An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorized access on the network crash or degrade the DNS service, resulting in a denial of service. The flaw affects unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds, and because the DNS role runs on most Active Directory domain controllers, any environment with an exposed or reachable DNS service should treat those hosts as in scope. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) the attacker must be authenticated with low privileges, exploitation is over the network, and impact is limited to availability with no code execution or data disclosure; CISA's SSVC assessment records no observed exploitation and no public exploit code, so this is a moderate-severity, patch-cycle issue rather than an emergency.
An authenticated, network-positioned attacker can force an out-of-bounds read in the Windows Local Security Authority Subsystem Service (LSASS), crashing the service and producing a denial of service on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. The vulnerability is rated 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so low-privilege valid credentials and network reachability are prerequisites; unauthenticated attackers cannot exploit it per the assessed vector, and the impact is confined to availability with no confidentiality or integrity consequence. Microsoft has published fixes via its update guide, CISA's SSVC assessment rates exploitation as none, and there is no public exploit identified at time of analysis - making this a moderate-severity, low-urgency patch-cycle item rather than an emergency.
Denial of service in the Microsoft Windows Kernel, caused by an untrusted pointer dereference (CWE-822), allows a network-positioned attacker who already holds low-privilege credentials to crash or hang an affected Windows 10, Windows 11, or Windows Server host. The assessed vector (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confines impact to availability, with no data disclosure or code execution, and exploitation is gated behind prior authentication rather than being pre-auth remote. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and the attack as not automatable, and Microsoft has made patches available.
Resource exhaustion in the Windows Netlogon service allows an authenticated attacker holding valid domain credentials to send unbounded requests that consume server resources and deny service to legitimate users over the network. CVE-2026-70072 (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) affects a wide set of Windows 10, Windows 11 and Windows Server branches from 2012 through 2025, including Server Core installations, with the highest exposure on domain controllers where Netlogon is reachable by default. Microsoft has published vendor patches, there is no public exploit identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with only partial technical impact - a moderate-priority availability problem rather than a mass-exploitation emergency.
An out-of-bounds read in Active Directory Domain Services (AD DS) on unpatched domain controllers allows an authenticated, low-privileged attacker to crash or hang the directory service over the network, producing a denial of service against domain authentication and directory lookups. The flaw requires a valid domain account or equivalent foothold (CVSS vector PR:L) and no user interaction; success yields only availability impact with no confidentiality or integrity loss (C:N/I:N/A:H, assessed 6.5). No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and non-automatable, and no CISA KEV listing exists, so this is a moderate-priority, availability-only issue affecting a critical infrastructure component rather than an emergency patch case.
Null pointer dereference in Microsoft's Active Directory Domain Services (AD DS) lets an attacker who already holds valid low-privilege domain credentials crash the service over the network, yielding a denial of service scored CVSS 6.5 with availability impact only (C:N/I:N/A:H). Exploitation requires an authenticated session (PR:L) with no user interaction (UI:N) and low attack complexity (AC:L), so the realistic threat is an insider or a holder of previously compromised credentials targeting a reachable domain controller; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit identified at time of analysis. This is a medium-severity, authenticated DoS that should be treated as a routine patch-cycle item rather than an emergency, and vendor patches are available for every affected Windows Server 2022/2025 and Windows 10/11 build listed in ENISA EUVD-2026-99312.
Local privilege escalation in Windows NTFS lets an authenticated attacker with local access to an affected Windows host trigger a use-after-free in the NTFS file system driver, which can lead to high-integrity code execution in kernel context and elevation to SYSTEM. The issue affects specific Windows 11 24H2, 25H2, and 26H1 builds and Windows Server 2025 (including Server Core) below the fixed builds listed in the Microsoft advisory. CVSS base score is 6.7, it is not in CISA KEV, and no public exploit identified at time of analysis; SSVC records exploitation as none and automatable as no, keeping the practical risk moderate and requiring a local foothold.
