Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user on an affected host to corrupt kernel memory and seize full control of the operating system, including reading and modifying protected data. The root cause is a use-after-free (CWE-416) in core kernel code, reachable only from a local session and rated high attack complexity because exploitation depends on winning a race/timing condition to reclaim the freed object. Affected builds are Windows Server 2025 (including Server Core) below 10.0.26100.33650 and Windows 11 Version 23H2 below 10.0.22631.7652; no public exploit code identified at time of analysis and no KEV listing, so this is a moderate-priority patching item rather than an emergency, with patched builds not exploitable.
Local privilege escalation in the Windows Audio Service (audiosrv) lets an authenticated, low-privileged attacker who already has code execution on a Windows host corrupt memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the high attack-complexity value indicates the trigger likely depends on a race or a specific allocation/free timing window, making it unreliably repeatable rather than a one-shot exploit. Microsoft has published fixes through its update guide, and no public exploit code has been identified at time of analysis; the CVE was not listed in CISA KEV as of this assessment, so there is no confirmation of active exploitation.
Local privilege escalation in the Windows Win32k kernel subsystem allows an authenticated, low-privileged attacker already running code on a Windows host to corrupt kernel memory and gain SYSTEM-level execution. The flaw is a use-after-free (CWE-416) reachable from a standard user context; per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H it requires pre-existing local, authenticated access (PR:L, AV:L) with no remote or unauthenticated path, and the high attack complexity (AC:H) reflects the need to win a timing/race window and reliably reclaim the freed object, which lowers exploitation reliability. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft rates it 7.0 (High) and has released fixes across all supported Windows 10, Windows 11, and Windows Server branches.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already holds low-level code execution on a host raise privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. The bug is a kernel type confusion (CWE-843) in an always-present, in-box WinSock component reachable by ordinary users through standard socket APIs, but exploitation is rated high-complexity (AV:L/AC:H/PR:L/UI:N) because a reliable trigger likely depends on winning a race or reaching a precise kernel object/memory state, which lowers real-world reliability. This is a genuine but moderate-priority local privilege-escalation issue: no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), while Microsoft has published fixes through its standard update channel.
Local privilege escalation in Windows Push Notifications allows an attacker who already holds a low-privileged authenticated local session to gain SYSTEM-level code execution by exploiting a timing-dependent use-after-free (CWE-416), but the high complexity score (AC:H) and race-condition requirement make successful exploitation unreliable. Microsoft has released patches, and no public exploit has been identified at time of analysis. The flaw scores 7.0 CVSS and can lead to full confidentiality, integrity, and availability impact, yet the mandatory local access prerequisite makes it a genuine but not top-priority issue.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated, low-privileged attacker who already has local code execution on the host to corrupt kernel memory and elevate to SYSTEM by winning a timing-dependent use-after-free race in the socket subsystem. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, total technical impact), requires no user interaction, and affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, though exploitation is non-trivial and not automatable per CISA SSVC (Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor-released patches are available for every affected build.
Local privilege escalation in the Windows TCP/IP stack allows an authenticated attacker who already holds low-privileged code execution on a host to corrupt kernel memory and elevate to a higher-integrity context. The flaw is a use-after-free (CWE-416) that requires winning a race condition (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), which limits reliability and keeps the flaw non-automatable per the CISA SSVC assessment; no public exploit code has been identified at time of analysis and exploitation has not been observed. Every supported Windows client and server edition, including Server Core installations, is affected until updated to the fixed builds published by Microsoft, and practical risk is concentrated on shared or multi-user hosts where untrusted users can run local code.
