rather than an initial-access or network-facing attack path. No public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none and Automatable: no), but Microsoft has published vendor fixes covering Windows 10, Windows 11, and Windows Server builds, so unpatched hosts where an attacker has already landed should be treated as high risk.
Heap-based buffer overflow in Microsoft Windows Installer (msiexec) allows an authenticated local attacker with low privileges to elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server releases. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is reachable only after a local foothold is obtained, making it a post-compromise escalation primitive rather than a remote entry point. At time of analysis, no public exploit code or confirmed active exploitation has been reported, and Microsoft has released patched builds.
Local privilege escalation in Windows Win32K allows an attacker who already holds low-privileged, authenticated local access to trigger a use-after-free in the kernel-mode window manager driver and obtain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability. The defect is a second-stage primitive rather than an initial-access flaw: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires a pre-existing foothold on the host plus the ability to execute code issuing Win32K syscalls, and it cannot be reached by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis, CISA's SSVC data records exploitation as "none" and automatable as "no", and Microsoft has released a vendor patch covering all listed Windows client and server builds.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an authenticated local attacker to execute code on the affected Windows host, earning a 7.8 score under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The flaw is not remotely reachable - exploitation requires that the attacker already hold low-level authenticated access and the ability to run code on the target and then drive the error-reporting component with crafted input, making this a post-compromise privilege-escalation primitive rather than an initial-access vector. Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, and no public exploit code has been identified at time of analysis; the assessed priority is credible but not emergency-tier, and it should be treated as a patch-cycle item rather than an out-of-band emergency.
Local privilege escalation in the Windows Camera Frame Server Monitor component allows an attacker who already holds a low-privileged authenticated session on an unpatched Windows host to corrupt heap memory and elevate to SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction, but it is strictly local - there is no network-facing exposure and a pre-existing foothold is mandatory, making this a post-compromise escalation step rather than an initial-access vector. Microsoft has released patches (MSRC update guide for CVE-2026-83753); no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and the issue as not automatable, so this is a serious but second-tier priority compared with remotely reachable flaws.
Local privilege escalation in Windows Overlay Filter (WOF) allows an authenticated low-privileged attacker with the ability to run code on a vulnerable Windows host to trigger a buffer over-read (CWE-126) and gain elevated privileges, potentially including SYSTEM-level access. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 below the fixed build numbers listed in the EUVD/MSRC advisory, and the flaw cannot be reached remotely. This is a genuine but second-tier priority: no public exploit code has been identified, SSVC rates exploitation as none and non-automatable, and the attacker must already hold a local authenticated session, so it is primarily a post-compromise escalation risk rather than an initial-access vector.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker holding standard user rights on a host to corrupt the DWM process through a use-after-free and execute code with the elevated privileges that process enjoys. Exploitation requires prior local access at low privilege (CVSS AV:L/PR:L), needs no user interaction and no non-default configuration, because DWM is a default-enabled composition subsystem on every supported Windows 10, Windows 11, and Windows Server build listed by EUVD. Microsoft has published fixed builds and no public exploit has been identified at time of analysis, so this functions as a post-foothold escalation step rather than a remote entry point; severity is high (7.8) but it is not a remotely exploitable crisis.
Local privilege escalation in Windows NTFS allows an authenticated attacker with a low-privileged local session to trigger an out-of-bounds write (CWE-787) and execute code with elevated privileges. Affected builds span Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers; the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis (SSVC exploitation: none, Automatable: no), and a vendor-released patch is available.
Local privilege escalation in Windows NTLM lets an attacker who already holds low-privileged, authenticated code execution on a Windows host corrupt heap memory and gain higher privileges (CVSS 7.8, CWE-122). The flaw is reachable without user interaction and on default installations, and because NTLM is a default, always-present Windows component, every client and server build listed by the vendor (Windows 10/11 and Windows Server 2016 through 2025) is affected. Exploitation is not confirmed actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment scores exploitation as none while flagging the technical impact on a successfully exploited system as total, so patching should be handled in a normal Patch Tuesday cadence rather than as an emergency.
