Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free inside the installer service and gain elevated (SYSTEM-level) code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0): the attacker must win a non-deterministic race/heap-grooming window to reclaim the freed object, so the technique is not consistently reliable, and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation: none and Automatable: no. Vendor patches are available for the full affected build matrix spanning Windows 10 and Windows 11 (through 26H2) as well as Windows Server 2012 through Windows Server 2025, so this is a genuine but second-tier priority relative to remotely exploitable or actively exploited issues.
Local privilege escalation in Microsoft Windows Graphics Kernel allows an authenticated local attacker with low privileges to gain elevated (likely SYSTEM) privileges by triggering a heap-based buffer overflow. Affected versions include Windows 11 24H2, 25H2, and 26H2 prior to builds 10.0.26100.9711, 10.0.26200.9711, and 10.0.26300.9711 respectively, and Windows Server 2025 (including Server Core) prior to 10.0.26100.33650. No public exploit code or active exploitation has been identified, and the high attack complexity (AC:H) suggests exploitation requires precise heap grooming or winning a race condition, reducing reliability.
Local privilege escalation in the Windows MIDI Service Module allows an attacker holding low-privileged local access on an affected Windows 11 host to trigger a null pointer dereference (CWE-476) and escalate to a higher-integrity security context, with high impact to confidentiality, integrity, and availability. Exploitation requires authenticated local access (PR:L) and a non-deterministic, likely race- or timing-dependent trigger (AV:L/AC:H/UI:N), which materially reduces real-world reliability; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none. With a 7.0 base score and total technical impact if successfully triggered, this is best treated as a moderate-priority local elevation-of-privilege flaw to be closed on the normal patch cycle rather than an urgent internet-facing emergency.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft's Windows Installer service lets an attacker who already holds authenticated low-privilege local access free and then reuse a memory object, potentially seizing control of the SYSTEM-level installer process. Exploitation hinges on winning a non-deterministic race/timing window (AC:H, PR:L, AV:L), so CISA's SSVC rates exploitation as 'none' and automatable as 'no'; no public exploit identified at time of analysis and the flaw is not in CISA KEV, though the technical impact if successfully triggered is total (full confidentiality, integrity and availability loss). Microsoft has released vendor patches covering all affected Windows 10, Windows 11 and Windows Server builds.
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) on supported Windows 10, Windows 11 and Windows Server builds allows a low-privileged, locally logged-on user (PR:L, AV:L, UI:N) to win a use-after-free race inside the service and execute code in a higher-privileged service context. The issue is rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), with high attack complexity reflecting the difficulty of reliably triggering and winning the memory-reuse race, and CISA's SSVC assessment records no exploitation, no automatable path and no public exploit identified at time of analysis. Because AppXSvc is default-enabled and the vector is strictly local, residual risk is concentrated on unpatched multi-user, shared or kiosk Windows hosts where any interactive account could repeatedly attempt the race; vendor patches are available and materially reduce that risk.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Windows Common Log File System (CLFS) kernel driver allows an attacker who already holds low-privileged execution or credentials on a host to abuse a use-after-free race in the driver and gain kernel-level (SYSTEM) privileges, per CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerable driver ships and loads by default on every listed Windows 10, Windows 11 and Windows Server build, so no non-default feature or configuration has to be enabled to reach the code - but the high attack complexity reflects the fact that the freed object must be reclaimed inside a narrow timing window, which weakens real-world reliability and complicates weaponization. No public exploit code has been identified and there is no evidence of active exploitation (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has published fixes for the affected builds.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects unpatched supported builds of Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2019, Server 2022, and Server 2025, where a use-after-free in the desktop compositor lets a locally authenticated, low-privileged attacker corrupt memory and run code at a higher integrity level. Exploitation requires an existing foothold on the host (AV:L/PR:L) and is rated high complexity (AC:H), consistent with a timing- or heap-state-dependent race in the graphics subsystem that an attacker must win reliably, so this is a genuine but moderate-priority elevation-of-privilege issue rather than a drop-everything emergency. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds through the MSRC update guide.
An out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library can be triggered by a local, authenticated low-privilege attacker to leak memory and, in the assessed worst case, achieve local privilege elevation on affected Windows 10, Windows 11, and Windows Server builds. This is a credible but not emergency-tier priority: exploitation demands a pre-existing local foothold and high attack complexity (race or precise memory/heap conditioning), and no public exploit or active exploitation has been identified at time of analysis. A vendor patch is available per the Microsoft advisory, so affected fleets should be updated through normal patch cycles rather than treated as an emergency.
