Local privilege escalation in Windows Installer (CVSS 7.0) lets an attacker who already holds low-privilege, local access on a Windows host escalate to SYSTEM by winning a race condition in the service's handling of a shared resource during concurrent execution. The flaw is CWE-362 and carries AC:H in the assessed vector, so the timing window is narrow and exploitation may require repeated attempts; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has published fixed builds for the affected Windows 10, Windows 11 and Windows Server releases via the MSRC update guide for CVE-2026-85941, making prompt patching the definitive mitigation.
Local privilege escalation in Windows Kernel-Mode Drivers allows an authorized attacker with a low-privileged local account to reach SYSTEM-level code execution by winning a time-of-check/time-of-use race (CWE-367) that triggers a use-after-free in kernel mode. Affected platforms are Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025 running builds below the patched revisions; the assessed CVSS 3.1 base score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Vendor patches are available from Microsoft, and no public exploit identified at time of analysis (CISA SSVC reports Exploitation: none, and the CVE is not linked to KEV), so risk is concentrated in post-compromise escalation on shared or multi-user hosts rather than remote mass exploitation.
Local privilege escalation in Windows Error Reporting (WER) allows an authenticated attacker who already holds a low-privileged session on a Windows host to win a time-of-check-time-of-use race and corrupt heap memory, potentially escalating to SYSTEM-level code execution. Affected builds span Windows 10, Windows 11 (23H2 through 26H1/26H2), and Windows Server 2012 through Windows Server 2025, including Server Core installations. There is no public exploit identified at time of analysis and no confirmed active exploitation - CISA's SSVC records Exploitation 'none' and Automatable 'no' - and the High attack complexity reflects the non-deterministic race window, which requires repeated attempts to land reliably.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated, low-privileged local user (CVSS PR:L) to elevate to a higher-integrity context, including SYSTEM, by triggering a use-after-free (CWE-416) in the search stack. Exploitation is constrained by High attack complexity (AC:H): the attacker must win a race/timing window and control reuse of the freed heap object, so reliable exploitation is conditions-dependent rather than one-shot, and there is no network vector or user-interaction requirement (AV:L, UI:N). Microsoft has released fixes in its update guide; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, making this a genuine but non-emergency privilege-escalation risk.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in Microsoft Windows through the Ancillary Function Driver for WinSock (afd.sys) lets an attacker who already holds low-privileged local code execution corrupt kernel pool memory and raise privileges to SYSTEM, yielding high confidentiality, integrity, and availability impact. Exploitation is gated by valid local credentials (PR:L, authenticated) and is further constrained by high attack complexity (AC:H), because the CWE-415 double free depends on winning a non-deterministic kernel memory race that may require repeated attempts; there is no network vector and no victim interaction (UI:N). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the exposure is broad - Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 - with vendor patches available.
Local privilege escalation in the Windows Kernel (CWE-416 use-after-free) affects Windows 11 versions 24H2, 25H2, 26H1, 26H2, and Windows Server 2025 including Server Core; an authenticated attacker with low privileges can exploit this to gain kernel-level or SYSTEM privileges on the local machine. The vulnerability requires local access and high attack complexity (likely a race condition or specific heap state), with no remote vector and no user interaction required; SSVC reports exploitation none and no public exploit identified at time of analysis. Microsoft has released patches addressing the issue, and updating to the fixed builds removes the vulnerability.
Local privilege escalation in the Windows Broadcast DVR User Service lets an attacker who already holds authenticated low-privilege code execution on a Windows 10 or Windows 11 host win a race against freed memory in the Game DVR capture component and take over the service with elevated (SYSTEM-level) rights. The flaw is a use-after-free (CWE-416) with High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) because the timing window must be reliably won, so no public exploit has been identified at time of analysis and the CISA SSVC assessment rates the issue not automatable with exploitation status 'none'. Microsoft has released vendor patches; affected builds span Windows 10 1809, 21H2 and 22H2 and Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2.
