Buffer Overflow
Monthly
Heap-based buffer overflow in Microsoft Office Excel enables local code execution across all major Office release tracks when a victim opens a maliciously crafted spreadsheet file. The vulnerability is rooted in improper heap memory management during Excel's file parsing routines (CWE-122), resulting in full compromise of confidentiality, integrity, and availability on the victim system. No public exploit code has been identified at time of analysis, but the breadth of affected versions - spanning Office 2016 through Microsoft 365 and Mac variants - makes this a high-priority patch target for enterprise environments.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver enables a local attacker already holding administrator-level privileges to execute arbitrary code with scope change - meaning successful exploitation can affect components beyond the vulnerable driver itself, most critically the Hyper-V hypervisor or co-hosted VMs. The flaw spans virtually all supported Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. Vendor-released patches are available via Microsoft MSRC; no public exploit identified at time of analysis.
Privilege escalation via heap-based buffer overflow (CWE-122) in Windows Hello affects Windows 10, Windows 11, and Windows Server 2019 across numerous build versions, allowing an authorized local attacker with high privileges to cross a security boundary and achieve full system compromise. The CVSS scope-change indicator (S:C) combined with C:H/I:H/A:H signals the overflow can propagate impact beyond the vulnerable Windows Hello component into other security principals - consistent with an admin-to-SYSTEM or authentication-subsystem boundary crossing. No public exploit or CISA KEV listing is present at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in the Microsoft Windows Codecs Library HEIF Image Extension (versions 1.0.0.0 through 1.2.48.0) enables local code execution with full compromise of confidentiality, integrity, and availability on the affected system. Exploitation requires the victim to open or preview a maliciously crafted HEIF image file, making this vulnerability well-suited for file-based social engineering campaigns. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-supplied patch raising the component to version 1.2.48.0 is available.
Heap-based buffer overflow in Microsoft's Web Media Extensions component of the Windows Codecs Library allows an unauthenticated remote attacker to achieve arbitrary code execution by delivering a specially crafted media file. The EUVD identifies all versions from 1.0.0.0 through pre-1.2.42.0 as affected. Exploitation requires a user to interact with attacker-controlled media content - for example, opening a file or visiting a page that triggers media playback - after which the heap overflow can yield full C/I/A compromise of the user's session. No public exploit or active exploitation is identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables unauthenticated remote attackers to achieve arbitrary code execution at the privilege level of the target user. The vulnerability (CWE-122) is triggered when a victim opens a specially crafted Word document, covering Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise across both Windows and Mac platforms. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the broad product coverage and high CVSS of 8.8 make this a priority patching target.
Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) allows remote code execution on a victim's machine when the user connects to an attacker-controlled RDP server. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms full confidentiality, integrity, and availability impact at low attack complexity, constrained only by the requirement that the victim actively initiate the connection. Vendor patch has been released and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Work Folders synchronization component allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across Windows 10 and Windows 11. The vulnerability (CWE-122) stems from improper bounds checking in a privileged Work Folders process and requires only a standard user account with no secondary user interaction. Microsoft has released cumulative updates addressing the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through 1.2.7279.0 exclusive) allows a remote unauthenticated attacker to execute arbitrary code on the client machine when a user connects to an attacker-controlled or compromised RDP server. The flaw carries a CVSS 8.8 with full C/I/A impact, requiring only that the victim initiate an RDP session. No public exploit identified at time of analysis, and a vendor-released patch is available at version 1.2.7279.0.
Remote code execution in Microsoft Office Word via a heap-based buffer overflow (CWE-122) allows an unauthenticated network attacker to fully compromise a victim system upon opening a crafted document. All major Office licensing tracks are affected on both Windows and macOS, spanning Office 2016 through Microsoft 365 Apps for Enterprise. No CISA KEV listing or public exploit code is referenced in available data, but the low-complexity, no-privileges-required vector with full confidentiality, integrity, and availability impact makes this a critical priority for enterprise patch cycles.
Out-of-bounds write (CWE-787) in multiple Microsoft Office versions enables remote code execution when a victim opens a specially crafted Office document. The vulnerability affects a broad matrix of products spanning Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and their Mac counterparts, covering virtually the entire modern Office product line. Vendor patches have been released via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis, but the network-deliverable, low-complexity nature and full C/I/A impact make this a high-priority patching target.
Heap-based buffer overflow in Microsoft Office Word's document parsing engine enables remote unauthenticated attackers to execute arbitrary code on target systems when a user opens a specially crafted document. The vulnerability affects a wide range of Microsoft Office releases - Word 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - making the attack surface extremely broad. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis, though UI:R interaction remains the sole barrier to exploitation.
