Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds low-privileged, authenticated local access on a vulnerable Windows host corrupt kernel memory and elevate to higher privilege, including SYSTEM-level execution. Only specific builds are exposed: Windows 11 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core), at build levels below the vendor's fixed releases. Exploitation is constrained by high attack complexity - the use-after-free must be won as a race/timing condition to reclaim the freed Win32 kernel object before it is reused, which limits reliability and makes the flaw non-automatable per CISA SSVC; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (KEV), though the high confidentiality, integrity and availability impact and full technical impact score make timely patching important.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated, low-privileged attacker to run code with elevated (SYSTEM) rights by planting a malicious binary in a directory that the cleanup routine searches ahead of its trusted location. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity limits reliable exploitation to hosts where the attacker already controls a suitable search-path directory or can win a timing window; no public exploit identified at time of analysis, and CISA's SSVC assessment records no observed exploitation. Affected builds cover Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, for which Microsoft has released fixed builds.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds valid credentials and code-execution capability on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw affects essentially every supported Windows release, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, on builds below the fixed numbers published in EUVD-2026-99570. Exploitation is gated by High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), because the corruption must be shaped into reliable kernel memory manipulation; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released patches.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds low-privileged local access on a Windows host raise their privileges to a high-integrity/kernel-level context. The flaw (CWE-829) stems from the driver consuming functionality or structured data from an untrusted sphere without adequate validation, and it carries high attack complexity because success depends on winning a timing/state-dependent condition rather than a deterministic sequence. Exploitation requires an existing foothold - it is a post-compromise escalation primitive, not a remote entry point - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Local privilege escalation in the Windows Update Orchestrator Service allows an authenticated, low-privileged user on an unpatched Windows host to follow a crafted symbolic link or NTFS junction into a privileged file operation and gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable: it requires an existing local foothold and credentials (PR:L, AV:L) plus winning a timing window against the service (AC:H), and it needs no user interaction (UI:N). No public exploit has been identified at time of analysis - CISA SSVC records exploitation as 'none' and automatable as 'no' - and Microsoft has shipped fixed builds across the affected Windows 10, Windows 11, and Windows Server branches, so remediation is a straightforward update rather than an emergency containment exercise.
Local privilege escalation in the Windows COM+ Event System Service (EventSystem) allows an attacker who already holds authenticated low-privileged local access on a Windows host to corrupt memory and elevate to the service's higher-integrity context. The flaw is a use-after-free (CWE-416) that must be triggered by winning a timing race on a freed object, which is why Microsoft rates it with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and CISA's SSVC evaluation marks it non-automatable with no observed exploitation. There is no remote or network-facing exposure - no user interaction is required but the attacker must already be running code locally, so this is a post-foothold elevation primitive rather than a wormable issue; no public exploit code has been identified at time of analysis and a vendor patch is available.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged local session to trigger a heap-based buffer overflow (CWE-122) and elevate to higher-integrity code execution, with high impact to confidentiality, integrity, and availability (CVSS 7.0). The vulnerable component is the service behind Offline Files, which ships and runs by default across Windows 10, Windows 11, and Windows Server releases, so any multi-user or shared-access endpoint with an existing local foothold is in scope. Exploitation requires local access (AV:L) and a high-complexity trigger (AC:H) - typically a race or precise heap-grooming precondition - so reliable attacks remain difficult; there is no public exploit identified at time of analysis, no KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released vendor patches, and the raw 7.0 score should be weighted against the pre-existing foothold and high-complexity precondition, placing this at moderate priority rather than emergency patching.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already has code execution on a target machine trigger a use-after-free in the kernel socket-handling paths and elevate to SYSTEM. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - it is strictly local and requires a pre-existing foothold, and the race/timing nature of the bug makes it hard to trigger reliably, which is why CISA's SSVC rates exploitation as 'none' and automatable as 'no'. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the risk is assessed as moderate rather than emergency priority; Microsoft has released fixes, with EUVD tracking the affected builds under EUVD-2026-99879.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds low-privileged authenticated access on a Windows host to corrupt the heap and elevate to a higher-integrity context. The flaw is a heap-based buffer overflow (CWE-122) reachable only locally (AV:L) with high attack complexity (AC:H), meaning the attacker must satisfy specific memory-layout conditions, and no user interaction is required (UI:N); the component ships by default across the affected Windows 10, Windows 11, and Windows Server editions, so no optional feature must be enabled. Microsoft has released vendor patches that raise the fixed OS build numbers for each affected branch, and no public exploit has been identified at time of analysis - this is a genuine but moderate-priority local privilege-escalation issue rather than a remotely exploitable or actively attacked flaw.
