Local privilege escalation in the Windows VHD Miniport Driver allows an authenticated attacker with low privileges to gain full system control by triggering a heap-based buffer overflow. The vulnerability is locally exploitable and requires high attack complexity (AC:H), indicating a race condition or precise heap grooming is necessary for successful exploitation. No public exploit code has been identified, and the EPSS score is not available; however, a vendor patch is available via Microsoft's security update guide.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows a low-privileged attacker who already holds an interactive session on a Windows host to elevate to higher integrity, including SYSTEM, by triggering a use-after-free memory corruption in the installer service. Successful exploitation requires winning a race/timing window (AC:H) rather than a simple reliable trigger, and no user interaction is needed from a victim; the CVSS 3.1 vector resolves to AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H for a base score of 7.0. At the time of analysis there is no public proof-of-concept and no confirmation of active exploitation (CISA KEV), so this is assessed as a genuine but moderate-priority privilege-escalation issue that matters most on multi-user, RDP-accessible, or shared-workstation deployments where untrusted users already have local logon rights.
Local privilege escalation in the Windows Update Delivery Optimization service allows an authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free (CWE-416) in the Delivery Optimization service (DoSvc), which is enabled by default on supported Windows client and server editions. Rated CVSS 7.0 (High) with High confidentiality, integrity and availability impact, exploitation requires prior local access (AV:L/PR:L) and no victim interaction (UI:N), but depends on winning a race/timing condition (AC:H), making reliable escalation non-trivial. No public exploit identified at time of analysis, and Microsoft has released vendor patches for all affected Windows versions.
Local privilege escalation in Microsoft Windows through the Software Protection Platform (SPP) service allows an authenticated attacker holding a low-privileged local account to trigger a use-after-free condition and ultimately execute code with elevated (SYSTEM) privileges. Exploitation is local-only and gated by a high-complexity precondition (a timing/allocation window that must be won), so this is a moderate-priority elevation-of-privilege issue rather than a remote emergency; no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV). Default installations of the affected Windows client and server builds carry the SPP service, so no unusual feature enablement is required, but the attacker must already have local code execution or a valid low-privileged account on the host.
Local privilege escalation in the Windows Broadcast DVR User Service - the component implementing GameDVR/game capture and broadcast functionality - lets an attacker who already holds a low-privilege, authenticated foothold on the host trigger a use-after-free (CWE-416) in the service and gain code execution at a higher privilege level. The flaw is rated 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: it requires local authenticated access (PR:L) and the successful winning of a high-complexity timing race (AC:H) to take control of the freed object, with no user interaction and no remote or unauthenticated path. This is therefore a moderate-priority, post-compromise escalation most relevant to shared or multi-user Windows hosts; no public exploit code has been identified at time of analysis, and neither CISA KEV status nor an EPSS score was supplied in the source data.
Local privilege escalation in Windows Autopilot (a component of Windows 11 24H2, 25H2, and 26H2) allows an attacker who already holds low-privileged local access to trigger a use-after-free and gain SYSTEM-level privileges. Exploitation requires an existing authenticated local foothold (PR:L, AV:L) and is complicated by a race-condition-style high attack complexity (AC:H), so it is not remotely or anonymously reachable and is not reliably triggered on demand. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not automatable), and vendors have released patches fixing the flaw in build 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), and 10.0.26300.9711 (26H2).
Local privilege escalation in the Microsoft Windows Kerberos component lets an attacker who already holds low-privileged code execution on a target host trigger a double-free memory-corruption condition (CWE-415) and elevate to a higher-integrity context. Per the assessed vector (AV:L/AC:H/PR:L/UI:N), the attack is strictly local and requires an authenticated low-privileged foothold, with high complexity reflecting the need to win a race or reach a specific memory/timing state that is not reliably reproducible, which materially limits weaponization; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS signal was supplied. The flaw is present in default installations of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds below their patched levels, and Microsoft has released updates (MSRC update guide referenced for CVE-2026-108132).
