Buffer Overflow
Monthly
Local code execution in Microsoft Office is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122), granting the attacker full control over the victim's user session. The vulnerability spans the entire modern Office portfolio - Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, LTSC 2024, and macOS equivalents - making the attack surface exceptionally broad. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches for all affected product lines.
Heap-based buffer overflow in Microsoft Office Word enables arbitrary local code execution when a user opens a specially crafted document. The vulnerability spans a broad set of affected products across both Windows and macOS platforms, including Office LTSC 2021/2024, Office 2019, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Outlook 2016. No public exploit code has been identified at time of analysis, though Microsoft has released a patch and the document-based delivery model is a proven and widely abused attack vector in enterprise phishing campaigns.
Out-of-bounds read (CWE-125) in Microsoft Office enables local code execution across a broad range of Office product editions on both Windows and macOS. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms the attack requires no privileges but does require a victim to open a crafted file, consistent with a malicious document delivery scenario. A patch has been released by Microsoft; no public exploit code or CISA KEV listing has been identified at the time of analysis, though the full CIA impact (C:H/I:H/A:H) and breadth of affected products make this a high-priority patching target for enterprise environments.
Heap-based buffer overflow in Microsoft Office enables local code execution with high impact across confidentiality, integrity, and availability. Affecting Office 2016 through 2024, including LTSC and Microsoft 365 variants on both Windows and macOS, the vulnerability is triggered when a user opens a specially crafted document - requiring no privileges but mandatory user interaction (CVSS AV:L/UI:R). Patch is available from Microsoft; no public exploit identified at time of analysis.
Remote code execution in Microsoft Exchange Server stems from a heap-based buffer overflow (CWE-122) exploitable by any network-accessible authenticated user with low privileges. Affected versions span Exchange Server 2016 CU23, 2019 CU14 and CU15, and the Subscription Edition - all major currently-supported release lines. Vendor patches are available, and no public exploit identified at time of analysis, though the low attack complexity and full CIA impact make this a critical patching priority for enterprise Exchange deployments.
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.
Remote code execution in the Windows DNS component allows an unauthenticated network attacker to run arbitrary code by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Microsoft platforms from Windows 10 1607/1809 through Windows Server 2012 to Server 2025, including Server Core installations, and carries a CVSS 9.8 rating with no required privileges or user interaction. Microsoft has shipped fixes; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.
Privilege escalation via out-of-bounds read in the Windows Win32K kernel graphics subsystem affects every supported and extended-support Windows client and server release, from Windows Server 2012 through Windows 11 26H1. Any locally authenticated standard user - requiring no elevated permissions or user interaction - can exploit CWE-125 in win32k.sys to obtain SYSTEM-level privileges. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected builds across the Microsoft fleet makes this a broad patching priority regardless of active exploitation signals.
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Stack-based buffer overflow in Microsoft's Remote Desktop Client (mstsc.exe) enables remote code execution on unpatched Windows 10 1607 and Windows Server 2012/2016 systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no attacker privileges, but demands that a victim actively connect to an attacker-controlled RDP server - a meaningful but achievable social-engineering hurdle. Microsoft has released patches for all affected version branches; no public exploit identified at time of analysis.
Unauthenticated code execution in Windows DHCP Server allows an attacker positioned on an adjacent network segment to trigger a heap-based buffer overflow and achieve full system compromise. The vulnerability spans a wide range of Microsoft server and desktop platforms, from Windows Server 2012 through Windows Server 2025 and select Windows 10 builds, making it broadly relevant in Windows-centric enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-interaction exploitation profile and vendor-confirmed patch availability make this a high-priority patching candidate for any organization running Windows DHCP Server.
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS exposes a wide range of Windows Server and desktop systems to unauthenticated exploitation from adjacent network positions. Rooted in a CWE-787 out-of-bounds write triggered during DNS processing, the flaw carries a CVSS 8.8 score reflecting full confidentiality, integrity, and availability impact with no credentials or user interaction required. No public exploit identified at time of analysis, but a vendor-released patch is available and the broad affected version list - spanning Windows 10/11 and Server 2019 through 2025 - makes prioritized patching urgent for any environment where the DNS service is internet-edge or internally exposed.
Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.
Privilege escalation via heap-based buffer overflow in the Windows HTTP.sys kernel-mode driver affects Windows 11 (23H2 through 26H1) and Windows Server 2022/2025. An authenticated low-privileged local attacker can exploit this flaw to gain SYSTEM-level privileges on the target machine. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected Windows builds make this a significant patching priority for organizations running vulnerable versions.
Remote code execution in Windows SMB Server is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that low-privileged, network-accessible credentials are sufficient - no user interaction or elevated rights are required. The vulnerability affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, with vendor patches now available. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows SMB Client on Windows 11 version 26H1 enables a low-privileged authorized attacker to gain SYSTEM-level control via a heap-based buffer overflow (CWE-122). The CVSS 7.8 (High) score reflects low attack complexity and no user interaction required once local access is established, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch raising build to 10.0.28000.2704 is available from Microsoft.
Privilege escalation via heap-based buffer overflow in the Windows NTFS driver enables a local authenticated attacker with standard user rights to gain SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans a wide swath of the Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making the aggregate exposure significant. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) mean that a working exploit would be highly reliable once developed.
Remote code execution via a stack-based buffer overflow in the Windows kernel TCP/IP driver (CWE-121) affects all major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An unauthenticated remote attacker who can deliver crafted TCP/IP packets to an exposed system may gain kernel-level code execution without requiring user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, though the kernel-mode attack surface and network-accessible delivery make this a high-priority patching target; Microsoft has released patches for all affected platforms.
Remote code execution is achievable in Windows SMB Server via a heap-based buffer overflow exploitable by a low-privileged, authenticated network attacker. The vulnerability (CWE-122) spans a wide range of Microsoft Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released patches via the MSRC update guide; no KEV listing or public exploit code is present in the available intelligence at time of analysis.
Heap-based buffer overflow in the Windows LDAP client implementation enables remote code execution against any Windows system that initiates an LDAP connection to an attacker-controlled server. The vulnerability spans an exceptionally wide set of affected Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the potential attack surface very large. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/UI:R vector and high CIAlll impact make this a credible priority for patching.