Local privilege escalation in the Windows kernel allows an authenticated attacker holding only low privileges on a vulnerable host to trigger a use-after-free (CWE-416) and gain code execution at higher integrity, with full confidentiality, integrity and availability impact per the CVSS vector (7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already be logged on locally and no user interaction is required, but the high attack complexity means success depends on reliably reclaiming a freed kernel object, a timing-sensitive operation requiring build-specific memory-layout knowledge across the large set of affected Windows 10, Windows 11 and Windows Server builds below their fixed patch levels. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CISA SSVC assessment records exploitation as 'none' and not automatable, making this a moderate-priority patch item rather than an emergency; vendor patches with explicit fixed build numbers are available via the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Audio Service lets an attacker who already holds low-privilege code execution on a Windows host trigger a use-after-free (CWE-416) and elevate to a more privileged context. The flaw is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable, requires an existing foothold and local code execution, and the high attack complexity reflects a race/timing window that must be won, making exploitation non-deterministic. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and non-automatable, and the issue does not appear in CISA KEV; completely patched builds are available from Microsoft.
Local privilege escalation in the Windows Event Tracing (ETW) subsystem allows an attacker who already holds low-privileged code execution on a host to raise their privileges, with high confidentiality, integrity and availability impact (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a use-after-free (CWE-416) that is only reachable locally and additionally requires winning a timing race, so reliable exploitation is non-trivial; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, with CISA SSVC scoring exploitation as 'none' and automatable as 'no'. Microsoft has released a vendor patch, and risk is concentrated on multi-user, terminal/RDP, or shared systems where untrusted low-privilege accounts can run code - a moderate, not emergency, priority.
Local privilege escalation in the Windows Audio Service (audiosrv) affects Windows 11 versions 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core), allowing an attacker who already holds a low-privileged foothold on the host to execute code in a more privileged context. Exploitation requires an authenticated local attacker with the ability to interact with the audio service (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity indicates the use-after-free hinges on a race or specific heap/object state that is difficult to trigger reliably; the service runs by default, so every affected build is exposed once a foothold exists. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as none and the issue is not automatable, so this is a genuine but moderate-priority local privilege escalation rather than an urgent remote threat; a vendor patch is available.
Local privilege escalation to SYSTEM in the Windows Win32k kernel subsystem affects Windows 10, Windows 11, and Windows Server releases, allowing an authenticated low-privileged attacker already executing code on the host to exploit a use-after-free (CWE-416) condition and gain full kernel-level control (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The high attack complexity (AC:H) reflects the need to reliably win a race or groom the kernel heap, and there is no remote or network vector, so multi-user, RDP/terminal-server, and kiosk systems are the most relevant risk surface. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows DHCP Server lets an authenticated, low-privileged user trigger a use-after-free (CWE-416) in the DHCP Server service and obtain SYSTEM-level code execution on the host. It is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already have local access and must win a non-deterministic race to reach the freed-memory window, so the flaw is not remotely reachable and is best treated as a post-compromise escalation step on provisioned DHCP infrastructure rather than an emergency. No public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows Update Service allows an attacker who already possesses valid low-privileged local access on an affected Windows host to elevate to a higher-integrity context (including SYSTEM) by triggering a use-after-free. The attack is entirely local - there is no network-facing path - and the assessed vector (AV:L/AC:H/PR:L/UI:N) means successful exploitation depends on winning a race/timing window inherent to the memory-reuse condition, so reliable elevation may require multiple attempts and is not a deterministic one-shot. Affected unpatched builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2019/2022/2025 (Server Core included); no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, making this a legitimate but moderate-priority LPE rather than an urgent, broadly exploited threat.
Local privilege escalation in Windows Work Folders allows an attacker who already holds authenticated, low-privileged access on an affected Windows 10, Windows 11, or Windows Server host to trigger a use-after-free in the Work Folders code path, corrupting memory and potentially executing code with elevated privileges. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms this is a post-compromise escalation step that requires an existing local foothold and a reliably won race/timing window, with no user interaction; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released fixed builds through the MSRC update guide, so the primary risk is to unpatched hosts where the Work Folders feature is present and in use.
Use-after-free in Windows Secure Kernel Mode allows an authenticated attacker running code locally on the target with low/standard-user privileges to escalate to higher privilege levels on affected Windows 10, Windows 11 and Windows Server 2019-2025 builds that are below their patched versions. The flaw is rated CVSS 7.0 (HIGH); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exploitation is gated by high attack complexity because a reliable UAF typically requires winning a timing race or precisely grooming Secure Kernel memory. Microsoft has released vendor patches - applying the fixed builds removes the condition entirely.
