Sandbox escape in the Mozilla Firefox Graphics component allows an attacker who can get a victim to render attacker-controlled web content to break out of the browser's content-process sandbox, with Low-rated confidentiality, integrity and availability impact but a changed security scope. Affected are unpatched Firefox builds below 158 and ESR builds below 115.43 and 153.5; no authentication is required, but exploitation is gated by mandatory user interaction (UI:R) such as visiting a crafted page, which precludes zero-click mass exploitation. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is very low at 0.19% (8th percentile), making this a moderate-severity but low-priority issue in practice; vendor-released patches are available.
Incorrect authorization of the import target namespace in GitLab CE/EE lets an authenticated user wielding a fine-grained Personal Access Token that is scoped only to user-boundary import permissions push project imports into group namespaces that fall outside the token's intended scope (CWE-863). Only installations running versions from 18.9 up to 19.2.8, 19.3.x before 19.3.5, and 19.4.x before 19.4.2 are affected, and the issue is limited to integrity (I:L) with no confidentiality or availability impact per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - a low-severity finding (base score 3.1) that does not warrant emergency prioritization. Publicly available exploit code exists (a HackerOne report and the corresponding GitLab work item are referenced), there is no confirmed actively exploited (CISA KEV) status, and exploitation additionally requires a valid scoped token plus favorable conditions, so the practical exposure is narrow.
A JIT compiler miscompilation in Firefox's JavaScript WebAssembly engine (CWE-843 type confusion) can lead to memory corruption and disclosure of sensitive data when a user loads attacker-controlled web content that triggers WASM compilation. Only users on Firefox before 158 or Firefox ESR before 153.5 are exposed; fixed builds are not affected, and exploitation requires user interaction (navigating to a malicious page), with no authentication or special configuration needed. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and the low EPSS score (0.15%, 4th percentile) plus the UI:R prerequisite place this at moderate rather than emergency priority.
An out-of-bounds write (CWE-787) in AMI Aptio V (APTIOV) BIOS firmware can be triggered by a local attacker who already holds high privileges, potentially corrupting memory inside firmware code paths and enabling buffer overflows, arbitrary code execution, and loss of confidentiality, integrity, and availability. Successful abuse requires local access plus pre-existing administrative or kernel-level privileges, and the high attack complexity means specific state, timing, or configuration preconditions must be met before the write can be controlled, so this is best characterized as a firmware persistence/privilege-escalation primitive rather than an initial-access or remote attack vector. At time of analysis there is no public exploit identified, no CISA KEV listing, and no confirmed exact fix version in the available data, though AMI has issued security advisory AMI-SA-2026002 covering the issue.
Integer overflow in AMI AptioV BIOS firmware, classified as CWE-190, can be triggered by a local high-privileged caller to cause buffer overflows, memory corruption, and potential arbitrary code execution with high impact to confidentiality, integrity, and availability. Exploitation requires local access, an existing administrator/root-level foothold (PR:H), and high attack complexity (AC:H) per the assessed vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, so it is not remotely reachable or mass-exploitable. No public exploit was identified at time of analysis, and active exploitation is not confirmed by KEV data; this is a moderate-priority, high-barrier firmware flaw rather than a widespread emergency.
Local capability escalation in the macOS build of the DigiD app (Logius) lets an attacker who already holds user-level code execution on the same Mac inject an arbitrary dynamic library into the DigiD process and run code under the app's identity, reaching DigiD data and cryptographic operations the process would not normally expose - CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The root cause is that the app binary is not signed with the Hardened Runtime flag, so the loader still honours DYLD_INSERT_LIBRARIES; this is a post-compromise escalation primitive, not a remote or initial-access bug, and it grants no privilege beyond the app's own context (S:U) and no availability impact. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a Hardened-Runtime-signed build blocks the injection path and is available per the vendor advisory pointing at the Mac App Store listing.