Remote code execution in Microsoft's Local Security Authority Server (lsasrv) affects virtually every supported Windows client and server release, from Windows Server 2012 through Server 2025 and Windows 10 through Windows 11 26H1. The heap-based buffer overflow (CWE-122) is reachable over the network by any low-privileged authenticated attacker - aligning with the CVSS PR:L designation and the description's 'authorized attacker' language - enabling full system compromise. No public exploit identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation in the Windows Remote Access Connection Manager (RASMAN) service enables a low-privileged local attacker to achieve SYSTEM-level access through a heap-based buffer overflow. Affecting Windows 10 (from version 1809), Windows 11 (through version 26H1), Windows Server 2019 through Server 2025, this vulnerability requires only a valid local user account and no user interaction. Microsoft has released patches via MSRC; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote information disclosure in the Windows SMB Client affects every actively-supported Windows 10, Windows 11, and Windows Server release from 2016 through 2025, exposing potentially sensitive memory contents to unauthenticated network attackers via a CWE-125 out-of-bounds read (CVSS 7.5). The flaw resides in the SMB client stack and is triggered when a vulnerable Windows host processes a crafted response from an attacker-controlled SMB server, requiring no authentication or user interaction from the attacker's perspective. No public exploit has been identified at time of analysis and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the extraordinary breadth of affected products and the vendor-confirmed patch make this a standard patch-cycle priority.
Remote code execution via heap-based buffer overflow in the Windows RPC Runtime affects every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated remote attacker who can reach an exposed RPC endpoint can corrupt heap memory and achieve arbitrary code execution, yielding full confidentiality, integrity, and availability compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions, combined with network accessibility and no authentication requirement, elevates operational priority for internet-facing and laterally-reachable Windows infrastructure.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated local attacker to gain SYSTEM-level privileges on affected Windows 11 26H1 systems. The vulnerability is a heap-based buffer overflow in the kernel driver, exploitable by a low-privileged user without any user interaction. No public exploit has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
Heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (CldFlt.sys) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard user account with no user interaction and no special configuration - a reliable post-access escalation primitive. Microsoft has released patches; no public exploit code or CISA KEV listing is present in the provided data.
Privilege escalation via heap-based buffer overflow in Windows Shell affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. A locally authenticated, low-privileged attacker can trigger heap corruption within the Windows Shell component to achieve full SYSTEM-level code execution with no user interaction required and low attack complexity. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Windows Installer enables local privilege escalation across a wide range of Microsoft Windows desktop and server editions. An authenticated low-privileged local user can exploit the flaw (CWE-121) to achieve SYSTEM-level code execution, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and broad affected surface spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025 make this a high-priority patching target.
Privilege escalation via heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service affects virtually every current and legacy Windows release from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can overwrite heap memory to gain SYSTEM-level code execution on the target host without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; however, Microsoft has confirmed and patched the vulnerability through the MSRC update guide.
Stack-based buffer overflow in the Windows DHCP Client service enables a low-privileged local attacker to elevate privileges to SYSTEM level with full confidentiality, integrity, and availability impact. The flaw spans virtually every supported Windows desktop and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad in any environment where interactive or local logon access is possible. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches via the standard update guide.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem enables a locally authenticated attacker to elevate privileges to SYSTEM-level access across a broad range of Windows client and server releases. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact upon successful exploitation with low attack complexity once local access is established. Microsoft has released patches per MSRC advisory CVE-2026-62754; no public exploit code has been identified and the vulnerability has not appeared in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in Windows HTTP.sys enables a locally authenticated, low-privileged attacker to escalate privileges on the affected host, likely achieving SYSTEM-level control. The flaw spans a wide range of Windows versions from Server 2012 through Windows 11 26H1, representing substantial enterprise exposure despite requiring initial local access. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines via the MSRC advisory.
Privilege escalation via heap-based buffer overflow in Windows Kerberos affects the full breadth of supported Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025. An attacker holding a valid low-privilege local account can trigger a heap corruption condition in the Kerberos implementation to achieve complete confidentiality, integrity, and availability impact on the compromised host - effectively gaining SYSTEM-level control. Vendor-released patches with exact fixed build numbers are available via Microsoft MSRC; no public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Projected File System (ProjFS) via an integer overflow allows an authenticated local user to gain full SYSTEM-level control over the affected host. The flaw spans a wide range of actively supported Windows releases - from Windows 10 21H2 through Windows 11 26H1, and both Windows Server 2022 and 2025 - making it a broadly applicable post-compromise escalation primitive. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds addressing the vulnerability.
Windows Device Association Service contains a heap-based buffer overflow (CWE-122) that enables local privilege escalation on a broad swath of Windows client and server editions, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An attacker holding a standard low-privileged local account can exploit this flaw without any user interaction, achieving high impact across confidentiality, integrity, and availability - consistent with full SYSTEM-level compromise. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but Microsoft has released patches and the low attack complexity (AC:L) makes this a reliable privilege escalation primitive once local foothold is established.
Privilege escalation via integer underflow in Windows HTTP.sys (the kernel-mode HTTP protocol stack) allows an authenticated local attacker to gain SYSTEM-level access on a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. The flaw is rooted in an integer wraparound condition (tagged by the reporter as a heap overflow mechanism) in the HTTP.sys kernel driver, enabling full compromise of confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Privilege escalation via heap-based buffer overflow in Windows HTTP.sys affects a broad range of Windows 10, 11, and Windows Server releases. An attacker with low-level local access can exploit the CWE-122 flaw in the kernel-mode HTTP driver to achieve full system compromise - High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing this vulnerability across all affected version branches.
Privilege escalation via heap-based buffer overflow in the Windows DHCP Client affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing an authorized local attacker with low-level privileges to gain full SYSTEM-level control. The flaw carries a CVSS base score of 7.8 with high confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, though Microsoft has released patches covering all affected build ranges.
Privilege escalation via heap-based buffer overflow in Windows HTTP.sys (a kernel-mode HTTP listener driver) allows a locally authenticated low-privilege attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only local authenticated access with no user interaction and low attack complexity, making this a practical post-compromise escalation primitive. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Privilege escalation via an out-of-bounds read in the Windows Win32K kernel subsystem allows a local authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server versions. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects a low-complexity local attack with full C/I/A impact, meaning any low-privileged user or compromised process can exploit this to completely own the host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the 19 affected Windows SKUs spanning Server 2012 through Windows 11 26H1 make this a high-priority patch cycle item - particularly for Remote Desktop and terminal server deployments where untrusted local sessions are common.
Privilege escalation via heap-based buffer overflow in Windows Telephony Service (TAPI) affects virtually all supported Windows client and server builds, from legacy Server 2012 through current Windows 11 25H2 and Server 2025. An authorized local user with standard low-privilege credentials can trigger the heap overflow in tapisrv to achieve SYSTEM-level access. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patches are available across all 19 affected product SKUs per MSRC.