A use-after-free in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets a locally authenticated attacker on a vulnerable Windows host elevate privileges to SYSTEM by winning a narrow timing window in which a freed kernel object is reclaimed before deletion completes. Because exploitation requires the attacker to already hold low-privileged local access (PR:L), it is a post-compromise privilege-escalation primitive rather than a remote entry point, and the high attack complexity (AC:H) means success is neither trivial nor deterministic. Microsoft has released fixes for all affected Windows 10, Windows 11, Windows Server 2019/2022/2025 builds, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated, low-privileged attacker who already holds a foothold on the host win a use-after-free and gain SYSTEM-level code execution. Exploitation requires winning a timing-dependent race against the service (AC:H), with no user interaction needed, and affects Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2) and Windows Server 2019 including Server Core builds below the patched levels. There is no confirmed active exploitation (CISA SSVC exploitation: none) and no public exploit identified at time of analysis; a vendor patch is available and the issue is assessed as a genuine but non-urgent High-severity local elevation-of-privilege flaw (CVSS 7.0, EPSS-level urgency not elevated).
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already possesses low-privilege code execution on a Windows host to corrupt memory via a use-after-free and elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is not remotely reachable and needs pre-existing local access; the high attack complexity reflects a race/heap-reuse condition that makes exploitation timing-dependent, and no public exploit identified at time of analysis. Microsoft has released a vendor patch.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an authorized low-privilege user elevate to SYSTEM by triggering a use-after-free memory-corruption condition in the installer service. Exploitation is confined to unpatched Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 hosts, and requires a valid local account plus high attack complexity because the primitive depends on precise object-lifetime/timing conditions (CVSS:3.1/AV:L/AC:H/PR:L/UI:N, 7.0); no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Microsoft has released patched builds for every affected branch, so exposure is limited to systems that have not yet applied the current cumulative updates.
Local privilege escalation in Microsoft's Windows Image Acquisition (WIA) service lets an attacker who already holds low-privileged authenticated access on a Windows host corrupt memory in the WIA component and run code with higher - ultimately SYSTEM-level - privileges. Exploitation is confined to the local machine (AV:L), requires a pre-existing foothold (PR:L), and hinges on winning a use-after-free timing window rated high complexity (AC:H), so it is not remotely reachable, cannot be reliably automated, and needs no victim interaction. Microsoft has released a vendor fix per its update guide and no public exploit code or active exploitation has been identified at time of analysis, making this a credible but not top-tier priority patch - the real-world risk comes from attackers who have already landed on a box and want to finish escalating.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Elevation of privilege in Windows Web Account Manager (WAM) allows a locally authenticated low-privileged attacker (CVSS PR:L) to abuse a use-after-free condition and obtain higher-integrity code execution, with high impact to confidentiality, integrity, and availability of the compromised host. Only systems that have not yet applied the current cumulative updates are exposed across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2019, 2022, and 2025, and because attack complexity is high (AC:H) reliable triggering depends on heap layout and timing, making this a post-compromise privilege-escalation primitive rather than an initial-access or wormable flaw. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; Microsoft has released fixed builds for all listed branches.
Local privilege escalation in the Microsoft Windows WebDAV component allows an authenticated low-privileged user to trigger a heap-based buffer overflow and gain code execution at a higher integrity level on the affected host. Exploitation requires a pre-existing local foothold (AV:L, PR:L, UI:N) plus reliable heap grooming or race-condition success (AC:H), making this a post-compromise escalation primitive rather than a remote or unauthenticated entry point. It affects unpatched Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 builds below their respective patched thresholds; no public exploit code has been identified at time of analysis, no CISA KEV entry is present, and no EPSS score was supplied with the record.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in the Windows Advanced Rasterization Platform (WARP), the software rasterizer shipped with Windows, allows an attacker who already holds valid low-level local privileges to raise their rights to a higher-integrity context by winning a use-after-free race in the graphics component. Exploitation is strictly local (AV:L), requires authentication as a standard user or pre-existing local code execution (PR:L), needs no user interaction (UI:N), but is assessed as high complexity (AC:H) because it depends on defeating allocator non-determinism and precise timing; CISA's SSVC rates exploitation as none and the issue as non-automatable, so no public exploit has been identified at time of analysis. This is most realistically a post-compromise escalation step rather than an initial-access or lateral-movement vector, and a vendor patch is available.
