Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in the Windows Advanced Rasterization Platform (WARP), the software rasterizer shipped with Windows, allows an attacker who already holds valid low-level local privileges to raise their rights to a higher-integrity context by winning a use-after-free race in the graphics component. Exploitation is strictly local (AV:L), requires authentication as a standard user or pre-existing local code execution (PR:L), needs no user interaction (UI:N), but is assessed as high complexity (AC:H) because it depends on defeating allocator non-determinism and precise timing; CISA's SSVC rates exploitation as none and the issue as non-automatable, so no public exploit has been identified at time of analysis. This is most realistically a post-compromise escalation step rather than an initial-access or lateral-movement vector, and a vendor patch is available.
Local privilege escalation in the Windows Installer service allows an authenticated attacker holding a low-privileged account to corrupt memory via a use-after-free and, if successful, obtain high-integrity code execution on the affected Windows host. The issue is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) and affects a broad range of Windows 10, Windows 11, and Windows Server builds up to vendor-published fixed builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Because exploitation requires existing local access, a valid low-privileged session, and a reliable win in a non-deterministic memory-reuse race (AC:H), this is a credible but non-urgent post-compromise escalation vector rather than a mass-exploitation emergency. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Microsoft Windows Overlay Filter driver (Wof.sys) allows an authenticated attacker who already holds a low-privileged foothold on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to full system-level rights. The underlying defect is a use-after-free (CWE-416) reachable through the driver's handling of overlay/compressed file operations; because it must be triggered inside a race/timing window it carries high attack complexity (AC:H), making success probabilistic and often requiring repeated attempts, and it is strictly local (AV:L) with no victim interaction (UI:N). No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none' with automatable 'no', so this is a genuine but moderate-priority elevation-of-privilege issue whose key prerequisite is prior local code execution as an unprivileged user; a vendor patch is available.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds low-privileged authenticated access to a Windows host to corrupt the heap of the SYSTEM-level installer service and gain elevated code execution. The flaw is rated CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local and authenticated, and the high attack-complexity metric reflects that successful exploitation hinges on conditions the attacker does not fully control, such as winning a heap layout or timing race, so reliable exploitation is difficult. No public exploit code was identified at time of analysis, and CISA's SSVC evaluation records Exploitation as none and Automatable as no; every supported Windows client and server edition (including Server Core) at builds below the vendor's fixed levels is affected, and a vendor patch is available.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).
Local privilege escalation in the Microsoft Windows Local Security Authority Server (lsasrv) lets an attacker who already holds a low-privilege local account win a race condition and trigger a use-after-free, corrupt memory inside the LSA process and run code with SYSTEM-level privileges, yielding high confidentiality, integrity and availability impact (CVSS 7.0). Affected builds cover default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core editions, below the vendor's patched builds. No public exploit identified at time of analysis and CISA's SSVC records Exploitation=none with Automatable=no, meaning the high-complexity timing window (AC:H) makes dependable, repeatable exploitation unlikely without significant effort. The elevation is not remotely reachable: an authenticated local foothold on the host is a prerequisite.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker with low privileges to gain elevated rights by exploiting a race condition that leads to a use-after-free. Exploitation requires VBS with Enclaves to be enabled and a pre-existing local foothold, and the attacker must win a timing race (CWE-362). Microsoft rates this as CVSS 7.0 (High); no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft SQL Server allows an authorized, low-privileged principal with existing access to the database host to exploit a use-after-free memory condition (CWE-416) and run code in a more privileged security context. Affected builds span SQL Server 2019, 2022, and 2025 on versions below the fixed GDR and CU releases published with Microsoft's January 2026 update. Exploitation is constrained by the local attack vector (AV:L) and high attack complexity (AC:H), since the attacker must already be authenticated on the host and win a memory-reuse/timing race; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege elevation in Windows Autopilot on Windows 11 (24H2, 25H2, 26H1, and 26H2) lets an authenticated low-privileged attacker who already holds a foothold on the machine exploit a race condition in an improperly synchronized shared provisioning resource and reach a high-integrity context, with high impact to confidentiality, integrity, and availability. Because the flaw is a race condition (AC:H), exploitation is non-deterministic and typically requires repeated attempts to hit a narrow timing window, but no user interaction is needed and the attack stays local (AV:L, PR:L). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and a vendor patch is available, making this a moderate-priority local elevation-of-privilege issue rather than an emergency.