Local privilege escalation in the Windows Now Playing Session Manager (NPSM) - a default component of supported Windows 10, Windows 11, and Windows Server builds - lets an attacker who already holds authenticated, interactive local access (CVSS 3.1 AV:L/PR:L/UI:N, score 7.8) corrupt memory via a use-after-free and execute code with elevated privileges. Exploitation is not automatable and requires the victim host to already be compromised or a low-privileged local user to be present; no public exploit code was identified at time of analysis and the CISA SSVC evaluation records exploitation as none, while CISA's technical-impact assessment is total (full loss of confidentiality, integrity, and availability on the vulnerable host). The flaw is a standard local privilege-escalation primitive rather than a remote entry point, and Microsoft has published fixed builds for every affected version.
A heap-based buffer overflow in the Windows Client-Side Caching (CSC) service - the component behind Offline Files - lets an attacker who already holds low-privileged local code execution on a Windows host corrupt heap memory and elevate to SYSTEM privileges. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations, with vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and Microsoft-rated patch availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and the local attack vector means this is a post-compromise privilege-escalation primitive rather than an initial-access vector.
Heap-based buffer overflow in the Windows Bind Filter Driver (bindflt), a kernel-mode component shipped by default on supported Windows client and server editions, lets a locally authenticated user with only low privileges corrupt kernel heap memory and escalate to SYSTEM. Exploitation requires existing local access and a valid low-privileged account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the bug functions as a privilege-escalation stage chained after an initial foothold rather than an independent remote entry point; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Microsoft has published fixed builds for all affected branches, so despite the lack of exploitation telemetry this is a genuine patch-priority item for Windows environments.
Local privilege escalation in the Windows DHCP Server role (CWE-122 heap-based buffer overflow, CVSS 7.8) allows an attacker who already holds a low-privileged, authorized local account on a server running the DHCP role to corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability. Exploitation is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N) and is low complexity (AC:L), so a foothold on a DHCP host is the principal prerequisite; DHCP Server is an optional role and is not present on default client installations, which limits exposure. Microsoft has released fixes and no public exploit has been identified at time of analysis - CISA SSVC rates exploitation as none, and the issue is not listed in KEV, so this is a genuine but non-urgent post-compromise escalation issue rather than an urgent remote threat.
Heap-based buffer overflow in the Windows TCP/IP stack allows an attacker who already holds authenticated low-privileged local access to elevate to SYSTEM-level privileges on the affected host. Exploitation is confined to unpatched builds within the published version ranges (for example Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), requires no user interaction (CVSS AV:L/AC:L/PR:L/UI:N), and is not assessed as automatable by CISA SSVC. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches; this is a credible but not emergency-level priority given the mandatory pre-existing local foothold.
Heap-based buffer overflow in the Windows NTFS filesystem driver lets an authenticated local user elevate privileges on the affected host. Exploitation requires pre-existing local code execution as at least a standard user (CVSS vector AV:L/PR:L/UI:N, CWE-122), so this is a post-compromise escalation primitive rather than a remote or initial-access vector - nothing here can be triggered across the network or through a browser, and no special feature toggle is needed because the NTFS driver is loaded and active by default on every listed Windows 10, Windows 11 and Windows Server 2012 through 2025 build, including Server Core installations. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis, but given the ubiquity of the component and the kernel memory-corruption class, this warrants prompt patching on any host where low-privileged users can run code.
Heap-based buffer overflow in the Windows Media component of supported Windows editions lets a locally authenticated, low-privileged user (or code already running at low integrity) corrupt heap memory and escalate to SYSTEM-level privileges by supplying a crafted media file to the affected component. Per the assessed vector (AV:L/PR:L/UI:N), exploitation is local only, requires a prior foothold, and cannot be triggered remotely or by an unauthenticated attacker, so it functions as a second-stage privilege-escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation, and vendor patches addressing every affected Windows build are available.
Local privilege escalation in the Windows Media component allows an authenticated attacker with low privileges (CVSS AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow and gain high-integrity code execution, giving full compromise of confidentiality, integrity, and availability on the host. The flaw is not remotely reachable and requires a pre-existing foothold on an unpatched build, so it is a second-stage escalation vector rather than an initial-access path; all supported Windows 10, Windows 11, and Windows Server branches below their respective fixed build numbers are affected. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so this is a legitimate but non-emergency patch priority - vendor patches are available.
