Local privilege escalation in the Windows Installer (msiexec) component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free and run code at a higher integrity level, including SYSTEM. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, all of which Microsoft has patched (for example Windows 11 24H2 at 10.0.26100.9711 and Windows Server 2025 at 10.0.26100.33650). No public exploit identified at time of analysis, CISA's SSVC records exploitation as 'none', and the High attack complexity (AC:H) rating implies a timing- or race-dependent primitive that will be unreliable for attackers; this is a genuine but non-emergency escalation issue requiring an existing local foothold rather than a remote, unauthenticated threat.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds a low-privileged, authenticated foothold on a Windows host convert that access into elevated rights by triggering the release of an invalid pointer or reference inside the management service. The flaw is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local, requires standard-user privileges, needs no user interaction, and carries a high-complexity success condition, so exploitation is not deterministic and depends on winning a specific timing or state condition in the service. No public exploit code exists and there is no CISA KEV listing (SSVC exploitation: none), and Microsoft has released an update through its security update guide, making this a genuine but moderate-priority patching item rather than an urgent, actively exploited threat.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authenticated, low-privileged local user trigger a use-after-free and gain code execution at a higher integrity level, ultimately SYSTEM on affected Windows hosts. The vulnerability carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning prior local access and a low-privileged foothold are required, and the high attack complexity implies the memory corruption depends on winning a timing or allocation race rather than succeeding reliably on a single attempt. Every currently supported Windows client and server edition is in scope, from Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2012 through Server 2025; vendor patches are available, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) lets an attacker who already holds a low-privileged, authenticated account on a Windows host trigger a use-after-free in the WER subsystem and elevate to SYSTEM-level code execution. The flaw spans a very broad set of supported releases - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 (including Server Core installations) - but exploitation requires local access and is rated high complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), since reliable abuse almost certainly depends on winning a memory-reclamation race under controlled heap conditions. No public exploit code has been identified at time of analysis and CISA's SSVC framework records exploitation as 'none'; vendor-released patch builds are available for each affected branch, making this routine patch-cycle work rather than emergency response.
Local privilege escalation in the Windows Device Association Service allows an authenticated low-privileged attacker who already has code execution on a host to win a use-after-free race inside the service and obtain SYSTEM-level code execution, turning a foothold into full control of the machine (CVSS 7.0, CWE-416). Exploitation is constrained by prerequisites and reliability: the vector is local only (AV:L), requires prior low-privileged credentials (PR:L), and carries high attack complexity (AC:H) because the memory-reuse window is timing-dependent, which is why CISA's SSVC records Exploitation: none and Automatable: no; no public exploit code has been identified at time of analysis. The hosts most at risk are multi-user, shared, or terminal-server Windows systems where untrusted local users can repeatedly attempt the race, making this a moderate-priority local privilege escalation rather than an emergency.
Use-after-free memory corruption in the Windows Device Association Service (DeviceAssociationService) lets an authenticated, low-privileged local user elevate to the privileges of the affected service and gain full control of confidentiality, integrity and availability on the host. Exploitation is local and requires an existing foothold with low privileges (PR:L) plus a win in a timing race (AC:H), so it is a post-compromise privilege-escalation primitive rather than a remote entry point; no user interaction is needed (UI:N), and because it is a default Windows component the service is present on all listed builds. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable, so signals align toward a moderate, non-urgent priority even though vendor patches are already available.
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) stems from a use-after-free memory-safety flaw (CWE-416) that an attacker with low-privileged local access can trigger to gain SYSTEM-level code execution. Real-world exposure is narrow: RRAS is not installed or running by default, so only hosts configured as VPN, NAT, or routing gateways are realistic targets, and exploitation depends on winning a timing race (CVSS AV:L/AC:H/PR:L, high attack complexity), which CISA SSVC assesses as not automatable with no observed exploitation. Microsoft has released a vendor patch, and no public exploit identified at time of analysis - this is a moderate-priority, not emergency, vulnerability whose practical risk sits below what the 7.0 base score alone suggests.
Local privilege escalation in Microsoft Windows Win32K allows an attacker who already holds a low-privileged local account to corrupt kernel memory and elevate to SYSTEM-level rights via a use-after-free condition (CWE-416). Exploitation is confined to the local host (AV:L, PR:L) and is gated by high attack complexity (AC:H) because the attacker must win a timing window in kernel object lifetime management; no user interaction is required and the flaw affects default configurations of Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 below the patched builds listed in EUVD-2026-99399. There is no confirmed active exploitation (CISA KEV is not present) and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, though technical impact is total once code execution is achieved. Microsoft has released fixes, and Microsoft product versions with the vendor update applied are not affected.