Privilege escalation via a time-of-check time-of-use (TOCTOU) race condition in the Windows Common Log File System (CLFS) Driver affects a broad range of Windows client and server versions from Server 2012 through Windows 11 25H2/26H1. A low-privileged local attacker can exploit the race window to gain SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available from Microsoft via the MSRC update guide.
Privilege escalation in the Windows Bind Filter Driver, a kernel-mode component present in Windows 11 and Windows Server 2025, stems from a heap-based buffer overflow that enables a locally authenticated user with standard privileges to gain SYSTEM-level control over the affected host. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core installations, with patched builds confirmed by Microsoft via MSRC advisory CVE-2026-62722. No public exploit has been identified at time of analysis, and the vulnerability has not been added to CISA's KEV catalog.
Privilege escalation via heap-based buffer overflow in Windows Message Queuing (MSMQ) allows a locally authenticated attacker with low privileges to gain SYSTEM-level access across a wide range of Microsoft Windows desktop and server editions. The flaw, classified as CWE-122, spans from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature update channels, making it broadly relevant in enterprise environments where MSMQ is deployed. Patch is available from Microsoft via the MSRC update guide; no public exploit or CISA KEV listing has been identified at the time of analysis.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to achieve full system compromise via a heap-based buffer overflow. Confirmed affected across a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 all versions. No public exploit identified at time of analysis and no CISA KEV listing; however, the low attack complexity combined with universal Windows platform coverage makes this a meaningful post-exploitation or insider-threat vector.
Privilege escalation via heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged local attacker to gain full SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans virtually all supported Windows versions, from Windows 10 1809 and Server 2019 through Windows 11 26H1 and Server 2025. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and broad platform coverage make this a credible post-exploitation privilege escalation primitive for threat actors who have already obtained a local foothold.
Privilege escalation in Windows Win32K via a heap-based buffer overflow enables a locally authenticated attacker to gain SYSTEM-level access across a broad range of Microsoft operating systems from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-122) requires only standard user privileges and no user interaction, making post-compromise escalation straightforward for any attacker who has already obtained local access. No public exploit has been identified at time of analysis, but the Microsoft Security Response Center has issued a patch and the wide affected product surface warrants urgent remediation.
Heap-based buffer overflow in the Windows Device Association Service allows a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server releases. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025, making this a high-coverage local privilege escalation. No public exploit identified at time of analysis, but vendor patches are available and should be applied immediately given the low attack complexity.
Privilege escalation via heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) affects virtually the entire Microsoft Windows product portfolio, from legacy Server 2012 through Windows 11 25H2 and Server 2025. A locally authenticated, low-privileged attacker can trigger memory corruption in ring-0 kernel space, resulting in full SYSTEM-level privilege acquisition on the target host. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches across all affected product lines via the MSRC update guide.
Windows Storage in multiple Windows 11 and Windows Server releases contains a heap-based buffer overflow that allows any locally authenticated low-privilege user to escalate to SYSTEM-level access with no user interaction required. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this is a straightforward, low-complexity privilege escalation once an attacker has a local foothold - covering Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025. Microsoft has released patches across all affected product lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Windows Remote Desktop Services stems from a heap-based buffer overflow (CWE-122) that an authorized local attacker can exploit to gain full SYSTEM-level control of the affected host. The vulnerability spans an exceptionally wide range of Microsoft Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the aggregate patch surface very large across enterprise fleets. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Privilege escalation via heap-based buffer overflow in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds. An attacker with an existing low-privileged local account can exploit this flaw to achieve full SYSTEM-level access, gaining high confidentiality, integrity, and availability impact with no user interaction required. No public exploit has been identified at time of analysis; Microsoft has released patches via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62688.
Local privilege escalation in Windows HTTP.sys enables authenticated local attackers to gain SYSTEM-level access across a sweeping range of Windows client and server releases, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An integer overflow in the kernel-mode HTTP driver triggers a heap-based buffer overflow (consistent with both the CWE-122 classification and the vendor-applied 'Heap Overflow' tag), allowing an attacker with an existing low-privilege local foothold to corrupt kernel heap structures and achieve full code execution as SYSTEM. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the extremely broad affected surface and low attack complexity make timely patching a high priority for enterprise environments.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables any standard authenticated local user to gain full SYSTEM-level control across a wide range of Windows 10, Windows 11, and Windows Server deployments. The vulnerability arises from a type confusion condition in the DWM Core Library - though the CWE-122 classification and vendor tags ('Heap Overflow', 'Buffer Overflow') indicate the confusion likely manifests through or triggers a heap-based memory corruption primitive. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Kernel (CWE-122) affects a broad span of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authenticated local attacker exploiting this flaw can gain SYSTEM-level privileges, achieving full control over confidentiality, integrity, and availability of the target system. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch is available.
Privilege escalation via heap-based buffer overflow in the Windows USB Driver (CWE-122) affects a broad range of Microsoft Windows client and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authenticated local attacker with low privileges can exploit this kernel-mode heap corruption to achieve full system compromise - gaining complete confidentiality, integrity, and availability over the affected host. Microsoft has released patches across all affected versions via the MSRC advisory; no public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Client component (CWE-125) exposes high-sensitivity memory contents to remote network attackers, enabling information disclosure across all supported Windows 10, Windows 11, and Windows Server 2012 through 2025 releases. The vulnerability carries a CVSS 7.5 base score with a network attack vector and no privilege requirement per the official vector, though SSVC classifies exploitation as not automatable and technical impact as partial, suggesting real-world exploitation is constrained by the need for a user to initiate an RDP connection to an attacker-controlled server. No public exploit code has been identified at time of analysis, EPSS places active exploitation probability at 0.85% (55th percentile), and a vendor-released patch is available via Microsoft MSRC.
Privilege escalation via heap-based buffer overflow in Windows Display Enhancement Service allows a local low-privileged attacker to gain SYSTEM-level control across a broad swath of Windows desktop and server releases. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes patching a meaningful operational priority.
Remote code memory disclosure in the Windows Remote Desktop Client (CWE-125) exposes sensitive process memory to an attacker operating a malicious or compromised RDP server. All major Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025 are affected, representing essentially the entire active Windows install base running an RDP client. Microsoft has released patches via the MSRC advisory; no public exploit code or CISA KEV listing exists at time of analysis, and SSVC rates exploitation status as none.
