Local privilege escalation in the Windows Clipboard Server component allows an attacker who already holds a low-privilege, authenticated local session on a Windows host to escalate privileges by triggering a NULL pointer dereference (CWE-476) in the clipboard handling path. Exploitation is constrained by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning a specific timing window or memory state must be won rather than a straightforward, repeatable sequence, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; affected builds span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 prior to the vendor-supplied fixed build numbers.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a use-after-free that yields high impact to confidentiality, integrity, and availability on affected Windows 11 and Windows Server 2025 hosts. Exploitation is local only and gated by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning the attacker must already hold a low-privileged foothold on the machine and win a heap-grooming or race condition to trigger the bug reliably, so it functions as a post-compromise escalation step rather than a remote attack path. No public exploit has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but patch availability from Microsoft makes unpatched systems the primary exposure.
Local privilege escalation in Microsoft Windows targets the Program Compatibility Assistant Service (PCASvc) and affects Windows 10, Windows 11, and Windows Server 2016 through 2025, letting an attacker who already holds low-privileged local code execution corrupt freed memory and escalate to SYSTEM. The root cause is a use-after-free (CWE-416) scored 7.0, and the assigned CVSS vector (AV:L/AC:H/PR:L/UI:N) makes clear that exploitation is gated by a timing-sensitive high-complexity memory-reclamation race rather than a deterministic trigger; the attacker must already have an authenticated local foothold and must successfully reclaim the freed object with controlled data. Microsoft has released a vendor patch and CISA's SSVC assessment records no exploitation and no automatable path, so there is no public exploit identified at time of analysis and no evidence of active exploitation (no CISA KEV listing).
Elevation of privilege in the Windows Error Reporting (WER) subsystem lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free in the crash-reporting path and escalate to higher-integrity code execution. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires winning a race window the attacker does not control, which makes it timing-dependent and non-trivial to weaponize; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. Microsoft has shipped vendor patches for every affected client and server build, so exposure is fully mitigated by patching even though the local privilege gain, if achieved, is total (C:H/I:H/A:H) within the unchanged security scope.
Local privilege escalation in the Windows Backup Engine allows an authenticated local attacker with low privileges to abuse link resolution during backup or restore operations and gain elevated privileges on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) systems below the vendor-patched build numbers. Exploitation requires a race or specific filesystem preconditions (CVSS AC:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patches via the MSRC update guide.
Local privilege escalation in the Microsoft Windows Update Service allows an attacker who already holds a low-privileged, authenticated local account to trigger a heap-based buffer overflow and corrupt memory in a service that runs with high privileges, potentially yielding full control of confidentiality, integrity and availability on the host (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the service listens on no network interface for this issue, exploitation requires an existing local foothold rather than remote access, and the High attack-complexity rating indicates a real reliability barrier - most likely a timing window or a specific heap layout that must be won before corruption succeeds. No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied, so this should be treated as a post-compromise escalation primitive rather than an opportunistic remote threat.
Local privilege escalation in the Windows Client License Service (ClipSVC) allows an authenticated low-privileged local attacker to execute arbitrary code at elevated integrity, potentially SYSTEM, via a heap-based buffer overflow (CWE-122). The vulnerability requires local access and high attack complexity (CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0), and there is no remote or unauthenticated path. No public exploit has been identified at the time of analysis, and exploitation is limited to scenarios where an attacker already has a foothold on the host, such as multi-user or terminal-server environments.
Local privilege escalation in the Windows Update Service on Microsoft Windows allows an authenticated attacker with low privileges to gain full control of a host by exploiting a use-after-free memory corruption flaw. The vulnerability requires high attack complexity to win a race condition, and no public exploit code has been identified at time of analysis. The CVSS 3.1 base score is 7.0 (HIGH), with full impact to confidentiality, integrity, and availability upon successful exploitation.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Privilege escalation in the Windows TCP/IP stack allows a locally authenticated, low-privileged user to trigger a kernel double free and, by winning the subsequent memory-reclamation race, gain code execution at higher (SYSTEM-level) integrity on unpatched Windows 10, Windows 11 and Windows Server builds. Exploitation demands an existing local foothold with at least low privileges and precise timing to line up kernel pool state, which is reflected in the high attack complexity component of the CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector; it cannot be triggered remotely or anonymously. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches. With a CVSS base score of 7.0 and a CISA SSVC assessment of total technical impact but no exploitation and no automatable path, this is a genuine but moderate-priority elevation-of-privilege flaw rather than an emergency, and matters most where low-privileged local access is common (RDP hosts, VDI, multi-user terminal servers).