Path traversal in MP Manager through 1.1.0 allows a local attacker to write files outside the intended extraction folder by supplying a crafted TAR, 7z, or RAR archive whose entry names such as ....//file bypass the app's non-recursive sanitizeEntryName filter and collapse to ../file. Exploitation requires the victim to manually extract the malicious archive in MP Manager, and the independent assessment limits impact to integrity (file creation or overwrite) on storage the app can write, with no confidentiality or availability impact. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the CVSS 4.0 base score is 6.7 in a moderate, non-urgent risk context.
An out-of-bounds read in the Windows Remote Desktop Gateway service allows an attacker who already holds valid credentials authorizing access to the gateway to disclose memory contents over the network, with confidentiality-only impact and no effect on integrity or availability. The flaw affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 - including Server Core installations - running the RD Gateway role below the builds listed by EUVD, and carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial - making this a moderate-priority information-disclosure issue rather than a critical emergency. Internet-facing RD Gateways that permit weakly controlled credential access are the realistic risk surface, while internal gateways protected by strong authentication and conditional access are substantially lower risk.
Memory disclosure in the Windows IKE (Internet Key Exchange) Extension lets an attacker who already holds low-level authorized access on the target read out-of-bounds process memory and leak potentially sensitive data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) confirms a low-complexity, network-reachable attack that requires existing privileges, needs no user interaction, and produces only confidentiality impact with no integrity or availability effect. Microsoft has released vendor patches, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with partial technical impact, so this should be treated as a normal-cycle patch rather than an emergency.
An out-of-bounds read (CWE-125) in the Microsoft Windows DNS Server role allows an attacker holding low-privilege authenticated access to disclose information over the network. Only hosts actually running the DNS Server role are exposed; the flaw is rated CVSS 6.5 with high confidentiality impact but no integrity or availability impact, and exploitation requires authorized (PR:L) rather than unauthenticated network access. Patched builds are available from the vendor per the MSRC update guide, and no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows DNS Server allows an authenticated, low-privilege attacker with network access to disclose sensitive information from server memory. The vulnerability affects numerous Windows Server and Windows 10/11 builds that have the DNS Server role installed, with no public exploit identified at time of analysis. Although rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the confidentiality-only impact and requirement for authentication limit the realistic threat to information leakage rather than code execution or denial of service.
Heap memory disclosure in Microsoft Windows Hyper-V lets an authenticated, low-privileged principal - such as an account inside a guest VM or a low-rights user able to reach the Hyper-V service over the network - read leaked contents of the hypervisor's heap, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025 including Server Core installations. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and low attack complexity are required, but the attacker must already hold valid credentials and the outcome is read-only: confidentiality is fully impacted while integrity and availability are untouched, so hosts without the Hyper-V role enabled are not exposed. No public exploit been identified at time of analysis, and Microsoft has published fixed builds via its MSRC update guide.
Information disclosure in the Windows WebDAV component lets an authenticated, low-privileged attacker read files or directories that should not be exposed over the network (CWE-552), rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, high confidentiality impact, no integrity or availability impact). The flaw affects a broad set of unpatched Windows client and server SKUs - Windows 10, Windows 11, and Windows Server 2012 through 2025 - wherever WebDAV is present and network-reachable. Exploitation is not remote-unauthenticated: it requires a valid low-privilege account plus WebDAV exposure, CISA's SSVC rates exploitation as not observed, non-automatable and only partial technical impact, and no public exploit code has been identified at time of analysis. Vendor patches are available.
Information disclosure in the Windows Event Viewer allows an authenticated attacker with low-level authorization (CVSS PR:L) to reach the component over the network (AV:N) and read files or directories that should not be exposed, resulting in high confidentiality impact with no integrity or availability effect. The flaw, tracked as CVE-2026-85840 and rooted in CWE-552, is rated 6.5 and affects a very broad set of Windows client and server builds, including Windows 10, Windows 11 (21H2 through 26H2) and Windows Server 2012 through 2025. CISA's SSVC assessment records no observed exploitation and no automatable attack path, and no public exploit code has been identified at time of analysis; vendor patches are available, so exposure is concentrated on unpatched, multi-user or shared-access hosts such as RDS/terminal servers and jump boxes where many low-privileged accounts coexist.