Local privilege escalation in Windows Direct Composition (DComp) lets an attacker who already has low-privileged code execution on an affected Windows 11 or Windows Server host escalate to SYSTEM-level privileges. The flaw is a use-after-free (CWE-416) that requires winning a heap-grooming race window, so it is rated high complexity (AC:H) and carries a CVSS of 7.0; exploitation is local and the attacker must be authenticated (PR:L, AV:L) with no user interaction needed (UI:N). Microsoft has released fixes for every affected branch, and there is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as "none," making this a moderate-priority patch item rather than an emergency.
Local privilege escalation in Microsoft's Quality Windows Audio/Video Experience (QWAVE) service stems from a use-after-free condition (CWE-416) that can let an already-authenticated local user execute code in the service's more privileged context, with high impact to confidentiality, integrity and availability (C:H/I:H/A:H). Rated CVSS 7.0 with a vector of AV:L/AC:H/PR:L/UI:N/S:U, exploitation requires an attacker who already holds a local account on the host and who can also win a timing or object-lifetime race - CISA's SSVC assessment records Exploitation=none and Automatable=no, and there is no public exploit identified at time of analysis. Microsoft has shipped vendor-released patches for every affected branch, so this is best treated as a moderate-priority post-foothold escalation whose realistic risk is lower than the base score alone suggests, rather than an emergency to be handled outside the normal patch cycle.
Local privilege escalation in Windows NTFS allows an authenticated attacker with low privileges to gain SYSTEM-level code execution by triggering a use-after-free race condition in the kernel filesystem driver. Affected systems are unpatched Windows 10, Windows 11, and Windows Server builds (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows 10 22H2 <10.0.19044.7807). Exploitation requires a local foothold and is complicated by the timing-dependent nature of the flaw (CVSS AC:H), and no public exploit has been identified at the time of analysis; a vendor-released patch is available.
Local privilege escalation in the Windows Clipboard Server component allows an attacker who already holds a low-privilege, authenticated local session on a Windows host to escalate privileges by triggering a NULL pointer dereference (CWE-476) in the clipboard handling path. Exploitation is constrained by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning a specific timing window or memory state must be won rather than a straightforward, repeatable sequence, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; affected builds span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 prior to the vendor-supplied fixed build numbers.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a use-after-free that yields high impact to confidentiality, integrity, and availability on affected Windows 11 and Windows Server 2025 hosts. Exploitation is local only and gated by high attack complexity (AV:L/AC:H/PR:L/UI:N), meaning the attacker must already hold a low-privileged foothold on the machine and win a heap-grooming or race condition to trigger the bug reliably, so it functions as a post-compromise escalation step rather than a remote attack path. No public exploit has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but patch availability from Microsoft makes unpatched systems the primary exposure.
Local privilege escalation in Microsoft Windows targets the Program Compatibility Assistant Service (PCASvc) and affects Windows 10, Windows 11, and Windows Server 2016 through 2025, letting an attacker who already holds low-privileged local code execution corrupt freed memory and escalate to SYSTEM. The root cause is a use-after-free (CWE-416) scored 7.0, and the assigned CVSS vector (AV:L/AC:H/PR:L/UI:N) makes clear that exploitation is gated by a timing-sensitive high-complexity memory-reclamation race rather than a deterministic trigger; the attacker must already have an authenticated local foothold and must successfully reclaim the freed object with controlled data. Microsoft has released a vendor patch and CISA's SSVC assessment records no exploitation and no automatable path, so there is no public exploit identified at time of analysis and no evidence of active exploitation (no CISA KEV listing).