Local privilege escalation in the Windows kernel TCP/IP stack allows an attacker who already holds a low-privilege foothold on a host to trigger a heap-based buffer overflow (CWE-122) and corrupt kernel memory, potentially gaining code execution at SYSTEM level. Successful exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N) and no user interaction, but the high attack complexity reflects the heap grooming or race conditions typically needed to turn kernel pool corruption into reliable code execution, so attempts are non-deterministic. Microsoft has published fixes for affected Windows 10, Windows 11, and Windows Server builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure is highest on multi-user, RDP, or shared workstation hosts where untrusted users can run local code.
Local privilege escalation in the WebDAV component of Microsoft Windows (CVE-2026-85828, CVSS 7.0) lets a low-privileged authenticated attacker who already holds a foothold on the host corrupt heap memory and gain elevated rights. Exploitation is local only (AV:L) and gated by high attack complexity (AC:H), reflecting the heap-layout or timing control needed to reliably win the CWE-122 overflow, so success is probabilistic rather than guaranteed; there is no network-facing path indicated in the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released patched builds for all affected Windows client and server branches via the MSRC update guide. This is best treated as a moderate-priority post-compromise hardening item rather than a critical remotely exploitable issue.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in Windows Composite Image File System (CimFS) affects Windows 11 24H2, 25H2, 26H1, and 26H2 plus Windows Server 2022 and Windows Server 2025 (including Server Core). An authenticated attacker who already has local access and standard user privileges (CVSS PR:L) and the ability to execute code that interacts with the CimFS driver can trigger a use-after-free (CWE-416) for high confidentiality, integrity, and availability impact inside the OS, though High attack complexity (AC:H) makes reliable exploitation dependent on winning a memory-reclamation race. Patch available per vendor advisory; no public exploit identified at time of analysis, and this is a medium-to-high priority local privilege escalation rather than a drop-everything emergency.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Local privilege escalation in the Windows Camera Frame Server Monitor allows an attacker who already holds a standard-user session on an affected host to drive a use-after-free in frame-server memory handling and elevate to SYSTEM-level code execution. Exploitation is local and needs no user interaction, but the assessed vector rates attack complexity as high (AC:H), meaning the attacker must realistically win a timing/race window against the service - a significant reliability barrier; no public exploit code has been identified at time of analysis. Only unpatched Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 builds and Windows Server 2025 (including Server Core) are affected, and Microsoft has released vendor patches. This is a moderate-priority local privilege escalation flaw, not an internet-facing emergency.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
A use-after-free in the Windows WebDAV (WebClient) implementation allows an authenticated, locally-present low-privileged user to elevate privileges on the same host by winning a race-conditioned memory-reuse path (CWE-416, CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N). All Windows client and server builds below their respective fixed build numbers are affected once the WebDAV client code path is reachable, with realistic exposure concentrated on multi-user hosts such as terminal servers, RDP session hosts and shared workstations where untrusted users can execute local code. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; no KEV listing), and Microsoft has released a vendor patch through the MSRC update guide.
Local privilege escalation in the Windows Cash Drawer Protocol Provider affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 builds, where an attacker who already holds authenticated local access can trigger a use-after-free in the cash drawer component and potentially execute code in a more privileged context (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained by high attack complexity because the dangling-pointer reuse must be timed precisely (race or controlled heap reuse), and there is no remote or unauthenticated path; a victim user does not need to be tricked into any action. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, so this is a moderate-priority local privilege escalation that should be handled through normal patch cycles. Microsoft rates the impact class as use-after-free/memory corruption with total technical impact, and the vendor has published a remediation update.