Remote code execution in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on a connecting client system by exploiting a heap-based buffer overflow triggered when the client processes a maliciously crafted RDP server response. All major Windows 10, Windows 11, and Windows Server editions from 2012 through 2025 are affected across x86, x64, and ARM64 architectures. No public exploit has been identified at time of analysis and CISA SSVC confirms no current exploitation; a vendor patch is available through the Microsoft Security Response Center.
Privilege escalation via heap-based buffer overflow in the Windows Storage subsystem affects a wide range of Windows 11 and Windows Server 2022/2025 builds. An attacker already holding a standard (low-privileged) local user account can exploit the memory corruption flaw to gain full SYSTEM-level control - no user interaction or elevated starting privileges required beyond basic logon. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this a credible post-access escalation primitive.
Heap-based buffer overflow in the Windows Sensor Data Service enables a locally authenticated, low-privileged attacker to fully compromise a target Windows system by escalating to SYSTEM-level privileges. Affecting Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across dozens of specific build ranges, exploitation requires no user interaction and low complexity once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, but SSVC classifies technical impact as total; Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Telephony Service (TAPISRV) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases spanning Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability carries a CVSS 7.8 score with low attack complexity, meaning exploitation is straightforward once local access is established, making it an effective second-stage tool in a broader attack chain. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected build lines.
Remote code execution in the Windows Remote Desktop Client exposes client machines across Windows 10, 11, and multiple Windows Server generations when connecting to an attacker-controlled RDP server. The heap-based buffer overflow (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) allows a remote unauthenticated attacker to gain full control over a vulnerable client machine, though the AC:H rating reflects non-trivial exploitation preconditions. Microsoft has released patches across all affected product lines; no active exploitation is confirmed per SSVC and the absence of a CISA KEV listing, with EPSS at 0.64% (47th percentile) indicating low near-term exploitation probability.
Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Heap-based buffer overflow in Microsoft Office Word enables local code execution with full user-level impact when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 (both Windows and Mac), and Office 365 for Mac. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.8 score and complete C/I/A impact triad reflect the severity of arbitrary code execution achievable through a standard phishing or malicious file delivery scenario.
Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.
Heap-based buffer overflow in Windows Imaging Component (WIC), Microsoft's built-in image processing framework, enables local code execution across virtually every supported Windows client and server release from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. The flaw is triggered when a user opens or previews a specially crafted image file, requiring no prior authentication or elevated privileges, and yields full confidentiality, integrity, and availability impact on the compromised system. Vendor-released patches are available via Microsoft's July 2026 update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows LUAFV (Layered User Access Filter Volume) kernel driver enables a locally authenticated, low-privileged user to escalate to full SYSTEM-level privileges across a wide range of Windows desktop and server releases. Microsoft has released patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with exact fix builds published via MSRC and ENISA EUVD-2026-56287. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H constraint limits opportunistic exploitation rather than eliminating risk from determined actors who already hold a foothold.
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.
Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.
Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from improper buffer restrictions (CWE-119) in the Ring 2 device driver layer, exploitable by an adjacent network attacker without authentication or user interaction. An attacker within Wi-Fi range or on the same network segment can trigger a driver-level crash by sending crafted wireless input, resulting in high availability impact on the target system and low availability impact on subsequent systems, with no confidentiality or integrity consequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in the kernel-mode (Ring 0) component of Intel PROSet/Wireless WiFi Software for Windows enables a denial-of-service condition against affected Windows hosts. An unauthenticated attacker with adjacent network access and the ability to satisfy specific attack requirements can trigger a kernel-level crash, resulting in high availability impact to both the vulnerable system and any subsequent system processes. No public exploit code has been identified at time of analysis, and this CVE has not been listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Heap buffer overflow in Vim's spell file parser prior to version 9.2.0846 enables arbitrary code execution when a user opens a maliciously crafted spell file. The flaw lies in set_sofo() reusing the sl_sal_first[] array without resetting values written by set_sal_first(), so a spell file ordering an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-controlled out-of-bounds heap writes (CWE-122). No public exploit has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; a vendor-released patch exists at version 9.2.0846.
Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence.
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when processing maliciously crafted NTFS images. Specifically affects deployments using the dead disk forensics workflow where Velociraptor ingests untrusted NTFS image files rather than live filesystems. An attacker who can supply a corrupted NTFS volume to a Velociraptor analyst can crash the tool, disrupting forensic investigations. No public exploit identified at time of analysis; patch available in version 0.77.2 and later.
Out-of-bounds read in Siemens Parasolid V38.0 and V38.1 allows code execution when a user opens a specially crafted X_T geometry file. The flaw (CWE-125) resides in the X_T file parser and can result in arbitrary code executing within the context of the host process - typically a CAD or PLM application embedding the Parasolid kernel. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 7.3 reflects the local attack vector and passive user interaction requirement that constrain opportunistic exploitation.
Out-of-bounds read during BMP file parsing in Siemens Simcenter Femap (all versions prior to V2606.0001) enables code execution within the context of the running process. An attacker must deliver a specially crafted BMP file and induce a local user to open it with the application. No public exploit or active exploitation has been identified at time of analysis, but the high CIA impact scores in the CVSS 4.0 vector confirm that successful exploitation achieves full process compromise.
Out-of-bounds read in Siemens Simcenter Femap's BMP file parser exposes all versions prior to V2606.0001 to code execution in the context of the running process. The flaw is triggered when a user opens a specially crafted BMP file, making it a classic file-format attack against a CAE/FEA desktop application. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality/integrity/availability impact and the availability of a vendor-confirmed patch make prompt upgrading advisable.
Local code execution in Microsoft Office is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122), granting the attacker full control over the victim's user session. The vulnerability spans the entire modern Office portfolio - Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, LTSC 2024, and macOS equivalents - making the attack surface exceptionally broad. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches for all affected product lines.
Heap-based buffer overflow in Microsoft Office Word enables arbitrary local code execution when a user opens a specially crafted document. The vulnerability spans a broad set of affected products across both Windows and macOS platforms, including Office LTSC 2021/2024, Office 2019, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Outlook 2016. No public exploit code has been identified at time of analysis, though Microsoft has released a patch and the document-based delivery model is a proven and widely abused attack vector in enterprise phishing campaigns.
Out-of-bounds read (CWE-125) in Microsoft Office enables local code execution across a broad range of Office product editions on both Windows and macOS. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms the attack requires no privileges but does require a victim to open a crafted file, consistent with a malicious document delivery scenario. A patch has been released by Microsoft; no public exploit code or CISA KEV listing has been identified at the time of analysis, though the full CIA impact (C:H/I:H/A:H) and breadth of affected products make this a high-priority patching target for enterprise environments.