Path traversal in Wazuh Manager's delete_rule_file and delete_decoder_file helpers lets an attacker who holds the Wazuh cluster key delete arbitrary files as the wazuh user, including ossec.conf, client.keys, and rule files. Affected versions are 4.1.1 through 4.14.7 (fixed in 4.14.8), tracked by CPE cpe:2.3:a:wazuh:wazuh-manager. Exploitation is not unauthenticated: the CVSS 4.0 vector carries PR:H and the assessed 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, meaning the attacker must already possess the cluster key and be able to invoke the DistributedAPI helpers as a cluster worker, so practical exposure is limited to clustered multi-node Manager deployments where the key has leaked or a worker node is compromised; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Configuration data leakage in Stonewuu ai-fusion-video 1.2.0 and earlier lets any authenticated non-admin user read the api-config get/list and system config endpoints, which return stored AI provider API keys, proxy passwords and mail_password values in plaintext. Because the controller methods (ApiConfigController and SystemConfigController) never verify the caller's role, a low-privilege account is enough to harvest credentials that enable AI-billing abuse and sending mail from the platform's own mail server; the vulnerability is rated CVSS 7.1 (v4.0, PR:L) and an independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. a confidentiality-only exposure that requires credentials to reach. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis and no EPSS value was supplied, which keeps this a genuine but bounded, second-order risk rather than a top-tier emergency.
Local privilege escalation in Microsoft Sysinternals utilities allows an authenticated low-privileged user to trigger an untrusted pointer dereference (CWE-822) and have the affected tool operate with higher integrity than the caller, yielding high integrity and availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Only Windows systems where an affected Sysinternals utility is present and executable by the attacker are exposed; because the vector is local (AV:L) with PR:L, the attacker must already hold a valid low-privileged local session, which limits mass or remote exploitation. No public exploit code or confirmed active exploitation is identified at time of analysis - no CISA KEV entry and no proof-of-concept were provided - and no EPSS score was supplied, so the practical risk is post-compromise escalation rather than initial access.
Local privilege escalation in Microsoft Sysinternals arises from an untrusted pointer dereference (CWE-822), allowing an attacker with existing low-privileged local access to elevate privileges on a Windows host. The CVSS 3.1 score is 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high impact to confidentiality and integrity but no availability impact and no scope change. There is no remote attack vector, and no public exploit code or confirmed active exploitation has been identified at the time of analysis.
An out-of-bounds read in FreeRDP's smartcard redirection channel (CVE-2026-109677) lets a malicious or compromised RDP server leak heap memory from the connecting client by sending a LocateCardsByATRA request whose cbAtr byte count exceeds the fixed 36-byte rgbAtr/rgbMask buffers. Affected versions are 2.0.0-beta1 through 3.27.x (fixed in 3.28.0), and per the independent assessment the impact is confidentiality-only: the client must initiate the RDP session to the hostile server and must have smartcard device redirection negotiated so the LocateCardsByATRA handler is reachable. Repeated timing-oracle queries can extract memory bit-by-bit to defeat ASLR as a precursor to remote code execution, but no code execution occurs directly; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Hash collisions in the inference request cache of NVIDIA Megatron-LM let an attacker who can already submit inference requests tamper with cached data and obtain partial information about other users' cached requests and responses, yielding a CVSS 7.1 impact (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N). Because the cache key relies on a weak hash (CWE-328), success depends on the attacker engineering colliding inputs against an enabled, shared inference cache, which is why the vector rates complexity as high rather than trivial. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; this is a moderate-severity issue rather than a top-tier emergency, and the NVIDIA product-security advisory is the authoritative source for affected builds and fixed versions.