Local privilege escalation in the Windows Installer (msiexec) component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free and run code at a higher integrity level, including SYSTEM. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, all of which Microsoft has patched (for example Windows 11 24H2 at 10.0.26100.9711 and Windows Server 2025 at 10.0.26100.33650). No public exploit identified at time of analysis, CISA's SSVC records exploitation as 'none', and the High attack complexity (AC:H) rating implies a timing- or race-dependent primitive that will be unreliable for attackers; this is a genuine but non-emergency escalation issue requiring an existing local foothold rather than a remote, unauthenticated threat.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds a low-privileged, authenticated foothold on a Windows host convert that access into elevated rights by triggering the release of an invalid pointer or reference inside the management service. The flaw is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local, requires standard-user privileges, needs no user interaction, and carries a high-complexity success condition, so exploitation is not deterministic and depends on winning a specific timing or state condition in the service. No public exploit code exists and there is no CISA KEV listing (SSVC exploitation: none), and Microsoft has released an update through its security update guide, making this a genuine but moderate-priority patching item rather than an urgent, actively exploited threat.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authenticated, low-privileged local user trigger a use-after-free and gain code execution at a higher integrity level, ultimately SYSTEM on affected Windows hosts. The vulnerability carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning prior local access and a low-privileged foothold are required, and the high attack complexity implies the memory corruption depends on winning a timing or allocation race rather than succeeding reliably on a single attempt. Every currently supported Windows client and server edition is in scope, from Windows 10 1607/1809/21H2/22H2 through Windows 11 23H2/24H2/25H2/26H1/26H2 and Windows Server 2012 through Server 2025; vendor patches are available, CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) lets an attacker who already holds a low-privileged, authenticated account on a Windows host trigger a use-after-free in the WER subsystem and elevate to SYSTEM-level code execution. The flaw spans a very broad set of supported releases - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 (including Server Core installations) - but exploitation requires local access and is rated high complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), since reliable abuse almost certainly depends on winning a memory-reclamation race under controlled heap conditions. No public exploit code has been identified at time of analysis and CISA's SSVC framework records exploitation as 'none'; vendor-released patch builds are available for each affected branch, making this routine patch-cycle work rather than emergency response.
Local privilege escalation in the Windows Device Association Service allows an authenticated low-privileged attacker who already has code execution on a host to win a use-after-free race inside the service and obtain SYSTEM-level code execution, turning a foothold into full control of the machine (CVSS 7.0, CWE-416). Exploitation is constrained by prerequisites and reliability: the vector is local only (AV:L), requires prior low-privileged credentials (PR:L), and carries high attack complexity (AC:H) because the memory-reuse window is timing-dependent, which is why CISA's SSVC records Exploitation: none and Automatable: no; no public exploit code has been identified at time of analysis. The hosts most at risk are multi-user, shared, or terminal-server Windows systems where untrusted local users can repeatedly attempt the race, making this a moderate-priority local privilege escalation rather than an emergency.
Use-after-free memory corruption in the Windows Device Association Service (DeviceAssociationService) lets an authenticated, low-privileged local user elevate to the privileges of the affected service and gain full control of confidentiality, integrity and availability on the host. Exploitation is local and requires an existing foothold with low privileges (PR:L) plus a win in a timing race (AC:H), so it is a post-compromise privilege-escalation primitive rather than a remote entry point; no user interaction is needed (UI:N), and because it is a default Windows component the service is present on all listed builds. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable, so signals align toward a moderate, non-urgent priority even though vendor patches are already available.
Local privilege escalation in the Windows Routing and Remote Access Service (RRAS) stems from a use-after-free memory-safety flaw (CWE-416) that an attacker with low-privileged local access can trigger to gain SYSTEM-level code execution. Real-world exposure is narrow: RRAS is not installed or running by default, so only hosts configured as VPN, NAT, or routing gateways are realistic targets, and exploitation depends on winning a timing race (CVSS AV:L/AC:H/PR:L, high attack complexity), which CISA SSVC assesses as not automatable with no observed exploitation. Microsoft has released a vendor patch, and no public exploit identified at time of analysis - this is a moderate-priority, not emergency, vulnerability whose practical risk sits below what the 7.0 base score alone suggests.
Local privilege escalation in Microsoft Windows Win32K allows an attacker who already holds a low-privileged local account to corrupt kernel memory and elevate to SYSTEM-level rights via a use-after-free condition (CWE-416). Exploitation is confined to the local host (AV:L, PR:L) and is gated by high attack complexity (AC:H) because the attacker must win a timing window in kernel object lifetime management; no user interaction is required and the flaw affects default configurations of Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 below the patched builds listed in EUVD-2026-99399. There is no confirmed active exploitation (CISA KEV is not present) and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, though technical impact is total once code execution is achieved. Microsoft has released fixes, and Microsoft product versions with the vendor update applied are not affected.