Out-of-bounds read in Microsoft Office Excel enables remote code execution when a victim opens a crafted Excel workbook, achieving full C/I/A compromise on the target system. The vulnerability spans every major Office product line from Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS. Vendor-released patches are available for all Windows product lines with specific fixed builds enumerated; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables remote unauthenticated code execution when a victim opens a specially crafted document. Affects the full breadth of Office deployments - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Word 2016, and their Mac equivalents - making the attack surface extremely wide. No public exploit identified at time of analysis, but the CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) with full C/I/A impact places this firmly in priority patching territory for enterprise environments.
Heap-based buffer overflow in Microsoft Word's document-parsing engine, arising from a numeric truncation error, enables remote code execution when a user opens a specially crafted Word document. The flaw spans a wide matrix of Office SKUs on both Windows and Mac - including Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - and carries CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting full compromise with the only friction being the required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the ubiquity of the Office install base makes this a high-priority patching target.
Remote code execution in Microsoft Office Word exposes virtually every Windows and macOS Office release channel - Word 2016, Office 2019, LTSC 2021/2024, 365 Apps for Enterprise, and Office for Mac - to full system compromise via a specially crafted document. The heap-based buffer overflow (CWE-122) fires during document parsing with no authentication required from the attacker, only standard user interaction to open the malicious file, yielding C:H/I:H/A:H impact under a low-complexity attack path. Microsoft has issued patches across all Windows release branches and flags macOS editions as affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow (CWE-122) that a remote attacker can trigger to run arbitrary code with the victim's privileges. It affects a broad set of Office builds including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and the macOS Office editions. Microsoft has released a patch; no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft Office Outlook stems from a heap-based buffer overflow (CWE-122) that lets an unauthenticated network attacker run arbitrary code, per Microsoft's MSRC advisory and CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Word 2016, and Office for Mac builds; Microsoft has released fixed builds. No public exploit identified at time of analysis, but the critical severity and no-interaction network vector make it a high patch priority.
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code on a victim's system when the victim opens a specially crafted Office document. Multiple product lines are affected, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and Mac variants of each. With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, this is a high-severity code execution path; no public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Stack-based buffer overflow (CWE-121) in Microsoft Office Word enables a remote unauthenticated attacker to execute arbitrary code on a victim's machine by delivering a specially crafted Word document and inducing the target to open it. The vulnerability spans a wide swath of Office product lines - from Word 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise - on both Windows and macOS platforms. Microsoft has released patches across Windows product lines; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Microsoft SQL Server 2022 enables an authenticated low-privileged network attacker to execute arbitrary code on the database server host. Both the GDR and CU 26 servicing branches of SQL Server 2022 are affected, with Microsoft having released fixed builds in both channels. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and full network reachability make this a high-priority patching target for any organization running SQL Server 2022.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
Heap-based buffer overflow in the Windows OLE DB component of Microsoft SQL Server 2017 and 2019 enables a network-adjacent unauthenticated attacker to achieve remote code execution when a user interacts with a malicious OLE DB data source. The vulnerability (CWE-122, CVSS 8.8) affects multiple servicing branches across both SQL Server versions, covering both Cumulative Update and General Distribution Release tracks. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected branches.
Stack-based buffer overflow in Microsoft Graphics Component enables remote code execution when a victim opens a specially crafted file containing malicious graphics content. Affected products include Microsoft Office LTSC for Mac 2021 and 2024, Microsoft 365 for Mac, and Microsoft Office for Android prior to 16.0.20430.20000. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects no privilege requirements on the target system and network-accessible delivery, though user interaction - opening a malicious document - is required. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable via a heap-based buffer overflow triggered when a victim opens a specially crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates unauthenticated network-reachable exploitation requiring only that the target developer open an attacker-supplied artifact - a realistic social-engineering scenario in development environments. Full compromise of confidentiality, integrity, and availability of the victim's system is possible upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable by unauthenticated network-reachable attackers via a heap-based buffer overflow in the IDE, though user interaction is required to trigger the flaw. The CVSS score of 8.8 reflects the high impact potential - full compromise of confidentiality, integrity, and availability - moderated only by the need for a developer to open or process a crafted file. A vendor patch has been released; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow (CWE-122) in multiple Microsoft Office versions enables remote code execution when a victim opens a specially crafted document. The CVSS vector (AV:N/AC:H/PR:N/UI:R) confirms network-based delivery without attacker authentication, but exploitation requires high attack complexity and active user interaction - consistent with a maliciously crafted Office file that triggers a memory corruption condition in Office's document parsing subsystem. Affected builds span Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac-platform variants; patched build numbers are available for Windows-based SKUs per EUVD-2026-73290, while Mac SKU fix versions are not specified in available data.