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker with low-level privileges to gain elevated privileges on affected Windows systems. The use-after-free flaw requires winning a memory-timing race condition (high attack complexity, CVSS 7.0), making reliable exploitation difficult. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated attacker to gain elevated privileges by exploiting a use-after-free (CWE-416) memory corruption flaw. The vulnerability requires local access (PR:L) and high attack complexity (AC:H), but successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 7.0). No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an attacker who already holds a low-privileged local account corrupt kernel heap memory and potentially elevate to SYSTEM. The defect is a heap-based buffer overflow (CWE-122) reachable by submitting I/O to the VHD storage stack, and with a CVSS 3.1 base score of 7.0 and High attack complexity (AC:H), reliable exploitation usually depends on heap-layout grooming or winning a timing window rather than a single deterministic request. Microsoft is the reporting vendor and no public exploit code or confirmed active exploitation has been identified at time of analysis; this is best treated as a moderate-priority local privilege escalation, not an emergency remote threat.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) allows an authenticated low-privileged attacker to execute code at a higher integrity level on affected Windows 10 and Windows 11 systems. The flaw is a use-after-free (CWE-416) in a default Game DVR/broadcast component; exploitation requires existing local access (AV:L/PR:L) and success is limited by high attack complexity (AC:H) due to a specific memory-reuse or race condition. No user interaction is needed (UI:N), there is no network attack vector, and no public exploit identified at time of analysis (no KEV or POC data was provided).
Privilege escalation in the Windows Win32k kernel subsystem lets an authenticated local attacker who already holds a low-privileged foothold (CVSS PR:L, AV:L) corrupt kernel memory via a use-after-free (CWE-416) and elevate to SYSTEM-level code execution with high confidentiality, integrity, and availability impact. Because the vulnerability depends on a timing-sensitive race or a specific memory-reclamation state, the attack complexity is rated high (AC:H) and success is non-deterministic, confining this to post-compromise escalation rather than initial access; no user interaction is required (UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS base score of 7.0 reflects the local-only vector tempered by the unreliable race condition.
Local privilege escalation in the Windows Broadcast DVR User Service (BcastDVRUserService) lets a low-privileged, already-authenticated user on the same machine trigger a use-after-free condition and obtain higher-integrity code execution, with full confidentiality, integrity, and availability impact scored at CVSS 7.0. Microsoft's authoritative fix information is published through the MSRC Security Update Guide entry for CVE-2026-102197; exploitation is not remotely reachable and is complicated by the high attack complexity of the underlying race/timing-dependent heap condition, and no public exploit code has been identified at time of analysis. This is a legitimately serious local elevation-of-privilege flaw but not an emergency.
Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds low-privileged, authenticated local access to a Windows client host corrupt memory via a use-after-free (CWE-416) and potentially gain full system-level read, write, and execute control. The vulnerability is rated CVSS 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable, requires no user interaction, but is gated by high attack complexity - exploitation likely depends on winning a race condition or precise heap grooming, so success is probabilistic rather than guaranteed. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation; the EPSS-style risk signal is not provided, and Microsoft's MSRC update guide is the authoritative source for the fix.
No public exploit identified at time of analysis for a local privilege-escalation use-after-free (CWE-416) in the Windows Graphics Kernel that allows an authenticated attacker with low privileges to elevate to higher privileges, potentially achieving SYSTEM-level code execution. The vulnerability requires local access and high attack complexity (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), as the exploit likely depends on winning a race condition or reliable kernel-heap grooming. No active exploitation is confirmed, and no patch version is specified; apply Microsoft's update when available and monitor the advisory.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker to elevate privileges on the host by triggering a use-after-free. The flaw affects Windows systems where the service is present, requires local access and high attack complexity, and no public exploit code has been identified at time of analysis. Successful exploitation could result in full compromise of confidentiality, integrity, and availability of the affected system.