Local privilege escalation in Windows BITS allows an authenticated attacker with low-level privileges to exploit a race condition and elevate to higher integrity on affected Windows 10, 11, and Server systems. Exploitation requires a pre-existing local foothold and winning a narrow timing window, making success probabilistic; no public exploit has been identified. Microsoft has released patches for all supported versions.
Local privilege escalation in the Windows Reliable Multicast Transport Driver (RMCAST, pgm.sys) lets an attacker who already holds low-privileged local access on a vulnerable host win a time-of-check time-of-use race and elevate to SYSTEM-level execution. The flaw is not remotely reachable: exploitation requires a pre-existing local, authenticated foothold (AV:L/PR:L) and must be repeated many times to reliably hit the narrow check/use window (AC:H), but a successful race yields full confidentiality, integrity, and availability impact. Microsoft has released fixed builds for the affected Windows 10, Windows 11, and Windows Server branches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at the time of analysis, and no EPSS score was supplied with the source data.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Composite Image File System (CimFS) driver allows an authenticated, low-privileged local user to reach SYSTEM-level code execution by winning a timing race that triggers a use-after-free in the driver. Exploitation requires an existing local account plus the ability to run code on the host, and the high attack complexity (AC:H) of the race makes success probabilistic rather than reliable, with no user interaction needed; no public exploit identified at time of analysis, and there is no KEV listing. Affected builds include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 below their fixed build numbers, and Microsoft has released patches.
Local privilege escalation in the Windows Phone Service on Windows 11 (23H2 through 26H2) and Windows Server 2022 lets an authenticated, low-privileged user on the machine win a race condition in a shared resource and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable and requires a pre-existing local account, and the AC:H rating reflects that a narrow, non-deterministic synchronization window must be won reliably - typically over many repeated attempts - so this is a patch-cycle item rather than an emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation none, Automatable no). Vendor patches are available per the MSRC advisory.
Local privilege escalation in Microsoft Windows Print Spooler components allows an authenticated, low-privileged user with interactive access to a Windows host to elevate privileges by triggering a race condition in spooler object handling. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations; the vulnerable spooler service is present and normally running by default, so no unusual configuration is required to reach the flaw. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor-released patches are available per the MSRC advisory - this is a moderate-priority LPE rather than an urgent remote threat.
A usable race condition in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds low-privileged local code execution on a host to escalate to SYSTEM-level rights. Because the flaw requires both an existing local foothold and repeated attempts to reliably win a narrow timing window, it functions as a post-compromise or malicious-insider escalation primitive rather than a remotely reachable attack - there is no network vector (AV:L), no user interaction (UI:N), and no public exploit identified at time of analysis. Microsoft has released fixes covering Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025, and CISA's SSVC assessment records no exploitation activity, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execution foothold on the host to win a time-of-check-to-time-of-use race condition and obtain high-integrity code execution. The issue affects unpatched Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, and Windows Server 2019, 2022, and 2025 builds wherever the Hyper-V role is installed, and is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - local-only access, existing privileges required, and a narrow race window that makes success probabilistic and likely to need many attempts. No public exploit has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied as routine maintenance.