Heap-based buffer overflow in Microsoft Office enables local code execution with high impact across confidentiality, integrity, and availability. Affecting Office 2016 through 2024, including LTSC and Microsoft 365 variants on both Windows and macOS, the vulnerability is triggered when a user opens a specially crafted document - requiring no privileges but mandatory user interaction (CVSS AV:L/UI:R). Patch is available from Microsoft; no public exploit identified at time of analysis.
Remote code execution in Microsoft Exchange Server stems from a heap-based buffer overflow (CWE-122) exploitable by any network-accessible authenticated user with low privileges. Affected versions span Exchange Server 2016 CU23, 2019 CU14 and CU15, and the Subscription Edition - all major currently-supported release lines. Vendor patches are available, and no public exploit identified at time of analysis, though the low attack complexity and full CIA impact make this a critical patching priority for enterprise Exchange deployments.
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process compromise (C:H/I:H/A:H) across a broad product surface spanning .NET Framework 3.5 through 4.8.1, .NET 8.0, 9.0, 10.0, and Visual Studio 2022 and 2026. An attacker who can deliver crafted input processed by a vulnerable .NET application can trigger arithmetic wraparound (CWE-190) to corrupt runtime memory and execute arbitrary code within the process context. Microsoft has released patches across all affected product lines; no public exploit identified at time of analysis, and no CISA KEV listing is present.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results from a heap-based buffer overflow triggered by an integer overflow or wraparound condition in the runtime's memory handling. An unprivileged local user who interacts with a crafted input - such as a malicious file processed by a .NET application - can exploit the flaw to gain elevated privileges on the host system. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available from Microsoft.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.
Remote code execution in the Windows DNS component allows an unauthenticated network attacker to run arbitrary code by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Microsoft platforms from Windows 10 1607/1809 through Windows Server 2012 to Server 2025, including Server Core installations, and carries a CVSS 9.8 rating with no required privileges or user interaction. Microsoft has shipped fixes; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.
Privilege escalation via out-of-bounds read in the Windows Win32K kernel graphics subsystem affects every supported and extended-support Windows client and server release, from Windows Server 2012 through Windows 11 26H1. Any locally authenticated standard user - requiring no elevated permissions or user interaction - can exploit CWE-125 in win32k.sys to obtain SYSTEM-level privileges. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected builds across the Microsoft fleet makes this a broad patching priority regardless of active exploitation signals.
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET release streams (8.0, 9.0, 10.0) and associated Visual Studio tooling. The flaw requires user interaction - consistent with a file-processing or input-parsing trigger - but no elevated privileges, meaning an attacker can exploit it by inducing a user to open or process a maliciously crafted artifact within a vulnerable .NET context. Full confidentiality, integrity, and availability compromise of the affected process is possible on successful exploitation. No public exploit identified at time of analysis and no CISA KEV listing; Microsoft has released patches across all affected branches.
Stack-based buffer overflow in Microsoft's Remote Desktop Client (mstsc.exe) enables remote code execution on unpatched Windows 10 1607 and Windows Server 2012/2016 systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no attacker privileges, but demands that a victim actively connect to an attacker-controlled RDP server - a meaningful but achievable social-engineering hurdle. Microsoft has released patches for all affected version branches; no public exploit identified at time of analysis.
Unauthenticated code execution in Windows DHCP Server allows an attacker positioned on an adjacent network segment to trigger a heap-based buffer overflow and achieve full system compromise. The vulnerability spans a wide range of Microsoft server and desktop platforms, from Windows Server 2012 through Windows Server 2025 and select Windows 10 builds, making it broadly relevant in Windows-centric enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-interaction exploitation profile and vendor-confirmed patch availability make this a high-priority patching candidate for any organization running Windows DHCP Server.
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS exposes a wide range of Windows Server and desktop systems to unauthenticated exploitation from adjacent network positions. Rooted in a CWE-787 out-of-bounds write triggered during DNS processing, the flaw carries a CVSS 8.8 score reflecting full confidentiality, integrity, and availability impact with no credentials or user interaction required. No public exploit identified at time of analysis, but a vendor-released patch is available and the broad affected version list - spanning Windows 10/11 and Server 2019 through 2025 - makes prioritized patching urgent for any environment where the DNS service is internet-edge or internally exposed.
Heap-based buffer overflow in the Windows Reliable Multicast Transport (RMCAST) kernel driver enables unauthenticated adjacent-network attackers to execute arbitrary code at kernel privilege level across a broad range of Windows desktop and server releases, from Server 2012 through Windows 11 version 26H1. The CVSS 8.8 rating reflects the zero-credential, zero-interaction exploitation path, constrained only by the requirement for network adjacency. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in the CISA KEV catalog; a vendor-released patch with confirmed fixed build numbers is available via Microsoft MSRC.
Privilege escalation via heap-based buffer overflow in the Windows HTTP.sys kernel-mode driver affects Windows 11 (23H2 through 26H1) and Windows Server 2022/2025. An authenticated low-privileged local attacker can exploit this flaw to gain SYSTEM-level privileges on the target machine. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected Windows builds make this a significant patching priority for organizations running vulnerable versions.
Remote code execution in Windows SMB Server is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that low-privileged, network-accessible credentials are sufficient - no user interaction or elevated rights are required. The vulnerability affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, with vendor patches now available. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows SMB Client on Windows 11 version 26H1 enables a low-privileged authorized attacker to gain SYSTEM-level control via a heap-based buffer overflow (CWE-122). The CVSS 7.8 (High) score reflects low attack complexity and no user interaction required once local access is established, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch raising build to 10.0.28000.2704 is available from Microsoft.
Privilege escalation via heap-based buffer overflow in the Windows NTFS driver enables a local authenticated attacker with standard user rights to gain SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans a wide swath of the Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making the aggregate exposure significant. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) mean that a working exploit would be highly reliable once developed.
Remote code execution via a stack-based buffer overflow in the Windows kernel TCP/IP driver (CWE-121) affects all major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An unauthenticated remote attacker who can deliver crafted TCP/IP packets to an exposed system may gain kernel-level code execution without requiring user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, though the kernel-mode attack surface and network-accessible delivery make this a high-priority patching target; Microsoft has released patches for all affected platforms.
Remote code execution is achievable in Windows SMB Server via a heap-based buffer overflow exploitable by a low-privileged, authenticated network attacker. The vulnerability (CWE-122) spans a wide range of Microsoft Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. Microsoft has released patches via the MSRC update guide; no KEV listing or public exploit code is present in the available intelligence at time of analysis.
