Monthly
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in Windows Input System allows an authenticated low-privileged attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds through a CWE-843 type-confusion condition. The flaw requires local access and low privileges but no user interaction, and Microsoft has issued fixes; no public exploit code or active exploitation has been identified at time of analysis, with CISA SSVC recording exploitation as none.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
Local privilege escalation in Microsoft Windows allows an attacker who already holds a low-privileged, authenticated local session on a host to raise their privileges to SYSTEM by abusing a type-confusion flaw in the Ancillary Function Driver for WinSock (AFD.sys), which is loaded by default on every supported Windows release. The issue is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-843), so it is not remotely reachable and requires no user interaction - the only barrier is first obtaining local code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the affected population spans Windows 10, Windows 11, and Windows Server 2012 through 2025, making it a patch-priority item rather than an emergency.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (AFD.sys) lets an attacker who already has low-privileged local code execution on a host obtain elevated (SYSTEM) rights by triggering a type confusion in the kernel driver. The flaw carries CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning the attack is local-only, needs valid low-level credentials or prior code execution, and requires no user interaction; AFD.sys is loaded by default on every supported Windows edition, so no non-default configuration is needed to reach the vulnerable code. It affects a broad set of Windows 10/11 and Windows Server 2012-2025 builds below the patched levels in EUVD-2026-99199; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no. This is a genuine patch-priority item but not an emergency.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already holds low-level code execution on a host raise privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. The bug is a kernel type confusion (CWE-843) in an always-present, in-box WinSock component reachable by ordinary users through standard socket APIs, but exploitation is rated high-complexity (AV:L/AC:H/PR:L/UI:N) because a reliable trigger likely depends on winning a race or reaching a precise kernel object/memory state, which lowers real-world reliability. This is a genuine but moderate-priority local privilege-escalation issue: no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), while Microsoft has published fixes through its standard update channel.
Local privilege escalation in Windows SmartScreen allows an attacker who already holds a low-privileged interactive session on a Windows host to corrupt memory through a type-confusion condition and elevate to a higher-integrity context, with full loss of confidentiality, integrity, and availability if successful. Exploitation is local only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8): there is no remote or network vector, and the attacker must first establish code execution on the target before triggering the flaw. Microsoft has released fixes, and CISA's SSVC review rates exploitation as none observed and not automatable, so this is best treated as a manual post-compromise escalation step rather than a mass-exploitation threat; no public exploit code or KEV listing is associated with the CVE at time of analysis.
Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.
Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) lets an authenticated, low-privileged attacker who already has code execution on a target host elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, but a vendor patch is available and the EPSS-style urgency is driven by the breadth of default-installed, unpatched builds rather than by observed attacks.
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in Windows Input System allows an authenticated low-privileged attacker to elevate privileges on unpatched Windows 10, Windows 11, and Windows Server builds through a CWE-843 type-confusion condition. The flaw requires local access and low privileges but no user interaction, and Microsoft has issued fixes; no public exploit code or active exploitation has been identified at time of analysis, with CISA SSVC recording exploitation as none.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
Local privilege escalation in Microsoft Windows allows an attacker who already holds a low-privileged, authenticated local session on a host to raise their privileges to SYSTEM by abusing a type-confusion flaw in the Ancillary Function Driver for WinSock (AFD.sys), which is loaded by default on every supported Windows release. The issue is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-843), so it is not remotely reachable and requires no user interaction - the only barrier is first obtaining local code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the affected population spans Windows 10, Windows 11, and Windows Server 2012 through 2025, making it a patch-priority item rather than an emergency.
Local privilege escalation in Microsoft's Windows Ancillary Function Driver for WinSock (AFD.sys) lets an attacker who already has low-privileged local code execution on a host obtain elevated (SYSTEM) rights by triggering a type confusion in the kernel driver. The flaw carries CVSS 7.8 (AV:L/AC:L/PR:L/UI:N), meaning the attack is local-only, needs valid low-level credentials or prior code execution, and requires no user interaction; AFD.sys is loaded by default on every supported Windows edition, so no non-default configuration is needed to reach the vulnerable code. It affects a broad set of Windows 10/11 and Windows Server 2012-2025 builds below the patched levels in EUVD-2026-99199; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable set to no. This is a genuine patch-priority item but not an emergency.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authenticated attacker who already holds low-level code execution on a host raise privileges to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. The bug is a kernel type confusion (CWE-843) in an always-present, in-box WinSock component reachable by ordinary users through standard socket APIs, but exploitation is rated high-complexity (AV:L/AC:H/PR:L/UI:N) because a reliable trigger likely depends on winning a race or reaching a precise kernel object/memory state, which lowers real-world reliability. This is a genuine but moderate-priority local privilege-escalation issue: no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), while Microsoft has published fixes through its standard update channel.
Local privilege escalation in Windows SmartScreen allows an attacker who already holds a low-privileged interactive session on a Windows host to corrupt memory through a type-confusion condition and elevate to a higher-integrity context, with full loss of confidentiality, integrity, and availability if successful. Exploitation is local only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8): there is no remote or network vector, and the attacker must first establish code execution on the target before triggering the flaw. Microsoft has released fixes, and CISA's SSVC review rates exploitation as none observed and not automatable, so this is best treated as a manual post-compromise escalation step rather than a mass-exploitation threat; no public exploit code or KEV listing is associated with the CVE at time of analysis.
Local privilege escalation in Microsoft's Desktop Window Manager (dwm.exe) allows a low-privileged attacker who already has code execution on a Windows system to bring about a type-confusion condition and obtain elevated rights, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because DWM is present and running by default in every interactive Windows desktop session, no special feature or non-default configuration is required to reach the vulnerable code; only a locally executed crafted program is needed. This is a post-compromise escalation primitive rather than a remote entry point, no public exploit identified at time of analysis, and Microsoft's MSRC update-guide entry is the authoritative reference for affected builds and the fix.
Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) lets an authenticated, low-privileged attacker who already has code execution on a target host elevate to SYSTEM-level privileges. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025, including Server Core installations. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, but a vendor patch is available and the EPSS-style urgency is driven by the breadth of default-installed, unpatched builds rather than by observed attacks.