Local code execution in the Windows NTFS filesystem implementation allows an attacker who already holds a low-privileged local account to corrupt heap memory in the kernel and elevate to full system-level code execution. All supported Windows client and server builds are affected, including Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires existing local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, so exposure is concentrated on multi-user, RDP/VDI, and already-compromised hosts. Patch status is available from the vendor, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Sensor Data Service lets an authenticated, low-privileged attacker who already holds code execution on a host corrupt the service's heap and run code in its higher-integrity context. The defect is a heap-based buffer overflow (CWE-122) tracked at CVSS 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, making it a post-compromise escalation step rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has published fixes covering the affected build ranges.
Heap-based buffer overflow in the Windows USB Driver stack (CWE-122) allows an attacker who already holds authenticated, low-privileged local access to a target system to elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Microsoft has released a vendor patch, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, making this a genuine but second-tier priority relative to remotely reachable issues. No victim user interaction is required, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in Microsoft's BitLocker drive-encryption component allows an attacker who already holds authenticated code execution on a Windows 11 or Windows Server host to corrupt memory inside a privileged Windows process and reach SYSTEM-level rights. The defect is a double free (CWE-415) rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it grants full confidentiality, integrity, and availability impact but only from an existing local foothold. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the issue as non-automatable with no observed exploitation; Microsoft has published a fixed build, so this is a credible but not emergency-level priority for organizations that have already applied the update.
Heap-based buffer overflow in the Windows USB Driver allows an authenticated local attacker with low-privileged code execution to elevate privileges to SYSTEM on affected Windows systems. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server editions, but exploitation requires a pre-existing local foothold and no remote vector is possible (CVSS AV:L, PR:L, UI:N). Microsoft has released patched builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the SSVC decision framework rates exploitation as none with total technical impact, making this a credible but not emergency-priority local privilege-escalation issue.
Local privilege escalation in Windows Core Messaging lets an authenticated attacker who already holds low-privilege code execution on a host escalate to a higher-integrity, potentially SYSTEM-level context. The underlying defect is an untrusted pointer dereference (CWE-822) reached through a crafted program that calls into the Core Messaging user-mode code path; attack complexity is low and no user interaction is required, but the attacker must first be logged on locally (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), making this an EoP primitive usable only after an initial foothold, not a remote or unauthenticated vector. Per available intelligence there is no public exploit identified at time of analysis (CISA SSVC: Exploitation none, Automatable no), though SSVC rates the technical impact as total and fully patched systems are not exploitable. All supported Windows client and server builds below the vendor-patched build numbers - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - are affected.
Local privilege escalation in Windows NTFS lets an attacker who already holds low-privileged local access on an affected Windows installation feed attacker-controlled input into a format-string handling path in the file system driver, resulting in elevated privileges with full impact to confidentiality, integrity and availability (CVSS 7.8). The flaw is not remotely reachable and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and the flaw as non-automatable, so it functions as a post-compromise privilege-escalation stage rather than an initial-access or self-propagating vector. Microsoft has released fixed builds for the affected Windows 10, Windows 11 and Windows Server versions.
Local privilege escalation in the Windows Bind Filter Driver (bindflt.sys) allows an authenticated attacker who can already execute code as a low-privileged user on the host to corrupt kernel memory and escalate to SYSTEM privileges. The flaw is a use-after-free reachable through the driver with no user interaction required (CVSS 7.8, AV:L/PR:L/UI:N, S:U, C:H/I:H/A:H), and it affects unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds as well as Windows Server 2025 (including Server Core) builds below the fixed build numbers. Microsoft has published a vendor patch; there is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit identified at time of analysis, so this is a post-compromise escalation step rather than a remote entry point.
Local privilege escalation in the Windows Storage Spaces Controller lets an authenticated low-privileged user corrupt kernel heap memory and gain execution at SYSTEM level, because the component fails to bounds-check attacker-influenced data (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected surface is the Storage Spaces Controller present by default across Windows 10, Windows 11 and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations; patched builds (for example Windows 11 24H2 10.0.26100.9711, Windows Server 2025 10.0.26100.33650) are not exploitable. Exploitation is confined to a post-compromise scenario requiring an existing local foothold or valid low-privileged credentials, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable exploitation as 'no', and the independent assessment rates this as credible but not emergency-priority.