Heap-based buffer overflow in the Windows LDAP client implementation enables remote code execution against any Windows system that initiates an LDAP connection to an attacker-controlled server. The vulnerability spans an exceptionally wide set of affected Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the potential attack surface very large. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/UI:R vector and high CIAlll impact make this a credible priority for patching.
Remote code execution in Microsoft's Local Security Authority Server (lsasrv) affects virtually every supported Windows client and server release, from Windows Server 2012 through Server 2025 and Windows 10 through Windows 11 26H1. The heap-based buffer overflow (CWE-122) is reachable over the network by any low-privileged authenticated attacker - aligning with the CVSS PR:L designation and the description's 'authorized attacker' language - enabling full system compromise. No public exploit identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation in the Windows Remote Access Connection Manager (RASMAN) service enables a low-privileged local attacker to achieve SYSTEM-level access through a heap-based buffer overflow. Affecting Windows 10 (from version 1809), Windows 11 (through version 26H1), Windows Server 2019 through Server 2025, this vulnerability requires only a valid local user account and no user interaction. Microsoft has released patches via MSRC; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote information disclosure in the Windows SMB Client affects every actively-supported Windows 10, Windows 11, and Windows Server release from 2016 through 2025, exposing potentially sensitive memory contents to unauthenticated network attackers via a CWE-125 out-of-bounds read (CVSS 7.5). The flaw resides in the SMB client stack and is triggered when a vulnerable Windows host processes a crafted response from an attacker-controlled SMB server, requiring no authentication or user interaction from the attacker's perspective. No public exploit has been identified at time of analysis and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, the extraordinary breadth of affected products and the vendor-confirmed patch make this a standard patch-cycle priority.
Remote code execution via heap-based buffer overflow in the Windows RPC Runtime affects every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated remote attacker who can reach an exposed RPC endpoint can corrupt heap memory and achieve arbitrary code execution, yielding full confidentiality, integrity, and availability compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions, combined with network accessibility and no authentication requirement, elevates operational priority for internet-facing and laterally-reachable Windows infrastructure.
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated local attacker to gain SYSTEM-level privileges on affected Windows 11 26H1 systems. The vulnerability is a heap-based buffer overflow in the kernel driver, exploitable by a low-privileged user without any user interaction. No public exploit has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
Heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (CldFlt.sys) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard user account with no user interaction and no special configuration - a reliable post-access escalation primitive. Microsoft has released patches; no public exploit code or CISA KEV listing is present in the provided data.
Privilege escalation via heap-based buffer overflow in Windows Shell affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. A locally authenticated, low-privileged attacker can trigger heap corruption within the Windows Shell component to achieve full SYSTEM-level code execution with no user interaction required and low attack complexity. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Windows Installer enables local privilege escalation across a wide range of Microsoft Windows desktop and server editions. An authenticated low-privileged local user can exploit the flaw (CWE-121) to achieve SYSTEM-level code execution, with full confidentiality, integrity, and availability impact on the compromised host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and broad affected surface spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025 make this a high-priority patching target.
Privilege escalation via heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service affects virtually every current and legacy Windows release from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can overwrite heap memory to gain SYSTEM-level code execution on the target host without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; however, Microsoft has confirmed and patched the vulnerability through the MSRC update guide.
Stack-based buffer overflow in the Windows DHCP Client service enables a low-privileged local attacker to elevate privileges to SYSTEM level with full confidentiality, integrity, and availability impact. The flaw spans virtually every supported Windows desktop and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad in any environment where interactive or local logon access is possible. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches via the standard update guide.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem enables a locally authenticated attacker to elevate privileges to SYSTEM-level access across a broad range of Windows client and server releases. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact upon successful exploitation with low attack complexity once local access is established. Microsoft has released patches per MSRC advisory CVE-2026-62754; no public exploit code has been identified and the vulnerability has not appeared in the CISA KEV catalog at time of analysis.
Heap-based buffer overflow in Windows HTTP.sys enables a locally authenticated, low-privileged attacker to escalate privileges on the affected host, likely achieving SYSTEM-level control. The flaw spans a wide range of Windows versions from Server 2012 through Windows 11 26H1, representing substantial enterprise exposure despite requiring initial local access. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines via the MSRC advisory.
Privilege escalation via heap-based buffer overflow in Windows Kerberos affects the full breadth of supported Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025. An attacker holding a valid low-privilege local account can trigger a heap corruption condition in the Kerberos implementation to achieve complete confidentiality, integrity, and availability impact on the compromised host - effectively gaining SYSTEM-level control. Vendor-released patches with exact fixed build numbers are available via Microsoft MSRC; no public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Projected File System (ProjFS) via an integer overflow allows an authenticated local user to gain full SYSTEM-level control over the affected host. The flaw spans a wide range of actively supported Windows releases - from Windows 10 21H2 through Windows 11 26H1, and both Windows Server 2022 and 2025 - making it a broadly applicable post-compromise escalation primitive. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds addressing the vulnerability.
Windows Device Association Service contains a heap-based buffer overflow (CWE-122) that enables local privilege escalation on a broad swath of Windows client and server editions, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An attacker holding a standard low-privileged local account can exploit this flaw without any user interaction, achieving high impact across confidentiality, integrity, and availability - consistent with full SYSTEM-level compromise. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but Microsoft has released patches and the low attack complexity (AC:L) makes this a reliable privilege escalation primitive once local foothold is established.
Privilege escalation via integer underflow in Windows HTTP.sys (the kernel-mode HTTP protocol stack) allows an authenticated local attacker to gain SYSTEM-level access on a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. The flaw is rooted in an integer wraparound condition (tagged by the reporter as a heap overflow mechanism) in the HTTP.sys kernel driver, enabling full compromise of confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Privilege escalation via heap-based buffer overflow in Windows HTTP.sys affects a broad range of Windows 10, 11, and Windows Server releases. An attacker with low-level local access can exploit the CWE-122 flaw in the kernel-mode HTTP driver to achieve full system compromise - High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing this vulnerability across all affected version branches.
Privilege escalation via heap-based buffer overflow in the Windows DHCP Client affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing an authorized local attacker with low-level privileges to gain full SYSTEM-level control. The flaw carries a CVSS base score of 7.8 with high confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, though Microsoft has released patches covering all affected build ranges.