A denial-of-service condition in ASP.NET Core allows an unauthenticated, remote attacker to exhaust server CPU by submitting HTTP form data in many small increments, causing Microsoft.AspNetCore.WebUtilities FormPipeReader to repeatedly rescan the entire buffered request body. The flaw (CWE-407, inefficient algorithmic complexity) affects applications running ASP.NET Core 8.0.0-8.0.31, 9.0 before 9.0.21, and 10.0 before 10.0.13, as well as Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4, and carries a CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Only availability is impacted - there is no data disclosure or modification - and the high attack-complexity rating reflects the need for an incrementally delivered body rather than a single malformed request. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Local privilege escalation in the Windows Update Orchestrator Service (UsoSvc) on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a standard, low-privileged local account to trigger a use-after-free in the service and elevate to the service's high-privilege (LocalSystem) context. There is no remote or unauthenticated path: the CVSS vector (AV:L/PR:L) confirms the attacker must already be logged on locally with low privileges, and the high attack complexity (AC:H) reflects that success depends on winning a timing-dependent memory-reuse race, which usually requires repeated attempts rather than a single deterministic trigger. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC exploitation: none), and vendor patches are available, so this is a genuine but second-tier priority concentrated on shared, multi-user, or terminal-server hosts where untrusted users hold standard accounts.
Local privilege escalation in the Windows Win32 Kernel Subsystem (win32k) lets an attacker who already holds low-privileged local code execution on a vulnerable host elevate to SYSTEM-level kernel privileges. The flaw is a use-after-free (CWE-416) reachable through the win32k syscall surface, requiring no user interaction but rated high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N) because reliable exploitation depends on winning a race or precisely steering kernel pool reuse, which is probabilistic and may simply crash the machine. All supported Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core) builds below the listed patch levels are affected; there is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation assessment: none), but the low-priority-prerequisite/high-impact combination makes it a strong post-compromise escalation primitive wherever local access can be obtained. Vendor patches are available, so risk is concentrated in unpatched fleets rather than in unknown-vulnerability exposure.
Local privilege escalation in the Windows Win32 Kernel Subsystem allows an attacker who already holds authenticated, low-privileged access on a host to reuse freed kernel memory and elevate to a higher privilege level, with the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicating full loss of confidentiality, integrity and availability once the elevation succeeds. The high attack complexity reflects the race/timing window an attacker must win to reclaim the freed kernel object, and CISA's SSVC assessment records exploitation as 'none' with automation judged infeasible, so no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The affected code is present by default across Windows 10, Windows 11 and Windows Server builds, so any environment where untrusted users can run code locally remains exposed until patched.
Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker who already holds low-privilege code execution on a host to gain SYSTEM-level privileges by triggering a use-after-free (CWE-416) during kernel object reclamation. The weakness is strictly local (AV:L) and high-complexity (AC:H) because the attacker must win a memory-reclamation race, making it a post-access escalation primitive rather than a remote entry point; no public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none). Every supported Windows 10, Windows 11, and Windows Server build below the fixed revision listed by the vendor is affected, and Microsoft has released patches.
Local privilege escalation in the Windows Win32k kernel subsystem (CVE-2026-70176) allows an authenticated attacker who already holds low-privileged local access on a host to elevate their privileges by triggering a use-after-free in kernel-mode code, rated CVSS 7.0 (High, AV:L/PR:L/AC:H/UI:N). The flaw sits in a component that is present by default in every supported Windows edition and cannot be disabled or removed, so no special configuration is required to reach the vulnerable code; the main obstacle for an attacker is the high attack complexity of the required free/reuse race, which lowers reliability and may force repeated attempts. Microsoft has published a vendor patch, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though the ENISA EUVD record and MSRC advisory confirm a wide set of affected Windows 10, Windows 11, and Windows Server 2016-2025 (including Server Core) builds.
Local privilege escalation in the Windows Win32 kernel subsystem allows an authenticated attacker running as a low-privileged user to abuse a use-after-free condition in a kernel object and elevate to full system privileges, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only specific Windows 11 builds (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 (including Server Core) below Microsoft's fixed builds are affected; exploitation is not remote, requires no user interaction, and hinges on winning a timing-dependent race window, which lowers exploit reliability. No public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and Microsoft has shipped a vendor patch, so fully updated hosts are not exploitable - the overall priority is moderate rather than emergency.
Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds low-privileged, authenticated local access on a vulnerable Windows host corrupt kernel memory and elevate to higher privilege, including SYSTEM-level execution. Only specific builds are exposed: Windows 11 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2025 (including Server Core), at build levels below the vendor's fixed releases. Exploitation is constrained by high attack complexity - the use-after-free must be won as a race/timing condition to reclaim the freed Win32 kernel object before it is reused, which limits reliability and makes the flaw non-automatable per CISA SSVC; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (KEV), though the high confidentiality, integrity and availability impact and full technical impact score make timely patching important.
Local privilege escalation in the Windows Setup Files Cleanup component allows an authenticated, low-privileged attacker to run code with elevated (SYSTEM) rights by planting a malicious binary in a directory that the cleanup routine searches ahead of its trusted location. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity limits reliable exploitation to hosts where the attacker already controls a suitable search-path directory or can win a timing window; no public exploit identified at time of analysis, and CISA's SSVC assessment records no observed exploitation. Affected builds cover Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, for which Microsoft has released fixed builds.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds valid credentials and code-execution capability on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw affects essentially every supported Windows release, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, on builds below the fixed numbers published in EUVD-2026-99570. Exploitation is gated by High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), because the corruption must be shaped into reliable kernel memory manipulation; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released patches.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds low-privileged local access on a Windows host raise their privileges to a high-integrity/kernel-level context. The flaw (CWE-829) stems from the driver consuming functionality or structured data from an untrusted sphere without adequate validation, and it carries high attack complexity because success depends on winning a timing/state-dependent condition rather than a deterministic sequence. Exploitation requires an existing foothold - it is a post-compromise escalation primitive, not a remote entry point - and no public exploit code was identified at time of analysis, with no CISA KEV listing.
Local privilege escalation in the Windows Update Orchestrator Service allows an authenticated, low-privileged user on an unpatched Windows host to follow a crafted symbolic link or NTFS junction into a privileged file operation and gain SYSTEM-level code execution, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable: it requires an existing local foothold and credentials (PR:L, AV:L) plus winning a timing window against the service (AC:H), and it needs no user interaction (UI:N). No public exploit has been identified at time of analysis - CISA SSVC records exploitation as 'none' and automatable as 'no' - and Microsoft has shipped fixed builds across the affected Windows 10, Windows 11, and Windows Server branches, so remediation is a straightforward update rather than an emergency containment exercise.
Local privilege escalation in the Windows COM+ Event System Service (EventSystem) allows an attacker who already holds authenticated low-privileged local access on a Windows host to corrupt memory and elevate to the service's higher-integrity context. The flaw is a use-after-free (CWE-416) that must be triggered by winning a timing race on a freed object, which is why Microsoft rates it with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and CISA's SSVC evaluation marks it non-automatable with no observed exploitation. There is no remote or network-facing exposure - no user interaction is required but the attacker must already be running code locally, so this is a post-foothold elevation primitive rather than a wormable issue; no public exploit code has been identified at time of analysis and a vendor patch is available.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged local session to trigger a heap-based buffer overflow (CWE-122) and elevate to higher-integrity code execution, with high impact to confidentiality, integrity, and availability (CVSS 7.0). The vulnerable component is the service behind Offline Files, which ships and runs by default across Windows 10, Windows 11, and Windows Server releases, so any multi-user or shared-access endpoint with an existing local foothold is in scope. Exploitation requires local access (AV:L) and a high-complexity trigger (AC:H) - typically a race or precise heap-grooming precondition - so reliable attacks remain difficult; there is no public exploit identified at time of analysis, no KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released vendor patches, and the raw 7.0 score should be weighted against the pre-existing foothold and high-complexity precondition, placing this at moderate priority rather than emergency patching.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already has code execution on a target machine trigger a use-after-free in the kernel socket-handling paths and elevate to SYSTEM. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - it is strictly local and requires a pre-existing foothold, and the race/timing nature of the bug makes it hard to trigger reliably, which is why CISA's SSVC rates exploitation as 'none' and automatable as 'no'. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the risk is assessed as moderate rather than emergency priority; Microsoft has released fixes, with EUVD tracking the affected builds under EUVD-2026-99879.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds low-privileged authenticated access on a Windows host to corrupt the heap and elevate to a higher-integrity context. The flaw is a heap-based buffer overflow (CWE-122) reachable only locally (AV:L) with high attack complexity (AC:H), meaning the attacker must satisfy specific memory-layout conditions, and no user interaction is required (UI:N); the component ships by default across the affected Windows 10, Windows 11, and Windows Server editions, so no optional feature must be enabled. Microsoft has released vendor patches that raise the fixed OS build numbers for each affected branch, and no public exploit has been identified at time of analysis - this is a genuine but moderate-priority local privilege-escalation issue rather than a remotely exploitable or actively attacked flaw.