Local privilege escalation in Windows Hello lets an attacker who already holds a valid low-privileged account and code execution on an affected Windows host win a use-after-free race in the authentication component and elevate to a higher-integrity context with high confidentiality, integrity, and availability impact. The vulnerability is not remotely reachable (AV:L, PR:L) and requires no user interaction (UI:N), but the high attack complexity (AC:H) reflects a timing-dependent memory-reuse window that must be won and is not reliably repeatable; CISA's SSVC assessment rates exploitation as none and automatable as no. No KEV listing and no public exploit code were identified at time of analysis, so despite a 7.0 CVSS base score the practical risk is moderate and should not outrank remotely exploitable, actively exploited issues in the same patch cycle. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H2/26H1, and a vendor patch is available.
Local privilege escalation in the Windows Bluetooth Port Driver lets an authenticated user who already holds a foothold on a Windows host trigger a heap-based buffer overflow and reach high-integrity code execution, scored CVSS 7.0 with total confidentiality, integrity, and availability impact. The defect (CWE-122) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 builds that predate the current cumulative updates, is not remotely reachable, and requires local access with low privileges, no user interaction, and high attack complexity (AV:L/AC:H/PR:L/UI:N). Microsoft has released a vendor patch, CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis - this is a genuine but second-tier priority behind remotely reachable or confirmed-exploited issues.
Use-after-free in Windows Hello allows an authenticated local attacker to elevate privileges to SYSTEM on affected Windows 10 (21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) builds. Exploitation requires the attacker to already hold low-privilege code execution on the target host (AV:L, PR:L) and depends on winning a non-deterministic memory-reuse race (AC:H), making this a post-compromise escalation path rather than a remotely reachable flaw. No public exploit code has been published and no active exploitation has been observed (CISA KEV not applicable, SSVC exploitation: none); Microsoft has released vendor patches, and this is best treated as a genuine but moderate-priority issue rather than a drop-everything emergency.
Local privilege escalation in Microsoft Windows Hello allows an attacker who already holds low-privilege code execution on a vulnerable Windows build to corrupt memory inside the Hello authentication component and elevate privileges on the host. Affected platforms span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, all of which have vendor-supplied fixes available. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC decision framework rates the flaw non-automatable because success depends on winning a timing-sensitive memory-reuse race rather than executing a deterministic payload.
A use-after-free in the Microsoft Windows Installer service (msiserver / msiexec) lets an attacker who already holds low-privilege local access on a Windows host corrupt heap memory and elevate to SYSTEM, giving full control over confidentiality, integrity and availability of the machine (CVSS 7.0, CWE-416). The flaw is local-only (AV:L), requires low-privilege credentials (PR:L) and no user interaction (UI:N), but high attack complexity (AC:H) reflects a timing- or heap-state-dependent trigger that makes reliable weaponization difficult; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none and automatable as no. Vendor-released patches are available from Microsoft, so this is a genuine but not top-tier priority - a routine monthly-update item rather than an emergency, though the total technical impact justifies prompt patching of any host reachable by untrusted local users.
Local privilege escalation in the Windows Device Association Service lets an authenticated low-privileged user on a Windows host trigger a use-after-free (CWE-416) memory-corruption condition and execute code with elevated rights, yielding high confidentiality, integrity, and availability impact within an unchanged security scope (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025 are affected, but an attacker must already be able to run code on the machine, making this a post-compromise escalation primitive rather than a remote entry point. High attack complexity (AC:H) means reliable exploitation depends on winning a race or forcing a specific freed-memory reuse, which SSVC reflects as not automatable; no public exploit code has been identified at time of analysis and there is no KEV entry, while Microsoft has released fixed builds.
A stack-based buffer overflow in the Windows Installer (msiexec) component allows an authenticated attacker holding a low-privileged local account to elevate privileges to SYSTEM on affected Windows hosts. The flaw is local-only (AV:L) and requires no victim interaction, but carries High attack complexity (AC:H), meaning a race condition or a specific system state must be won before the overflow can be reliably triggered, which limits practical exploitability to shared and multi-user systems such as RDS/terminal servers rather than typical single-user endpoints. No public exploit code has been identified at time of analysis and no active exploitation is confirmed (CISA SSVC exploitation: none); the high EPSS-style urgency signals are absent, and Microsoft has released a vendor patch, making this a genuine but moderate-priority issue that should be handled through normal patch cycles.