Local privilege escalation in the Windows Storage component lets an authenticated, low-privileged user already running code on a Windows host drive a heap-based buffer overflow to gain high-integrity (SYSTEM-level) privileges. Exploitation is not remote: it requires an existing local session (CVSS AV:L, PR:L) and no user interaction (UI:N), but the high attack complexity (AC:H) means the attacker must win a non-deterministic heap-layout or timing condition, which makes reliable weaponization harder than a typical PR:L/AC:L elevation-of-privilege bug. At the time of analysis there is no public exploit identified, no EPSS or KEV signal in the provided intelligence, and the authoritative source for fixed builds is the Microsoft MSRC update guide; the moderate-priority character of this issue reflects that prior host access is a hard prerequisite and success is probabilistic.
Heap-based buffer overflow in the Windows Storage subsystem (CWE-122) allows an authenticated local attacker holding low privileges to elevate to a higher-privileged context on the affected host. The CVSS vector (AV:L/AC:H/PR:L/UI:N) and the assessment confirm the attacker must already be able to execute code locally and that exploitation is gated by high complexity, most likely a race condition or a carefully groomed heap layout, making success unreliable rather than repeatable. This is a moderate-priority local privilege-escalation issue rather than a remote emergency; no public exploit identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV). The supplied data does not enumerate affected Windows builds, so the MSRC update guide must be consulted for the precise vulnerable and fixed versions.
Local privilege escalation in Microsoft's Windows Storage component allows an attacker who already holds authenticated, low-privileged local access to trigger a heap-based buffer overflow and obtain elevated rights on the affected host. Exploitation is gated by High attack complexity (AC:H), meaning success depends on controlling heap layout or allocation state rather than being deterministic, so this is best treated as a second-stage escalation primitive following an initial compromise rather than an easily weaponized or remotely reachable bug. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Local privilege escalation in Microsoft's Windows Storage component allows an authenticated attacker who already holds low-level privileges on the host to trigger a stack-based buffer overflow and gain elevated (likely SYSTEM-level) code execution. The vulnerability is not remotely reachable and requires no user interaction, but the high attack complexity (AC:H) means exploitation likely depends on winning a race or achieving a precise memory state, so it is harder to weaponize than the 7.0 base score suggests. No public exploit code has been identified and it is not listed in CISA KEV; this is an escalation-from-foothold primitive rather than an initial-access vector, making it a moderate-priority local privilege escalation for patching rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Windows Connected Devices Platform Service (Cdpsvc) stems from a use-after-free (CWE-416) memory corruption defect rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is confined to a local attack vector with low privileges required - an attacker must already hold a low-privileged foothold on the host and interact with the Cdpsvc service locally, and exploitation is gated by high attack complexity because it depends on winning a memory-reclamation race window, making reliable triggering difficult. Impact on a successful attempt is total (confidentiality, integrity, and availability high), allowing an authorized local attacker to elevate to SYSTEM-level privileges. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC exploitation: none); vendor patches are available.
Heap-based buffer overflow in the Microsoft Streaming Service, a Windows kernel-mode component, allows an attacker who already holds local access and low-privileged code execution on the host to elevate to SYSTEM-level privileges. The flaw is not remotely reachable: exploitation requires direct interaction with the affected kernel driver (AV:L) and a high-complexity trigger condition (AC:H), typically a race or a carefully shaped heap layout, so reliable exploitation is non-trivial even though no victim interaction is needed (UI:N). Per the available intelligence, there is no public exploit code and no KEV confirmation, so exploitation status at time of analysis is: no public exploit identified; the primary defence is prompt application of Microsoft's update from the MSRC advisory.
Local privilege escalation in the Microsoft Streaming Service lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a use-after-free condition and elevate to full system privileges, yielding high confidentiality, integrity, and availability impact (CVSS 7.0). The flaw is a memory-corruption race condition reachable only from the local machine with a valid low-privileged session (AV:L, AC:H, PR:L, UI:N), so it provides no remote or network-facing attack surface and is not reliably exploitable on every attempt. No public exploit code and no active exploitation have been identified at time of analysis (CISA SSVC exploitation: none), but Microsoft has released patches for every affected Windows branch, so the primary risk is unpatched fleets where an attacker is already resident.