Elevation of privilege in the Windows Error Reporting (WER) subsystem lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free in the crash-reporting path and escalate to higher-integrity code execution. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw requires winning a race window the attacker does not control, which makes it timing-dependent and non-trivial to weaponize; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. Microsoft has shipped vendor patches for every affected client and server build, so exposure is fully mitigated by patching even though the local privilege gain, if achieved, is total (C:H/I:H/A:H) within the unchanged security scope.
Local privilege escalation in the Windows Backup Engine allows an authenticated local attacker with low privileges to abuse link resolution during backup or restore operations and gain elevated privileges on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) systems below the vendor-patched build numbers. Exploitation requires a race or specific filesystem preconditions (CVSS AC:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patches via the MSRC update guide.
Local privilege escalation in the Microsoft Windows Update Service allows an attacker who already holds a low-privileged, authenticated local account to trigger a heap-based buffer overflow and corrupt memory in a service that runs with high privileges, potentially yielding full control of confidentiality, integrity and availability on the host (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the service listens on no network interface for this issue, exploitation requires an existing local foothold rather than remote access, and the High attack-complexity rating indicates a real reliability barrier - most likely a timing window or a specific heap layout that must be won before corruption succeeds. No public exploit code has been identified at time of analysis, KEV status is not indicated, and no EPSS score was supplied, so this should be treated as a post-compromise escalation primitive rather than an opportunistic remote threat.
Local privilege escalation in the Windows Client License Service (ClipSVC) allows an authenticated low-privileged local attacker to execute arbitrary code at elevated integrity, potentially SYSTEM, via a heap-based buffer overflow (CWE-122). The vulnerability requires local access and high attack complexity (CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0), and there is no remote or unauthenticated path. No public exploit has been identified at the time of analysis, and exploitation is limited to scenarios where an attacker already has a foothold on the host, such as multi-user or terminal-server environments.
Local privilege escalation in the Windows Update Service on Microsoft Windows allows an authenticated attacker with low privileges to gain full control of a host by exploiting a use-after-free memory corruption flaw. The vulnerability requires high attack complexity to win a race condition, and no public exploit code has been identified at time of analysis. The CVSS 3.1 base score is 7.0 (HIGH), with full impact to confidentiality, integrity, and availability upon successful exploitation.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Privilege escalation in the Windows TCP/IP stack allows a locally authenticated, low-privileged user to trigger a kernel double free and, by winning the subsequent memory-reclamation race, gain code execution at higher (SYSTEM-level) integrity on unpatched Windows 10, Windows 11 and Windows Server builds. Exploitation demands an existing local foothold with at least low privileges and precise timing to line up kernel pool state, which is reflected in the high attack complexity component of the CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector; it cannot be triggered remotely or anonymously. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches. With a CVSS base score of 7.0 and a CISA SSVC assessment of total technical impact but no exploitation and no automatable path, this is a genuine but moderate-priority elevation-of-privilege flaw rather than an emergency, and matters most where low-privileged local access is common (RDP hosts, VDI, multi-user terminal servers).
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds authenticated low-privilege access on a Windows host to exploit a use-after-free memory-corruption condition and elevate to SYSTEM-level code execution. The flaw affects Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations, running builds below the vendor-supplied fixed build numbers. Exploitation is local-only (AV:L), requires an existing foothold with low privileges (PR:L), and carries high attack complexity (AC:H) because success depends on winning a non-deterministic memory-reclamation race; no user interaction by a victim is required, and no public exploit code or active in-the-wild exploitation has been identified at time of analysis (CISA SSVC Exploitation: none). Vendor patches are available from Microsoft, so the practical risk is concentrated in unpatched endpoints and multi-user systems where an attacker already has a standard account.
Local privilege escalation in the Windows Kerberos implementation allows an authenticated, low-privileged attacker who already has code execution on a target host to escalate to higher integrity and potentially SYSTEM-level rights through a use-after-free memory corruption. Exploitation is restricted to the local attack surface and carries high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must win a timing/race window against the freed Kerberos memory object, but no user interaction is needed and no non-default configuration is named as a prerequisite. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC exploitation: none), so this is best treated as a post-compromise escalation primitive that is difficult but high-impact if successfully triggered.