Local privilege escalation in Windows Hello lets an attacker who already holds a valid low-privileged account and code execution on an affected Windows host win a use-after-free race in the authentication component and elevate to a higher-integrity context with high confidentiality, integrity, and availability impact. The vulnerability is not remotely reachable (AV:L, PR:L) and requires no user interaction (UI:N), but the high attack complexity (AC:H) reflects a timing-dependent memory-reuse window that must be won and is not reliably repeatable; CISA's SSVC assessment rates exploitation as none and automatable as no. No KEV listing and no public exploit code were identified at time of analysis, so despite a 7.0 CVSS base score the practical risk is moderate and should not outrank remotely exploitable, actively exploited issues in the same patch cycle. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2/26H1, and a vendor patch is available.
Local privilege escalation in the Windows Bluetooth Port Driver lets an authenticated user who already holds a foothold on a Windows host trigger a heap-based buffer overflow and reach high-integrity code execution, scored CVSS 7.0 with total confidentiality, integrity, and availability impact. The defect (CWE-122) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 builds that predate the current cumulative updates, is not remotely reachable, and requires local access with low privileges, no user interaction, and high attack complexity (AV:L/AC:H/PR:L/UI:N). Microsoft has released a vendor patch, CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis - this is a genuine but second-tier priority behind remotely reachable or confirmed-exploited issues.
Use-after-free in Windows Hello allows an authenticated local attacker to elevate privileges to SYSTEM on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) builds. Exploitation requires the attacker to already hold low-privilege code execution on the target host (AV:L, PR:L) and depends on winning a non-deterministic memory-reuse race (AC:H), making this a post-compromise escalation path rather than a remotely reachable flaw. No public exploit code has been published and no active exploitation has been observed (CISA KEV not applicable, SSVC exploitation: none); Microsoft has released vendor patches, and this is best treated as a genuine but moderate-priority issue rather than a drop-everything emergency.
Local privilege escalation in Microsoft Windows Hello allows an attacker who already holds low-privilege code execution on a vulnerable Windows build to corrupt memory inside the Hello authentication component and elevate privileges on the host. Affected platforms span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, all of which have vendor-supplied fixes available. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the flaw non-automatable because success depends on winning a timing-sensitive memory-reuse race rather than executing a deterministic payload.
A use-after-free in the Microsoft Windows Installer service (msiserver / msiexec) lets an attacker who already holds low-privilege local access on a Windows host corrupt heap memory and elevate to SYSTEM, giving full control over confidentiality, integrity and availability of the machine (CVSS 7.0, CWE-416). The flaw is local-only (AV:L), requires low-privilege credentials (PR:L) and no user interaction (UI:N), but high attack complexity (AC:H) reflects a timing- or heap-state-dependent trigger that makes reliable weaponization difficult; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none and automatable as no. Vendor-released patches are available from Microsoft, so this is a genuine but not top-tier priority - a routine monthly-update item rather than an emergency, though the total technical impact justifies prompt patching of any host reachable by untrusted local users.
Local privilege escalation in the Windows Device Association Service lets an authenticated low-privileged user on a Windows host trigger a use-after-free (CWE-416) memory-corruption condition and execute code with elevated rights, yielding high confidentiality, integrity, and availability impact within an unchanged security scope (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025 are affected, but an attacker must already be able to run code on the machine, making this a post-compromise escalation primitive rather than a remote entry point. High attack complexity (AC:H) means reliable exploitation depends on winning a race or forcing a specific freed-memory reuse, which SSVC reflects as not automatable; no public exploit code has been identified at time of analysis and there is no KEV entry, while Microsoft has released fixed builds.
A stack-based buffer overflow in the Windows Installer (msiexec) component allows an authenticated attacker holding a low-privileged local account to elevate privileges to SYSTEM on affected Windows hosts. The flaw is local-only (AV:L) and requires no victim interaction, but carries High attack complexity (AC:H), meaning a race condition or a specific system state must be won before the overflow can be reliably triggered, which limits practical exploitability to shared and multi-user systems such as RDS/terminal servers rather than typical single-user endpoints. No public exploit code has been identified at time of analysis and no active exploitation is confirmed (CISA SSVC exploitation: none); the high EPSS-style urgency signals are absent, and Microsoft has released a vendor patch, making this a genuine but moderate-priority issue that should be handled through normal patch cycles.