Local privilege escalation in the Windows Application Compatibility Cache (ShimCache) allows an attacker who already holds low-privileged local code execution to elevate to higher integrity on unpatched Windows 11 (23H2 through 26H2) and Windows Server 2022/2025 systems. The defect is a use-after-free (CWE-416) that must be won in a narrow race window, and the assessed vector (AV:L/AC:H/PR:L/UI:N) reflects a post-compromise escalation path rather than a remote entry point, which is why SSVC records Exploitation: none, Automatable: no, and our assessment treats this as a genuine but moderate-priority local privilege escalation rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and no CISA KEV entry exists, though the CVSS base score of 7.0 is driven by total confidentiality, integrity, and availability impact once the elevation succeeds.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated attacker who already holds low-privileged code execution on an affected host to gain full control of the system (CVSS 7.0, C:H/I:H/A:H) by triggering a use-after-free in kernel memory. Exploitation is constrained by high attack complexity (AC:H), since the attacker must reliably win a timing/race window and groom kernel heap state; there is no remote or unauthenticated vector. Affected are unpatched Windows 11 24H2, 25H2, 26H1, and 26H2 builds and Windows Server 2025 builds below the fixed versions, and no public exploit or confirmed active exploitation was identified at time of analysis; Microsoft has released a patch.
Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds authenticated, low-privileged access on a host trigger a use-after-free in kernel memory and gain elevated (SYSTEM-level) code execution. The assessed vector (AV:L/AC:H/PR:L/UI:N) shows exploitation is confined to the local machine and is gated by high attack complexity - the memory-reclamation or race timing makes reliable exploitation difficult and non-deterministic - with no user interaction and no remote or unauthenticated path. Microsoft has released vendor patches for every affected Windows 10/11 and Windows Server build, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV not listed; SSVC exploitation: none, automatable: no).
Local privilege escalation in the Windows Console Driver (conhost/console driver component) allows an attacker who already holds authenticated local code execution on a Windows host to win a use-after-free race and gain high-integrity code execution, yielding full confidentiality and integrity impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). Every supported Windows client and server branch is affected - from Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 - because the vulnerable console driver ships in the base OS. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation as 'no', so this is a moderate-priority local EoP hardening item rather than an internet-facing emergency; the practical limiting factors are the precondition of an existing local foothold (PR:L) and the high attack complexity of the memory-reuse race.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
An authenticated, low-privileged local attacker can trigger a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) to corrupt kernel memory and elevate to SYSTEM on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 hosts. Exploitation is local-only and high-complexity (CVSS 7.0, AC:H), requiring precise kernel heap grooming or a race window, so this is a moderate-priority privilege-escalation issue rather than a remote or wormable emergency. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds that remove the vulnerable condition.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
Privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged local account corrupt kernel memory through a use-after-free and ultimately execute code at SYSTEM level, with high impact to confidentiality, integrity and availability. Exploitation is gated by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because reliable triggering typically requires winning a race condition or achieving a specific memory-reuse state, and no public exploit identified at time of analysis; CISA's SSVC review likewise records exploitation as 'none' and automatable as 'no'. The flaw affects unpatched default installations across essentially the entire supported Windows client and server lineup below the vendor-fixed builds, making it a pervasive post-compromise privilege-escalation primitive rather than a remote entry point.