Local privilege escalation in the Windows Connected Devices Platform Service (CDPSvc) affects a broad set of Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds, allowing an attacker who already holds an authenticated low-privileged local account to raise their privileges to a higher integrity level. The flaw is a race condition (CWE-362) in which concurrent access to an improperly synchronized shared resource can be timed to corrupt service state; the narrow, hard-to-control timing window is reflected in the high attack complexity (AC:H) of the assessed CVSS 7.0 (High) vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning remote or anonymous exploitation is not possible and success likely requires repeated attempts. Vendor patches are available and no public exploit code has been identified at time of analysis; the service ships by default on supported editions, so exposure is limited mainly by the requirement for pre-existing local access.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privileged attacker to gain elevated privileges by winning a time-of-check time-of-use race condition in the MDM component. The flaw is rated CVSS 7.0 (High) and requires local access and a narrow timing window (AC:H), with no public exploit identified at time of analysis. Affected are Windows hosts with the MDM component enabled, and successful exploitation could lead to complete compromise of confidentiality, integrity, and availability.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Local privilege escalation in Microsoft Office Click-To-Run (C2R) arises from a time-of-check time-of-use race condition in the installer/updater's file handling, letting an authorized low-privileged local user substitute attacker-controlled content in the window between validation and use and thereby gain higher privileges on the host. The flaw is rated CVSS 3.1 base 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is strictly local, requires a pre-existing authenticated session, needs no victim interaction, but is timing-dependent and therefore probabilistic - repeated attempts may be needed to win the race. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a privilege-escalation primitive for an attacker who already holds a local foothold rather than a remotely reachable or actively exploited issue. Deployments affected are Microsoft 365 Apps for Enterprise installed via Click-To-Run (reported as version 16.0.1).
Local privilege escalation in Microsoft SQL Server allows an authenticated attacker holding low-privilege access to the instance or its host to potentially elevate privileges on the underlying system by triggering an integer overflow (CWE-190). The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0 High) confirms the attack is local rather than network-based, requires a pre-existing authenticated foothold (PR:L), and carries high attack complexity (AC:H), meaning precise conditions such as specific input sizes or memory state are needed; no public exploit identified at time of analysis, and the issue is not in CISA KEV. This is a credible but not emergency-tier privilege-escalation issue whose practical risk concentrates on multi-tenant SQL Server instances or hosts shared with low-trust principals, and vendor patches are available per the Microsoft advisory.
Local privilege elevation in Microsoft SQL Server 2019, 2022, and 2025 stems from a heap-based buffer overflow that a low-privileged authenticated user with local access can trigger to gain elevated rights on the database host. Exploitation is not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:N) demands an existing authorized database session plus successful heap manipulation, and no public exploit has been identified at time of analysis, with no CISA KEV listing. Vendor patches are available, so this is a moderate-priority hardening item rather than a drop-everything emergency.
Privilege elevation on Microsoft SQL Server 2019, 2022, and 2025 instances can be achieved by an authenticated, low-privileged user who already has local access to the host or instance and can drive crafted input into a vulnerable heap-allocation code path. Successful exploitation corrupts heap memory and, because the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0), yields high confidentiality, integrity, and availability impact within the database engine's security context; the High attack complexity reflects the non-deterministic heap-grooming required for reliable code execution, and no end-user interaction is needed. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available per the Microsoft advisory, and unaffected instances are those already running the corrected cumulative-update or GDR builds.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege escalation in the Microsoft Bluetooth Driver allows an authorized, low-privileged user already running code on a Windows host to win a timing-dependent race condition and elevate to full system privileges (high confidentiality, integrity and availability impact). Exploitation is strongly limited by high attack complexity: the race window is non-deterministic, success is unreliable, and the flaw is not automatable, so it cannot be exploited by network-only attackers. There is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - and no KEV listing exists, making this a moderate-priority local EoP issue rather than an emergency. Vendor patches are available through Microsoft's update guide.
Local privilege escalation in the Microsoft MANA network driver for the Linux kernel lets an authenticated low-privilege user on the host raise privileges to kernel/root level by winning a time-of-check time-of-use race in the driver (CWE-367). The attack is strictly local (AV:L) and high-complexity (AC:H) because the race must be won, and it only applies where the MANA driver is present and loaded - in practice Azure-hosted or MANA-capable Linux systems that use it as the primary network path. A vendor-released patch is available per the Microsoft advisory; no public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV).
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvruserservice) allows an authenticated user who already holds low privileges and local access to the host to elevate to a higher integrity context on affected Windows 10, Windows 11, and Windows Server 2019 installations. Success depends on winning a narrow, non-deterministic race window between the freeing and reuse of an object (CWE-362, reflected in the CVSS vector as AC:H), so exploitation is unreliable and may require many repeated attempts, though a successful trigger yields high confidentiality, integrity, and availability impact on the vulnerable component. No public exploit code was identified and there is no confirmed active exploitation (the vulnerability is not in CISA KEV); Microsoft has released fixed builds through its monthly update channel.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.