Local privilege escalation in the Microsoft Graphics Component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a heap-based buffer overflow and gain full control over confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected machine. The flaw is exploitable only from the local attack vector (AV:L) by an authenticated low-privileged principal (PR:L) with no user interaction required (UI:N), and the high attack complexity (AC:H) means success depends on winning a race or precisely grooming the heap layout, making exploitation non-deterministic rather than reliable. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it is primarily a post-compromise escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows Setup and Deployment component allows an attacker who already holds a low-privileged authenticated session on the host to invoke a critical setup/deployment function that performs no authentication check, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The flaw is not remotely reachable: it requires local access (AV:L), a pre-existing low-privileged account (PR:L), and the high attack complexity (AC:H) reflects an additional precondition such as a timing or state dependency during setup or deployment, so exploitation is a post-compromise escalation step rather than an initial-access or mass-exploitable vector. Affected platforms include Windows 11 (23H2 through 26H2/26H1), Windows 10 (1809, 21H2, 22H2), and Windows Server 2019, 2022, and 2025 including Server Core, and a vendor patch is available per the Microsoft MSRC advisory; no public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE.
Local privilege escalation in Windows Security Center lets an attacker who already holds a foothold on a Windows host with low-level privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 High) abuse an improperly restricted communication channel to obtain high confidentiality and integrity impact on the same machine. Only hosts that have not yet applied the current cumulative builds are affected, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019 including Server Core installations. The high attack complexity indicates a non-trivial precondition - most consistent with a race or transient-state condition that must be won to redirect or spoof the endpoint - so reliability is limited; prior local access and valid credentials are mandatory and no public exploit identified at time of analysis, with no CISA KEV listing.
Local privilege escalation exists in Microsoft's Windows Setup Files Cleanup component, where a time-of-check time-of-use race condition lets an authenticated, low-privileged user on the host escalate to higher (typically SYSTEM-level) privileges. The issue affects a broad range of Windows client and server releases, from Windows 10 version 1607 and Server 2016 through Windows 11 version 26H2/26H1 and Windows Server 2025. Exploitation requires prior local access and a low-privileged account (CVSS PR:L) and depends on winning a timing-dependent race, which makes it high-complexity (AC:H) and non-deterministic rather than a reliable, automatable attack - there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, though the technical impact is rated total. Vendor patches are available.
Local privilege escalation in the Windows Push Notifications service allows an authenticated attacker with low-level user privileges to achieve high-integrity code execution by exploiting a missing authentication check (CWE-306) in a critical internal function. Scored CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local access, no user interaction, and winning a non-deterministic condition due to high attack complexity; there is no public exploit identified at time of analysis. Affected builds of Windows 10, Windows 11, and Windows Server (2019 through 2025) below the fixed versions can be remediated with the Microsoft update.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated low-privileged user who already holds a session on a vulnerable Windows host to gain elevated privileges by abusing a weak authentication check (CWE-1390) in the projected file system component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms a local attack path requiring a prior foothold, no user interaction, and a high-complexity precondition - most plausibly a race condition or specific local timing/state the attacker must win - so there is no remote or unauthenticated route, and CISA's SSVC scoring explicitly rates Automation as "no" and Exploitation as "none". No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, meaning the practical risk is moderate rather than urgent; a vendor patch is available and all affected Windows 10, Windows 11, and Windows Server builds listed by EUVD should be updated to the specified fixed build levels.
Local privilege escalation in Windows Management Instrumentation (WMI) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to corrupt heap memory and escalate to SYSTEM-level privileges. The flaw is a heap-based buffer overflow (CWE-122) reachable through the WMI code path that ships enabled by default on every supported Windows client and Windows Server build, from Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2 up to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. Microsoft has released a vendor patch and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, reflecting the high attack complexity and unpredictable heap state required for reliable exploitation. The issue is a real but opportunistic escalation primitive rather than a wormable or remotely reachable bug.