Local code execution in Windows Error Reporting (WER) lets an authenticated, low-privileged attacker who already holds a foothold on a host trigger a double free (CWE-415) in the crash-reporting subsystem, corrupting heap memory and achieving code execution with the privileges of the affected WER component. The flaw affects an extremely broad install base - Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, including Server Core builds - but the attack surface is narrow: local access only (AV:L), prior low-privilege authentication (PR:L), no user interaction (UI:N), and high attack complexity (AC:H) because a reliable double free generally requires winning a timing race and precise heap grooming. There is no public exploit and no evidence of active exploitation - CISA's SSVC assessment rates exploitation as "none" and the vector is not automatable - so this is a moderate-priority local privilege/execution issue best handled through routine cumulative-update patching rather than emergency response. Microsoft rates it 7.0 with total technical impact, tracking it as CVE-2026-83916; ENISA mirrors it as EUVD-2026-99434.
Local privilege escalation in the Windows Diagnostic Policy Service (DPS) allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free and gain elevated rights, with the potential for total loss of confidentiality, integrity, and availability on the affected machine. The flaw affects Windows 10 versions 1809 through 22H2, Windows 11 versions 23H2 through 26H2, and Windows Server 2019, 2022, and 2025 builds listed in the EUVD data, and Microsoft has published a fixed build for each affected branch. Exploitation is not automatable in the CISA SSVC assessment and there is no public exploit identified at time of analysis, so while the consequence of a successful attack is severe, the practical barrier of high attack complexity and a required local foothold keeps this a moderate-priority patching item rather than an emergency.
Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).
Local privilege escalation in the Windows RPC Runtime lets an attacker who already holds a low-privileged local account on a Windows host free an invalid pointer or reference (CWE-763) inside the RPC code path and turn that memory-management error into SYSTEM-level code execution on the same machine (CVSS 7.0, AV:L/PR:L/UI:N/S:U). Exploitation is gated by high attack complexity (AC:H), which is consistent with a race/timing-dependent condition rather than a reliable one-shot primitive, and it cannot be reached remotely or by an unauthenticated user. No public exploit code or confirmed active exploitation has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes through its monthly update channel, so this is a genuine but non-urgent patching priority concentrated on multi-user, RDP and jump hosts where untrusted standard users can log on locally.
A use-after-free (CWE-416) in the Windows Win32 kernel subsystem leaves affected Windows hosts open to local privilege escalation: an attacker who already holds authenticated, low-privileged code execution on the machine can corrupt kernel memory and raise their rights to SYSTEM (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote entry point but a post-compromise escalation primitive, and the high attack complexity reflects the non-deterministic timing and kernel pool-reclaim conditions a reliable exploit must win. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is a patch-now hardening item rather than an emergency, while the vendor has published fixed builds through the MSRC update guide.
Local privilege escalation in the Windows Bind Filter Driver (bindflt.sys) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to corrupt kernel memory and elevate to SYSTEM. The flaw is a use-after-free (CWE-416) requiring a race-condition-style trigger, reflected in the CVSS vector AV:L/AC:H/PR:L/UI:N (7.0 High) and the CISA SSVC assessment of Exploitation: none and Automatable: no - there is no remote path, no user interaction, and no public exploit identified at time of analysis. It was not added to CISA KEV, and vendor-supplied patches are available; affected builds are specific Windows 11 23H2 through 26H2 releases and Windows Server 2025 (including Server Core) below the fixed build numbers, while patched builds are not exploitable. Independent assessment rates this as a genuine but not emergency-grade priority best handled through routine monthly patching.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged foothold on an affected Windows host to elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0). Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attack is local and requires an authenticated low-privileged user, and the use-after-free must be won under a high-complexity memory/race condition, reducing reliability. All supported Windows client and server builds below their respective fixed revisions are affected, Microsoft has released patches, and no public exploit code was identified at time of analysis and CISA's SSVC assessment records exploitation as none with the vulnerability not automatable.
Local privilege escalation in the Microsoft Windows Search component allows an authenticated, low-privileged attacker who already has code execution on a host to raise their privileges on that machine by triggering a use-after-free during Search operations. Exploitation is gated by a hard timing/reachability condition (AC:H) and is not automatable, and no public exploit has been identified at time of analysis, so this presents as a genuine but non-urgent local escalation issue rather than a mass-exploitation threat. Impact is confined to the local Windows system (S:U) but is high across confidentiality, integrity, and availability once achieved, making shared multi-user hosts the primary concern.
