Local privilege escalation in Microsoft's Windows Storage component allows an authenticated attacker who already holds low-level privileges on the host to trigger a stack-based buffer overflow and gain elevated (likely SYSTEM-level) code execution. The vulnerability is not remotely reachable and requires no user interaction, but the high attack complexity (AC:H) means exploitation likely depends on winning a race or achieving a precise memory state, so it is harder to weaponize than the 7.0 base score suggests. No public exploit code has been identified and it is not listed in CISA KEV; this is an escalation-from-foothold primitive rather than an initial-access vector, making it a moderate-priority local privilege escalation for patching rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) stems from a use-after-free (CWE-416) memory corruption defect rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is confined to a local attack vector with low privileges required - an attacker must already hold a low-privileged foothold on the host and interact with the Cdpsvc service locally, and exploitation is gated by high attack complexity because it depends on winning a memory-reclamation race window, making reliable triggering difficult. Impact on a successful attempt is total (confidentiality, integrity, and availability high), allowing an authorized local attacker to elevate to SYSTEM-level privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.
Heap-based buffer overflow in the Microsoft Streaming Service, a Windows kernel-mode component, allows an attacker who already holds local access and low-privileged code execution on the host to elevate to SYSTEM-level privileges. The flaw is not remotely reachable: exploitation requires direct interaction with the affected kernel driver (AV:L) and a high-complexity trigger condition (AC:H), typically a race or a carefully shaped heap layout, so reliable exploitation is non-trivial even though no victim interaction is needed (UI:N). Per the available intelligence, there is no public exploit code and no KEV confirmation, so exploitation status at time of analysis is: no public exploit identified; the primary defence is prompt application of Microsoft's update from the MSRC advisory.
Local privilege escalation in the Microsoft Streaming Service lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free condition and elevate to full system privileges, yielding high confidentiality, integrity, and availability impact (CVSS 7.0). The flaw is a memory-corruption race condition reachable only from the local machine with a valid low-privileged session (AV:L, AC:H, PR:L, UI:N), so it provides no remote or network-facing attack surface and is not reliably exploitable on every attempt. No public exploit code and no active exploitation have been identified at time of analysis (CISA SSVC exploitation: none), but Microsoft has released patches for every affected Windows branch, so the primary risk is unpatched fleets where an attacker is already resident.
Local privilege escalation in the Microsoft Graphics Component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a heap-based buffer overflow and gain full control over confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected machine. The flaw is exploitable only from the local attack vector (AV:L) by an authenticated low-privileged principal (PR:L) with no user interaction required (UI:N), and the high attack complexity (AC:H) means success depends on winning a race or precisely grooming the heap layout, making exploitation non-deterministic rather than reliable. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it is primarily a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows Setup and Deployment component allows an attacker who already holds a low-privileged authenticated session on the host to invoke a critical setup/deployment function that performs no authentication check, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The flaw is not remotely reachable: it requires local access (AV:L), a pre-existing low-privileged account (PR:L), and the high attack complexity (AC:H) reflects an additional precondition such as a timing or state dependency during setup or deployment, so exploitation is a post-compromise escalation step rather than an initial-access or mass-exploitable vector. Affected platforms include Windows 11 (23H2 through 26H2/26H1), Windows 10 (1809, 21H2, 22H2), and Windows Server 2019, 2022, and 2025 including Server Core, and a vendor patch is available per the Microsoft MSRC advisory; no public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE.
Local privilege escalation in Windows Security Center lets an attacker who already holds a foothold on a Windows host with low-level privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 High) abuse an improperly restricted communication channel to obtain high confidentiality and integrity impact on the same machine. Only hosts that have not yet applied the current cumulative builds are affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019 including Server Core installations. The high attack complexity indicates a non-trivial precondition - most consistent with a race or transient-state condition that must be won to redirect or spoof the endpoint - so reliability is limited; prior local access and valid credentials are mandatory and no public exploit identified at time of analysis, with no CISA KEV listing.
Local privilege escalation exists in Microsoft's Windows Setup Files Cleanup component, where a time-of-check time-of-use race condition lets an authenticated, low-privileged user on the host escalate to higher (typically SYSTEM-level) privileges. The issue affects a broad range of Windows client and server releases, from Windows 10 version 1607 and Server 2016 through Windows 11 version 26H2/26H1 and Windows Server 2025. Exploitation requires prior local access and a low-privileged account (CVSS PR:L) and depends on winning a timing-dependent race, which makes it high-complexity (AC:H) and non-deterministic rather than a reliable, automatable attack - there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, though the technical impact is rated total. Vendor patches are available.