Local privilege escalation in Microsoft Windows Event Tracing (ETW) lets an authenticated attacker who already holds low-privileged local access on a target host trigger a use-after-free condition (CWE-416) and execute code in a more privileged security context, potentially reaching SYSTEM. The flaw carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is a local-only primitive that requires pre-existing low-privilege credentials, no user interaction, and is gated by High Attack Complexity because reliable exploitation hinges on winning a memory-lifecycle race rather than a deterministic trigger. All supported Windows client and server builds below the vendor-patched revision levels are affected, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2016/2019/2022/2025 and their Server Core installations, and Microsoft has released fixes; there is no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC framework rates exploitation as none and the activity as not automatable, so this should be treated as a high-value post-compromise escalation primitive rather than an imminent mass-exploitation threat.
Local privilege escalation in the Windows Installer service (msiexec) on affected Windows 10, Windows 11, and Windows Server builds allows an attacker who already holds low-privileged local code execution to elevate to a higher-integrity context by winning a use-after-free race in Installer memory handling. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CWE-416) and is not remotely reachable - it requires local access, no user interaction, and a timing-dependent heap race that the AC:H rating marks as unreliable from attempt to attempt, which is why SSVC rates it Automatable=no with Exploitation=none. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); Microsoft has released fixes, so this is a legitimately dangerous-but-not-urgent flaw whose practical risk is concentrated in environments where untrusted users or malware already run on unpatched hosts. This assessment is consistent with the feed's SSVC signal (technical impact total, no exploitation observed) and the high-complexity local vector.
Local privilege escalation in Windows Now Playing Session Manager allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free (CWE-416) memory corruption. Affected are default installations of Windows 10 (21H2, 22H2, 1607, 1809), Windows 11 (23H2 through 26H2), and Windows Server 2016-2025 below the patched builds. No public exploit identified at time of analysis; exploitation requires high attack complexity (AC:H) and is not automatable per CISA SSVC, though a vendor patch is available.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated attacker who can already execute code on a target host to trigger a use-after-free in kernel memory and elevate to SYSTEM. Microsoft rates the flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation hinges on winning a kernel race condition, and the affected code is a standard OS component present by default on Windows 10 1809 through Windows 11 26H2 and Windows Server 2019 through 2025. There is no remote attack path, no user interaction is needed, no non-default configuration is required, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; a vendor patch is available.
Local privilege escalation in the Windows Volume Manager Extension Driver affects unpatched Windows 10, Windows 11, and Windows Server builds, allowing an authenticated attacker who already holds low-privilege local access to trigger an out-of-bounds read that corrupts kernel memory handling and elevates privileges to SYSTEM. The CVE's CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and CISA SSVC assessment (Exploitation: none, Automatable: no) both indicate exploitation is not reliably repeatable or automatable - success depends on memory-layout or timing conditions outside the attacker's direct control, and there is no public exploit identified at time of analysis. This is a moderate-priority local EoP issue rather than an urgent internet-facing emergency: it is not remotely exploitable, requires pre-existing local access, and Microsoft has released patches, though the same code path touches both confidentiality and integrity of the kernel, so the impact when it does succeed is total.
Local privilege escalation in Microsoft Windows Error Reporting (WER) allows an attacker who already holds low-privileged local access on a Windows host to elevate to higher integrity, and potentially to SYSTEM, by triggering a use-after-free during error-report handling. Only unpatched Windows 10/11 builds (23H2 through 26H2) and Windows Server 2012 through 2025 up to the build thresholds listed by Microsoft are affected; patched builds are not vulnerable. Exploitation requires authentication (CVSS PR:L) and is rated high complexity (AC:H) because the memory-reuse condition must be won reliably, which is consistent with CISA SSVC scoring of Autonomable: no - no public exploit code has been identified and there is no KEV listing, so the practical risk is a local, post-compromise escalation primitive rather than an urgent remote threat. A vendor patch is available.
A use-after-free in the Windows TCP/IP kernel stack lets an attacker who already holds valid low-privileged local access on a Windows host escalate to SYSTEM-level privileges (CVSS 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation is not remotely reachable despite the TCP/IP component name: the attacker must locally drive the network stack into freeing a kernel object and then win a timing-dependent race to reclaim it, which makes reliable exploitation difficult. Vendor patches are available for all listed builds and no public exploit code has been identified at time of analysis, so this is a moderate-priority local privilege-escalation hardening item rather than an emergency.