Local privilege escalation in the Windows Win32K ICOMP subsystem allows an authenticated attacker holding only low-privilege local code execution to elevate to kernel/SYSTEM context by triggering a use-after-free (CWE-416) in a Win32K object-lifetime code path. The flaw is confined to local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and requires winning a timing-dependent race, so it cannot be used for initial access or remote compromise and is only meaningful as a post-exploitation escalation step. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; Microsoft has released a vendor patch.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds a low-privileged account on a target host to trigger a use-after-free and execute code with SYSTEM privileges. The flaw affects supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 builds, including Server Core installations, up to Microsoft's fixed build numbers. No public exploit identified at time of analysis: CISA's SSVC records exploitation as 'none' and the issue as not automatable, and the HIGH attack complexity (AC:H) means an attacker must reliably win a memory-corruption race rather than fire a one-shot exploit, keeping real-world risk moderate despite the CVSS 7.0 (High) rating.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authorized attacker who already holds a foothold on a Windows host to run code at higher integrity by triggering a use-after-free memory corruption condition (CWE-416). Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local authenticated access and a hard-to-win timing or object-lifecycle state (AC:H) that the attacker does not fully control, but yields total loss of confidentiality, integrity and availability once achieved. Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds are affected; Microsoft has shipped fixed builds, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
A use-after-free (CWE-416) in the Windows Program Compatibility Assistant Service (PCASVC) lets an attacker who already holds low-privileged local access on a Windows host elevate to SYSTEM-level privileges. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N), meaning the attacker must win what is most likely a timing or memory-state race while interacting with the service; no user interaction is required and no non-default configuration is needed, since the affected service ships on default Windows installs. There is no public exploit identified at time of analysis, SSVC records exploitation as 'none' and the technique as non-automatable, so this is a moderate-priority local privilege-escalation (LPE) hardening item rather than an emergency - patching should follow normal monthly-cadence prioritization given the 'total' technical impact if the race is won.
Use-after-free in the Windows Program Compatibility Assistant Service (PcaSvc) allows an attacker who already holds a low-privileged, authenticated local session to escalate privileges to a higher-integrity context on the same host, achieving total compromise of confidentiality, integrity, and availability (CVSS 7.0, C:H/I:H/A:H). The flaw is a memory-corruption race that the attacker must win to reliably corrupt freed memory, so the high attack-complexity rating limits repeatability, and exploitation requires prior local code execution - remote, unauthenticated attackers are not in scope (AV:L/AC:H/PR:L/UI:N). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2025 builds are affected; no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework records exploitation as 'none' with the vulnerability not automatable. This is a genuine but moderate-priority elevation-of-privilege issue rather than a top-tier emergency, and vendor patches are available.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user on an affected host to corrupt kernel memory and seize full control of the operating system, including reading and modifying protected data. The root cause is a use-after-free (CWE-416) in core kernel code, reachable only from a local session and rated high attack complexity because exploitation depends on winning a race/timing condition to reclaim the freed object. Affected builds are Windows Server 2025 (including Server Core) below 10.0.26100.33650 and Windows 11 Version 23H2 below 10.0.22631.7652; no public exploit code identified at time of analysis and no KEV listing, so this is a moderate-priority patching item rather than an emergency, with patched builds not exploitable.
Local privilege escalation in the Windows Audio Service (audiosrv) lets an authenticated, low-privileged attacker who already has code execution on a Windows host corrupt memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the high attack-complexity value indicates the trigger likely depends on a race or a specific allocation/free timing window, making it unreliably repeatable rather than a one-shot exploit. Microsoft has published fixes through its update guide, and no public exploit code has been identified at time of analysis; the CVE was not listed in CISA KEV as of this assessment, so there is no confirmation of active exploitation.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated, low-privileged attacker already running code on a Windows host to corrupt kernel memory and gain SYSTEM-level execution. The flaw is a use-after-free (CWE-416) reachable from a standard user context; per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H it requires pre-existing local, authenticated access (PR:L, AV:L) with no remote or unauthenticated path, and the high attack complexity (AC:H) reflects the need to win a timing/race window and reliably reclaim the freed object, which lowers exploitation reliability. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft rates it 7.0 (High) and has released fixes across all supported Windows 10, Windows 11, and Windows Server branches.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already holds low-level code execution on a host raise privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. The bug is a kernel type confusion (CWE-843) in an always-present, in-box WinSock component reachable by ordinary users through standard socket APIs, but exploitation is rated high-complexity (AV:L/AC:H/PR:L/UI:N) because a reliable trigger likely depends on winning a race or reaching a precise kernel object/memory state, which lowers real-world reliability. This is a genuine but moderate-priority local privilege-escalation issue: no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), while Microsoft has published fixes through its standard update channel.