Denial-of-service via out-of-bounds read in Windows DHCP Server allows a remote, unauthenticated attacker to crash the DHCP service across a broad range of Windows Server versions. Exploitation requires only network access and no authentication, making it trivially reachable by any host on a network segment served by the vulnerable DHCP role. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and wide affected version range make this a credible operational risk for enterprise environments.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables network-delivered code execution on any Windows system where a user opens a crafted image file. The flaw affects an extremely broad surface spanning Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making it relevant to virtually every Windows-based enterprise environment. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, though the low-complexity, no-privileges-required vector is conducive to phishing-style mass targeting.
Remote code execution in Microsoft SQL Server 2017 and 2019 is enabled by an integer overflow that precipitates a heap-based buffer overflow (CWE-122), allowing an unauthenticated network attacker to execute arbitrary code on the database host. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low attack complexity and no required privileges, though some user interaction is required, moderating fully automated exploitation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all affected servicing branches.
Heap-based buffer overflow in Microsoft SQL Server 2017 and 2019 enables unauthenticated network attackers to execute arbitrary code on the database host with high impact across confidentiality, integrity, and availability. The flaw (CWE-122) is reachable without credentials over the network, though user interaction is required per the vendor CVSS vector (UI:R), placing the CVSS base score at 8.8. A vendor patch is available, and no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server (versions 2017 through 2025) enables any authenticated network attacker holding a low-privileged SQL Server account to achieve full remote code execution on the database host. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires no user interaction and is low-complexity once a valid login is held, with complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; Microsoft has released patches across all affected major release branches including both CU and GDR servicing tracks.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM on a wide range of Windows and Windows Server releases. The affected component handles ONC RPC data serialization for NFS operations; triggering the overflow requires only an existing local session and no user interaction. Microsoft has released build-specific patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Windows Imaging Component (WIC) across a broad range of Microsoft Windows desktop and server releases via a heap-based buffer overflow triggered when a user opens or previews a specially crafted image file. The flaw is reachable over the network with no privileges required, making phishing or drive-by delivery viable attack vectors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Windows Update.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability is exploitable with no user interaction beyond local code execution rights, and affects virtually the entire supported Windows ecosystem - from Windows 10 version 1607 through Windows 11 26H1 and all major Server SKUs. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access across a wide range of Windows releases spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all fifteen affected product/version combinations via the standard Windows Update channel. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the CVSS AC:L rating indicates reliable exploitation without race conditions, making this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in the Windows Graphic Fonts font-processing component enables remote code execution across virtually the entire Windows ecosystem, from Server 2012 to Windows 11 26H1 and Server 2025. The attack vector is network-based with user interaction required (CVSS AV:N/UI:R), consistent with a font delivered via a malicious document or webpage that triggers the vulnerable parser. Microsoft has released patches across all affected platform versions; no public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Microsoft Graphics Component enables remote code execution across a broad range of Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated network-based attacker can exploit this flaw by inducing a user to interact with maliciously crafted graphical content, triggering a CWE-122 heap overflow that yields full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available via Microsoft's August 2026 Patch Tuesday.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) affects authorized standard users across a sweeping range of Windows 10, Windows 11, and Windows Server versions from 2016 through 2025. A low-privileged local attacker can trigger the CWE-122 heap overflow to achieve full SYSTEM-level control (C:H/I:H/A:H) without user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the ubiquity of the affected platform and the low attack complexity make this a meaningful post-access privilege escalation primitive.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote unauthenticated attackers to execute arbitrary code on affected Windows systems when a user opens or previews a specially crafted image file. Affected platforms span Windows 10/11 desktop editions and Windows Server 2012 through 2025, covering a core OS image-processing library consumed by Explorer, Office, and countless third-party applications. No public exploit identified at time of analysis, but the unauthenticated network-reachable vector with a low-friction user-interaction trigger makes this a high patch-priority item given the enormous install base.
Heap-based buffer overflow in Windows Management Services enables a network-reachable, low-privileged authenticated attacker to escalate privileges with high impact across confidentiality, integrity, and availability on affected Windows systems. The vulnerability spans a broad range of Windows releases from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H1, making the remediation surface unusually wide. No public exploit code has been identified at time of analysis, but the low attack complexity and network reachability make this a high-priority patch-cycle item.