Information disclosure in the Windows Universal Disk Format (UDFS) file-system driver lets an authenticated local attacker read memory beyond the bounds of an allocated buffer by presenting a crafted UDF volume - typically a rigged ISO image, optical disc, or virtual/removable disk - for the kernel driver to mount and parse. The flaw is an out-of-bounds read (CWE-125) rated 6.5 MEDIUM; although the supplied CVSS vector advertises network reachability (AV:N), the file-system parsing path and the description's 'locally' wording indicate that local, authenticated access is required, so defenders should treat the vector as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Impact is bounded to confidentiality with no code execution or data tampering, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the attack as non-automatable, and vendor patches are available - together these signals keep real-world urgency moderate-to-low despite the MEDIUM score.
Information disclosure in the Windows Device Association Service (DAS) lets an attacker who already holds valid low-privileged credentials on a target host read portions of the service's memory over the network, exposing potentially sensitive data. The flaw affects default installations of Windows 10, Windows 11 (23H2 through 26H2/26H1), Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below their respective patched builds, and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality-only impact with no code execution, modification, or denial of service. Microsoft has released fixes and CISA's SSVC evaluation records no exploitation and no automatable exploitation at time of analysis, with no public exploit identified; the PR:L authentication prerequisite and read-only outcome materially reduce real-world urgency.
An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.
Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.
Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.
An out-of-bounds read in the Windows Graphics Device Interface (GDI) subsystem can leak memory contents to a remote, unauthenticated attacker, but only after the victim opens or previews attacker-supplied content such as a crafted image, embedded font, or metafile (CVSS 3.1: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Every supported client and server edition is affected in default configurations, spanning Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with automatable 'no', so this is a moderate-priority information-disclosure issue whose practical risk hinges on social-engineering a user into rendering the malicious file; note that the flaw yields disclosure only (I:N/A:N) and cannot by itself corrupt data or crash the host, and a vendor patch is available.
Information disclosure in the Windows RPC Runtime allows remote attackers to read uninitialized memory content from affected Windows systems, but only when the victim is induced to connect to, or process a response from, an attacker-controlled RPC server or endpoint - the mandatory client interaction keeps this from being autonomously exploitable against a default listening service. Unpatched builds of Windows Server 2012 through Server 2025, Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) are affected; the leak is limited to memory contents, with no code execution or data tampering, and SSVC rates the technical impact as partial, meaning repeated attempts may be needed to recover useful data. No public exploit code has been identified at time of analysis, CISA SSVC marks the issue as not automatable, and no authentication is required of the attacker (PR:N) with user interaction the primary limiting factor (UI:R) - making this a moderate-priority patch item rather than an emergency.
An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.
An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.
Heap-based buffer overflow in Microsoft SQL Server 2022 and SQL Server 2025 allows an attacker who already holds an authorized, high-privilege database session to execute code on the database server over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.6) confirms the attacker must be authenticated with high privileges (PR:H) and must clear a high-complexity exploitation bar (AC:H) such as precise heap state manipulation, while successful exploitation yields full confidentiality, integrity, and availability impact on the SQL Server instance. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and Microsoft has released vendor patches for the affected GDR and cumulative-update builds.
Heap-based buffer overflow in the Windows Installer service lets an attacker who already holds an authenticated low-privilege session and has physical access to a vulnerable Windows machine escalate privileges, with high confidentiality, integrity, and availability impact within the operating system. The flaw is rated 6.6 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects a very broad install base - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 including Server Core - but it is not remotely reachable, requires no victim interaction, and is useless against patched builds. Vendor patches are available, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which makes this a moderate-severity, low-urgency local elevation-of-privilege issue rather than an urgent remote threat.
