Remote code execution in Microsoft Office allows an unauthenticated attacker to execute arbitrary code by convincing a user to open a specially crafted document. This heap-based buffer overflow affects Office LTSC 2021 (before 16.0.14334.20974), Office LTSC 2024 (before 16.0.17932.21056), Microsoft 365 Apps for Enterprise, and Mac versions of Office LTSC 2021/2024 and Office 365 for Mac. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the vulnerability is high-priority due to total technical impact and network attack vector; patching is available from Microsoft.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow that an unauthenticated attacker can trigger by delivering a specially crafted Word document that the victim then opens; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms full compromise of confidentiality, integrity and availability of the user's session, but also confirms that user interaction (UI:R) is the gating precondition. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC/365 for Mac 2021 and 2024, with Windows LTSC fixed versions published as 16.0.14334.20974 (LTSC 2021) and 16.0.17932.21056 (LTSC 2024). No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has released patched builds, so this is a credible, actionable remediation priority rather than an emergency-compromise scenario.
Remote code execution in Microsoft Word (part of Microsoft 365 Apps, Office LTSC 2021/2024, and Office for Mac) allows an unauthenticated attacker to execute arbitrary code in the context of a user who opens a crafted document. The vulnerability arises from use of an uninitialized resource (CWE-908) in Word's document parsing; although user interaction is required (UI:R), no privileges are needed on the attacker side (PR:N) and successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code has been identified at time of analysis, but Microsoft has released patches for affected builds.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code on a victim's machine when the target opens a specially crafted workbook, delivered over a network via email attachment, web download, or a shared file. The flaw is a heap-based buffer overflow (CWE-122) in affected Office builds, carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no authentication or prior access is required, but the attacker is dependent on the victim opening the file, which is why CISA's SSVC assessment rates exploitation as none and the issue as non-automatable. Affected configurations include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, and the listed macOS Office editions prior to their fixed builds. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, so this is a high-priority but not top-of-queue patch item; no EPSS probability was supplied with the source data.
Unauthorized remote code execution in Microsoft Windows PowerShell (CVE-2026-85817) stems from the engine relying on attacker-influenced data when making a security decision (CWE-807), allowing an unauthenticated network attacker to bypass that check and execute code in the context of the affected user. Exploitation requires user interaction (UI:R per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector) - typically the victim running an attacker-supplied script or module, or opening content that PowerShell evaluates while deciding whether to trust it - so unattended server-side compromise is not indicated. Microsoft has shipped fixes in its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; the 8.8 base score reflects full confidentiality, integrity, and availability impact once the required user action occurs.
Memory corruption in Microsoft's WPF desktop stack (Microsoft.WindowsDesktop.App.Runtime, shared by .NET and .NET Framework) allows an unauthenticated, network-positioned attacker to cause an out-of-bounds write by delivering an XPS document whose glyph coordinates overflow pointer arithmetic in CD3DGlyphBank::RectFillAlpha. Exploitation requires user interaction - the victim must open or render the malicious XPS file in an affected WPF application - and prerequisites are otherwise limited to the Windows platform and to applications that actually process untrusted XPS/glyph content, so server services that never render such documents are not exposed. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with high confidentiality, integrity and availability impact; note that signals conflict and should be weighed carefully, since the CVE description frames the outcome as privilege elevation while the vendor advisory frames it as remote code execution with process termination. No public exploit code and no confirmed active exploitation have been identified at time of analysis (SSVC exploitation: none), and vendor patches are available across .NET 8/9/10/11 RC, .NET Framework 3.5 and 4.x, and Visual Studio.
Heap-based buffer overflow in Microsoft Office Access allows remote code execution when a victim opens a malicious, attacker-crafted Access file such as an .accdb or .mdb database or an embedded object. Affected users are those with Access installed on the target host: no authentication to the system is required (PR:N) and attack complexity is low (AC:L), but exploitation is gated by the mandatory victim interaction (UI:R) of opening the crafted file, and any code executes only with the opening user's privileges (S:U). No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the MSRC advisory is the authoritative reference, and CVSS 8.8 reflects high confidentiality, integrity, and availability impact, making this a credible operational priority rather than a drop-everything emergency.
Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a victim opens a specially crafted Access database file, with an attacker needing no credentials but depending on user interaction to trigger the flaw. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning successful exploitation yields full loss of confidentiality, integrity, and availability within the Access process context, though the mandatory opening of the malicious file limits automated, hands-off exploitation. Based on available intelligence, no public exploit identified at time of analysis and EPSS scoring was not supplied; the entry appears only in the Microsoft Security Response Center update guide, and no CISA KEV listing or other exploitation signal is present.
Heap-based buffer overflow in Microsoft Office Access lets unauthenticated remote attackers execute arbitrary code in the context of the user who opens a specially crafted Access database (.accdb/.mdb) file. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms that no credentials are required and attack complexity is low, but the mandatory user interaction (UI:R) - typically a phishing attachment, download, or shared file - is the gating factor that prevents automated, widespread exploitation; code runs only with the privileges of the user who opened the file. There is confirmed KEV? no - no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so this is a credible, patchable priority rather than an actively exploited emergency.
Remote code execution in Microsoft Office Access occurs when a victim opens an attacker-supplied, specially crafted Access database file that triggers a heap-based buffer overflow during file parsing (CWE-122). The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): it is network-deliverable, low-complexity and needs no authentication, but is gated entirely by the requirement that a user open the malicious document, and scope is unchanged so code runs in the victim's user context rather than granting system-wide control. No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Microsoft Access (part of Microsoft Office) contains an out-of-bounds read (CWE-125) that can be exploited to execute arbitrary code when a victim opens a specially crafted database file. The CVSS vector (8.8, AV:N/AC:L/PR:N/UI:R) indicates that unauthenticated remote attackers can achieve high confidentiality, integrity, and availability impact, but the required user interaction makes this a serious yet not top-tier emergency. No public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Access allows unauthenticated remote attackers to execute code when a victim opens a maliciously crafted Access database, scoring CVSS 8.8. Exploitation requires user interaction (UI:R), so there is no zero-click or server-side vector, and code runs in the context of the user who opens the file, limiting immediate blast radius. No public exploit identified at time of analysis; this is serious but not emergency-tier because the victim must open the attacker-supplied file.
Heap-based buffer overflow in Microsoft Office Access allows unauthenticated remote attackers to execute arbitrary code when a victim opens a maliciously crafted Access database file. The vulnerability requires user interaction (UI:R) but no authentication (PR:N), and successful exploitation grants code execution with the privileges of the current user (S:U). No public exploit code or active exploitation has been identified at time of analysis; however, the high CVSS score (8.8) and low attack complexity make this a significant risk for organizations using affected Access versions.
Heap-based buffer overflow in Microsoft OneNote allows unauthenticated remote attackers to execute arbitrary code in the security context of the user who opens a crafted OneNote file, rated CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Exploitation is not zero-click: per the UI:R component of the assessed vector, the victim must open or preview an attacker-supplied OneNote/Office document delivered by email, web, or file share, and code then runs with that user's privileges without scope change (S:U), so no inherent privilege escalation is provided. No public exploit identified at time of analysis and the CVE is not in CISA KEV; no EPSS score was supplied in the available data.
Code injection in the Windows Encrypting File System (EFS) allows an authenticated attacker holding only low-level privileges (PR:L) to execute arbitrary code over the network against unpatched Windows hosts, with high impact across confidentiality, integrity, and availability (CVSS 8.8). Every supported Windows branch is in scope, including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2016, 2019, 2022, and 2025 (Server Core included), and exploitation requires network reachability to the EFS component rather than any user interaction. Microsoft has published patched builds for each affected branch, and at time of analysis there is no CISA KEV listing, no public exploit code identified, and CISA's SSVC assessment records exploitation as 'none' with automatable set to 'no'.
Heap-based buffer overflow in the Windows Libarchive component - the library Windows uses to extract 7z, rar, tar, cab and similar archive formats - lets a remote attacker execute arbitrary code with the privileges of the user who opens a malicious archive. Because exploitation is delivered over the network (AV:N) with no authentication required (PR:N) but demands that the victim open or process the crafted file (UI:R), the realistic attack path is a phishing email attachment, a web download, or a hosted share rather than anything wormable; CISA's SSVC decision framework reflects this with Exploitation=none and Automatable=no. There is no public exploit identified at time of analysis and vendor patches are available, so the practical priority is patch deployment rather than emergency containment - while noting the CVSS 8.8 score masks that the mandatory user interaction is the single factor keeping risk below critical.