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds a low-privileged authenticated account on a Windows host raise their privileges to SYSTEM or administrative level by triggering a heap-based buffer overflow (CWE-122) that stems from an integer underflow during MSI package processing. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 including Server Core, while fully patched builds such as Windows 11 24H2 10.0.26100.9711 and Windows Server 2022 10.0.20348.5761 are not vulnerable. Scoring is 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker needs local access and an existing low-privilege account but no user interaction, and the high attack complexity (AC:H) reflects timing or memory-layout conditions that are not reliably under the attacker's control. There is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC rates exploitation as none and the flaw as not automatable, so realistic risk sits below the raw 7.0 for most environments.
Local privilege escalation in the Windows Audio Service (Audiosrv) lets an authenticated local attacker holding only low privileges (PR:L) escalate to full control of the host by corrupting memory through a use-after-free (CWE-416), with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is confined to a post-compromise scenario: the attacker must already have code execution on the machine and must win a timing race against the service (AC:H), and no user interaction is required (UI:N). Microsoft has published a vendor fix, and there is no public exploit identified at time of analysis; because the vector is purely local, affected organizations should treat this as an endpoint privilege-escalation risk rather than a remote attack surface item.
Local privilege escalation in the Windows Smart Card subsystem allows an attacker who already holds authenticated low-privilege access on a target host to corrupt memory through a use-after-free (CWE-416) and elevate to a higher-integrity context, including SYSTEM, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.0, vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is local-only and requires a race or specific timing/memory-state window to be won (AC:H), so it is a post-compromise escalation primitive rather than a remote entry point; no user interaction is required and the Smart Card component ships enabled by default on all supported Windows releases, so no special configuration is needed to reach the flawed code. Microsoft has released vendor fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds low-level (standard user) rights on a Windows host trigger a use-after-free and gain SYSTEM-level code execution. Every supported Windows client and server release in scope is affected - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations. Exploitation is local-only and gated by high attack complexity (a memory-reuse race), so it is a post-compromise escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis, and no CISA KEV listing.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver (vhdmp) allows an authenticated attacker with existing low-privileged code execution to gain SYSTEM-level privileges by triggering a use-after-free. Exploitation requires winning a timing/race window (AC:H) and is therefore not deterministic; no public exploit code has been identified at time of analysis. The vulnerability affects a broad range of Windows client and server editions and has been patched by Microsoft.
A use-after-free in the Microsoft Windows Search Component allows an authenticated local attacker with low privileges to elevate to SYSTEM-level code execution on affected Windows client and server builds. Exploitation requires the attacker to already be running code on the host and is constrained by high attack complexity (AC:H), consistent with winning a memory-reuse race in the search/indexing component that depends on precise timing and heap state and may need repeated attempts; no user interaction is required. This is a moderate-priority local privilege-escalation issue rather than an emergency: there is no public exploit identified at time of analysis, SSVC records Exploitation as 'none', and Microsoft has released fixes (vendor advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70150).
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker with a low-privileged local account corrupt memory and potentially execute code at a higher integrity level. The flaw is a use-after-free (CWE-416) rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires prior authentication, needs no user interaction, and carries high attack complexity because the attacker must reliably reclaim a freed object. Microsoft has released vendor patches; no public exploit code has been identified, and CISA's SSVC assessment records exploitation as none with the issue not automatable (technical impact: total).
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds valid low-privilege credentials on an affected Windows host free an object and then reallocate it under their control, corrupting memory inside the component's elevated process. Impacted builds are Windows 11 24H2, 25H2, 26H1 and 26H2 alongside Windows Server 2025 (including Server Core installations) at versions below the fixed build numbers published by the vendor. No public exploit code identified at time of analysis and CISA's SSVC assessment records exploitation as none with the flaw rated non-automatable, but the vendor has shipped a patch and the technical impact is assessed as total (high confidentiality, integrity and availability loss).
Local privilege escalation in Microsoft's Windows Search Component lets an authenticated attacker who already holds a low-privileged session on a Windows host trigger a use-after-free and elevate to a more privileged security context on the same machine. Exploitation is constrained by a high attack complexity rating (AC:H), reflecting a race/timing condition on the freed object that must be won reliably, and the vector (AV:L/PR:L/UI:N) confirms the attacker must already be logged in locally with low privileges; there is no remote attack surface and no victim interaction required. Patches are available from Microsoft (fixed builds such as Windows 11 24H2 10.0.26100.9711 or later), CISA's SSVC assessment records exploitation as none and the issue as not automatable, and no public exploit code has been identified at time of analysis.