Local privilege escalation in Microsoft Windows Event Tracing (ETW) lets an authenticated attacker who already holds low-privileged local access on a target host trigger a use-after-free condition (CWE-416) and execute code in a more privileged security context, potentially reaching SYSTEM. The flaw carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is a local-only primitive that requires pre-existing low-privilege credentials, no user interaction, and is gated by High Attack Complexity because reliable exploitation hinges on winning a memory-lifecycle race rather than a deterministic trigger. All supported Windows client and server builds below the vendor-patched revision levels are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2016/2019/2022/2025 and their Server Core installations, and Microsoft has released fixes; there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC framework rates exploitation as none and the activity as not automatable, so this should be treated as a high-value post-compromise escalation primitive rather than an imminent mass-exploitation threat.
Local privilege escalation in the Windows Installer service (msiexec) on affected Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-privileged local code execution to elevate to a higher-integrity context by winning a use-after-free race in Installer memory handling. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CWE-416) and is not remotely reachable - it requires local access, no user interaction, and a timing-dependent heap race that the AC:H rating marks as unreliable from attempt to attempt, which is why SSVC rates it Automatable=no with Exploitation=none. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); Microsoft has released fixes, so this is a legitimately dangerous-but-not-urgent flaw whose practical risk is concentrated in environments where untrusted users or malware already run on unpatched hosts. This assessment is consistent with the feed's SSVC signal (technical impact total, no exploitation observed) and the high-complexity local vector.
Local privilege escalation in Windows Now Playing Session Manager allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free (CWE-416) memory corruption. Affected are default installations of Windows 10 (21H2, 22H2, 1607, 1809), Windows 11 (23H2 through 26H2), and Windows Server 2016-2025 below the patched builds. No public exploit identified at time of analysis; exploitation requires high attack complexity (AC:H) and is not automatable per CISA SSVC, though a vendor patch is available.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated attacker who can already execute code on a target host to trigger a use-after-free in kernel memory and elevate to SYSTEM. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation hinges on winning a kernel race condition, and the affected code is a standard OS component present by default on Windows 10 1809 through Windows 11 26H2 and Windows Server 2019 through 2025. There is no remote attack path, no user interaction is needed, no non-default configuration is required, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; a vendor patch is available.
Local privilege escalation in the Windows Volume Manager Extension Driver affects unpatched Windows 10, Windows 11, and Windows Server builds, allowing an authenticated attacker who already holds low-privilege local access to trigger an out-of-bounds read that corrupts kernel memory handling and elevates privileges to SYSTEM. The CVE's CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and CISA SSVC assessment (Exploitation: none, Automatable: no) both indicate exploitation is not reliably repeatable or automatable - success depends on memory-layout or timing conditions outside the attacker's direct control, and there is no public exploit identified at time of analysis. This is a moderate-priority local EoP issue rather than an urgent internet-facing emergency: it is not remotely exploitable, requires pre-existing local access, and Microsoft has released patches, though the same code path touches both confidentiality and integrity of the kernel, so the impact when it does succeed is total.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an attacker who already holds low-privileged local access on a Windows host to elevate to higher integrity, and potentially to SYSTEM, by triggering a use-after-free during error-report handling. Only unpatched Windows 10/11 builds (23H2 through 26H2) and Windows Server 2012 through 2025 up to the build thresholds listed by Microsoft are affected; patched builds are not vulnerable. Exploitation requires authentication (CVSS PR:L) and is rated high complexity (AC:H) because the memory-reuse condition must be won reliably, which is consistent with CISA SSVC scoring of Autonomable: no - no public exploit code has been identified and there is no KEV listing, so the practical risk is a local, post-compromise escalation primitive rather than an urgent remote threat. A vendor patch is available.
A use-after-free in the Windows TCP/IP kernel stack lets an attacker who already holds valid low-privileged local access on a Windows host escalate to SYSTEM-level privileges (CVSS 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation is not remotely reachable despite the TCP/IP component name: the attacker must locally drive the network stack into freeing a kernel object and then win a timing-dependent race to reclaim it, which makes reliable exploitation difficult. Vendor patches are available for all listed builds and no public exploit code has been identified at time of analysis, so this is a moderate-priority local privilege-escalation hardening item rather than an emergency.