Privilege escalation in the Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to gain SYSTEM-level access via a heap-based buffer overflow. Affecting 15 distinct Windows client and server builds spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw requires only a standard user account and no interaction from any other user. Microsoft has released patched builds across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated standard user to escalate privileges to SYSTEM on a broad range of affected Windows desktop and server editions. The flaw (CWE-122) requires only low-privilege local access with no user interaction, making it an attractive post-compromise escalation primitive. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated user to gain full system control via an integer overflow or wraparound (CWE-190). Affected versions span Windows 10, Windows 11, and Windows Server 2016 through 2025, with Microsoft providing patched builds across all affected product lines. No public exploit code or CISA KEV listing was identified at time of analysis, but the low attack complexity and absence of user-interaction requirement make this a high-value post-compromise escalation primitive.
Heap-based buffer overflow in the Windows Biometric Service (WBF) enables a locally authenticated attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server versions. The flaw (CWE-122) is reachable by any standard user account and requires no user interaction, yielding full confidentiality, integrity, and availability compromise on the vulnerable host. Patch is available via Microsoft's Patch Tuesday update cycle; SSVC assessment indicates no exploitation observed and the attack is not automatable.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables any locally authenticated standard user to escalate privileges to SYSTEM across virtually all supported Windows 10, Windows 11, and Windows Server editions. The flaw (CWE-122) exploits the service's privileged execution context combined with its exposure to requests from low-privileged user sessions, yielding full confidentiality, integrity, and availability compromise of the host. Microsoft has released patched builds across all affected platforms; no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WinBio) allows an authenticated low-privileged user to gain full system control via a heap-based buffer overflow. The flaw spans a broad surface - Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2016 through 2025 - all pre-patched builds are affected. Microsoft has released security updates addressing the overflow; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service enables local privilege escalation to SYSTEM-level access across a wide range of Windows client and server releases. Any low-privileged, authorized local user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Privilege escalation to SYSTEM-level in Windows Biometric Service (WinBioSrvc) affects virtually all supported Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authorized local attacker with low-privilege code execution can exploit a heap-based buffer overflow in the biometric service process to achieve full local compromise - gaining high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches across all 15 affected build branches as confirmed by EUVD-2026-73750.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) affects the full current Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated local user can trigger the overflow to achieve full SYSTEM-level code execution, with complete confidentiality, integrity, and availability impact on the local machine. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build branches via the standard update guide.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrv) enables a locally authenticated standard user to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans virtually every currently supported Windows release - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making organizational exposure exceptionally broad. Microsoft has released patched builds via the standard Patch Tuesday cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (wbiosrvc.exe) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across all major Windows 10, Windows 11, and Windows Server 2016 through 2025 releases. The flaw (CWE-122) can be triggered with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact over the affected host. No public exploit has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in Microsoft Office Word enables remote unauthenticated attackers to achieve full code execution (C:H/I:H/A:H) by delivering a specially crafted Word document to a target user across all major Office suite versions on both Windows and macOS. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016, with fixed version thresholds confirmed by EUVD. No public exploit or CISA KEV listing identified at time of analysis, but the network-vector, no-auth delivery model is highly attractive for phishing-based initial access campaigns. Vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office Word's document-parsing engine enables remote code execution when a victim opens a specially crafted file, yielding full confidentiality, integrity, and availability compromise of the user's session. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, Word 2016, and corresponding macOS editions across both x86 and x64 architectures. No public exploit identified at time of analysis, but the AV:N/PR:N/UI:R CVSS pattern is historically associated with rapid phishing-campaign weaponization for Office document vulnerabilities.
Heap-based buffer overflow in the Windows Network Connection Broker service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - making it a broad-surface local privilege escalation risk. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches via the standard Patch Tuesday update cycle.
Heap-based buffer overflow in the Windows USB Video Driver (CWE-122) allows a locally authenticated, high-privileged attacker to escalate privileges with scope change, achieving full confidentiality, integrity, and availability impact across the broader system. Twelve Windows editions are confirmed affected, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Vendor-released patches are available via Microsoft's update guide; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Hyper-V allows a locally authenticated attacker with high privileges to escalate privileges and escape the guest VM boundary, achieving scope change to the underlying host. Affected across a broad range of Windows 10, 11, and Windows Server releases from 2016 through 2025. Vendor-released patches are available; no public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in Windows Media Player enables network-delivered remote code execution across 15 Windows OS SKUs, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. An unauthenticated remote attacker who can entice a user to open a crafted media file triggers memory corruption yielding full code execution at the victim's privilege level (C:H/I:H/A:H). No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the ubiquitous Windows footprint and well-understood heap-overflow exploit class warrant priority patching.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Deployment Services (WDS) allows a locally authenticated low-privileged attacker to execute arbitrary code, effectively achieving local privilege escalation on affected Windows Server and Windows 10 systems. The flaw spans a wide range of Microsoft server OS versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809. No public exploit identified at time of analysis, but Microsoft has released patches via the standard update mechanism.