Local privilege escalation in the Windows Push Notifications service allows an authenticated attacker with low-level user privileges to achieve high-integrity code execution by exploiting a missing authentication check (CWE-306) in a critical internal function. Scored CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local access, no user interaction, and winning a non-deterministic condition due to high attack complexity; there is no public exploit identified at time of analysis. Affected builds of Windows 10, Windows 11, and Windows Server (2019 through 2025) below the fixed versions can be remediated with the Microsoft update.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated low-privileged user who already holds a session on a vulnerable Windows host to gain elevated privileges by abusing a weak authentication check (CWE-1390) in the projected file system component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms a local attack path requiring a prior foothold, no user interaction, and a high-complexity precondition - most plausibly a race condition or specific local timing/state the attacker must win - so there is no remote or unauthenticated route, and CISA's SSVC scoring explicitly rates Automation as "no" and Exploitation as "none". No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, meaning the practical risk is moderate rather than urgent; a vendor patch is available and all affected Windows 10, Windows 11, and Windows Server builds listed by EUVD should be updated to the specified fixed build levels.
Local privilege escalation in Windows Management Instrumentation (WMI) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to corrupt heap memory and escalate to SYSTEM-level privileges. The flaw is a heap-based buffer overflow (CWE-122) reachable through the WMI code path that ships enabled by default on every supported Windows client and Windows Server build, from Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2 up to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. Microsoft has released a vendor patch and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, reflecting the high attack complexity and unpredictable heap state required for reliable exploitation. The issue is a real but opportunistic escalation primitive rather than a wormable or remotely reachable bug.
Local privilege escalation in Microsoft Windows allows an attacker who already holds low-privileged, interactive access on a host to corrupt kernel memory and elevate to SYSTEM by exploiting a use-after-free in the Advanced Local Procedure Call (ALPC) subsystem. All unpatched Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2019/2022/2025 (including Server Core) builds below the vendor-supplied build thresholds are affected, so impact is broad across default installations but confined to the local attack surface (AV:L, PR:L, UI:N) with a high-complexity race condition (AC:H) gating reliable exploitation. There is no indication of active exploitation: CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, making this a moderate-priority local privilege-escalation issue rather than an urgent internet-facing emergency; vendor patches are available.
Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.
Local privilege escalation in Microsoft Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated, low-privileged attacker who already has local code execution to corrupt kernel memory and raise their privileges to kernel/SYSTEM level. The bug is a use-after-free reached by winning a race condition (CWE-362) in the socket-handling path, which is why it carries high attack complexity (AC:H) - exploitation requires repeatedly racing a narrow timing window and is unreliable and non-automatable (SSVC Automatable=no). Almost every supported Windows client and server build is affected because AFD.sys is loaded by default, but the practical exposure is limited to multi-user hosts or post-foothold escalation; vendor patches are available and no public exploit code or observed exploitation was identified at the time of analysis.
Local privilege escalation in the Windows Update Orchestrator Service on unpatched Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets a local, low-privileged attacker who can already run code on the host win a heap race condition and elevate to SYSTEM. The defect is a use-after-free (CWE-416) with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and CISA's SSVC assessment records Exploitation=none and Automatable=no, meaning the race is unreliable and must be won manually rather than triggered by a repeatable exploit chain. There is no public exploit code identified at time of analysis, so this is a moderate-priority patch-and-move-on item rather than an emergency, though the vendor has made a fix available.
Local privilege escalation in the Windows Certificates component lets an attacker who already holds low-privileged authenticated access on a Windows host trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, affecting Windows 10, Windows 11 (through 26H2) and Windows Server 2016 through 2025 builds below the fixed levels listed in EUVD-2026-99101. Exploitation requires local access (AV:L, PR:L) and no user interaction, but is constrained by high attack complexity (AC:H), meaning the memory-reuse condition is not reliably reachable, and CISA's SSVC assessment records exploitation as 'none' - no public exploit identified at time of analysis. The result is a credible moderate-priority privilege-escalation issue rather than an emergency; vendor patches are available from Microsoft.