Local privilege escalation in Windows Push Notifications allows an attacker who already holds a low-privileged authenticated local session to gain SYSTEM-level code execution by exploiting a timing-dependent use-after-free (CWE-416), but the high complexity score (AC:H) and race-condition requirement make successful exploitation unreliable. Microsoft has released patches, and no public exploit has been identified at time of analysis. The flaw scores 7.0 CVSS and can lead to full confidentiality, integrity, and availability impact, yet the mandatory local access prerequisite makes it a genuine but not top-priority issue.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated, low-privileged attacker who already has local code execution on the host to corrupt kernel memory and elevate to SYSTEM by winning a timing-dependent use-after-free race in the socket subsystem. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, total technical impact), requires no user interaction, and affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, though exploitation is non-trivial and not automatable per CISA SSVC (Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor-released patches are available for every affected build.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated attacker who already holds low-privileged code execution on a host to corrupt kernel memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) that requires winning a race condition (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), which limits reliability and keeps the flaw non-automatable per the CISA SSVC assessment; no public exploit code has been identified at time of analysis and exploitation has not been observed. Every supported Windows client and server edition, including Server Core installations, is affected until updated to the fixed builds published by Microsoft, and practical risk is concentrated on shared or multi-user hosts where untrusted users can run local code.
Local privilege escalation in the Windows kernel allows an authenticated attacker holding only low privileges on a vulnerable host to trigger a use-after-free (CWE-416) and gain code execution at higher integrity, with full confidentiality, integrity and availability impact per the CVSS vector (7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already be logged on locally and no user interaction is required, but the high attack complexity means success depends on reliably reclaiming a freed kernel object, a timing-sensitive operation requiring build-specific memory-layout knowledge across the large set of affected Windows 10, Windows 11 and Windows Server builds below their fixed patch levels. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and not automatable, making this a moderate-priority patch item rather than an emergency; vendor patches with explicit fixed build numbers are available via the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Audio Service lets an attacker who already holds low-privilege code execution on a Windows host trigger a use-after-free (CWE-416) and elevate to a more privileged context. The flaw is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and local code execution, and the high attack complexity reflects a race/timing window that must be won, making exploitation non-deterministic. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and non-automatable, and the issue does not appear in CISA KEV; completely patched builds are available from Microsoft.
Local privilege escalation in the Windows Event Tracing (ETW) subsystem allows an attacker who already holds low-privileged code execution on a host to raise their privileges, with high confidentiality, integrity and availability impact (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use-after-free (CWE-416) that is only reachable locally and additionally requires winning a timing race, so reliable exploitation is non-trivial; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, with CISA SSVC scoring exploitation as 'none' and automatable as 'no'. Microsoft has released a vendor patch, and risk is concentrated on multi-user, terminal/RDP, or shared systems where untrusted low-privilege accounts can run code - a moderate, not emergency, priority.
Local privilege escalation in the Windows Audio Service (audiosrv) affects Windows 11 versions 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core), allowing an attacker who already holds a low-privileged foothold on the host to execute code in a more privileged context. Exploitation requires an authenticated local attacker with the ability to interact with the audio service (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity indicates the use-after-free hinges on a race or specific heap/object state that is difficult to trigger reliably; the service runs by default, so every affected build is exposed once a foothold exists. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and the issue is not automatable, so this is a genuine but moderate-priority local privilege escalation rather than an urgent remote threat; a vendor patch is available.