Local privilege escalation in Microsoft Windows allows an attacker who already holds low-privileged, interactive access on a host to corrupt kernel memory and elevate to SYSTEM by exploiting a use-after-free in the Advanced Local Procedure Call (ALPC) subsystem. All unpatched Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2019/2022/2025 (including Server Core) builds below the vendor-supplied build thresholds are affected, so impact is broad across default installations but confined to the local attack surface (AV:L, PR:L, UI:N) with a high-complexity race condition (AC:H) gating reliable exploitation. There is no indication of active exploitation: CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, making this a moderate-priority local privilege-escalation issue rather than an urgent internet-facing emergency; vendor patches are available.
Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.
Local privilege escalation in Microsoft Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated, low-privileged attacker who already has local code execution to corrupt kernel memory and raise their privileges to kernel/SYSTEM level. The bug is a use-after-free reached by winning a race condition (CWE-362) in the socket-handling path, which is why it carries high attack complexity (AC:H) - exploitation requires repeatedly racing a narrow timing window and is unreliable and non-automatable (SSVC Automatable=no). Almost every supported Windows client and server build is affected because AFD.sys is loaded by default, but the practical exposure is limited to multi-user hosts or post-foothold escalation; vendor patches are available and no public exploit code or observed exploitation was identified at the time of analysis.
Local privilege escalation in the Windows Update Orchestrator Service on unpatched Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2025 lets a local, low-privileged attacker who can already run code on the host win a heap race condition and elevate to SYSTEM. The defect is a use-after-free (CWE-416) with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and CISA's SSVC assessment records Exploitation=none and Automatable=no, meaning the race is unreliable and must be won manually rather than triggered by a repeatable exploit chain. There is no public exploit code identified at time of analysis, so this is a moderate-priority patch-and-move-on item rather than an emergency, though the vendor has made a fix available.
Local privilege escalation in the Windows Certificates component lets an attacker who already holds low-privileged authenticated access on a Windows host trigger a use-after-free (CWE-416) and gain SYSTEM-level code execution, affecting Windows 10, Windows 11 (through 26H2) and Windows Server 2016 through 2025 builds below the fixed levels listed in EUVD-2026-99101. Exploitation requires local access (AV:L, PR:L) and no user interaction, but is constrained by high attack complexity (AC:H), meaning the memory-reuse condition is not reliably reachable, and CISA's SSVC assessment records exploitation as 'none' - no public exploit identified at time of analysis. The result is a credible moderate-priority privilege-escalation issue rather than an emergency; vendor patches are available from Microsoft.
Local privilege elevation in the Windows Security Center component allows an attacker who already holds a low-privileged local account to gain higher privileges (high confidentiality, integrity and availability impact) by exploiting a race condition during concurrent execution of a shared resource. Only Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2 through 26H2) installations are in scope, and because the attack requires an existing foothold plus a reliably won timing window (CVSS AV:L/AC:H/PR:L), it is not remotely reachable and is not automatable. Exploitation is assessed as none by CISA SSVC, no public exploit code has been identified at time of analysis, and EPSS is low at 0.22% (11th percentile), which places this in a this-week remediation cadence rather than an emergency one.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds a low-privileged local account on a Windows host elevate to SYSTEM-level privileges by winning a race condition during an installer operation. Per the assessed vector (AV:L/AC:H/PR:L/UI:N) the attacker must be authenticated locally and must win a non-deterministic time-of-check/time-of-use window, which typically requires repeated attempts, so exploitation is unreliable and cannot be performed remotely or unauthenticated. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none', making this a moderate, non-urgent local privilege-escalation issue rather than an emergency; vendor patches are available for all listed Windows editions and builds.
Local privilege escalation in the Windows Setup Files Cleanup component allows an attacker who already holds low-privileged, authenticated access to a vulnerable Windows host to win a time-of-check time-of-use race and gain SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations, with CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no remote vector and no user interaction required, but exploitation demands an existing foothold plus a reliably won race, which CISA's SSVC assessment marks as not automatable and with no observed exploitation; no public exploit code has been identified at time of analysis and Patch is available from the vendor.