Local privilege escalation in the Windows Installer service allows an authenticated attacker holding a low-privileged account to corrupt memory via a use-after-free and, if successful, obtain high-integrity code execution on the affected Windows host. The issue is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) and affects a broad range of Windows 10, Windows 11, and Windows Server builds up to vendor-published fixed builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Because exploitation requires existing local access, a valid low-privileged session, and a reliable win in a non-deterministic memory-reuse race (AC:H), this is a credible but non-urgent post-compromise escalation vector rather than a mass-exploitation emergency. Vendor patches are available per the Microsoft advisory.
Local privilege escalation in the Microsoft Windows Overlay Filter driver (Wof.sys) allows an authenticated attacker who already holds a low-privileged foothold on a Windows 10, Windows 11, or Windows Server 2016-2025 host to escalate to full system-level rights. The underlying defect is a use-after-free (CWE-416) reachable through the driver's handling of overlay/compressed file operations; because it must be triggered inside a race/timing window it carries high attack complexity (AC:H), making success probabilistic and often requiring repeated attempts, and it is strictly local (AV:L) with no victim interaction (UI:N). No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none' with automatable 'no', so this is a genuine but moderate-priority elevation-of-privilege issue whose key prerequisite is prior local code execution as an unprivileged user; a vendor patch is available.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds low-privileged authenticated access to a Windows host to corrupt the heap of the SYSTEM-level installer service and gain elevated code execution. The flaw is rated CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local and authenticated, and the high attack-complexity metric reflects that successful exploitation hinges on conditions the attacker does not fully control, such as winning a heap layout or timing race, so reliable exploitation is difficult. No public exploit code was identified at time of analysis, and CISA's SSVC evaluation records Exploitation as none and Automatable as no; every supported Windows client and server edition (including Server Core) at builds below the vendor's fixed levels is affected, and a vendor patch is available.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).
Local privilege escalation in the Microsoft Windows Local Security Authority Server (lsasrv) lets an attacker who already holds a low-privilege local account win a race condition and trigger a use-after-free, corrupt memory inside the LSA process and run code with SYSTEM-level privileges, yielding high confidentiality, integrity and availability impact (CVSS 7.0). Affected builds cover default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core editions, below the vendor's patched builds. No public exploit identified at time of analysis and CISA's SSVC records Exploitation=none with Automatable=no, meaning the high-complexity timing window (AC:H) makes dependable, repeatable exploitation unlikely without significant effort. The elevation is not remotely reachable: an authenticated local foothold on the host is a prerequisite.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker with low privileges to gain elevated rights by exploiting a race condition that leads to a use-after-free. Exploitation requires VBS with Enclaves to be enabled and a pre-existing local foothold, and the attacker must win a timing race (CWE-362). Microsoft rates this as CVSS 7.0 (High); no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft SQL Server allows an authorized, low-privileged principal with existing access to the database host to exploit a use-after-free memory condition (CWE-416) and run code in a more privileged security context. Affected builds span SQL Server 2019, 2022, and 2025 on versions below the fixed GDR and CU releases published with Microsoft's January 2026 update. Exploitation is constrained by the local attack vector (AV:L) and high attack complexity (AC:H), since the attacker must already be authenticated on the host and win a memory-reuse/timing race; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege elevation in Windows Autopilot on Windows 11 (24H2, 25H2, 26H1, and 26H2) lets an authenticated low-privileged attacker who already holds a foothold on the machine exploit a race condition in an improperly synchronized shared provisioning resource and reach a high-integrity context, with high impact to confidentiality, integrity, and availability. Because the flaw is a race condition (AC:H), exploitation is non-deterministic and typically requires repeated attempts to hit a narrow timing window, but no user interaction is needed and the attack stays local (AV:L, PR:L). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and a vendor patch is available, making this a moderate-priority local elevation-of-privilege issue rather than an emergency.