Local privilege elevation in the Windows Security Center component allows an attacker who already holds a low-privileged local account to gain higher privileges (high confidentiality, integrity and availability impact) by exploiting a race condition during concurrent execution of a shared resource. Only Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) installations are in scope, and because the attack requires an existing foothold plus a reliably won timing window (CVSS AV:L/AC:H/PR:L), it is not remotely reachable and is not automatable. Exploitation is assessed as none by CISA SSVC, no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (11th percentile), which places this in a this-week remediation cadence rather than an emergency one.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds a low-privileged local account on a Windows host elevate to SYSTEM-level privileges by winning a race condition during an installer operation. Per the assessed vector (AV:L/AC:H/PR:L/UI:N) the attacker must be authenticated locally and must win a non-deterministic time-of-check/time-of-use window, which typically requires repeated attempts, so exploitation is unreliable and cannot be performed remotely or unauthenticated. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none', making this a moderate, non-urgent local privilege-escalation issue rather than an emergency; vendor patches are available for all listed Windows editions and builds.
Local privilege escalation in the Windows Setup Files Cleanup component allows an attacker who already holds low-privileged, authenticated access to a vulnerable Windows host to win a time-of-check time-of-use race and gain SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations, with CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no remote vector and no user interaction required, but exploitation demands an existing foothold plus a reliably won race, which CISA's SSVC assessment marks as not automatable and with no observed exploitation; no public exploit code has been identified at time of analysis and Patch is available from the vendor.
Local privilege escalation in Windows NTFS allows an authenticated local user to elevate privileges by winning a race condition on shared NTFS filesystem resources (CWE-362). Only systems running affected Windows builds below their fixed revision are vulnerable (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761), and exploitation requires the attacker to already have local code execution and to repeatedly contend for a narrow timing window, making it probabilistic and non-automatable per CISA SSVC. No public exploit has been identified at time of analysis, no KEV listing exists, and vendor patches are available.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated attacker with low-privileged local access to gain elevated privileges on affected Windows systems. The flaw is a race condition (CWE-362) that is timing-sensitive (CVSS AC:H) and requires no user interaction (UI:N), making exploitation probabilistic and limited to local contexts. No public exploit code was identified at time of analysis, and no active exploitation is confirmed (CISA SSVC: Exploitation=none); vendor patches are available.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to gain SYSTEM-level access by triggering an unsynchronized access to a shared resource during MSI package operations. Exploitation requires a valid local account (PR:L, AV:L) and hinges on winning a narrow timing window (AC:H), so attacks are typically unreliable and may need many repeated attempts - consistent with CISA SSVC rating the issue not automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV signals are absent, so real-world urgency is lower than the HIGH-adjacent, 7.0 CVSS score alone might suggest; vendor patches are available for all affected Windows builds.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in the Windows Storage component of Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows an authenticated attacker with standard user rights to raise their privileges to SYSTEM level on the affected host. Exploitation requires an existing local foothold and winning a timing race in the storage stack (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so this is realistically a post-compromise escalation step rather than an initial-access or network-reachable flaw; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft rates the issue 7.0 High and vendor patches are available for all affected branches.
Local privilege escalation in the Windows Storage component of supported Windows 10, Windows 11, and Windows Server releases lets a low-privileged attacker who already holds an account or process on the host race a use-after-free to reach a higher-integrity context, with high confidentiality, integrity, and availability impact. Exploitation is timing-dependent rather than deterministic: the attacker must win a race condition (CWE-362, reflected in the high attack complexity of the CVSS vector) and needs an existing local foothold (AV:L, PR:L, no user interaction required), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has shipped vendor patches for all listed builds, so this is a genuine but moderate-priority patch-cycle item rather than an urgent internet-facing threat; the residual risk is that local privilege-escalation fixes are commonly reverse-engineered into exploits after publication, which makes timely patching of multi-user and remote-access hosts worthwhile.
Use-after-free in the Windows Storage component allows an authenticated low-privileged local user to elevate privileges to full system integrity on affected Windows hosts. Exploitation requires winning a narrow race-condition timing window (CWE-362) and grooming freed memory for reuse, which is why attack complexity is rated high and CISA's SSVC assessment marks the flaw non-automatable, keeping this a moderate-priority rather than drop-everything issue. All currently supported Windows 10, Windows 11 and Windows Server builds below the vendor-fixed versions are affected, including Server Core installations, but Microsoft has released patches; no public exploit code has been identified and no exploitation activity is recorded (CISA SSVC exploitation: none).