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated low-privilege access on a Windows host to exploit a use-after-free memory-corruption condition and elevate to SYSTEM-level code execution. The flaw affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations, running builds below the vendor-supplied fixed build numbers. Exploitation is local-only (AV:L), requires an existing foothold with low privileges (PR:L), and carries high attack complexity (AC:H) because success depends on winning a non-deterministic memory-reclamation race; no user interaction by a victim is required, and no public exploit code or active in-the-wild exploitation has been identified at time of analysis (CISA SSVC Exploitation: none). Vendor patches are available from Microsoft, so the practical risk is concentrated in unpatched endpoints and multi-user systems where an attacker already has a standard account.
Local privilege escalation in the Windows Kerberos implementation allows an authenticated, low-privileged attacker who already has code execution on a target host to escalate to higher integrity and potentially SYSTEM-level rights through a use-after-free memory corruption. Exploitation is restricted to the local attack surface and carries high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must win a timing/race window against the freed Kerberos memory object, but no user interaction is needed and no non-default configuration is named as a prerequisite. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation: none), so this is best treated as a post-compromise escalation primitive that is difficult but high-impact if successfully triggered.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to trigger a use-after-free and escalate to SYSTEM-level code execution. Affected systems are Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) and Windows Server 2012 through 2025 editions running builds below the fixed levels published for CVE-2026-70156; the component is enabled by default on all of them, so no non-default configuration is required. Rated CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation hinges on winning a race or achieving a precise heap-reuse state, which lowers reliability, and no public exploit identified at time of analysis. The only material prerequisite is existing local access, making this a post-compromise escalation and persistence primitive rather than a remote entry point.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Local privilege escalation in the Windows Kernel lets an authenticated low-privileged user on unpatched Windows 11 (24H2, 25H2, 26H2) or Windows Server 2025 builds trigger a heap-based buffer overflow and execute code with SYSTEM-level privileges. Exploitation requires the attacker to already hold local access (PR:L, AV:L) and is complicated by a race on kernel heap state (AC:H), so it is not reliably triggerable on demand. No public exploit has been identified at time of analysis, patched builds are not exploitable, and this rates as a genuine but moderate-priority privilege-escalation issue rather than an emergency.
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Update component of unpatched Windows 10, Windows 11, and Windows Server installations lets a user who already holds a low-privileged local account corrupt memory and elevate to a higher-integrity context. Exploitation is gated by two factors: the attacker must already have an authenticated local foothold (AV:L, PR:L, no user interaction required), and the use-after-free is rated high attack complexity (AC:H) because it requires reliably winning a timing/race window and controlling the contents of the freed allocation, which is non-deterministic and typically needs heap grooming. No public exploit code has been identified at time of analysis, the vulnerability is not a confirmed actively exploited (CISA KEV) item, and Microsoft has released fixes, making this a genuine but moderate-priority privilege-escalation issue rather than a remotely reachable or wormable threat.
Local privilege escalation in the Windows USB Print Driver lets an authenticated attacker who already holds a foothold on a vulnerable Windows host corrupt kernel memory and obtain SYSTEM-level code execution. The flaw is a use-after-free (CWE-416) reachable only through the USB printing driver path; the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, base 7.0) requires valid local credentials and a successful race on freed kernel memory, so exploitation is timing-dependent, non-deterministic, and rated non-automatable by CISA SSVC. Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases, and no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows USB Print Driver (usbprint) lets an attacker who already holds a low-privileged local account corrupt kernel memory via a use-after-free and escalate to full system-level code execution on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a race-condition-driven memory corruption (CWE-416, high attack complexity) that requires the attacker to win a timing window and reclaim a freed kernel object, so it functions as a post-compromise escalation primitive rather than a remote entry point; exploitation is rated CVSS 7.0 with high confidentiality, integrity, and availability impact. No public exploit code exists for this issue and it is not confirmed actively exploited (CISA KEV); Microsoft has released updates addressing the affected builds.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
A use-after-free flaw (CWE-416) in the Windows USB Print Driver (usbprint.sys) allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows 10, Windows 11 and Windows Server builds that have not been updated. Exploitation requires the attacker to already hold low-privileged local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and to trigger the vulnerable code path while winning a heap-reuse/race window, making success probabilistic rather than deterministic. Microsoft has released vendor patches, and there is no public exploit identified at time of analysis.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
A use-after-free (CWE-416) in the Windows USB Print Driver lets an attacker who already holds a local, low-privileged account on a Windows host escalate to SYSTEM-level privileges by racing the driver into reclaiming a freed memory object. Successful exploitation requires winning a timing window (AC:H, PR:L, AV:L, UI:N), so the flaw is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code or evidence of active exploitation has been identified at time of analysis. Microsoft has released patched builds, and the CVSS 3.1 base score of 7.0 reflects high confidentiality, integrity, and availability impact confined to the local machine (S:U) - this is a moderate-priority local privilege escalation, not an emergency remote-compromise scenario.