Out-of-bounds read in Microsoft Word lets a remote, unauthenticated attacker disclose memory contents from an affected host when a victim opens or previews a specially crafted Word document, producing confidentiality-only impact (C:H/I:N/A:N) under a 6.5 CVSS score. Affected builds include Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC for Mac 2021/2024; the required user interaction (UI:R) is the main limiting factor, since nothing triggers the parser automatically. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and CISA SSVC records Exploitation as none and Automatable as no, so the risk signals are consistently moderate and non-urgent.
An out-of-bounds read in Microsoft Word lets an unauthorized attacker disclose information from process memory when a victim opens a crafted Word document, affecting Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise builds that predate the vendor's fixed releases. Successful exploitation requires the user to open the malicious file delivered over the network (email attachment, web download, or file share); no attacker authentication is needed and default Office configurations are exposed. Impact is confined to confidentiality - process memory disclosure with no code execution, data modification, or availability effect - and no public exploit or confirmed active exploitation has been identified at time of analysis, making this a genuine but moderate-priority issue.
An out-of-bounds read in the Windows Remote Desktop Client lets a malicious or compromised RDP server leak process memory, giving an unauthenticated attacker a network-based information disclosure path against any Windows host whose user connects to that server. The flaw is strictly client-side: the victim must initiate an outbound RDP session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), which is the main limiting factor, while confidentiality impact is rated High and no authentication, integrity, or availability impact is involved. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as "none" and automatable as "no", and Microsoft has published remediation through its Security Update Guide, making this a moderate-priority issue rather than a top-tier emergency.
An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.
Information disclosure in Microsoft Excel allows unauthenticated remote attackers to read sensitive memory contents by enticing a user to open a specially crafted Excel document. The flaw affects multiple Microsoft Office products, including Office LTSC 2024, Office LTSC 2021, Office Online Server, and Microsoft 365 Apps, and requires user interaction (opening or previewing the file) for exploitation. No public exploit code has been identified, and CISA SSVC rates exploitation as none; the risk is considered a moderate-priority information-disclosure issue.
Out-of-bounds read in Microsoft Excel allows an unauthenticated remote attacker to disclose confidential process memory, but only when a targeted user opens a maliciously crafted Excel file. No public exploit or active exploitation has been identified (CISA SSVC exploitation: none, automatable: no), and the EPSS score was not provided at the time of analysis. The flaw carries a moderate CVSS 6.5 with confidentiality impact only; vendor-released patches are available.
Information disclosure in Microsoft Excel occurs when a user opens a specially crafted Excel workbook, triggering a use-after-free during file parsing that can leak sensitive memory contents. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac; exploitation is unauthenticated over the network (PR:N) but gated behind mandatory user interaction (UI:R), since the victim must open the malicious document. Impact is confined to confidentiality (C:H) with no integrity or availability effect per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (6.5), and there is no public exploit identified at time of analysis, with CISA SSVC recording Exploitation:'none' and Automatable:'no'.
Information disclosure in Microsoft Office Excel allows an unauthenticated attacker to read sensitive system data when a victim opens a crafted spreadsheet. Affected builds include Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Office for Mac 2021/2024, Office 365 for Mac, and Office Online Server before 16.0.10417.20228. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), exploitation requires user interaction, and no public exploit or active exploitation has been identified at time of analysis; vendor patches are available.
Microsoft Office Access contains an out-of-bounds read (CWE-125) that lets an attacker disclose information from the affected process's memory by convincing a user to open a crafted Access file. Affected installations include Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 before 16.0.17932.21056 and LTSC 2021 before 16.0.14334.20974; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) confirms remote delivery is possible but that the victim must open the file, and that there is no integrity or availability impact and no authentication requirement. Microsoft has released fixes, and no public exploit has been identified at time of analysis, with CISA SSVC recording exploitation as 'none' and the attack as not automatable - making this a moderate-risk information-disclosure issue rather than an urgent priority.