Use-after-free in the Windows Storport Miniport Driver (storport.sys) on Windows Server 2025, including Server Core installations, allows remote attackers to corrupt kernel memory and potentially execute code in the kernel after a user on the host performs an action that reaches the vulnerable driver code path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R), no authentication is needed but successful exploitation is conditional on user interaction, which is the primary limiting factor and is consistent with the SSVC assessment of Automatable=no; the specific network-facing feature or protocol that carries the trigger into this storage-stack driver is not named in the available data and should be confirmed against the Microsoft MSRC advisory. A vendor patch is available and hosts at build 10.0.26100.33650 or later are not vulnerable; no public exploit code and no confirmed active exploitation have been identified at time of analysis. Overall, signals are moderately consistent but point to a conditional rather than wormable threat, with technical impact assessed as total if the use-after-free is successfully triggered.
Integer overflow in the Windows iSCSI implementation can lead to memory corruption and remote code execution on an affected host, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack requires user interaction: the victim host must initiate or process a connection to an attacker-controlled iSCSI target or portal so that a crafted iSCSI response reaches the vulnerable parser - no prior authentication is required (PR:N), but the victim must be using the iSCSI initiator/service path. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft is the reporting and advisory source (MSRC update guide). The practical limiting factor is the need for a victim to engage a hostile iSCSI endpoint, which makes this a serious, high-priority but not automatic-emergency issue.
Remote code execution in Microsoft's Windows Desktop (WPF) runtime lets an unauthenticated attacker execute arbitrary code in the context of a victim who opens crafted WPF content containing a malicious pixel-shader. The flaw is a heap out-of-bounds write (CWE-787) in the shader-processing routine CPSTrans::Initialize, triggered when crafted pixel-shader bytecode desynchronizes the component's two parsing passes; per the CVSS vector the attacker needs no credentials (PR:N) but the victim must interact with the malicious content (UI:R), and exploitation yields code execution at the user's privilege level rather than elevated (S:U), which is why the independent assessment rates this as high priority but not an emergency. Affected software spans .NET 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 preview/RC builds before 11.0.0-rc.2, multiple .NET Framework 3.5/4.6.2-4.8.1 servicing branches on Windows, and Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4). No public exploit code has been identified and there is no KEV listing at time of analysis, but vendor patches are available and should be applied promptly given the ease of triggering (AC:L) once a user opens the file.
Heap-based buffer overflow in the Windows Graphics/Fonts subsystem (CVE-2026-69326) lets remote attackers execute arbitrary code on affected Windows client and server systems when a victim opens or renders content containing a malformed embedded font. All Windows 10, Windows 11, and Windows Server 2012 through 2025 builds listed in the advisory are affected, and the vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a total technical impact rating under CISA's SSVC framework. Exploitation is gated by mandatory user interaction - there is no unattended or server-side trigger - and there is no public exploit identified at time of analysis and no CISA KEV listing, so while severity signals are consistent, urgency signals diverge.
Heap-based buffer overflow in Microsoft Office Access allows an unauthenticated remote attacker to execute arbitrary code in the security context of the user who opens a crafted Access database file. Exploitation is gated by user interaction (UI:R) - the victim must open an attacker-supplied file delivered by email, web download, or shared location - with low attack complexity (AC:L) and no credentials required from the attacker (PR:N), and code runs as the invoking user rather than as SYSTEM. Rated 8.8 (C:H/I:H/A:H); no public exploit code and no confirmed active exploitation were identified at time of analysis, and environments that do not install or use Access are not exposed.
Remote code execution in Microsoft Access is possible when a user opens a specially crafted Access file, exploiting a heap-based buffer overflow (CWE-122) to let an unauthenticated attacker execute code in the context of the victim. Affected are systems with Microsoft Access installed; the attack requires user interaction (UI:R in the CVSS vector) and no public exploit code or confirmed active exploitation is identified at time of analysis, though the vendor advisory should be consulted for updates.
Remote code execution in the Windows GDI (Graphics Device Interface) component affects unpatched Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 R2, 2016, 2019, 2022 and 2025, where an attacker who convinces a user to open or render a crafted file triggers an out-of-bounds write that can execute code in that user's security context. The flaw is network-reachable with no privileges or credentials required on the attacker side, but successful exploitation is gated by user interaction, so there is no zero-click or automatable path; consistent with the CISA SSVC assessment (Exploitation: none, Automatable: no), no public exploit code was identified at the time of analysis. Microsoft has published vendor patches, and this should be treated as a genuine high-priority patch item rather than an emergency at the time of analysis.