Privilege escalation via heap-based buffer overflow in Windows HTTP.sys (a kernel-mode HTTP listener driver) allows a locally authenticated low-privilege attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only local authenticated access with no user interaction and low attack complexity, making this a practical post-compromise escalation primitive. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Privilege escalation via an out-of-bounds read in the Windows Win32K kernel subsystem allows a local authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server versions. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects a low-complexity local attack with full C/I/A impact, meaning any low-privileged user or compromised process can exploit this to completely own the host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the 19 affected Windows SKUs spanning Server 2012 through Windows 11 26H1 make this a high-priority patch cycle item - particularly for Remote Desktop and terminal server deployments where untrusted local sessions are common.
Privilege escalation via heap-based buffer overflow in Windows Telephony Service (TAPI) affects virtually all supported Windows client and server builds, from legacy Server 2012 through current Windows 11 25H2 and Server 2025. An authorized local user with standard low-privilege credentials can trigger the heap overflow in tapisrv to achieve SYSTEM-level access. No public exploit or CISA KEV listing exists at time of analysis; vendor-released patches are available across all 19 affected product SKUs per MSRC.
Privilege escalation via a time-of-check time-of-use (TOCTOU) race condition in the Windows Common Log File System (CLFS) Driver affects a broad range of Windows client and server versions from Server 2012 through Windows 11 25H2/26H1. A low-privileged local attacker can exploit the race window to gain SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available from Microsoft via the MSRC update guide.
Privilege escalation in the Windows Bind Filter Driver, a kernel-mode component present in Windows 11 and Windows Server 2025, stems from a heap-based buffer overflow that enables a locally authenticated user with standard privileges to gain SYSTEM-level control over the affected host. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core installations, with patched builds confirmed by Microsoft via MSRC advisory CVE-2026-62722. No public exploit has been identified at time of analysis, and the vulnerability has not been added to CISA's KEV catalog.
Privilege escalation via heap-based buffer overflow in Windows Message Queuing (MSMQ) allows a locally authenticated attacker with low privileges to gain SYSTEM-level access across a wide range of Microsoft Windows desktop and server editions. The flaw, classified as CWE-122, spans from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature update channels, making it broadly relevant in enterprise environments where MSMQ is deployed. Patch is available from Microsoft via the MSRC update guide; no public exploit or CISA KEV listing has been identified at the time of analysis.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to achieve full system compromise via a heap-based buffer overflow. Confirmed affected across a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 all versions. No public exploit identified at time of analysis and no CISA KEV listing; however, the low attack complexity combined with universal Windows platform coverage makes this a meaningful post-exploitation or insider-threat vector.
Privilege escalation via heap-based buffer overflow in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged local attacker to gain full SYSTEM-level control on affected Windows endpoints and servers. The vulnerability spans virtually all supported Windows versions, from Windows 10 1809 and Server 2019 through Windows 11 26H1 and Server 2025. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity (AC:L) and broad platform coverage make this a credible post-exploitation privilege escalation primitive for threat actors who have already obtained a local foothold.
Privilege escalation in Windows Win32K via a heap-based buffer overflow enables a locally authenticated attacker to gain SYSTEM-level access across a broad range of Microsoft operating systems from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-122) requires only standard user privileges and no user interaction, making post-compromise escalation straightforward for any attacker who has already obtained local access. No public exploit has been identified at time of analysis, but the Microsoft Security Response Center has issued a patch and the wide affected product surface warrants urgent remediation.
Heap-based buffer overflow in the Windows Device Association Service allows a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server releases. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025, making this a high-coverage local privilege escalation. No public exploit identified at time of analysis, but vendor patches are available and should be applied immediately given the low attack complexity.
Privilege escalation via heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) affects virtually the entire Microsoft Windows product portfolio, from legacy Server 2012 through Windows 11 25H2 and Server 2025. A locally authenticated, low-privileged attacker can trigger memory corruption in ring-0 kernel space, resulting in full SYSTEM-level privilege acquisition on the target host. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches across all affected product lines via the MSRC update guide.
Windows Storage in multiple Windows 11 and Windows Server releases contains a heap-based buffer overflow that allows any locally authenticated low-privilege user to escalate to SYSTEM-level access with no user interaction required. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms this is a straightforward, low-complexity privilege escalation once an attacker has a local foothold - covering Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025. Microsoft has released patches across all affected product lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Windows Remote Desktop Services stems from a heap-based buffer overflow (CWE-122) that an authorized local attacker can exploit to gain full SYSTEM-level control of the affected host. The vulnerability spans an exceptionally wide range of Microsoft Windows versions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the aggregate patch surface very large across enterprise fleets. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Privilege escalation via heap-based buffer overflow in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds. An attacker with an existing low-privileged local account can exploit this flaw to achieve full SYSTEM-level access, gaining high confidentiality, integrity, and availability impact with no user interaction required. No public exploit has been identified at time of analysis; Microsoft has released patches via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62688.
Local privilege escalation in Windows HTTP.sys enables authenticated local attackers to gain SYSTEM-level access across a sweeping range of Windows client and server releases, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An integer overflow in the kernel-mode HTTP driver triggers a heap-based buffer overflow (consistent with both the CWE-122 classification and the vendor-applied 'Heap Overflow' tag), allowing an attacker with an existing low-privilege local foothold to corrupt kernel heap structures and achieve full code execution as SYSTEM. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the extremely broad affected surface and low attack complexity make timely patching a high priority for enterprise environments.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables any standard authenticated local user to gain full SYSTEM-level control across a wide range of Windows 10, Windows 11, and Windows Server deployments. The vulnerability arises from a type confusion condition in the DWM Core Library - though the CWE-122 classification and vendor tags ('Heap Overflow', 'Buffer Overflow') indicate the confusion likely manifests through or triggers a heap-based memory corruption primitive. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Kernel (CWE-122) affects a broad span of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authenticated local attacker exploiting this flaw can gain SYSTEM-level privileges, achieving full control over confidentiality, integrity, and availability of the target system. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch is available.
Privilege escalation via heap-based buffer overflow in the Windows USB Driver (CWE-122) affects a broad range of Microsoft Windows client and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authenticated local attacker with low privileges can exploit this kernel-mode heap corruption to achieve full system compromise - gaining complete confidentiality, integrity, and availability over the affected host. Microsoft has released patches across all affected versions via the MSRC advisory; no public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Client component (CWE-125) exposes high-sensitivity memory contents to remote network attackers, enabling information disclosure across all supported Windows 10, Windows 11, and Windows Server 2012 through 2025 releases. The vulnerability carries a CVSS 7.5 base score with a network attack vector and no privilege requirement per the official vector, though SSVC classifies exploitation as not automatable and technical impact as partial, suggesting real-world exploitation is constrained by the need for a user to initiate an RDP connection to an attacker-controlled server. No public exploit code has been identified at time of analysis, EPSS places active exploitation probability at 0.85% (55th percentile), and a vendor-released patch is available via Microsoft MSRC.