Local privilege escalation in Windows NTFS allows an authenticated local user to elevate privileges by winning a race condition on shared NTFS filesystem resources (CWE-362). Only systems running affected Windows builds below their fixed revision are vulnerable (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761), and exploitation requires the attacker to already have local code execution and to repeatedly contend for a narrow timing window, making it probabilistic and non-automatable per CISA SSVC. No public exploit has been identified at time of analysis, no KEV listing exists, and vendor patches are available.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated attacker with low-privileged local access to gain elevated privileges on affected Windows systems. The flaw is a race condition (CWE-362) that is timing-sensitive (CVSS AC:H) and requires no user interaction (UI:N), making exploitation probabilistic and limited to local contexts. No public exploit code was identified at time of analysis, and no active exploitation is confirmed (CISA SSVC: Exploitation=none); vendor patches are available.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to gain SYSTEM-level access by triggering an unsynchronized access to a shared resource during MSI package operations. Exploitation requires a valid local account (PR:L, AV:L) and hinges on winning a narrow timing window (AC:H), so attacks are typically unreliable and may need many repeated attempts - consistent with CISA SSVC rating the issue not automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV signals are absent, so real-world urgency is lower than the HIGH-adjacent, 7.0 CVSS score alone might suggest; vendor patches are available for all affected Windows builds.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in the Windows Storage component of Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows an authenticated attacker with standard user rights to raise their privileges to SYSTEM level on the affected host. Exploitation requires an existing local foothold and winning a timing race in the storage stack (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so this is realistically a post-compromise escalation step rather than an initial-access or network-reachable flaw; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft rates the issue 7.0 High and vendor patches are available for all affected branches.
Local privilege escalation in the Windows Storage component of supported Windows 10, Windows 11, and Windows Server releases lets a low-privileged attacker who already holds an account or process on the host race a use-after-free to reach a higher-integrity context, with high confidentiality, integrity, and availability impact. Exploitation is timing-dependent rather than deterministic: the attacker must win a race condition (CWE-362, reflected in the high attack complexity of the CVSS vector) and needs an existing local foothold (AV:L, PR:L, no user interaction required), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has shipped vendor patches for all listed builds, so this is a genuine but moderate-priority patch-cycle item rather than an urgent internet-facing threat; the residual risk is that local privilege-escalation fixes are commonly reverse-engineered into exploits after publication, which makes timely patching of multi-user and remote-access hosts worthwhile.
Use-after-free in the Windows Storage component allows an authenticated low-privileged local user to elevate privileges to full system integrity on affected Windows hosts. Exploitation requires winning a narrow race-condition timing window (CWE-362) and grooming freed memory for reuse, which is why attack complexity is rated high and CISA's SSVC assessment marks the flaw non-automatable, keeping this a moderate-priority rather than drop-everything issue. All currently supported Windows 10, Windows 11 and Windows Server builds below the vendor-fixed versions are affected, including Server Core installations, but Microsoft has released patches; no public exploit code has been identified and no exploitation activity is recorded (CISA SSVC exploitation: none).
Local privilege escalation in Windows Credential Manager affects Windows 10, Windows 11, and Windows Server (2012 through 2025) builds, letting an attacker who already holds a low-privileged local session on the host win a race condition (CWE-362) and elevate to higher privileges. The vulnerable component is not remotely reachable and the high attack complexity rating reflects a non-deterministic timing window that may require repeated attempts; exploitation requires authenticated local access (CVSS vector PR:L/AV:L), and no public exploit identified at time of analysis, with CISA SSVC recording no observed exploitation. Microsoft has published updated builds that correct the synchronization flaw, so remediation is a matter of patching rather than emergency mitigation.
Local privilege escalation in the Windows Servicing Stack Updates (SSU) component affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) built below their respective fixed build thresholds, letting an attacker who already holds authenticated local access win a time-of-check time-of-use race and gain high-integrity code execution, confidentiality, and availability impact (CVSS 7.0, CWE-367). The high attack complexity reflects a narrow timing window that must typically be hit through repeated, precisely timed attempts, and no user interaction is required, though the attacker must already be present on the host with low privileges (PR:L, AV:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched servicing stack via its update guide.