Privilege elevation in the Windows Partition Management Driver (partmgr.sys) allows an unauthorized attacker to trigger a heap-based buffer overflow and achieve high-integrity code execution with full confidentiality, integrity, and availability impact, affecting unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds below their respective fixed build numbers. The attack is network-vectored (AV:N) with low complexity and no required privileges, but exploitation is gated by user interaction (UI:R) - a victim must open, mount, or otherwise engage with attacker-supplied content that reaches the vulnerable driver code path - which is why CISA's SSVC assessment rates the flaw not automatable. No public exploit identified at time of analysis and SSVC reports no observed exploitation; vendor-released patches are available, so risk is concentrated in unpatched fleets where social engineering of the user-interaction step is plausible.
Heap-based buffer overflow in the Microsoft Windows Search Component enables unauthenticated remote attackers to achieve arbitrary code execution, though exploitation requires victim user interaction (UI:R) to open, preview, or index attacker-controlled content. This affects default configurations across supported Windows client and server editions, including Server Core installations, and vendor patched builds are available. No public exploit code has been identified at time of analysis, and the SSVC assessment lists exploitation as none and automatable as no.
Heap-based buffer overflow in Microsoft Office Visio allows unauthenticated remote attackers to execute arbitrary code in the context of the user who opens a specially crafted Visio document, with the only barrier being user interaction (UI:R) - the victim must be socially engineered into opening the file. Affected builds are Microsoft 365 Apps for Enterprise (16.0.1, patched via the current channel at https://aka.ms/OfficeSecurityReleases), Office LTSC 2021 below 16.0.14334.20974, and Office LTSC 2024 below 16.0.17932.21056. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the 8.8 CVSS score, network attack vector, and complete confidentiality/integrity/availability impact make prompt patching a high priority for any environment where Visio is installed.
Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.
Arbitrary code execution in Microsoft Office Excel is possible when a user opens a specially crafted workbook, because the parser mishandles memory and triggers a double free (CWE-415). The flaw is remotely deliverable by an unauthenticated attacker (CVSS 3.1 AV:N/AC:L/PR:N), but exploitation depends on the victim opening the malicious file (UI:R), limiting the attack to social-engineering delivery; successful exploitation runs code with the privileges of the opening user. Affected software includes Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac builds, and Office Online Server builds below the fixed versions, and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Heap-based buffer overflow in Microsoft Excel enables remote code execution when a user opens or previews a specially crafted spreadsheet, rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Any affected build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft Office 365 for Mac, or Office Online Server - that processes the malicious file is at risk; no authentication or non-default configuration is required, but the attacker must convince the victim to open the document. No public exploit identified at time of analysis, and the flaw is not confirmed as actively exploited, though the high confidentiality, integrity, and availability impact makes it a priority patch for Office endpoints.
Remote code execution in the optional Microsoft Windows Raw Image Extension codec (versions 2.1.0.0 up to but not including 2.4.36.0) allows an unauthenticated, remote attacker to run arbitrary code in the context of the victim user by supplying a malformed RAW image file. Exploitation requires user interaction (CVSS UI:R) - the victim must open, preview, or let Explorer generate a thumbnail for the crafted file, which can be delivered via email, web download, or a network share - and requires the optional codec to be installed, since it is not present on default Windows installations (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); vendor patch data indicates a fix is available. Overall this is a credible, patch-worthy priority but not a drop-everything emergency, given the dependency on the optional codec and on victim interaction with the malicious file.
Unauthenticated remote attackers can write arbitrary files on servers running Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 by abusing a path traversal flaw in the fileManager module's storeFile endpoint; a single crafted POST to /rest/storeFile with attacker-controlled fullPath and fileName parameters lets the service account create or overwrite files anywhere it has write permission, which can escalate to code execution if a writable path is later executed or parsed. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (8.8, matching the published CVSS 4.0 score), reflecting high integrity and availability impact with no confidentiality impact, and no KEV listing, so there is no confirmed active exploitation (no public exploit identified at time of analysis), though the presence of a public technical writeup and a VulnCheck advisory makes weaponization plausible. Real-world impact is bounded by the service account's write permissions and by whether the vulnerable fileManager endpoint is reachable from the attacker's network position rather than internal-only; this is a credible high-priority issue rather than a high-CVSS-but-low-risk paper cut.