Local privilege escalation in the Microsoft Windows Search Component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to trigger a use-after-free and escalate to SYSTEM-level code execution. Affected systems are Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1 and 26H2) and Windows Server 2012 through 2025 editions running builds below the fixed levels published for CVE-2026-70156; the component is enabled by default on all of them, so no non-default configuration is required. Rated CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation hinges on winning a race or achieving a precise heap-reuse state, which lowers reliability, and no public exploit identified at time of analysis. The only material prerequisite is existing local access, making this a post-compromise escalation and persistence primitive rather than a remote entry point.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Local privilege escalation in the Windows Kernel lets an authenticated low-privileged user on unpatched Windows 11 (24H2, 25H2, 26H2) or Windows Server 2025 builds trigger a heap-based buffer overflow and execute code with SYSTEM-level privileges. Exploitation requires the attacker to already hold local access (PR:L, AV:L) and is complicated by a race on kernel heap state (AC:H), so it is not reliably triggerable on demand. No public exploit has been identified at time of analysis, patched builds are not exploitable, and this rates as a genuine but moderate-priority privilege-escalation issue rather than an emergency.
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Update component of unpatched Windows 10, Windows 11, and Windows Server installations lets a user who already holds a low-privileged local account corrupt memory and elevate to a higher-integrity context. Exploitation is gated by two factors: the attacker must already have an authenticated local foothold (AV:L, PR:L, no user interaction required), and the use-after-free is rated high attack complexity (AC:H) because it requires reliably winning a timing/race window and controlling the contents of the freed allocation, which is non-deterministic and typically needs heap grooming. No public exploit code has been identified at time of analysis, the vulnerability is not a confirmed actively exploited (CISA KEV) item, and Microsoft has released fixes, making this a genuine but moderate-priority privilege-escalation issue rather than a remotely reachable or wormable threat.
Local privilege escalation in the Windows USB Print Driver lets an authenticated attacker who already holds a foothold on a vulnerable Windows host corrupt kernel memory and obtain SYSTEM-level code execution. The flaw is a use-after-free (CWE-416) reachable only through the USB printing driver path; the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, base 7.0) requires valid local credentials and a successful race on freed kernel memory, so exploitation is timing-dependent, non-deterministic, and rated non-automatable by CISA SSVC. Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases, and no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows USB Print Driver (usbprint) lets an attacker who already holds a low-privileged local account corrupt kernel memory via a use-after-free and escalate to full system-level code execution on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a race-condition-driven memory corruption (CWE-416, high attack complexity) that requires the attacker to win a timing window and reclaim a freed kernel object, so it functions as a post-compromise escalation primitive rather than a remote entry point; exploitation is rated CVSS 7.0 with high confidentiality, integrity, and availability impact. No public exploit code exists for this issue and it is not confirmed actively exploited (CISA KEV); Microsoft has released updates addressing the affected builds.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
A use-after-free flaw (CWE-416) in the Windows USB Print Driver (usbprint.sys) allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows 10, Windows 11 and Windows Server builds that have not been updated. Exploitation requires the attacker to already hold low-privileged local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and to trigger the vulnerable code path while winning a heap-reuse/race window, making success probabilistic rather than deterministic. Microsoft has released vendor patches, and there is no public exploit identified at time of analysis.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
A use-after-free (CWE-416) in the Windows USB Print Driver lets an attacker who already holds a local, low-privileged account on a Windows host escalate to SYSTEM-level privileges by racing the driver into reclaiming a freed memory object. Successful exploitation requires winning a timing window (AC:H, PR:L, AV:L, UI:N), so the flaw is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code or evidence of active exploitation has been identified at time of analysis. Microsoft has released patched builds, and the CVSS 3.1 base score of 7.0 reflects high confidentiality, integrity, and availability impact confined to the local machine (S:U) - this is a moderate-priority local privilege escalation, not an emergency remote-compromise scenario.