A use-after-free in the Windows USB Print Driver (CWE-416) allows an attacker who already holds low-privileged local access to a Windows host to escalate privileges and obtain full control over confidentiality, integrity, and availability of the affected system. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022 and 2025 (including Server Core installations), per the EUVD version ranges. Exploitation requires winning a timing-dependent race in the driver (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), which CISA's SSVC rates as not automatable, and no public exploit has been identified at time of analysis - this is a post-compromise privilege-escalation primitive rather than an opportunistic remote threat, and Microsoft has shipped a vendor update addressing it.
Local privilege escalation in the Windows USB Print Driver enables an authenticated attacker with low-level privileges to achieve kernel-mode code execution by exploiting a use-after-free memory corruption condition (CWE-416). Microsoft has released patches covering Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core). No public exploit code or confirmed active exploitation has been identified at time of analysis (not listed in CISA KEV), and the high attack complexity (AC:H) - requiring a race or specific memory-state condition - materially limits reliable exploitation, making this a post-foothold escalation rather than an emergency.
Local privilege escalation in the Windows USB Print Driver (usbprint.sys) lets an authenticated, low-privileged user on the target host raise their privileges to SYSTEM by winning a use-after-free race in the driver's request-handling path. CVSS 3.1 scores it 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker must already have a foothold on the machine, no user interaction is needed, and the high attack complexity reflects the probabilistic nature of reclaiming the freed object. The affected builds are Windows 10 21H2/22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2022 and Windows Server 2025 (including Server Core); no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and Microsoft has published fixes, so this is a moderate-priority local escalation rather than an emergency remote threat.
Local privilege escalation in Windows Kernel allows an authenticated low-privileged user to gain elevated privileges by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation requires prior local code execution as a low-privileged user (PR:L, AV:L), has no user interaction (UI:N), and is made difficult by high attack complexity (AC:H) because the race/timing needed to trigger the freed object is not deterministic. This is a genuine but not top-tier priority; no public exploit identified at time of analysis, and SSVC records exploitation as none, with Microsoft providing vendor updates.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Local Security Authority (LSA) allows an authenticated attacker who already holds low-level local access on a Windows host to win a timing race against a use-after-free in the LSA process and obtain SYSTEM-level rights, with high impact on confidentiality, integrity, and availability. The flaw spans all supported Windows client and server releases, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations, per the EUVD version ranges; exploitation requires local access (AV:L) plus a difficult race condition (AC:H), so there is no remote or unauthenticated exposure. Signal convergence - CISA SSVC Exploitation 'none', Automatable 'no', no KEV listing, and no public exploit identified at time of analysis - makes this a moderate-priority local elevation-of-privilege issue rather than an emergency, with the highest practical risk on multi-user or RDP/terminal hosts where low-privileged users share a machine with sensitive assets.
Local privilege escalation in the Windows Kernel lets an authenticated attacker who already has low-privileged code execution on the host win a use-after-free race condition to obtain SYSTEM-level rights, yielding full compromise of confidentiality, integrity, and availability (CVSS 7.0, CWE-416). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds in the ranges listed by Microsoft are affected; the flaw is not remotely reachable, requires local authenticated access, and carries high attack complexity, so exploitation is likely unreliable and may need repeated attempts. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, not in KEV), and vendor patches are available, making this a credible but not top-tier priority for most environments.