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds a low-privileged authenticated account on a Windows host raise their privileges to SYSTEM or administrative level by triggering a heap-based buffer overflow (CWE-122) that stems from an integer underflow during MSI package processing. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 including Server Core, while fully patched builds such as Windows 11 24H2 10.0.26100.9711 and Windows Server 2022 10.0.20348.5761 are not vulnerable. Scoring is 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker needs local access and an existing low-privilege account but no user interaction, and the high attack complexity (AC:H) reflects timing or memory-layout conditions that are not reliably under the attacker's control. There is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC rates exploitation as none and the flaw as not automatable, so realistic risk sits below the raw 7.0 for most environments.
Local privilege escalation in the Windows Audio Service (Audiosrv) lets an authenticated local attacker holding only low privileges (PR:L) escalate to full control of the host by corrupting memory through a use-after-free (CWE-416), with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is confined to a post-compromise scenario: the attacker must already have code execution on the machine and must win a timing race against the service (AC:H), and no user interaction is required (UI:N). Microsoft has published a vendor fix, and there is no public exploit identified at time of analysis; because the vector is purely local, affected organizations should treat this as an endpoint privilege-escalation risk rather than a remote attack surface item.
Local privilege escalation in the Windows Smart Card subsystem allows an attacker who already holds authenticated low-privilege access on a target host to corrupt memory through a use-after-free (CWE-416) and elevate to a higher-integrity context, including SYSTEM, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0, vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is local-only and requires a race or specific timing/memory-state window to be won (AC:H), so it is a post-compromise escalation primitive rather than a remote entry point; no user interaction is required and the Smart Card component ships enabled by default on all supported Windows releases, so no special configuration is needed to reach the flawed code. Microsoft has released vendor fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds low-level (standard user) rights on a Windows host trigger a use-after-free and gain SYSTEM-level code execution. Every supported Windows client and server release in scope is affected - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Exploitation is local-only and gated by high attack complexity (a memory-reuse race), so it is a post-compromise escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis, and no CISA KEV listing.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver (vhdmp) allows an authenticated attacker with existing low-privileged code execution to gain SYSTEM-level privileges by triggering a use-after-free. Exploitation requires winning a timing/race window (AC:H) and is therefore not deterministic; no public exploit code has been identified at time of analysis. The vulnerability affects a broad range of Windows client and server editions and has been patched by Microsoft.
A use-after-free in the Microsoft Windows Search Component allows an authenticated local attacker with low privileges to elevate to SYSTEM-level code execution on affected Windows client and server builds. Exploitation requires the attacker to already be running code on the host and is constrained by high attack complexity (AC:H), consistent with winning a memory-reuse race in the search/indexing component that depends on precise timing and heap state and may need repeated attempts; no user interaction is required. This is a moderate-priority local privilege-escalation issue rather than an emergency: there is no public exploit identified at time of analysis, SSVC records Exploitation as 'none', and Microsoft has released fixes (vendor advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70150).
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker with a low-privileged local account corrupt memory and potentially execute code at a higher integrity level. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires prior authentication, needs no user interaction, and carries high attack complexity because the attacker must reliably reclaim a freed object. Microsoft has released vendor patches; no public exploit code has been identified, and CISA's SSVC assessment records exploitation as none with the issue not automatable (technical impact: total).
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds valid low-privilege credentials on an affected Windows host free an object and then reallocate it under their control, corrupting memory inside the component's elevated process. Impacted builds are Windows 11 24H2, 25H2, 26H1 and 26H2 alongside Windows Server 2025 (including Server Core installations) at versions below the fixed build numbers published by the vendor. No public exploit code identified at time of analysis and CISA's SSVC assessment records exploitation as none with the flaw rated non-automatable, but the vendor has shipped a patch and the technical impact is assessed as total (high confidentiality, integrity and availability loss).
Local privilege escalation in Microsoft's Windows Search Component lets an authenticated attacker who already holds a low-privileged session on a Windows host trigger a use-after-free and elevate to a more privileged security context on the same machine. Exploitation is constrained by a high attack complexity rating (AC:H), reflecting a race/timing condition on the freed object that must be won reliably, and the vector (AV:L/PR:L/UI:N) confirms the attacker must already be logged in locally with low privileges; there is no remote attack surface and no victim interaction required. Patches are available from Microsoft (fixed builds such as Windows 11 24H2 10.0.26100.9711 or later), CISA's SSVC assessment records exploitation as none and the issue as not automatable, and no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows VHD Miniport Driver allows an authenticated attacker with low privileges to gain full system control by triggering a heap-based buffer overflow. The vulnerability is locally exploitable and requires high attack complexity (AC:H), indicating a race condition or precise heap grooming is necessary for successful exploitation. No public exploit code has been identified, and the EPSS score is not available; however, a vendor patch is available via Microsoft's security update guide.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows a low-privileged attacker who already holds an interactive session on a Windows host to elevate to higher integrity, including SYSTEM, by triggering a use-after-free memory corruption in the installer service. Successful exploitation requires winning a race/timing window (AC:H) rather than a simple reliable trigger, and no user interaction is needed from a victim; the CVSS 3.1 vector resolves to AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H for a base score of 7.0. At the time of analysis there is no public proof-of-concept and no confirmation of active exploitation (CISA KEV), so this is assessed as a genuine but moderate-priority privilege-escalation issue that matters most on multi-user, RDP-accessible, or shared-workstation deployments where untrusted users already have local logon rights.