A use-after-free in the Windows USB Print Driver (CWE-416) allows an attacker who already holds low-privileged local access to a Windows host to escalate privileges and obtain full control over confidentiality, integrity, and availability of the affected system. Affected platforms span Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022 and 2025 (including Server Core installations), per the EUVD version ranges. Exploitation requires winning a timing-dependent race in the driver (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), which CISA's SSVC rates as not automatable, and no public exploit has been identified at time of analysis - this is a post-compromise privilege-escalation primitive rather than an opportunistic remote threat, and Microsoft has shipped a vendor update addressing it.
Local privilege escalation in the Windows USB Print Driver enables an authenticated attacker with low-level privileges to achieve kernel-mode code execution by exploiting a use-after-free memory corruption condition (CWE-416). Microsoft has released patches covering Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core). No public exploit code or confirmed active exploitation has been identified at time of analysis (not listed in CISA KEV), and the high attack complexity (AC:H) - requiring a race or specific memory-state condition - materially limits reliable exploitation, making this a post-foothold escalation rather than an emergency.
Local privilege escalation in the Windows USB Print Driver (usbprint.sys) lets an authenticated, low-privileged user on the target host raise their privileges to SYSTEM by winning a use-after-free race in the driver's request-handling path. CVSS 3.1 scores it 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker must already have a foothold on the machine, no user interaction is needed, and the high attack complexity reflects the probabilistic nature of reclaiming the freed object. The affected builds are Windows 10 21H2/22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, plus Windows Server 2022 and Windows Server 2025 (including Server Core); no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation='none' and Automatable='no', and Microsoft has published fixes, so this is a moderate-priority local escalation rather than an emergency remote threat.
Local privilege escalation in Windows Kernel allows an authenticated low-privileged user to gain elevated privileges by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation requires prior local code execution as a low-privileged user (PR:L, AV:L), has no user interaction (UI:N), and is made difficult by high attack complexity (AC:H) because the race/timing needed to trigger the freed object is not deterministic. This is a genuine but not top-tier priority; no public exploit identified at time of analysis, and SSVC records exploitation as none, with Microsoft providing vendor updates.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Local Security Authority (LSA) allows an authenticated attacker who already holds low-level local access on a Windows host to win a timing race against a use-after-free in the LSA process and obtain SYSTEM-level rights, with high impact on confidentiality, integrity, and availability. The flaw spans all supported Windows client and server releases, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations, per the EUVD version ranges; exploitation requires local access (AV:L) plus a difficult race condition (AC:H), so there is no remote or unauthenticated exposure. Signal convergence - CISA SSVC Exploitation 'none', Automatable 'no', no KEV listing, and no public exploit identified at time of analysis - makes this a moderate-priority local elevation-of-privilege issue rather than an emergency, with the highest practical risk on multi-user or RDP/terminal hosts where low-privileged users share a machine with sensitive assets.
Local privilege escalation in the Windows Kernel lets an authenticated attacker who already has low-privileged code execution on the host win a use-after-free race condition to obtain SYSTEM-level rights, yielding full compromise of confidentiality, integrity, and availability (CVSS 7.0, CWE-416). Unpatched Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2022/2025 builds in the ranges listed by Microsoft are affected; the flaw is not remotely reachable, requires local authenticated access, and carries high attack complexity, so exploitation is likely unreliable and may need repeated attempts. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, not in KEV), and vendor patches are available, making this a credible but not top-tier priority for most environments.
Local privilege escalation in the Windows SMB Server allows an authenticated, low-privileged user with local logon rights to trigger a use-after-free in the SMB server component and obtain code execution at a higher integrity level, with high impact across confidentiality, integrity and availability. The flaw spans a wide range of Windows client and server branches - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) - and is constrained by the local vector (AV:L, PR:L) plus a non-default timing/memory precondition (AC:H), meaning the freed object must be won through a race or specific reuse state rather than reliably on a first attempt. Vendor patches are available for every affected branch and no public exploit code had been identified at time of analysis; this is a moderate-priority local escalation rather than a top-tier emergency, since it presupposes an existing foothold and an unreliable exploitation window.