Local privilege escalation in the Windows Search component affects every pre-patch build of supported Windows client and server editions, letting an attacker who already holds low-privileged local access execute code at a higher integrity level by exploiting a numeric truncation error in the search/indexing code path. Rated CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires local authenticated access (PR:L, AV:L) but no victim interaction (UI:N) and has low attack complexity, making it a post-compromise escalation primitive rather than a remote or initial-access vector. CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; vendor patches are available from Microsoft.
Local privilege escalation in the Microsoft Windows Search Component lets an authenticated, low-privileged attacker on a Windows host trigger a use-after-free (CWE-416) and gain elevated privileges, potentially SYSTEM, with high impact to confidentiality, integrity, and availability. Exploitation requires local access and a valid low-privilege account (CVSS PR:L/AV:L) and no user interaction; it cannot be triggered remotely and is therefore a post-compromise escalation step, especially risky on shared, multi-user, RDP, or terminal-server hosts. No public exploit was identified at time of analysis, and this is assessed as a credible but not emergency-tier patch priority.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated attacker to trigger an invalid pointer or reference release (CWE-763) and potentially execute code at SYSTEM level. Exploitation requires an existing local foothold (AV:L, PR:L) and no user interaction; the flaw is not remotely reachable. Although it is a credible high-severity issue (CVSS 7.8), no public exploit has been identified at the time of analysis.
Local privilege escalation in the Windows Overlay Filter (wof.sys) driver on affected Windows systems allows an authenticated attacker with low-privileged code execution to trigger an out-of-bounds read (CWE-125) and elevate privileges to a higher integrity level. The flaw is rated CVSS 7.8 (High) and requires no user interaction (UI:N), but the attacker must already have a local foothold (PR:L, AV:L). No public exploit code or active exploitation has been identified at time of analysis; a vendor advisory is available via the Microsoft Security Response Center.
Local privilege escalation in the Windows Partition Management Driver lets an already-authorized, low-privileged user who can execute code on the host elevate privileges by triggering an out-of-bounds read against malformed partition-related structures handled by the kernel driver. Microsoft rates it CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with a CWE-125 root cause, and because the driver is a standard in-box Windows component, default installations are affected with no non-default configuration required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limiter is the prerequisite local foothold, making this a credible, patch-worthy privilege-escalation building block rather than an emergency or an initial-access vector.
Heap-based buffer overflow in Windows Resilient File System (ReFS) enables a locally authenticated low-privileged attacker to execute arbitrary code with elevated privileges when a ReFS volume is mounted or parsed. The vulnerability has a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior local access to the target Windows host; it is not remotely exploitable, and exploitation depends on ReFS being in use, which is common on Windows Server storage, Storage Spaces, and Hyper-V/backup deployments but not default NTFS-only endpoints. At time of analysis, no public exploit code or confirmed active exploitation (CISA KEV) has been identified; EPSS data is not provided.
Local privilege escalation in the Windows VHD miniport driver allows an authenticated attacker with low privileges to execute arbitrary code in kernel mode, resulting in full system compromise. This use-after-free (CWE-416) vulnerability requires the attacker to already possess low-privileged local access and the ability to interact with the virtual disk subsystem. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and EPSS data is not available; the CVSS score is 7.8.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker with existing low-privileged execution to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122) while the driver parses a crafted UDF volume, such as a malicious ISO image or optical/removable disk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the local prerequisite and high confidentiality, integrity, and availability impact, while requiring no separate victim interaction. No public exploit code has been identified at time of analysis, and a vendor advisory is available through the Microsoft Security Response Center.
Local privilege escalation in the Windows StateRepository API allows an attacker who already has code execution as a low-privileged, authenticated user to trigger a type-confusion condition and gain higher-integrity code execution on the same machine. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), the flaw is not reachable remotely and requires no user interaction, but it cannot serve as an initial-access vector - it is a post-compromise escalation primitive that assumes a local foothold and valid credentials. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); combined with the local-only attack path, this is a credible but not emergency-tier internet-facing threat.