Local privilege escalation in the Windows Application Compatibility Cache (ShimCache) allows an attacker who already holds low-privileged local code execution to elevate to higher integrity on unpatched Windows 11 (23H2 through 26H2) and Windows Server 2022/2025 systems. The defect is a use-after-free (CWE-416) that must be won in a narrow race window, and the assessed vector (AV:L/AC:H/PR:L/UI:N) reflects a post-compromise escalation path rather than a remote entry point, which is why SSVC records Exploitation: none, Automatable: no, and our assessment treats this as a genuine but moderate-priority local privilege escalation rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and no CISA KEV entry exists, though the CVSS base score of 7.0 is driven by total confidentiality, integrity, and availability impact once the elevation succeeds.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated attacker who already holds low-privileged code execution on an affected host to gain full control of the system (CVSS 7.0, C:H/I:H/A:H) by triggering a use-after-free in kernel memory. Exploitation is constrained by high attack complexity (AC:H), since the attacker must reliably win a timing/race window and groom kernel heap state; there is no remote or unauthenticated vector. Affected are unpatched Windows 11 24H2, 25H2, 26H1, and 26H2 builds and Windows Server 2025 builds below the fixed versions, and no public exploit or confirmed active exploitation was identified at time of analysis; Microsoft has released a patch.
Local privilege escalation in the Windows Win32 Kernel Subsystem lets an attacker who already holds authenticated, low-privileged access on a host trigger a use-after-free in kernel memory and gain elevated (SYSTEM-level) code execution. The assessed vector (AV:L/AC:H/PR:L/UI:N) shows exploitation is confined to the local machine and is gated by high attack complexity - the memory-reclamation or race timing makes reliable exploitation difficult and non-deterministic - with no user interaction and no remote or unauthenticated path. Microsoft has released vendor patches for every affected Windows 10/11 and Windows Server build, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV not listed; SSVC exploitation: none, automatable: no).
Local privilege escalation in the Windows Console Driver (conhost/console driver component) allows an attacker who already holds authenticated local code execution on a Windows host to win a use-after-free race and gain high-integrity code execution, yielding full confidentiality and integrity impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). Every supported Windows client and server branch is affected - from Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 - because the vulnerable console driver ships in the base OS. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable exploitation as 'no', so this is a moderate-priority local EoP hardening item rather than an internet-facing emergency; the practical limiting factors are the precondition of an existing local foothold (PR:L) and the high attack complexity of the memory-reuse race.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
An authenticated, low-privileged local attacker can trigger a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) to corrupt kernel memory and elevate to SYSTEM on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 hosts. Exploitation is local-only and high-complexity (CVSS 7.0, AC:H), requiring precise kernel heap grooming or a race window, so this is a moderate-priority privilege-escalation issue rather than a remote or wormable emergency. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds that remove the vulnerable condition.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
Privilege escalation in the Windows Kernel lets an attacker who already holds a low-privileged local account corrupt kernel memory through a use-after-free and ultimately execute code at SYSTEM level, with high impact to confidentiality, integrity and availability. Exploitation is gated by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because reliable triggering typically requires winning a race condition or achieving a specific memory-reuse state, and no public exploit identified at time of analysis; CISA's SSVC review likewise records exploitation as 'none' and automatable as 'no'. The flaw affects unpatched default installations across essentially the entire supported Windows client and server lineup below the vendor-fixed builds, making it a pervasive post-compromise privilege-escalation primitive rather than a remote entry point.
