Monthly
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.
Local privilege escalation to root in util-linux's libmount affects versions 2.17 through 2.41.6 and 2.42 through 2.42.3, and also 2.42.4 when the legacy mount(2) path is used without /proc available. A local, low-privileged user who is already authorized by an /etc/fstab entry carrying the user or users option can exploit a time-of-check/time-of-use race: libmount validates the fstab target path and then the mount operation re-resolves that pathname, so an attacker who controls a writable ancestor directory can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect the authorized mount to a root-owned location such as /etc/sudoers.d, gaining root. Exploitation is local only, requires the attacker to already hold an fstab mount authorization plus a writable ancestor on the configured target, and depends on winning the race (assessed AC:H), so it is non-deterministic; patched code paths using the new mount API (2.41.5 / 2.42.2 and later) or 2.42.4 with /proc present are not affected, and no public exploit identified at time of analysis.
Local privilege escalation in util-linux's SUID mount utility affects versions 2.39 through 2.41.4 and 2.42 through 2.42.1: a local, already-authorized low-privileged user can win a narrow timing race in the post-mount hook and redirect a privileged chmod()/lchown() onto a root-owned path, potentially obtaining root privileges. Exploitation requires a non-default /etc/fstab entry that combines the 'user' or 'users' mount option with an X-mount.mode, X-mount.owner, or X-mount.group option, plus write access to a writable ancestor directory of the mount target; the race itself is difficult (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released fixes in 2.41.5 and 2.42.2.
Local privilege escalation in the Microsoft MANA network driver for the Linux kernel lets an authenticated low-privilege user on the host raise privileges to kernel/root level by winning a time-of-check time-of-use race in the driver (CWE-367). The attack is strictly local (AV:L) and high-complexity (AC:H) because the race must be won, and it only applies where the MANA driver is present and loaded - in practice Azure-hosted or MANA-capable Linux systems that use it as the primary network path. A vendor-released patch is available per the Microsoft advisory; no public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV).
Local privilege escalation in Microsoft Office Click-To-Run (C2R) arises from a time-of-check time-of-use race condition in the installer/updater's file handling, letting an authorized low-privileged local user substitute attacker-controlled content in the window between validation and use and thereby gain higher privileges on the host. The flaw is rated CVSS 3.1 base 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is strictly local, requires a pre-existing authenticated session, needs no victim interaction, but is timing-dependent and therefore probabilistic - repeated attempts may be needed to win the race. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a privilege-escalation primitive for an attacker who already holds a local foothold rather than a remotely reachable or actively exploited issue. Deployments affected are Microsoft 365 Apps for Enterprise installed via Click-To-Run (reported as version 16.0.1).
Local privilege escalation in the Windows Servicing Stack Updates (SSU) component affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) built below their respective fixed build thresholds, letting an attacker who already holds authenticated local access win a time-of-check time-of-use race and gain high-integrity code execution, confidentiality, and availability impact (CVSS 7.0, CWE-367). The high attack complexity reflects a narrow timing window that must typically be hit through repeated, precisely timed attempts, and no user interaction is required, though the attacker must already be present on the host with low privileges (PR:L, AV:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched servicing stack via its update guide.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) allows unauthenticated network attackers to execute arbitrary code on affected Windows Server and Windows 10 hosts, though the narrow time-of-check/time-of-use race condition (CWE-367) makes reliable exploitation non-deterministic and difficult, as reflected by CVSS 8.1 with high attack complexity (AC:H). Affected builds include Windows Server 2025 before 10.0.26100.33650, Server 2019 before 10.0.17763.9376, Server 2016 and Windows 10 1607 before 10.0.14393.9612, Server 2022 before 10.0.20348.5761, and Server 2012/R2 before 6.2.9200.26434 and 6.3.9600.23470 respectively. No public exploit identified at time of analysis, and Microsoft has released patches.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege escalation in WSL2 allows an authenticated low-privileged user to gain elevated privileges by exploiting a time-of-check time-of-use race condition. Affected versions are 5.0.0.0 through 2.7.10, and a vendor patch is available. No public exploit code is identified, and the high attack complexity (requiring precise timing) makes reliable exploitation difficult, consistent with CISA SSVC marking it as not automatable.
Local privilege escalation in Microsoft Windows Print Spooler components allows an authenticated, low-privileged user with interactive access to a Windows host to elevate privileges by triggering a race condition in spooler object handling. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations; the vulnerable spooler service is present and normally running by default, so no unusual configuration is required to reach the flaw. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor-released patches are available per the MSRC advisory - this is a moderate-priority LPE rather than an urgent remote threat.
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.