Local privilege escalation in Windows BITS allows an authenticated attacker with low-level privileges to exploit a race condition and elevate to higher integrity on affected Windows 10, 11, and Server systems. Exploitation requires a pre-existing local foothold and winning a narrow timing window, making success probabilistic; no public exploit has been identified. Microsoft has released patches for all supported versions.
Local privilege escalation in the Windows Reliable Multicast Transport Driver (RMCAST, pgm.sys) lets an attacker who already holds low-privileged local access on a vulnerable host win a time-of-check time-of-use race and elevate to SYSTEM-level execution. The flaw is not remotely reachable: exploitation requires a pre-existing local, authenticated foothold (AV:L/PR:L) and must be repeated many times to reliably hit the narrow check/use window (AC:H), but a successful race yields full confidentiality, integrity, and availability impact. Microsoft has released fixed builds for the affected Windows 10, Windows 11, and Windows Server branches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at the time of analysis, and no EPSS score was supplied with the source data.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Composite Image File System (CimFS) driver allows an authenticated, low-privileged local user to reach SYSTEM-level code execution by winning a timing race that triggers a use-after-free in the driver. Exploitation requires an existing local account plus the ability to run code on the host, and the high attack complexity (AC:H) of the race makes success probabilistic rather than reliable, with no user interaction needed; no public exploit identified at time of analysis, and there is no KEV listing. Affected builds include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 below their fixed build numbers, and Microsoft has released patches.
Local privilege escalation in the Windows Phone Service on Windows 11 (23H2 through 26H2) and Windows Server 2022 lets an authenticated, low-privileged user on the machine win a race condition in a shared resource and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable and requires a pre-existing local account, and the AC:H rating reflects that a narrow, non-deterministic synchronization window must be won reliably - typically over many repeated attempts - so this is a patch-cycle item rather than an emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation none, Automatable no). Vendor patches are available per the MSRC advisory.
Local privilege escalation in Microsoft Windows Print Spooler components allows an authenticated, low-privileged user with interactive access to a Windows host to elevate privileges by triggering a race condition in spooler object handling. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations; the vulnerable spooler service is present and normally running by default, so no unusual configuration is required to reach the flaw. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor-released patches are available per the MSRC advisory - this is a moderate-priority LPE rather than an urgent remote threat.
A usable race condition in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds low-privileged local code execution on a host to escalate to SYSTEM-level rights. Because the flaw requires both an existing local foothold and repeated attempts to reliably win a narrow timing window, it functions as a post-compromise or malicious-insider escalation primitive rather than a remotely reachable attack - there is no network vector (AV:L), no user interaction (UI:N), and no public exploit identified at time of analysis. Microsoft has released fixes covering Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025, and CISA's SSVC assessment records no exploitation activity, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execution foothold on the host to win a time-of-check-to-time-of-use race condition and obtain high-integrity code execution. The issue affects unpatched Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, and Windows Server 2019, 2022, and 2025 builds wherever the Hyper-V role is installed, and is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - local-only access, existing privileges required, and a narrow race window that makes success probabilistic and likely to need many attempts. No public exploit has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied as routine maintenance.
Local privilege escalation in the Windows Connected Devices Platform Service (CDPSvc) affects a broad set of Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds, allowing an attacker who already holds an authenticated low-privileged local account to raise their privileges to a higher integrity level. The flaw is a race condition (CWE-362) in which concurrent access to an improperly synchronized shared resource can be timed to corrupt service state; the narrow, hard-to-control timing window is reflected in the high attack complexity (AC:H) of the assessed CVSS 7.0 (High) vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning remote or anonymous exploitation is not possible and success likely requires repeated attempts. Vendor patches are available and no public exploit code has been identified at time of analysis; the service ships by default on supported editions, so exposure is limited mainly by the requirement for pre-existing local access.