Local code execution in Windows Error Reporting (WER) lets an authenticated, low-privileged attacker who already holds a foothold on a host trigger a double free (CWE-415) in the crash-reporting subsystem, corrupting heap memory and achieving code execution with the privileges of the affected WER component. The flaw affects an extremely broad install base - Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025, including Server Core builds - but the attack surface is narrow: local access only (AV:L), prior low-privilege authentication (PR:L), no user interaction (UI:N), and high attack complexity (AC:H) because a reliable double free generally requires winning a timing race and precise heap grooming. There is no public exploit and no evidence of active exploitation - CISA's SSVC assessment rates exploitation as "none" and the vector is not automatable - so this is a moderate-priority local privilege/execution issue best handled through routine cumulative-update patching rather than emergency response. Microsoft rates it 7.0 with total technical impact, tracking it as CVE-2026-83916; ENISA mirrors it as EUVD-2026-99434.
Local privilege escalation in the Windows Diagnostic Policy Service (DPS) allows an attacker who already holds low-privileged authenticated access on a Windows host to trigger a use-after-free and gain elevated rights, with the potential for total loss of confidentiality, integrity, and availability on the affected machine. The flaw affects Windows 10 versions 1809 through 22H2, Windows 11 versions 23H2 through 26H2, and Windows Server 2019, 2022, and 2025 builds listed in the EUVD data, and Microsoft has published a fixed build for each affected branch. Exploitation is not automatable in the CISA SSVC assessment and there is no public exploit identified at time of analysis, so while the consequence of a successful attack is severe, the practical barrier of high attack complexity and a required local foothold keeps this a moderate-priority patching item rather than an emergency.
Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).
Local privilege escalation in the Windows RPC Runtime lets an attacker who already holds a low-privileged local account on a Windows host free an invalid pointer or reference (CWE-763) inside the RPC code path and turn that memory-management error into SYSTEM-level code execution on the same machine (CVSS 7.0, AV:L/PR:L/UI:N/S:U). Exploitation is gated by high attack complexity (AC:H), which is consistent with a race/timing-dependent condition rather than a reliable one-shot primitive, and it cannot be reached remotely or by an unauthenticated user. No public exploit code or confirmed active exploitation has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes through its monthly update channel, so this is a genuine but non-urgent patching priority concentrated on multi-user, RDP and jump hosts where untrusted standard users can log on locally.
A use-after-free (CWE-416) in the Windows Win32 kernel subsystem leaves affected Windows hosts open to local privilege escalation: an attacker who already holds authenticated, low-privileged code execution on the machine can corrupt kernel memory and raise their rights to SYSTEM (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote entry point but a post-compromise escalation primitive, and the high attack complexity reflects the non-deterministic timing and kernel pool-reclaim conditions a reliable exploit must win. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is a patch-now hardening item rather than an emergency, while the vendor has published fixed builds through the MSRC update guide.