Local privilege escalation in the Windows SMB Server allows an authenticated, low-privileged user with local logon rights to trigger a use-after-free in the SMB server component and obtain code execution at a higher integrity level, with high impact across confidentiality, integrity and availability. The flaw spans a wide range of Windows client and server branches - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - and is constrained by the local vector (AV:L, PR:L) plus a non-default timing/memory precondition (AC:H), meaning the freed object must be won through a race or specific reuse state rather than reliably on a first attempt. Vendor patches are available for every affected branch and no public exploit code had been identified at time of analysis; this is a moderate-priority local escalation rather than a top-tier emergency, since it presupposes an existing foothold and an unreliable exploitation window.
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free inside the installer service and gain elevated (SYSTEM-level) code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0): the attacker must win a non-deterministic race/heap-grooming window to reclaim the freed object, so the technique is not consistently reliable, and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation: none and Automatable: no. Vendor patches are available for the full affected build matrix spanning Windows 10 and Windows 11 (through 26H2) as well as Windows Server 2012 through Windows Server 2025, so this is a genuine but second-tier priority relative to remotely exploitable or actively exploited issues.
Local privilege escalation in Microsoft Windows Graphics Kernel allows an authenticated local attacker with low privileges to gain elevated (likely SYSTEM) privileges by triggering a heap-based buffer overflow. Affected versions include Windows 11 24H2, 25H2, and 26H2 prior to builds 10.0.26100.9711, 10.0.26200.9711, and 10.0.26300.9711 respectively, and Windows Server 2025 (including Server Core) prior to 10.0.26100.33650. No public exploit code or active exploitation has been identified, and the high attack complexity (AC:H) suggests exploitation requires precise heap grooming or winning a race condition, reducing reliability.
Local privilege escalation in the Windows MIDI Service Module allows an attacker holding low-privileged local access on an affected Windows 11 host to trigger a null pointer dereference (CWE-476) and escalate to a higher-integrity security context, with high impact to confidentiality, integrity, and availability. Exploitation requires authenticated local access (PR:L) and a non-deterministic, likely race- or timing-dependent trigger (AV:L/AC:H/UI:N), which materially reduces real-world reliability; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none. With a 7.0 base score and total technical impact if successfully triggered, this is best treated as a moderate-priority local elevation-of-privilege flaw to be closed on the normal patch cycle rather than an urgent internet-facing emergency.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft's Windows Installer service lets an attacker who already holds authenticated low-privilege local access free and then reuse a memory object, potentially seizing control of the SYSTEM-level installer process. Exploitation hinges on winning a non-deterministic race/timing window (AC:H, PR:L, AV:L), so CISA's SSVC rates exploitation as 'none' and automatable as 'no'; no public exploit identified at time of analysis and the flaw is not in CISA KEV, though the technical impact if successfully triggered is total (full confidentiality, integrity and availability loss). Microsoft has released vendor patches covering all affected Windows 10, Windows 11 and Windows Server builds.
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) on supported Windows 10, Windows 11 and Windows Server builds allows a low-privileged, locally logged-on user (PR:L, AV:L, UI:N) to win a use-after-free race inside the service and execute code in a higher-privileged service context. The issue is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), with high attack complexity reflecting the difficulty of reliably triggering and winning the memory-reuse race, and CISA's SSVC assessment records no exploitation, no automatable path and no public exploit identified at time of analysis. Because AppXSvc is default-enabled and the vector is strictly local, residual risk is concentrated on unpatched multi-user, shared or kiosk Windows hosts where any interactive account could repeatedly attempt the race; vendor patches are available and materially reduce that risk.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Windows Common Log File System (CLFS) kernel driver allows an attacker who already holds low-privileged execution or credentials on a host to abuse a use-after-free race in the driver and gain kernel-level (SYSTEM) privileges, per CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerable driver ships and loads by default on every listed Windows 10, Windows 11 and Windows Server build, so no non-default feature or configuration has to be enabled to reach the code - but the high attack complexity reflects the fact that the freed object must be reclaimed inside a narrow timing window, which weakens real-world reliability and complicates weaponization. No public exploit code has been identified and there is no evidence of active exploitation (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has published fixes for the affected builds.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects unpatched supported builds of Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2019, Server 2022, and Server 2025, where a use-after-free in the desktop compositor lets a locally authenticated, low-privileged attacker corrupt memory and run code at a higher integrity level. Exploitation requires an existing foothold on the host (AV:L/PR:L) and is rated high complexity (AC:H), consistent with a timing- or heap-state-dependent race in the graphics subsystem that an attacker must win reliably, so this is a genuine but moderate-priority elevation-of-privilege issue rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds through the MSRC update guide.