Local privilege escalation in Windows Modern Device Management (MDM) allows an authenticated low-privileged attacker to gain elevated privileges by winning a time-of-check time-of-use race condition in the MDM component. The flaw is rated CVSS 7.0 (High) and requires local access and a narrow timing window (AC:H), with no public exploit identified at time of analysis. Affected are Windows hosts with the MDM component enabled, and successful exploitation could lead to complete compromise of confidentiality, integrity, and availability.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Local privilege escalation in Microsoft Office Click-To-Run (C2R) arises from a time-of-check time-of-use race condition in the installer/updater's file handling, letting an authorized low-privileged local user substitute attacker-controlled content in the window between validation and use and thereby gain higher privileges on the host. The flaw is rated CVSS 3.1 base 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is strictly local, requires a pre-existing authenticated session, needs no victim interaction, but is timing-dependent and therefore probabilistic - repeated attempts may be needed to win the race. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a privilege-escalation primitive for an attacker who already holds a local foothold rather than a remotely reachable or actively exploited issue. Deployments affected are Microsoft 365 Apps for Enterprise installed via Click-To-Run (reported as version 16.0.1).
Local privilege escalation in Microsoft SQL Server allows an authenticated attacker holding low-privilege access to the instance or its host to potentially elevate privileges on the underlying system by triggering an integer overflow (CWE-190). The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0 High) confirms the attack is local rather than network-based, requires a pre-existing authenticated foothold (PR:L), and carries high attack complexity (AC:H), meaning precise conditions such as specific input sizes or memory state are needed; no public exploit identified at time of analysis, and the issue is not in CISA KEV. This is a credible but not emergency-tier privilege-escalation issue whose practical risk concentrates on multi-tenant SQL Server instances or hosts shared with low-trust principals, and vendor patches are available per the Microsoft advisory.
Local privilege elevation in Microsoft SQL Server 2019, 2022, and 2025 stems from a heap-based buffer overflow that a low-privileged authenticated user with local access can trigger to gain elevated rights on the database host. Exploitation is not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:N) demands an existing authorized database session plus successful heap manipulation, and no public exploit has been identified at time of analysis, with no CISA KEV listing. Vendor patches are available, so this is a moderate-priority hardening item rather than a drop-everything emergency.
Privilege elevation on Microsoft SQL Server 2019, 2022, and 2025 instances can be achieved by an authenticated, low-privileged user who already has local access to the host or instance and can drive crafted input into a vulnerable heap-allocation code path. Successful exploitation corrupts heap memory and, because the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0), yields high confidentiality, integrity, and availability impact within the database engine's security context; the High attack complexity reflects the non-deterministic heap-grooming required for reliable code execution, and no end-user interaction is needed. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available per the Microsoft advisory, and unaffected instances are those already running the corrected cumulative-update or GDR builds.
Information disclosure in .NET's System.Net.Http affects applications that use SocketsHttpHandler with an authenticating proxy, because the Proxy-Authorization header is retained when an outbound request is redirected and is then sent to the redirect destination, exposing Basic proxy credentials to a server the attacker can observe or control. Affected runtimes are .NET 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13 and 11.0 before 11.0.0-rc.2, with Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4 shipping the same component; the CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (5.9), reflecting high attack complexity rather than any authentication requirement. There is no public exploit identified at time of analysis - CISA's SSVC assessment rates exploitation as none and automatable as no - but the severity comes from a leaked credential, not from any integrity or availability impact, and the exposure is limited to the proxy secret rather than general application data.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege escalation in the Microsoft Bluetooth Driver allows an authorized, low-privileged user already running code on a Windows host to win a timing-dependent race condition and elevate to full system privileges (high confidentiality, integrity and availability impact). Exploitation is strongly limited by high attack complexity: the race window is non-deterministic, success is unreliable, and the flaw is not automatable, so it cannot be exploited by network-only attackers. There is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - and no KEV listing exists, making this a moderate-priority local EoP issue rather than an emergency. Vendor patches are available through Microsoft's update guide.