Local privilege escalation in the Windows Bind Filter Driver (bindflt.sys) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to corrupt kernel memory and elevate to SYSTEM. The flaw is a use-after-free (CWE-416) requiring a race-condition-style trigger, reflected in the CVSS vector AV:L/AC:H/PR:L/UI:N (7.0 High) and the CISA SSVC assessment of Exploitation: none and Automatable: no - there is no remote path, no user interaction, and no public exploit identified at time of analysis. It was not added to CISA KEV, and vendor-supplied patches are available; affected builds are specific Windows 11 23H2 through 26H2 releases and Windows Server 2025 (including Server Core) below the fixed build numbers, while patched builds are not exploitable. Independent assessment rates this as a genuine but not emergency-grade priority best handled through routine monthly patching.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged foothold on an affected Windows host to elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0). Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attack is local and requires an authenticated low-privileged user, and the use-after-free must be won under a high-complexity memory/race condition, reducing reliability. All supported Windows client and server builds below their respective fixed revisions are affected, Microsoft has released patches, and no public exploit code was identified at time of analysis and CISA's SSVC assessment records exploitation as none with the vulnerability not automatable.
Local privilege escalation in the Microsoft Windows Search component allows an authenticated, low-privileged attacker who already has code execution on a host to raise their privileges on that machine by triggering a use-after-free during Search operations. Exploitation is gated by a hard timing/reachability condition (AC:H) and is not automatable, and no public exploit has been identified at time of analysis, so this presents as a genuine but non-urgent local escalation issue rather than a mass-exploitation threat. Impact is confined to the local Windows system (S:U) but is high across confidentiality, integrity, and availability once achieved, making shared multi-user hosts the primary concern.
Local privilege escalation in the Windows Win32K ICOMP subsystem allows an authenticated attacker holding only low-privilege local code execution to elevate to kernel/SYSTEM context by triggering a use-after-free (CWE-416) in a Win32K object-lifetime code path. The flaw is confined to local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0) and requires winning a timing-dependent race, so it cannot be used for initial access or remote compromise and is only meaningful as a post-exploitation escalation step. CISA's SSVC assessment records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; Microsoft has released a vendor patch.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds a low-privileged account on a target host to trigger a use-after-free and execute code with SYSTEM privileges. The flaw affects supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 builds, including Server Core installations, up to Microsoft's fixed build numbers. No public exploit identified at time of analysis: CISA's SSVC records exploitation as 'none' and the issue as not automatable, and the HIGH attack complexity (AC:H) means an attacker must reliably win a memory-corruption race rather than fire a one-shot exploit, keeping real-world risk moderate despite the CVSS 7.0 (High) rating.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authorized attacker who already holds a foothold on a Windows host to run code at higher integrity by triggering a use-after-free memory corruption condition (CWE-416). Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local authenticated access and a hard-to-win timing or object-lifecycle state (AC:H) that the attacker does not fully control, but yields total loss of confidentiality, integrity and availability once achieved. Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds are affected; Microsoft has shipped fixed builds, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
A use-after-free (CWE-416) in the Windows Program Compatibility Assistant Service (PCASVC) lets an attacker who already holds low-privileged local access on a Windows host elevate to SYSTEM-level privileges. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N), meaning the attacker must win what is most likely a timing or memory-state race while interacting with the service; no user interaction is required and no non-default configuration is needed, since the affected service ships on default Windows installs. There is no public exploit identified at time of analysis, SSVC records exploitation as 'none' and the technique as non-automatable, so this is a moderate-priority local privilege-escalation (LPE) hardening item rather than an emergency - patching should follow normal monthly-cadence prioritization given the 'total' technical impact if the race is won.
Use-after-free in the Windows Program Compatibility Assistant Service (PcaSvc) allows an attacker who already holds a low-privileged, authenticated local session to escalate privileges to a higher-integrity context on the same host, achieving total compromise of confidentiality, integrity, and availability (CVSS 7.0, C:H/I:H/A:H). The flaw is a memory-corruption race that the attacker must win to reliably corrupt freed memory, so the high attack-complexity rating limits repeatability, and exploitation requires prior local code execution - remote, unauthenticated attackers are not in scope (AV:L/AC:H/PR:L/UI:N). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2025 builds are affected; no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework records exploitation as 'none' with the vulnerability not automatable. This is a genuine but moderate-priority elevation-of-privilege issue rather than a top-tier emergency, and vendor patches are available.