Local privilege escalation in Windows Credential Manager affects Windows 10, Windows 11, and Windows Server (2012 through 2025) builds, letting an attacker who already holds a low-privileged local session on the host win a race condition (CWE-362) and elevate to higher privileges. The vulnerable component is not remotely reachable and the high attack complexity rating reflects a non-deterministic timing window that may require repeated attempts; exploitation requires authenticated local access (CVSS vector PR:L/AV:L), and no public exploit identified at time of analysis, with CISA SSVC recording no observed exploitation. Microsoft has published updated builds that correct the synchronization flaw, so remediation is a matter of patching rather than emergency mitigation.
Local privilege escalation in the Windows Servicing Stack Updates (SSU) component affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) built below their respective fixed build thresholds, letting an attacker who already holds authenticated local access win a time-of-check time-of-use race and gain high-integrity code execution, confidentiality, and availability impact (CVSS 7.0, CWE-367). The high attack complexity reflects a narrow timing window that must typically be hit through repeated, precisely timed attempts, and no user interaction is required, though the attacker must already be present on the host with low privileges (PR:L, AV:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched servicing stack via its update guide.
Local privilege escalation in Windows Installer (CVSS 7.0) lets an attacker who already holds low-privilege, local access on a Windows host escalate to SYSTEM by winning a race condition in the service's handling of a shared resource during concurrent execution. The flaw is CWE-362 and carries AC:H in the assessed vector, so the timing window is narrow and exploitation may require repeated attempts; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has published fixed builds for the affected Windows 10, Windows 11 and Windows Server releases via the MSRC update guide for CVE-2026-85941, making prompt patching the definitive mitigation.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authorized attacker with a low-privileged local account to reach SYSTEM-level code execution by winning a time-of-check/time-of-use race (CWE-367) that triggers a use-after-free in kernel mode. Affected platforms are Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 running builds below the patched revisions; the assessed CVSS 3.1 base score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor patches are available from Microsoft, and no public exploit identified at time of analysis (CISA SSVC reports Exploitation: none, and the CVE is not linked to KEV), so risk is concentrated in post-compromise escalation on shared or multi-user hosts rather than remote mass exploitation.
Local privilege escalation in Windows Error Reporting (WER) allows an authenticated attacker who already holds a low-privileged session on a Windows host to win a time-of-check-time-of-use race and corrupt heap memory, potentially escalating to SYSTEM-level code execution. Affected builds span Windows 10, Windows 11 (23H2 through 26H1/26H2), and Windows Server 2012 through Windows Server 2025, including Server Core installations. There is no public exploit identified at time of analysis and no confirmed active exploitation - CISA's SSVC records Exploitation 'none' and Automatable 'no' - and the High attack complexity reflects the non-deterministic race window, which requires repeated attempts to land reliably.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated, low-privileged local user (CVSS PR:L) to elevate to a higher-integrity context, including SYSTEM, by triggering a use-after-free (CWE-416) in the search stack. Exploitation is constrained by High attack complexity (AC:H): the attacker must win a race/timing window and control reuse of the freed heap object, so reliable exploitation is conditions-dependent rather than one-shot, and there is no network vector or user-interaction requirement (AV:L, UI:N). Microsoft has released fixes in its update guide; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, making this a genuine but non-emergency privilege-escalation risk.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in Microsoft Windows through the Ancillary Function Driver for WinSock (afd.sys) lets an attacker who already holds low-privileged local code execution corrupt kernel pool memory and raise privileges to SYSTEM, yielding high confidentiality, integrity, and availability impact. Exploitation is gated by valid local credentials (PR:L, authenticated) and is further constrained by high attack complexity (AC:H), because the CWE-415 double free depends on winning a non-deterministic kernel memory race that may require repeated attempts; there is no network vector and no victim interaction (UI:N). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the exposure is broad - Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 - with vendor patches available.