Information disclosure in Microsoft PowerPoint (Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise) allows a remote, unauthenticated attacker to read memory contents from a victim's machine by convincing them to open a specially crafted presentation file. The vulnerability is an untrusted pointer dereference (CWE-822) that is only triggered through the required user action of opening the malicious document (UI:R), and its impact is limited to confidentiality (C:H) with no integrity or availability effect. No public exploit code has been identified at time of analysis, the exploit is not listed in CISA KEV, and CISA's SSVC assessment records Exploitation: none and Automatable: no, so signals point to moderate-to-low risk rather than an urgent, high-priority threat. A vendor patch is available from Microsoft. EPSS data was not provided in the available intelligence.
Information disclosure in Microsoft Excel allows a remote, unauthenticated attacker to read out-of-bounds memory and potentially leak sensitive process data when a victim opens a crafted spreadsheet. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024, and corresponding Mac editions; exploitation requires user interaction (UI:R) and is limited to confidentiality impact (C:H/I:N/A:N). No public exploit identified at time of analysis, active exploitation is not indicated, and vendor patches are available.
Memory disclosure in Microsoft Excel (CVE-2026-88190), where an out-of-bounds read while parsing a crafted workbook leaks process memory to a remote, unauthenticated attacker - but only if the victim opens the attacker-supplied file, making user interaction the decisive control point. Affected builds are Microsoft Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise (fixed build listed on the vendor's Office security-release page). Rated 6.5 with confidentiality-only impact and no integrity or availability effect, delivery is network-based (phishing attachment, shared document, or web download); no public exploit has been identified at time of analysis, and CISA's SSVC assessment rates the flaw non-automatable (Exploitation: none, Automatable: no), consistent with the mandatory user-interaction requirement and the absence of a code-execution primitive.
An out-of-bounds read in Microsoft PowerPoint lets a remote, unauthenticated attacker disclose process memory by convincing a victim to open a specially crafted presentation file. Affected builds include Microsoft 365 Apps for Enterprise and Office LTSC 2024/2021 on Windows, along with the Office LTSC for Mac 2024/2021 and Office 365 for Mac editions; the flaw is scored 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) and requires user interaction, so there is no server-side or automatic trigger. Impact is bounded to confidentiality (C:H, I:N, A:N) - the read does not by itself yield code execution or data modification - and there is no public exploit identified at time of analysis, with SSVC recording Exploitation: none and no CISA KEV listing.
Out-of-bounds read in Microsoft Excel lets an unauthenticated remote attacker disclose information from the application's memory when a victim opens a specially crafted spreadsheet, scoring CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Affected builds include Microsoft Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, and Office 365 for Mac; the crafted file can arrive by email attachment or web download, but a human must actively open it, so there is no remote zero-click or automated server-side exposure. Exploitation has not been observed (CISA SSVC records exploitation: none and automatable: no) and no public exploit code has been identified at time of analysis, with vendor patches available through the Microsoft update channels.
Out-of-bounds read in Microsoft Word lets an unauthenticated remote attacker disclose information from process memory when a victim opens a specially crafted Word document. Exploitation is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so delivery depends on social engineering - a malicious email attachment, download, or shared file - rather than a drive-by or wormable trigger, and the resulting impact is limited to confidentiality (C:H) with no integrity or availability effect. At time of analysis there is no public exploit identified, CISA SSVC records exploitation as none and automatable as no, and Microsoft has released fixed builds (Office LTSC 2024 16.0.17932.21056 and later, Office LTSC 2021 16.0.14334.20974 and later, plus updated Microsoft 365 Apps and Mac editions), making this a moderate-priority information-disclosure issue rather than a critical emergency.
Information disclosure in Microsoft Word allows an unauthenticated attacker to leak memory contents from a victim's machine when the victim opens a specially crafted Word document. The flaw is a buffer over-read (CWE-126) rated CVSS 6.5, with confidentiality impact limited to memory disclosure and no effect on integrity or availability. Exploitation is gated by user interaction (UI:R) - the attacker must convince a victim to open a malicious file - which prevents unattended or wormable mass abuse; no public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches via the MSRC update guide.