Local privilege escalation in the Windows Update Delivery Optimization service allows an authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free (CWE-416) in the Delivery Optimization service (DoSvc), which is enabled by default on supported Windows client and server editions. Rated CVSS 7.0 (High) with High confidentiality, integrity and availability impact, exploitation requires prior local access (AV:L/PR:L) and no victim interaction (UI:N), but depends on winning a race/timing condition (AC:H), making reliable escalation non-trivial. No public exploit identified at time of analysis, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in Microsoft Windows through the Software Protection Platform (SPP) service allows an authenticated attacker holding a low-privileged local account to trigger a use-after-free condition and ultimately execute code with elevated (SYSTEM) privileges. Exploitation is local-only and gated by a high-complexity precondition (a timing/allocation window that must be won), so this is a moderate-priority elevation-of-privilege issue rather than a remote emergency; no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV). Default installations of the affected Windows client and server builds carry the SPP service, so no unusual feature enablement is required, but the attacker must already have local code execution or a valid low-privileged account on the host.
Local privilege escalation in the Windows Broadcast DVR User Service - the component implementing GameDVR/game capture and broadcast functionality - lets an attacker who already holds a low-privilege, authenticated foothold on the host trigger a use-after-free (CWE-416) in the service and gain code execution at a higher privilege level. The flaw is rated 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: it requires local authenticated access (PR:L) and the successful winning of a high-complexity timing race (AC:H) to take control of the freed object, with no user interaction and no remote or unauthenticated path. This is therefore a moderate-priority, post-compromise escalation most relevant to shared or multi-user Windows hosts; no public exploit code has been identified at time of analysis, and neither CISA KEV status nor an EPSS score was supplied in the source data.
Local privilege escalation in Windows Autopilot (a component of Windows 11 24H2, 25H2, and 26H2) allows an attacker who already holds low-privileged local access to trigger a use-after-free and gain SYSTEM-level privileges. Exploitation requires an existing authenticated local foothold (PR:L, AV:L) and is complicated by a race-condition-style high attack complexity (AC:H), so it is not remotely or anonymously reachable and is not reliably triggered on demand. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not automatable), and vendors have released patches fixing the flaw in build 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), and 10.0.26300.9711 (26H2).
Local privilege escalation in the Microsoft Windows Kerberos component lets an attacker who already holds low-privileged code execution on a target host trigger a double-free memory-corruption condition (CWE-415) and elevate to a higher-integrity context. Per the assessed vector (AV:L/AC:H/PR:L/UI:N), the attack is strictly local and requires an authenticated low-privileged foothold, with high complexity reflecting the need to win a race or reach a specific memory/timing state that is not reliably reproducible, which materially limits weaponization; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS signal was supplied. The flaw is present in default installations of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds below their patched levels, and Microsoft has released updates (MSRC update guide referenced for CVE-2026-108132).
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker with low-level privileges to gain elevated privileges on affected Windows systems. The use-after-free flaw requires winning a memory-timing race condition (high attack complexity, CVSS 7.0), making reliable exploitation difficult. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker to gain elevated privileges by exploiting a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires local access (PR:L) and high attack complexity (AC:H), but successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 7.0). No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an attacker who already holds a low-privileged local account corrupt kernel heap memory and potentially elevate to SYSTEM. The defect is a heap-based buffer overflow (CWE-122) reachable by submitting I/O to the VHD storage stack, and with a CVSS 3.1 base score of 7.0 and High attack complexity (AC:H), reliable exploitation usually depends on heap-layout grooming or winning a timing window rather than a single deterministic request. Microsoft is the reporting vendor and no public exploit code or confirmed active exploitation has been identified at time of analysis; this is best treated as a moderate-priority local privilege escalation, not an emergency remote threat.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an authenticated low-privileged attacker to execute code at a higher integrity level on affected Windows 10 and Windows 11 systems. The flaw is a use-after-free (CWE-416) in a default Game DVR/broadcast component; exploitation requires existing local access (AV:L/PR:L) and success is limited by high attack complexity (AC:H) due to a specific memory-reuse or race condition. No user interaction is needed (UI:N), there is no network attack vector, and no public exploit identified at time of analysis (no KEV or POC data was provided).