Privilege escalation via heap-based buffer overflow in Windows Display Enhancement Service allows a local low-privileged attacker to gain SYSTEM-level control across a broad swath of Windows desktop and server releases. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes patching a meaningful operational priority.
Remote code memory disclosure in the Windows Remote Desktop Client (CWE-125) exposes sensitive process memory to an attacker operating a malicious or compromised RDP server. All major Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025 are affected, representing essentially the entire active Windows install base running an RDP client. Microsoft has released patches via the MSRC advisory; no public exploit code or CISA KEV listing exists at time of analysis, and SSVC rates exploitation status as none.
Remote code execution in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on a connecting client system by exploiting a heap-based buffer overflow triggered when the client processes a maliciously crafted RDP server response. All major Windows 10, Windows 11, and Windows Server editions from 2012 through 2025 are affected across x86, x64, and ARM64 architectures. No public exploit has been identified at time of analysis and CISA SSVC confirms no current exploitation; a vendor patch is available through the Microsoft Security Response Center.
Privilege escalation via heap-based buffer overflow in the Windows Storage subsystem affects a wide range of Windows 11 and Windows Server 2022/2025 builds. An attacker already holding a standard (low-privileged) local user account can exploit the memory corruption flaw to gain full SYSTEM-level control - no user interaction or elevated starting privileges required beyond basic logon. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this a credible post-access escalation primitive.
Heap-based buffer overflow in the Windows Sensor Data Service enables a locally authenticated, low-privileged attacker to fully compromise a target Windows system by escalating to SYSTEM-level privileges. Affecting Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across dozens of specific build ranges, exploitation requires no user interaction and low complexity once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, but SSVC classifies technical impact as total; Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Telephony Service (TAPISRV) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases spanning Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability carries a CVSS 7.8 score with low attack complexity, meaning exploitation is straightforward once local access is established, making it an effective second-stage tool in a broader attack chain. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected build lines.
Remote code execution in the Windows Remote Desktop Client exposes client machines across Windows 10, 11, and multiple Windows Server generations when connecting to an attacker-controlled RDP server. The heap-based buffer overflow (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) allows a remote unauthenticated attacker to gain full control over a vulnerable client machine, though the AC:H rating reflects non-trivial exploitation preconditions. Microsoft has released patches across all affected product lines; no active exploitation is confirmed per SSVC and the absence of a CISA KEV listing, with EPSS at 0.64% (47th percentile) indicating low near-term exploitation probability.
Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Heap-based buffer overflow in Microsoft Office Word enables local code execution with full user-level impact when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 (both Windows and Mac), and Office 365 for Mac. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.8 score and complete C/I/A impact triad reflect the severity of arbitrary code execution achievable through a standard phishing or malicious file delivery scenario.
Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.
Heap-based buffer overflow in Windows Imaging Component (WIC), Microsoft's built-in image processing framework, enables local code execution across virtually every supported Windows client and server release from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. The flaw is triggered when a user opens or previews a specially crafted image file, requiring no prior authentication or elevated privileges, and yields full confidentiality, integrity, and availability impact on the compromised system. Vendor-released patches are available via Microsoft's July 2026 update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows LUAFV (Layered User Access Filter Volume) kernel driver enables a locally authenticated, low-privileged user to escalate to full SYSTEM-level privileges across a wide range of Windows desktop and server releases. Microsoft has released patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with exact fix builds published via MSRC and ENISA EUVD-2026-56287. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H constraint limits opportunistic exploitation rather than eliminating risk from determined actors who already hold a foothold.
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.
Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.
Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from improper buffer restrictions (CWE-119) in the Ring 2 device driver layer, exploitable by an adjacent network attacker without authentication or user interaction. An attacker within Wi-Fi range or on the same network segment can trigger a driver-level crash by sending crafted wireless input, resulting in high availability impact on the target system and low availability impact on subsequent systems, with no confidentiality or integrity consequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in the kernel-mode (Ring 0) component of Intel PROSet/Wireless WiFi Software for Windows enables a denial-of-service condition against affected Windows hosts. An unauthenticated attacker with adjacent network access and the ability to satisfy specific attack requirements can trigger a kernel-level crash, resulting in high availability impact to both the vulnerable system and any subsequent system processes. No public exploit code has been identified at time of analysis, and this CVE has not been listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Heap buffer overflow in Vim's spell file parser prior to version 9.2.0846 enables arbitrary code execution when a user opens a maliciously crafted spell file. The flaw lies in set_sofo() reusing the sl_sal_first[] array without resetting values written by set_sal_first(), so a spell file ordering an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-controlled out-of-bounds heap writes (CWE-122). No public exploit has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog; a vendor-released patch exists at version 9.2.0846.
Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence.
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when processing maliciously crafted NTFS images. Specifically affects deployments using the dead disk forensics workflow where Velociraptor ingests untrusted NTFS image files rather than live filesystems. An attacker who can supply a corrupted NTFS volume to a Velociraptor analyst can crash the tool, disrupting forensic investigations. No public exploit identified at time of analysis; patch available in version 0.77.2 and later.
Out-of-bounds read in Siemens Parasolid V38.0 and V38.1 allows code execution when a user opens a specially crafted X_T geometry file. The flaw (CWE-125) resides in the X_T file parser and can result in arbitrary code executing within the context of the host process - typically a CAD or PLM application embedding the Parasolid kernel. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 7.3 reflects the local attack vector and passive user interaction requirement that constrain opportunistic exploitation.
Out-of-bounds read during BMP file parsing in Siemens Simcenter Femap (all versions prior to V2606.0001) enables code execution within the context of the running process. An attacker must deliver a specially crafted BMP file and induce a local user to open it with the application. No public exploit or active exploitation has been identified at time of analysis, but the high CIA impact scores in the CVSS 4.0 vector confirm that successful exploitation achieves full process compromise.
Out-of-bounds read in Siemens Simcenter Femap's BMP file parser exposes all versions prior to V2606.0001 to code execution in the context of the running process. The flaw is triggered when a user opens a specially crafted BMP file, making it a classic file-format attack against a CAE/FEA desktop application. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality/integrity/availability impact and the availability of a vendor-confirmed patch make prompt upgrading advisable.