An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library can be triggered by a local, authenticated low-privilege attacker to leak memory and, in the assessed worst case, achieve local privilege elevation on affected Windows 10, Windows 11, and Windows Server builds. This is a credible but not emergency-tier priority: exploitation demands a pre-existing local foothold and high attack complexity (race or precise memory/heap conditioning), and no public exploit or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft advisory, so affected fleets should be updated through normal patch cycles rather than treated as an emergency.
Local privilege escalation in the Windows kernel TCP/IP stack allows an attacker who already holds a low-privilege foothold on a host to trigger a heap-based buffer overflow (CWE-122) and corrupt kernel memory, potentially gaining code execution at SYSTEM level. Successful exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N) and no user interaction, but the high attack complexity reflects the heap grooming or race conditions typically needed to turn kernel pool corruption into reliable code execution, so attempts are non-deterministic. Microsoft has published fixes for affected Windows 10, Windows 11, and Windows Server builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure is highest on multi-user, RDP, or shared workstation hosts where untrusted users can run local code.
Local privilege escalation in the WebDAV component of Microsoft Windows (CVE-2026-85828, CVSS 7.0) lets a low-privileged authenticated attacker who already holds a foothold on the host corrupt heap memory and gain elevated rights. Exploitation is local only (AV:L) and gated by high attack complexity (AC:H), reflecting the heap-layout or timing control needed to reliably win the CWE-122 overflow, so success is probabilistic rather than guaranteed; there is no network-facing path indicated in the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released patched builds for all affected Windows client and server branches via the MSRC update guide. This is best treated as a moderate-priority post-compromise hardening item rather than a critical remotely exploitable issue.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in Windows Composite Image File System (CimFS) affects Windows 11 24H2, 25H2, 26H1, and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core). An authenticated attacker who already has local access and standard user privileges (CVSS PR:L) and the ability to execute code that interacts with the CimFS driver can trigger a use-after-free (CWE-416) for high confidentiality, integrity, and availability impact inside the OS, though High attack complexity (AC:H) makes reliable exploitation dependent on winning a memory-reclamation race. Patch available per vendor advisory; no public exploit identified at time of analysis, and this is a medium-to-high priority local privilege escalation rather than a drop-everything emergency.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Local privilege escalation in the Windows Camera Frame Server Monitor allows an attacker who already holds a standard-user session on an affected host to drive a use-after-free in frame-server memory handling and elevate to SYSTEM-level code execution. Exploitation is local and needs no user interaction, but the assessed vector rates attack complexity as high (AC:H), meaning the attacker must realistically win a timing/race window against the service - a significant reliability barrier; no public exploit code has been identified at time of analysis. Only unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and Windows Server 2025 (including Server Core) are affected, and Microsoft has released vendor patches. This is a moderate-priority local privilege escalation flaw, not an internet-facing emergency.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
A use-after-free in the Windows WebDAV (WebClient) implementation allows an authenticated, locally-present low-privileged user to elevate privileges on the same host by winning a race-conditioned memory-reuse path (CWE-416, CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). All Windows client and server builds below their respective fixed build numbers are affected once the WebDAV client code path is reachable, with realistic exposure concentrated on multi-user hosts such as terminal servers, RDP session hosts and shared workstations where untrusted users can execute local code. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; no KEV listing), and Microsoft has released a vendor patch through the MSRC update guide.
Local privilege escalation in the Windows Cash Drawer Protocol Provider affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 builds, where an attacker who already holds authenticated local access can trigger a use-after-free in the cash drawer component and potentially execute code in a more privileged context (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained by high attack complexity because the dangling-pointer reuse must be timed precisely (race or controlled heap reuse), and there is no remote or unauthenticated path; a victim user does not need to be tricked into any action. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a moderate-priority local privilege escalation that should be handled through normal patch cycles. Microsoft rates the impact class as use-after-free/memory corruption with total technical impact, and the vendor has published a remediation update.