Local privilege escalation to root in util-linux's libmount affects versions 2.17 through 2.41.6 and 2.42 through 2.42.3, and also 2.42.4 when the legacy mount(2) path is used without /proc available. A local, low-privileged user who is already authorized by an /etc/fstab entry carrying the user or users option can exploit a time-of-check/time-of-use race: libmount validates the fstab target path and then the mount operation re-resolves that pathname, so an attacker who controls a writable ancestor directory can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect the authorized mount to a root-owned location such as /etc/sudoers.d, gaining root. Exploitation is local only, requires the attacker to already hold an fstab mount authorization plus a writable ancestor on the configured target, and depends on winning the race (assessed AC:H), so it is non-deterministic; patched code paths using the new mount API (2.41.5 / 2.42.2 and later) or 2.42.4 with /proc present are not affected, and no public exploit identified at time of analysis.
Local privilege escalation in util-linux's SUID mount utility affects versions 2.39 through 2.41.4 and 2.42 through 2.42.1: a local, already-authorized low-privileged user can win a narrow timing race in the post-mount hook and redirect a privileged chmod()/lchown() onto a root-owned path, potentially obtaining root privileges. Exploitation requires a non-default /etc/fstab entry that combines the 'user' or 'users' mount option with an X-mount.mode, X-mount.owner, or X-mount.group option, plus write access to a writable ancestor directory of the mount target; the race itself is difficult (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released fixes in 2.41.5 and 2.42.2.
Local privilege escalation in the Microsoft MANA network driver for the Linux kernel lets an authenticated low-privilege user on the host raise privileges to kernel/root level by winning a time-of-check time-of-use race in the driver (CWE-367). The attack is strictly local (AV:L) and high-complexity (AC:H) because the race must be won, and it only applies where the MANA driver is present and loaded - in practice Azure-hosted or MANA-capable Linux systems that use it as the primary network path. A vendor-released patch is available per the Microsoft advisory; no public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV).
Local privilege escalation in Microsoft Office Click-To-Run (C2R) arises from a time-of-check time-of-use race condition in the installer/updater's file handling, letting an authorized low-privileged local user substitute attacker-controlled content in the window between validation and use and thereby gain higher privileges on the host. The flaw is rated CVSS 3.1 base 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is strictly local, requires a pre-existing authenticated session, needs no victim interaction, but is timing-dependent and therefore probabilistic - repeated attempts may be needed to win the race. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a privilege-escalation primitive for an attacker who already holds a local foothold rather than a remotely reachable or actively exploited issue. Deployments affected are Microsoft 365 Apps for Enterprise installed via Click-To-Run (reported as version 16.0.1).
Local privilege escalation in the Windows Servicing Stack Updates (SSU) component affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) built below their respective fixed build thresholds, letting an attacker who already holds authenticated local access win a time-of-check time-of-use race and gain high-integrity code execution, confidentiality, and availability impact (CVSS 7.0, CWE-367). The high attack complexity reflects a narrow timing window that must typically be hit through repeated, precisely timed attempts, and no user interaction is required, though the attacker must already be present on the host with low privileges (PR:L, AV:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched servicing stack via its update guide.
Remote code execution in the Windows Background Intelligent Transfer Service (BITS) allows unauthenticated network attackers to execute arbitrary code on affected Windows Server and Windows 10 hosts, though the narrow time-of-check/time-of-use race condition (CWE-367) makes reliable exploitation non-deterministic and difficult, as reflected by CVSS 8.1 with high attack complexity (AC:H). Affected builds include Windows Server 2025 before 10.0.26100.33650, Server 2019 before 10.0.17763.9376, Server 2016 and Windows 10 1607 before 10.0.14393.9612, Server 2022 before 10.0.20348.5761, and Server 2012/R2 before 6.2.9200.26434 and 6.3.9600.23470 respectively. No public exploit identified at time of analysis, and Microsoft has released patches.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege escalation in WSL2 allows an authenticated low-privileged user to gain elevated privileges by exploiting a time-of-check time-of-use race condition. Affected versions are 5.0.0.0 through 2.7.10, and a vendor patch is available. No public exploit code is identified, and the high attack complexity (requiring precise timing) makes reliable exploitation difficult, consistent with CISA SSVC marking it as not automatable.
Local privilege escalation in Microsoft Windows Print Spooler components allows an authenticated, low-privileged user with interactive access to a Windows host to elevate privileges by triggering a race condition in spooler object handling. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations; the vulnerable spooler service is present and normally running by default, so no unusual configuration is required to reach the flaw. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and vendor-released patches are available per the MSRC advisory - this is a moderate-priority LPE rather than an urgent remote threat.