Local privilege escalation in the Windows Universal Disk Format (UDFS) file system driver allows an authenticated, low-privileged attacker to corrupt kernel heap memory and elevate to SYSTEM by having the driver parse an attacker-controlled UDF volume. The defect is a heap-based buffer overflow (CWE-122) triggered when the driver processes a crafted UDF image - such as a malicious ISO, optical disc, or USB/removable media image - that is mounted or opened; no additional user interaction is required once the volume is presented (UI:N) and attack complexity is low (AC:L). Exploitation is not confirmed in the wild: no public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score of 7.8 reflects the local, low-privilege prerequisite (AV:L/PR:L) combined with full confidentiality, integrity, and availability impact.
Local privilege escalation in the Windows Universal Disk Format File System Driver (udfs.sys) allows an attacker with low-privileged local credentials to gain SYSTEM-level rights by triggering a heap-based buffer overflow when the driver parses a maliciously crafted UDF volume. The attacker must mount a rogue disk, ISO image, or removable media formatted with UDF; no user interaction by a victim is required. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited.
Local privilege escalation in Microsoft Windows Media Foundation (CVSS 3.1 7.8, High) lets an attacker who already holds low-privileged authenticated code execution on a Windows host corrupt memory via a use-after-free and elevate to a higher-integrity context. The flaw requires no user interaction (UI:N) and has low attack complexity (AC:L), but it is strictly local - there is no network vector and scope remains unchanged, so a pre-existing foothold is a hard prerequisite. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); risk is therefore primarily relevant to post-compromise escalation and defense-evasion chains rather than initial access.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to elevate privileges by exploiting a use-after-free condition. The service is a default component on Windows client installations, and exploitation requires no user interaction, making it a reliable post-compromise escalation vector for low-privileged users. No public exploit code or active exploitation has been identified at time of analysis, but the issue is considered credible and actionable for multi-user systems.
Local privilege escalation in the Windows StateRepository API allows an authenticated, low-privileged attacker who already has code execution on a Windows 11 host to gain SYSTEM-level rights, because the API's access controls lack sufficient granularity to separate callers by privilege. Affected builds are Windows 11 24H2 below 10.0.26100.9711, 25H2 below 10.0.26200.9711, 26H1 below 10.0.28000.3231, and 26H2 below 10.0.26300.9711. The flaw is not remotely reachable (AV:L, PR:L, UI:N) and CISA's SSVC framework rates it non-automatable with exploitation observed as none, so it functions as a post-compromise escalation step rather than an initial-access vector; no public exploit identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Microsoft OneNote stems from a use-after-free memory corruption flaw (CWE-416) that an authenticated attacker with low-privilege local access can trigger to execute code in a higher-privileged context. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and the corresponding Mac editions. No public exploit has been identified at time of analysis, and vendor patches are available; given the local access prerequisite and patch availability, this is a patch-priority item rather than an emergency.
Stack-based buffer overflow in Microsoft Office Word enables a local, authenticated user to elevate privileges to the level of the affected process, resulting in high confidentiality, integrity, and availability impact on the host (CVSS 3.1 base 7.8 HIGH). Affected builds include Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, and Office LTSC/365 for Mac. A vendor patch is available; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Desktop Window Manager (DWM) allows an authenticated local attacker with low privileges to execute arbitrary code at a higher integrity level, typically SYSTEM, on affected Windows 10, 11, and Server installations. The flaw is a use-after-free (CWE-416) in DWM, requiring no user interaction (UI:N) and only low privileges (PR:L), so any unprivileged process on a vulnerable build can trigger it. Microsoft has released patches, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Scripting Engine (CWE-122) allows an authenticated attacker with an existing low-privileged foothold on a Windows host to have crafted script content parsed into an out-of-bounds heap write, escalating privileges to the integrity level of the scripting host process with high confidentiality, integrity and availability impact (CVSS 7.8). Because the assessed vector is AV:L/PR:L/UI:N/AC:L, the vulnerability is not remotely reachable and no victim interaction is required, so its realistic value is post-initial-access privilege escalation rather than a remote compromise path. Patch available per vendor advisory through the Microsoft MSRC update guide; no public exploit code and no CISA KEV listing were identified at time of analysis.