Information disclosure in Microsoft Excel allows an unauthenticated remote attacker to read memory contents by having a victim open a specially crafted Excel file in a vulnerable build. The flaw is an out-of-bounds read (CWE-125) rated CVSS 6.5 with a UI:R requirement, meaning the victim must open the malicious document - the primary limiting factor - while impact stays confined to confidentiality (C:H) with no code execution, data modification, or denial of service. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA SSVC: Exploitation none, Automatable no), and vendor patches are available for Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office LTSC 2021, and Office 365 for Mac.
Out-of-bounds read in Microsoft Office Word allows a remote, unauthenticated attacker to disclose the contents of memory beyond the bounds of an allocated buffer when a victim opens a specially crafted document (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Affected builds include Office LTSC 2021 and 2024 for Windows, Microsoft 365 Apps for Enterprise, and the Office LTSC/365 editions for Mac, so the exposure footprint is essentially the entire supported Microsoft Office desktop install base. Impact is confidentiality-only - read access to process memory, with no integrity or availability effect and no demonstrated code execution path - and the flaw cannot be triggered without the user opening the malicious file. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no, keeping real-world urgency low despite the ubiquitous target.
An out-of-bounds read in Microsoft Excel enables an unauthenticated attacker to disclose sensitive in-process memory by convincing a victim to open a specially crafted Excel document (CVSS 3.1: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Affected builds are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 before 16.0.14334.20878, and Microsoft Office LTSC 2024 before 16.0.17932.20934; the mandatory user interaction (UI:R) is the primary limiter and prevents automated or wormable exploitation, matching the SSVC assessment of Exploitation: none and Automatable: no. There is no public exploit identified at time of analysis, and the impact is limited to information disclosure - no code execution, data modification, or denial of service.
Denial of service in Microsoft's Windows Codecs Library affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 when an application invokes the vulnerable codec to parse a malformed media file. The defect is a stack-based buffer overflow (CWE-121) that is network-deliverable and requires no authentication (AV:N/PR:N), but it is gated by mandatory victim interaction (UI:R) such as opening, previewing, or rendering the crafted file, which prevents unattended remote exploitation. Impact is availability-only (A:H) with no confidentiality or integrity effect and no confirmed code execution; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and Microsoft has released fixes. This is a moderate resilience/uptime concern rather than a breach vector.
Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.
Improper authorization (CWE-639, an IDOR-class flaw) in Skype for Business Server and the legacy Microsoft Lync product lets an authenticated, low-privilege user reach data or functionality that should be reserved for other users or higher-privileged roles, resulting in unauthorized disclosure of sensitive information over the network (CVSS 6.5, C:H/I:N/A:N). The affected deployments are Skype for Business Server Subscription Edition before 7.0.2046.889, Skype for Business Server 2019 CU8 before 7.0.2046.583, and Skype for Business Server 2015 CU13 before 6.0.9319.886; Microsoft has published fixes for all three. The flaw is not remotely exploitable by anonymous attackers, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', so risk is concentrated in environments where low-privileged accounts exist and the server is broadly reachable.
An out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who is already authorized to send DNS messages to the service trigger a denial of service over the network, degrading or crashing the DNS service on affected Windows Server builds. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it is remotely reachable without user interaction but requires at least low-level authorization - the attacker must be an authorized actor able to submit DNS queries, not an anonymous internet client - and the impact is confined to availability with no confidentiality or integrity loss. Affected systems are Windows Server 2012 through Windows Server 2025, including Server Core installations, that are actually running the DNS Server role; default workstation installs are not affected. Vendor patches are available for all affected builds, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and the vulnerability as not automatable.
Denial of service in Microsoft Windows Message Queuing (MSMQ) Queue Manager allows an authenticated, low-privileged remote attacker to crash the service by triggering a null pointer dereference, rendering the queuing service unavailable to legitimate applications on the affected host. Exploitation is constrained: MSMQ is an optional, non-default Windows component that must be installed, running, and network-reachable (typically TCP 1801), and the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms credentials are required while no user interaction is needed. Impact is purely availability (A:H with C:N/I:N) - no data exposure or modification - and there is no public exploit identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available for all affected Windows client and server branches.