Monthly
FreeBSD's bhyve hypervisor contains a guest-to-host race condition and input-validation flaw in its framebuffer/VNC device model, allowing a guest with existing code execution to crash the bhyve process or potentially execute code in the host userspace context, subject to bhyve's Capsicum sandbox. Only VMs configured with the fbuf framebuffer/VNC device are exposed, affecting FreeBSD 14.4 before p11, 14.5 before p2, and 15.1 before p5, while headless or serial-only guests are not affected by this path. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring guest-level privilege and a difficult timing race, and no public exploit identified at time of analysis.
FreeBSD's bhyve hypervisor xHCI (USB 3) device model can be driven into a guest-to-host memory race by a malicious privileged guest: the emulated controller neither validates nor caches the guest-supplied event ring size, re-reading it from guest memory on each use, and loads Transfer Request Block (TRB) fields without guarding against concurrent modification by the guest. Winning that race (CVSS 3.1 AV:L/AC:H/PR:L) crashes the host-side bhyve process or potentially yields arbitrary code execution in the host userspace running the VM, bounded by bhyve's Capsicum sandbox. Exploitation requires an attacker who already controls privileged code inside a guest configured with the bhyve xHCI controller; no public exploit code was identified at time of analysis, and EPSS is low at 0.18% (7th percentile), making this a moderate, defense-in-depth priority rather than an urgent emergency.
Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvruserservice) allows an authenticated user who already holds low privileges and local access to the host to elevate to a higher integrity context on affected Windows 10, Windows 11, and Windows Server 2019 installations. Success depends on winning a narrow, non-deterministic race window between the freeing and reuse of an object (CWE-362, reflected in the CVSS vector as AC:H), so exploitation is unreliable and may require many repeated attempts, though a successful trigger yields high confidentiality, integrity, and availability impact on the vulnerable component. No public exploit code was identified and there is no confirmed active exploitation (the vulnerability is not in CISA KEV); Microsoft has released fixed builds through its monthly update channel.
Local privilege elevation in Windows Autopilot on Windows 11 (24H2, 25H2, 26H1, and 26H2) lets an authenticated low-privileged attacker who already holds a foothold on the machine exploit a race condition in an improperly synchronized shared provisioning resource and reach a high-integrity context, with high impact to confidentiality, integrity, and availability. Because the flaw is a race condition (AC:H), exploitation is non-deterministic and typically requires repeated attempts to hit a narrow timing window, but no user interaction is needed and the attack stays local (AV:L, PR:L). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and a vendor patch is available, making this a moderate-priority local elevation-of-privilege issue rather than an emergency.
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.
FreeBSD's bhyve hypervisor contains a guest-to-host race condition and input-validation flaw in its framebuffer/VNC device model, allowing a guest with existing code execution to crash the bhyve process or potentially execute code in the host userspace context, subject to bhyve's Capsicum sandbox. Only VMs configured with the fbuf framebuffer/VNC device are exposed, affecting FreeBSD 14.4 before p11, 14.5 before p2, and 15.1 before p5, while headless or serial-only guests are not affected by this path. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring guest-level privilege and a difficult timing race, and no public exploit identified at time of analysis.
FreeBSD's bhyve hypervisor xHCI (USB 3) device model can be driven into a guest-to-host memory race by a malicious privileged guest: the emulated controller neither validates nor caches the guest-supplied event ring size, re-reading it from guest memory on each use, and loads Transfer Request Block (TRB) fields without guarding against concurrent modification by the guest. Winning that race (CVSS 3.1 AV:L/AC:H/PR:L) crashes the host-side bhyve process or potentially yields arbitrary code execution in the host userspace running the VM, bounded by bhyve's Capsicum sandbox. Exploitation requires an attacker who already controls privileged code inside a guest configured with the bhyve xHCI controller; no public exploit code was identified at time of analysis, and EPSS is low at 0.18% (7th percentile), making this a moderate, defense-in-depth priority rather than an urgent emergency.
Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvruserservice) allows an authenticated user who already holds low privileges and local access to the host to elevate to a higher integrity context on affected Windows 10, Windows 11, and Windows Server 2019 installations. Success depends on winning a narrow, non-deterministic race window between the freeing and reuse of an object (CWE-362, reflected in the CVSS vector as AC:H), so exploitation is unreliable and may require many repeated attempts, though a successful trigger yields high confidentiality, integrity, and availability impact on the vulnerable component. No public exploit code was identified and there is no confirmed active exploitation (the vulnerability is not in CISA KEV); Microsoft has released fixed builds through its monthly update channel.
Local privilege elevation in Windows Autopilot on Windows 11 (24H2, 25H2, 26H1, and 26H2) lets an authenticated low-privileged attacker who already holds a foothold on the machine exploit a race condition in an improperly synchronized shared provisioning resource and reach a high-integrity context, with high impact to confidentiality, integrity, and availability. Because the flaw is a race condition (AC:H), exploitation is non-deterministic and typically requires repeated attempts to hit a narrow timing window, but no user interaction is needed and the attack stays local (AV:L, PR:L). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and a vendor patch is available, making this a moderate-priority local elevation-of-privilege issue rather than an emergency.
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.