Privilege escalation on supported Windows 10, Windows 11, and Windows Server builds stems from a use-after-free in the Cloud Files Mini Filter Driver (cldflt.sys), the component that services OneDrive-style cloud placeholder files. An attacker who already holds local, authenticated access to the host (CVSS PR:L, AC:H) and can drive concurrent cloud-file operations may win a narrow race window (CWE-362) and corrupt driver memory, ultimately gaining SYSTEM-level code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is not confirmed actively exploited (CISA KEV) and no public exploit code was identified at time of analysis; the local foothold requirement, the timing-dependent nature of the race, and the need for repeated attempts keep realistic risk below the raw score. Vendor patches are available from Microsoft.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Local privilege escalation in the Windows Clipboard User Service allows an attacker who already holds a low-privileged, authenticated session on a Windows host to win a race condition on an improperly synchronized shared resource and elevate their privileges on that machine. Only local access is viable (AV:L, PR:L) with no user interaction required, and the timing-dependent nature of the flaw (AC:H, SSVC Automatable=no) means exploitation is non-deterministic and typically requires many repeated attempts rather than a reliable one-shot trigger. There is confirmed publicly documented vendor patching but no public exploit identified at time of analysis, and the race-condition reliability plus the prerequisite foothold make practical risk more moderate than the 7.0 severity score alone suggests.
Vifm file manager versions 0.8.1-beta through 0.14.4 reuse an already-existing IPC FIFO named vifm-ipc-vifm in the shared temporary directory without verifying who owns it, so a local attacker who plants a world-writable FIFO can feed it IPC packets containing -c and ! shell commands that then run with the victim's privileges. Reaching the flaw requires a multi-user host with a common temp directory, a local foothold on that host (PR:L), and a victim who subsequently starts vifm (UI:R passive interaction); the independent assessment rates this CVSS:3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (7.8 High), while the supplied CVSS 4.0 vector scores 7.0. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and no vendor-released patch has been identified, since the referenced source at v0.14.4 still contains the vulnerable FIFO handling.
Command injection in the VNote note-taking application before version 4.3.0 lets an attacker-controlled note filename execute arbitrary commands as the victim user on Linux and macOS, but only when the victim opens that note and has configured an external program whose arguments are command-capable, such as vim/gvim's -c option. The root cause is SessionConfig::ExternalProgram::fetchCommand, which wraps the note path in double quotes and hands the whole string to QProcess::start(const QString&), so a double quote inside a POSIX filename terminates the quoted path and appends attacker-chosen arguments to the configured program. The vendor fixed the issue in 4.3.0; no public exploit identified at time of analysis, and the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.0) reflects full impact on confidentiality, integrity and availability once the narrow exploitation prerequisites are met.
Elevation of privilege in the Windows Connected Devices Platform Service (Cdpsvc) allows a local, low-privileged attacker to gain SYSTEM-level privileges by exploiting a double-free memory corruption issue. The flaw affects Windows 11 versions 23H2 through 26H2 and Windows Server 2025 (including Server Core) prior to the fixed builds listed in the Microsoft advisory. No public exploit code or active exploitation has been identified, but exploitation requires high attack complexity due to a race condition.
Local privilege escalation in WSL2 allows an authenticated low-privileged user to gain elevated privileges by exploiting a time-of-check time-of-use race condition. Affected versions are 5.0.0.0 through 2.7.10, and a vendor patch is available. No public exploit code is identified, and the high attack complexity (requiring precise timing) makes reliable exploitation difficult, consistent with CISA SSVC marking it as not automatable.