Privilege escalation in the Windows Win32k kernel subsystem lets an authenticated local attacker who already holds a low-privileged foothold (CVSS PR:L, AV:L) corrupt kernel memory via a use-after-free (CWE-416) and elevate to SYSTEM-level code execution with high confidentiality, integrity, and availability impact. Because the vulnerability depends on a timing-sensitive race or a specific memory-reclamation state, the attack complexity is rated high (AC:H) and success is non-deterministic, confining this to post-compromise escalation rather than initial access; no user interaction is required (UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS base score of 7.0 reflects the local-only vector tempered by the unreliable race condition.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) lets a low-privileged, already-authenticated user on the same machine trigger a use-after-free condition and obtain higher-integrity code execution, with full confidentiality, integrity, and availability impact scored at CVSS 7.0. Microsoft's authoritative fix information is published through the MSRC Security Update Guide entry for CVE-2026-102197; exploitation is not remotely reachable and is complicated by the high attack complexity of the underlying race/timing-dependent heap condition, and no public exploit code has been identified at time of analysis. This is a legitimately serious local elevation-of-privilege flaw but not an emergency.
Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds low-privileged, authenticated local access to a Windows client host corrupt memory via a use-after-free (CWE-416) and potentially gain full system-level read, write, and execute control. The vulnerability is rated CVSS 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable, requires no user interaction, but is gated by high attack complexity - exploitation likely depends on winning a race condition or precise heap grooming, so success is probabilistic rather than guaranteed. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the EPSS-style risk signal is not provided, and Microsoft's MSRC update guide is the authoritative source for the fix.
No public exploit identified at time of analysis for a local privilege-escalation use-after-free (CWE-416) in the Windows Graphics Kernel that allows an authenticated attacker with low privileges to elevate to higher privileges, potentially achieving SYSTEM-level code execution. The vulnerability requires local access and high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), as the exploit likely depends on winning a race condition or reliable kernel-heap grooming. No active exploitation is confirmed, and no patch version is specified; apply Microsoft's update when available and monitor the advisory.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker to elevate privileges on the host by triggering a use-after-free. The flaw affects Windows systems where the service is present, requires local access and high attack complexity, and no public exploit code has been identified at time of analysis. Successful exploitation could result in full compromise of confidentiality, integrity, and availability of the affected system.
Local privilege escalation in the Windows Storage component lets an authenticated, low-privileged user already running code on a Windows host drive a heap-based buffer overflow to gain high-integrity (SYSTEM-level) privileges. Exploitation is not remote: it requires an existing local session (CVSS AV:L, PR:L) and no user interaction (UI:N), but the high attack complexity (AC:H) means the attacker must win a non-deterministic heap-layout or timing condition, which makes reliable weaponization harder than a typical PR:L/AC:L elevation-of-privilege bug. At the time of analysis there is no public exploit identified, no EPSS or KEV signal in the provided intelligence, and the authoritative source for fixed builds is the Microsoft MSRC update guide; the moderate-priority character of this issue reflects that prior host access is a hard prerequisite and success is probabilistic.
Heap-based buffer overflow in the Windows Storage subsystem (CWE-122) allows an authenticated local attacker holding low privileges to elevate to a higher-privileged context on the affected host. The CVSS vector (AV:L/AC:H/PR:L/UI:N) and the assessment confirm the attacker must already be able to execute code locally and that exploitation is gated by high complexity, most likely a race condition or a carefully groomed heap layout, making success unreliable rather than repeatable. This is a moderate-priority local privilege-escalation issue rather than a remote emergency; no public exploit identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV). The supplied data does not enumerate affected Windows builds, so the MSRC update guide must be consulted for the precise vulnerable and fixed versions.
Local privilege escalation in Microsoft's Windows Storage component allows an attacker who already holds authenticated, low-privileged local access to trigger a heap-based buffer overflow and obtain elevated rights on the affected host. Exploitation is gated by High attack complexity (AC:H), meaning success depends on controlling heap layout or allocation state rather than being deterministic, so this is best treated as a second-stage escalation primitive following an initial compromise rather than an easily weaponized or remotely reachable bug. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).