An out-of-bounds write in the Windows Local Security Authority Subsystem Service (LSASS) allows a network-positioned attacker to corrupt memory in a high-privilege system process and execute arbitrary code, with the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicating a low-privilege authenticated attacker, no user interaction, and full confidentiality, integrity, and availability impact. The affected surface spans essentially the entire supported Windows fleet, from Windows Server 2012/2012 R2 and Windows 10 1607 through Windows 11 26H2 and Windows Server 2025, so unpatched domain controllers and member servers are the highest-value targets. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none and the flaw as non-automatable, meaning exploitation is not trivial to script at scale; Microsoft has released fixed builds for all affected branches.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
An out-of-bounds read (CWE-125) in Microsoft's Windows Server 'Server for NFS' role can be triggered by a remote, unauthenticated attacker sending crafted network requests, and Microsoft rates it as potentially leading to remote code execution with full confidentiality and integrity impact. The flaw affects the optional NFS server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 as well as Windows 10 1607 and 1809 builds below the patched revisions, so hosts that have never installed the Server for NFS feature are not exposed. No public exploit code has been identified and CISA SSVC records exploitation as 'none' and automatable as 'no', which is consistent with the CVSS UI:R requirement for user interaction; the high base score (8.8) alongside those low exploitation signals is a conflict that defenders should weigh when prioritising, with patched builds available from Microsoft.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
Heap corruption in the Microsoft Windows Shell allows an unauthenticated remote attacker to execute arbitrary code in the context of a user who opens or interacts with attacker-supplied Shell content, such as a crafted file, link, or shell item. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw is gated by mandatory user interaction and CISA's SSVC assessment records exploitation as 'none' and the attack as not automatable, so it is best suited to targeted social-engineering delivery rather than unattended mass exploitation; no public exploit identified at time of analysis. The affected build range is broad, covering Windows 10, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.
Remote code execution in Microsoft's Windows Routing and Remote Access Service (RRAS) lets a remote, unauthenticated attacker corrupt heap memory and execute code on affected hosts, though exploitation requires the victim to perform an action (UI:R) such as initiating or accepting a connection to attacker-controlled remote-access traffic. The Routing and Remote Access Service is an optional Windows role that is not installed by default, which sharply limits the exposed population to systems explicitly configured as VPN or dial-up servers. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as 'none'; Microsoft has released fixes, and all Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed revisions listed by EUVD are affected.
Privilege escalation in the Windows Bluetooth Service lets an attacker within Bluetooth radio range trigger a heap-based buffer overflow and gain full control over the confidentiality, integrity, and availability of the target host, as reflected in the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.8). No authentication and no user interaction are required; a reachable, Bluetooth-enabled endpoint in default configuration is sufficient, which makes this a genuinely serious but not emergency-tier issue because the flaw cannot be triggered over the internet or a routed network - CISA's SSVC decision framework accordingly rates it non-automatable with exploitation observed as none. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases.
Heap-based buffer overflow in Microsoft Excel (CWE-122) lets an unauthenticated attacker execute arbitrary code in the context of the victim's user account when that user opens a specially crafted spreadsheet; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) reflects full confidentiality, integrity and availability impact but is gated by mandatory user interaction. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows and Mac, Office 365 for Mac, and Office Online Server, so both endpoint document handling and server-side file rendering are in scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but with a vendor patch already published it is a high-priority patching candidate for environments that routinely open externally sourced Office files rather than a drop-everything emergency.
Unauthorized code execution in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x is achievable by remote attackers who get a user to run, import, or otherwise process attacker-controlled PowerShell content, because the product relies on untrusted input when making a security decision (CWE-807). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): network-reachable and unauthenticated in vector terms, but gated by a mandatory user-interaction prerequisite, so this is not a drive-by or unattended attack. SSVC records Exploitation:none and Automatable:no, and no public exploit identified at time of analysis; with Technical Impact:total, a successful trigger yields high confidentiality, integrity, and availability impact, but scope is limited to PowerShell 7.4.0 through 7.4.20, 7.5.0 through 7.5.11, and 7.6.0 through 7.6.6.