Privilege escalation in the Windows DWM Core Library lets a locally authenticated attacker with only low-level privileges raise their rights on an affected host by triggering a use-after-free (CWE-416) in the Desktop Window Manager's core component. Successful exploitation is constrained by high attack complexity (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), meaning it depends on winning a race/timing window and arranging a specific memory layout, so it is expected to be unreliable per attempt rather than a guaranteed escalation. This is a post-access escalation path rather than a remote entry point: the attacker must already hold a standard/interactive foothold on an unpatched build, and no user interaction is required. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Bind Filter Driver (bflt.sys), a core kernel-mode component, allows an authenticated low-privileged attacker with existing code execution on a target host to escalate to SYSTEM-level privileges through a use-after-free condition (CWE-416). Exploitation is not trivial: the flaw is a race condition requiring precisely timed reclamation of a freed kernel object, reflected in the high attack-complexity rating of the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 7.0), and the attacker must already hold local access (AV:L, PR:L) - this is a post-compromise escalation primitive, not a remote entry vector. No public exploit code was identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but second-tier priority relative to actively exploited kernel flaws; it nonetheless affects default installations of Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 (including Server Core) until patched.
Local privilege escalation in the Windows MIDI Service Module allows an authenticated low-privileged attacker to gain elevated code execution by triggering a use-after-free (CWE-416) in the service's memory handling. Affected versions include Windows 11 24H2 (10.0.26100.0 < 10.0.26100.9711), 25H2 (10.0.26200.0 < 10.0.26200.9711), 26H1 (10.0.28000.0 < 10.0.28000.3231), and 26H2 (10.0.26300.0 < 10.0.26300.9711). Exploitation requires the attacker to already possess authenticated local code execution (PR:L, AV:L) and to win a timing-dependent race (AC:H), making reliable exploitation non-trivial; no public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Windows Kerberos allows an authenticated attacker who already holds low-privileged code execution on a Windows 11 26H1 host (builds 10.0.28000.0 up to but not including 10.0.28000.3231) to elevate to a higher integrity level, with high impact across confidentiality, integrity, and availability on the affected machine. The root cause is a use-after-free that must be triggered and won as a race, so the high attack complexity (AC:H) materially limits reliable exploitation; there is no remote vector and no victim user interaction is required. No public exploit identified at time of analysis, no exploitation has been observed (CISA SSVC records Exploitation: none, Automatable: no), and a vendor patch is available.
Local privilege escalation in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows an authenticated attacker who already holds a low-privileged foothold on Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server 2025 to elevate to SYSTEM-level code execution by triggering a use-after-free (CWE-416) inside the service. Exploitation requires winning a race condition to reuse a freed memory object, which raises attack complexity and limits reliability, and there is no remote vector - this is a post-compromise escalation primitive rather than an initial-access flaw. No public exploit code has been identified and no active exploitation has been confirmed; Microsoft has released vendor patches for all affected branches.
Privilege escalation in the Windows Kernel lets an authenticated local attacker with low privileges trigger a timing-dependent use-after-free in kernel memory and, on success, execute code at a higher integrity level (SYSTEM) on the affected host. Only unpatched Windows 11 24H2/25H2/26H1/26H2 and Windows Server 2025 builds are in scope, and the attacker must already hold a local foothold on the machine - there is no remote or network-facing path. CISA's SSVC assessment records no exploitation and no public exploit has been identified at time of analysis, but because the technical impact is rated total and a vendor patch is already shipping, the update should be treated as a routine-but-priority patch rather than an emergency.
Local privilege escalation in Windows Active Directory Certificate Services (AD CS) arises from a race condition (CWE-362) on a shared resource, letting an attacker who already holds a low-privileged, locally authenticated account on an AD CS host gain elevated privileges with high impact to confidentiality, integrity, and availability. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable and requires no victim interaction, but its high attack complexity means success depends on winning a narrow, timing-dependent race, so exploitation is non-deterministic and may need many attempts rather than being cleanly automatable - consistent with CISA's SSVC rating of exploitation 'none' and automatable 'no'. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Microsoft has shipped a vendor update, making patching the definitive fix.
Local privilege escalation in the Windows Security App allows an authenticated attacker with existing local access to elevate privileges to SYSTEM or administrative level via a use-after-free (CWE-416) memory corruption condition. Exploitation is rated CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring a local foothold and successful heap grooming or timing manipulation; no public exploit code has been identified at time of analysis, and Microsoft has released a patch (see advisory).