Monthly
User-mode-to-kernel escape in Zephyr RTOS lets a local thread that holds a granted PECI device object turn peci_transfer() into arbitrary supervisor-mode read and write primitives. The syscall verifier z_vrfy_peci_transfer() validated only the outer struct peci_msg and then handed the caller-controlled tx_buffer/rx_buffer pointers and lengths to in-tree drivers (NPCX, IT8xxx2, MCHP XEC), which dereference them in supervisor mode - allowing kernel memory to be overwritten with hardware-supplied bytes, kernel contents to be pushed onto the PECI/eSPI bus, or a supervisor fault via an unmapped address. Scoring is CVSS 3.1 7.8 (AV:L/PR:L, C:H/I:H/A:H) and exploitation is gated on CONFIG_USERSPACE=y, an enabled vulnerable PECI driver, and local code execution in a thread already granted the PECI device; no public exploit code exists at time of analysis and there is no confirmed active exploitation (CISA KEV).
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated low-privileged user to elevate to a high-integrity level (e.g., SYSTEM) via an untrusted pointer dereference (CWE-822), achieving full confidentiality, integrity, and availability impact. Affected systems span a wide range of Windows client and server editions, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025. No public exploit code or active exploitation has been identified at the time of analysis, but a vendor patch is available.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Remote code execution in the Windows RPC Runtime is possible due to an untrusted pointer dereference (CWE-822) that can be triggered when a victim initiates or accepts an RPC connection to an attacker-controlled endpoint. Unauthenticated attackers on the network can exploit this with user interaction (CVSS 8.8, AV:N/AC:L/PR:N/UI:R), affecting a wide range of supported Windows client and server editions. No public exploit or active exploitation has been observed (SSVC Exploitation: none), but vendor patches are available.
Local privilege escalation in the Windows WebDAV component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to escalate to a higher-integrity context, with the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating total loss of confidentiality, integrity and availability and no further user interaction required. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations. Exploitation requires a pre-existing local foothold, making this an escalation primitive rather than an initial-access vector; CISA's SSVC assessment records exploitation as "none" and automatable as "no", and no public exploit code has been identified at time of analysis, so this is a plausible but not top-tier priority. A vendor patch is available from Microsoft via the MSRC Security Update Guide.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
User-mode-to-kernel escape in Zephyr RTOS lets a local thread that holds a granted PECI device object turn peci_transfer() into arbitrary supervisor-mode read and write primitives. The syscall verifier z_vrfy_peci_transfer() validated only the outer struct peci_msg and then handed the caller-controlled tx_buffer/rx_buffer pointers and lengths to in-tree drivers (NPCX, IT8xxx2, MCHP XEC), which dereference them in supervisor mode - allowing kernel memory to be overwritten with hardware-supplied bytes, kernel contents to be pushed onto the PECI/eSPI bus, or a supervisor fault via an unmapped address. Scoring is CVSS 3.1 7.8 (AV:L/PR:L, C:H/I:H/A:H) and exploitation is gated on CONFIG_USERSPACE=y, an enabled vulnerable PECI driver, and local code execution in a thread already granted the PECI device; no public exploit code exists at time of analysis and there is no confirmed active exploitation (CISA KEV).
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated low-privileged user to elevate to a high-integrity level (e.g., SYSTEM) via an untrusted pointer dereference (CWE-822), achieving full confidentiality, integrity, and availability impact. Affected systems span a wide range of Windows client and server editions, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025. No public exploit code or active exploitation has been identified at the time of analysis, but a vendor patch is available.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Remote code execution in the Windows RPC Runtime is possible due to an untrusted pointer dereference (CWE-822) that can be triggered when a victim initiates or accepts an RPC connection to an attacker-controlled endpoint. Unauthenticated attackers on the network can exploit this with user interaction (CVSS 8.8, AV:N/AC:L/PR:N/UI:R), affecting a wide range of supported Windows client and server editions. No public exploit or active exploitation has been observed (SSVC Exploitation: none), but vendor patches are available.
Local privilege escalation in the Windows WebDAV component allows an attacker who already holds a low-privileged, authenticated session on a Windows host to escalate to a higher-integrity context, with the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) indicating total loss of confidentiality, integrity and availability and no further user interaction required. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations. Exploitation requires a pre-existing local foothold, making this an escalation primitive rather than an initial-access vector; CISA's SSVC assessment records exploitation as "none" and automatable as "no", and no public exploit code has been identified at time of analysis, so this is a plausible but not top-tier priority. A vendor patch is available from Microsoft via the MSRC Security Update Guide.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.