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code in the context of the victim user, but only if that user is convinced to open a specially crafted document (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected installations span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC 2021/2024 plus Office 365 for Mac, so both Windows and macOS environments are in scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory user interaction (UI:R) - together with Protected View and untrusted-document blocking - is the principal factor limiting real-world exposure; this is a credible prioritization candidate rather than a top-tier emergency on current signals. Microsoft has released vendor patches addressing the flaw.
Heap-based buffer overflow in OpenSSH for Windows can let an unauthenticated network attacker execute code, but the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and the independent assessment indicate the victim must initiate the vulnerable SSH operation, likely by using an affected Windows OpenSSH client against an attacker-controlled or compromised SSH server. Affected builds span Windows 10, Windows 11, and Windows Server 2019, 2022, and 2025 as enumerated in EUVD-2026-99587; Microsoft has released patched builds through the MSRC update guide. No public exploit identified at time of analysis, and CISA SSVC marks exploitation as none and Automatable as no, so risk is gated by user interaction and the need for the victim to connect to attacker-influenced infrastructure.
Heap-based buffer overflow in Microsoft SQL Server lets an authenticated attacker who holds any valid, low-privileged database login - and can reach the instance's listening port over the network - execute code in the context of the SQL Server service process, with high confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no user interaction). The vendor has released patched builds for SQL Server 2017, 2019, 2022 and 2025, and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible priority rather than an emergency. Because exploitation needs only ordinary credentials rather than sysadmin rights, the practical exposure is concentrated on instances reachable from untrusted networks and on estates where database logins are shared or weakly managed.
Code execution in the Windows Background Intelligent Transfer Service (BITS) lets a network-positioned attacker with low privileges trigger a use-after-free and run arbitrary code on unpatched Windows 10, Windows 11 and Windows Server systems. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so impact to confidentiality, integrity and availability is high but confined to the vulnerable host. No public exploit code and no active exploitation are confirmed at time of analysis (SSVC exploitation: none), and EPSS is modest at 0.49% (40th percentile), making this a serious but not emergency-grade issue that should be handled in the current patch cycle.
Arbitrary code execution in dataclasses-avroschema 0.38.0 through 0.70.5 occurs when the library's Avro-to-Python model generator processes a schema containing a fixed type whose 'aliases' value is a bare string instead of a list; the value is interpolated unquoted into a generated 'types.confixed' annotation and evaluated when the generated module is imported, giving an attacker code execution in the victim's Python process. Exploitation is unauthenticated from the network perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but gated on victim interaction: someone must run the schema-to-code generation path on attacker-controlled schema content and then import the resulting module. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a high-severity but precondition-gated code-injection flaw; the vendor released 0.70.6, which rejects non-list aliases.
Unauthenticated remote attackers can read portions of device memory or cause a denial-of-service condition in Siemens APOGEE MBC/MEC and PXC, and TALON TC building controllers through the embedded web service, due to improper length validation of user-controllable input (CWE-191 integer underflow). Affected versions include APOGEE PXC Compact/Modular (BACnet) before V3.5.7 and (P2 Ethernet) before V2.8.21, TALON TC Compact/Modular (BACnet) before V3.5.7, and all versions of APOGEE MBC and MEC. No public exploit has been identified at the time of analysis; the vendor has released patches for the PXC and TALON variants, but no fix is available for MBC/MEC.
Arbitrary Python code execution is possible in dataclasses-avroschema versions 0.65.9 through 0.70.5 when the library's Pydantic or AvroDantic model-generation path is run over an Avro schema the attacker controls: the schema field's 'doc' value is interpolated unescaped between the quotes of a generated pydantic.Field(description="...") argument, so a crafted quote can close the string and inject a Python expression that is evaluated when the generated class is defined (CWE-94). The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8), reflecting high confidentiality and integrity impact with user interaction required because a developer or build process must actively generate models from the malicious schema; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and urgency is further moderated because only the Pydantic/AvroDantic generators are affected and only versions 0.65.9-0.70.5 are vulnerable.
Missing authorization in Visual Studio Code lets a local attacker bypass a security feature once the victim opens attacker-controlled content, such as a crafted workspace, folder, or file, producing high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No pre-existing privileges or authentication are required, but exploitation demands local delivery of the malicious content plus mandatory user interaction, which rules out remote, unattended, or automated mass exploitation. No public exploit code has been identified at time of analysis, and the specific security feature being bypassed is not detailed in the available data and should be confirmed against the Microsoft MSRC advisory.