Local privilege escalation in the Windows Kernel (CWE-416 use-after-free) affects Windows 11 versions 24H2, 25H2, 26H1, 26H2, and Windows Server 2025 including Server Core; an authenticated attacker with low privileges can exploit this to gain kernel-level or SYSTEM privileges on the local machine. The vulnerability requires local access and high attack complexity (likely a race condition or specific heap state), with no remote vector and no user interaction required; SSVC reports exploitation none and no public exploit identified at time of analysis. Microsoft has released patches addressing the issue, and updating to the fixed builds removes the vulnerability.
Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds authenticated low-privilege code execution on a Windows 10 or Windows 11 host win a race against freed memory in the Game DVR capture component and take over the service with elevated (SYSTEM-level) rights. The flaw is a use-after-free (CWE-416) with High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) because the timing window must be reliably won, so no public exploit has been identified at time of analysis and the CISA SSVC assessment rates the issue not automatable with exploitation status 'none'. Microsoft has released vendor patches; affected builds span Windows 10 1809, 21H2 and 22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2.
A use-after-free in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets a locally authenticated attacker on a vulnerable Windows host elevate privileges to SYSTEM by winning a narrow timing window in which a freed kernel object is reclaimed before deletion completes. Because exploitation requires the attacker to already hold low-privileged local access (PR:L), it is a post-compromise privilege-escalation primitive rather than a remote entry point, and the high attack complexity (AC:H) means success is neither trivial nor deterministic. Microsoft has released fixes for all affected Windows 10, Windows 11, Windows Server 2019/2022/2025 builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated, low-privileged attacker who already holds a foothold on the host win a use-after-free and gain SYSTEM-level code execution. Exploitation requires winning a timing-dependent race against the service (AC:H), with no user interaction needed, and affects Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019 including Server Core builds below the patched levels. There is no confirmed active exploitation (CISA SSVC exploitation: none) and no public exploit identified at time of analysis; a vendor patch is available and the issue is assessed as a genuine but non-urgent High-severity local elevation-of-privilege flaw (CVSS 7.0, EPSS-level urgency not elevated).
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already possesses low-privilege code execution on a Windows host to corrupt memory via a use-after-free and elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is not remotely reachable and needs pre-existing local access; the high attack complexity reflects a race/heap-reuse condition that makes exploitation timing-dependent, and no public exploit identified at time of analysis. Microsoft has released a vendor patch.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authorized low-privilege user elevate to SYSTEM by triggering a use-after-free memory-corruption condition in the installer service. Exploitation is confined to unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 hosts, and requires a valid local account plus high attack complexity because the primitive depends on precise object-lifetime/timing conditions (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, 7.0); no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Microsoft has released patched builds for every affected branch, so exposure is limited to systems that have not yet applied the current cumulative updates.
Local privilege escalation in Microsoft's Windows Image Acquisition (WIA) service lets an attacker who already holds low-privileged authenticated access on a Windows host corrupt memory in the WIA component and run code with higher - ultimately SYSTEM-level - privileges. Exploitation is confined to the local machine (AV:L), requires a pre-existing foothold (PR:L), and hinges on winning a use-after-free timing window rated high complexity (AC:H), so it is not remotely reachable, cannot be reliably automated, and needs no victim interaction. Microsoft has released a vendor fix per its update guide and no public exploit code or active exploitation has been identified at time of analysis, making this a credible but not top-tier priority patch - the real-world risk comes from attackers who have already landed on a box and want to finish escalating.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Elevation of privilege in Windows Web Account Manager (WAM) allows a locally authenticated low-privileged attacker (CVSS PR:L) to abuse a use-after-free condition and obtain higher-integrity code execution, with high impact to confidentiality, integrity, and availability of the compromised host. Only systems that have not yet applied the current cumulative updates are exposed across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025, and because attack complexity is high (AC:H) reliable triggering depends on heap layout and timing, making this a post-compromise privilege-escalation primitive rather than an initial-access or wormable flaw. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Microsoft has released fixed builds for all listed branches.
Local privilege escalation in the Microsoft Windows WebDAV component allows an authenticated low-privileged user to trigger a heap-based buffer overflow and gain code execution at a higher integrity level on the affected host. Exploitation requires a pre-existing local foothold (AV:L, PR:L, UI:N) plus reliable heap grooming or race-condition success (AC:H), making this a post-compromise escalation primitive rather than a remote or unauthenticated entry point. It affects unpatched Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 builds below their respective patched thresholds; no public exploit code has been identified at time of analysis, no CISA KEV entry is present, and no EPSS score was supplied with the record.