Local privilege escalation to SYSTEM in the Windows Win32k kernel subsystem affects Windows 10, Windows 11, and Windows Server releases, allowing an authenticated low-privileged attacker already executing code on the host to exploit a use-after-free (CWE-416) condition and gain full kernel-level control (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The high attack complexity (AC:H) reflects the need to reliably win a race or groom the kernel heap, and there is no remote or network vector, so multi-user, RDP/terminal-server, and kiosk systems are the most relevant risk surface. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows DHCP Server lets an authenticated, low-privileged user trigger a use-after-free (CWE-416) in the DHCP Server service and obtain SYSTEM-level code execution on the host. It is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already have local access and must win a non-deterministic race to reach the freed-memory window, so the flaw is not remotely reachable and is best treated as a post-compromise escalation step on provisioned DHCP infrastructure rather than an emergency. No public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows Update Service allows an attacker who already possesses valid low-privileged local access on an affected Windows host to elevate to a higher-integrity context (including SYSTEM) by triggering a use-after-free. The attack is entirely local - there is no network-facing path - and the assessed vector (AV:L/AC:H/PR:L/UI:N) means successful exploitation depends on winning a race/timing window inherent to the memory-reuse condition, so reliable elevation may require multiple attempts and is not a deterministic one-shot. Affected unpatched builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019/2022/2025 (Server Core included); no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, making this a legitimate but moderate-priority LPE rather than an urgent, broadly exploited threat.
Local privilege escalation in Windows Work Folders allows an attacker who already holds authenticated, low-privileged access on an affected Windows 10, Windows 11, or Windows Server host to trigger a use-after-free in the Work Folders code path, corrupting memory and potentially executing code with elevated privileges. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms this is a post-compromise escalation step that requires an existing local foothold and a reliably won race/timing window, with no user interaction; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released fixed builds through the MSRC update guide, so the primary risk is to unpatched hosts where the Work Folders feature is present and in use.
Use-after-free in Windows Secure Kernel Mode allows an authenticated attacker running code locally on the target with low/standard-user privileges to escalate to higher privilege levels on affected Windows 10, Windows 11 and Windows Server 2019-2025 builds that are below their patched versions. The flaw is rated CVSS 7.0 (HIGH); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exploitation is gated by high attack complexity because a reliable UAF typically requires winning a timing race or precisely grooming Secure Kernel memory. Microsoft has released vendor patches - applying the fixed builds removes the condition entirely.
Local privilege escalation in Windows Direct Composition (DComp) lets an attacker who already has low-privileged code execution on an affected Windows 11 or Windows Server host escalate to SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) that requires winning a heap-grooming race window, so it is rated high complexity (AC:H) and carries a CVSS of 7.0; exploitation is local and the attacker must be authenticated (PR:L, AV:L) with no user interaction needed (UI:N). Microsoft has released fixes for every affected branch, and there is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as "none," making this a moderate-priority patch item rather than an emergency.
Local privilege escalation in Microsoft's Quality Windows Audio/Video Experience (QWAVE) service stems from a use-after-free condition (CWE-416) that can let an already-authenticated local user execute code in the service's more privileged context, with high impact to confidentiality, integrity and availability (C:H/I:H/A:H). Rated CVSS 7.0 with a vector of AV:L/AC:H/PR:L/UI:N/S:U, exploitation requires an attacker who already holds a local account on the host and who can also win a timing or object-lifetime race - CISA's SSVC assessment records Exploitation=none and Automatable=no, and there is no public exploit identified at time of analysis. Microsoft has shipped vendor-released patches for every affected branch, so this is best treated as a moderate-priority post-foothold escalation whose realistic risk is lower than the base score alone suggests, rather than an emergency to be handled outside the normal patch cycle.
Local privilege escalation in Windows NTFS allows an authenticated attacker with low privileges to gain SYSTEM-level code execution by triggering a use-after-free race condition in the kernel filesystem driver. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 22H2 <10.0.19044.7807). Exploitation requires a local foothold and is complicated by the timing-dependent nature of the flaw (CVSS AC:H), and no public exploit has been identified at the time of analysis; a vendor-released patch is available.