Privilege escalation via heap-based buffer overflow in the Windows USB driver stack allows a low-privileged local attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) resides in kernel-mode USB driver handling, where malformed or malicious USB-related input can corrupt heap memory and redirect execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the low attack complexity and broad Windows footprint make this a meaningful post-exploitation and insider-threat vector.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker to execute arbitrary code with full system impact across a broad range of Microsoft Windows releases. The vulnerability (CWE-122) affects Windows 10, Windows 11, and Windows Server 2012 through 2025, with vendor-released patches available via MSRC. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low authentication bar (PR:L) and wide platform coverage make this a high-priority patch for any organization operating RRAS-enabled servers.
Heap-based buffer overflow in the Windows Storage Port Driver enables local privilege escalation on Windows 11 and Windows Server 2025. An authenticated low-privilege local attacker can exploit the overflow to achieve full C:H/I:H/A:H impact, effectively gaining SYSTEM-level access. No public exploit identified at time of analysis, and the flaw is not listed in the CISA KEV catalog; Microsoft has released patches resolving the issue.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Remote code execution is achievable in Windows Schannel - Microsoft's built-in TLS/SSL security package - through a heap-based buffer overflow triggered over a network connection. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, all prior to Microsoft's patched releases. No public exploit has been identified at time of analysis, but the network-reachable attack surface, low complexity, and fully high-impact CVSS score of 8.8 make this a high-priority patch for any Windows environment relying on Schannel-backed services.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Heap-based buffer overflow in Windows Credential Guard enables a local low-privileged attacker to escalate privileges to full system control across multiple Windows 10 and Windows 11 releases. The vulnerability (CWE-122) resides in the virtualization-based security component responsible for isolating credential material, meaning successful exploitation can directly undermine the primary defense protecting NTLM hashes and Kerberos tickets. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution across all major Office release tracks when a victim opens a maliciously crafted spreadsheet file. The vulnerability is rooted in improper heap memory management during Excel's file parsing routines (CWE-122), resulting in full compromise of confidentiality, integrity, and availability on the victim system. No public exploit code has been identified at time of analysis, but the breadth of affected versions - spanning Office 2016 through Microsoft 365 and Mac variants - makes this a high-priority patch target for enterprise environments.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver enables a local attacker already holding administrator-level privileges to execute arbitrary code with scope change - meaning successful exploitation can affect components beyond the vulnerable driver itself, most critically the Hyper-V hypervisor or co-hosted VMs. The flaw spans virtually all supported Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. Vendor-released patches are available via Microsoft MSRC; no public exploit identified at time of analysis.
Privilege escalation via heap-based buffer overflow (CWE-122) in Windows Hello affects Windows 10, Windows 11, and Windows Server 2019 across numerous build versions, allowing an authorized local attacker with high privileges to cross a security boundary and achieve full system compromise. The CVSS scope-change indicator (S:C) combined with C:H/I:H/A:H signals the overflow can propagate impact beyond the vulnerable Windows Hello component into other security principals - consistent with an admin-to-SYSTEM or authentication-subsystem boundary crossing. No public exploit or CISA KEV listing is present at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in the Microsoft Windows Codecs Library HEIF Image Extension (versions 1.0.0.0 through 1.2.48.0) enables local code execution with full compromise of confidentiality, integrity, and availability on the affected system. Exploitation requires the victim to open or preview a maliciously crafted HEIF image file, making this vulnerability well-suited for file-based social engineering campaigns. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-supplied patch raising the component to version 1.2.48.0 is available.
Heap-based buffer overflow in Microsoft's Web Media Extensions component of the Windows Codecs Library allows an unauthenticated remote attacker to achieve arbitrary code execution by delivering a specially crafted media file. The EUVD identifies all versions from 1.0.0.0 through pre-1.2.42.0 as affected. Exploitation requires a user to interact with attacker-controlled media content - for example, opening a file or visiting a page that triggers media playback - after which the heap overflow can yield full C/I/A compromise of the user's session. No public exploit or active exploitation is identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables unauthenticated remote attackers to achieve arbitrary code execution at the privilege level of the target user. The vulnerability (CWE-122) is triggered when a victim opens a specially crafted Word document, covering Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise across both Windows and Mac platforms. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the broad product coverage and high CVSS of 8.8 make this a priority patching target.
Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) allows remote code execution on a victim's machine when the user connects to an attacker-controlled RDP server. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms full confidentiality, integrity, and availability impact at low attack complexity, constrained only by the requirement that the victim actively initiate the connection. Vendor patch has been released and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Work Folders synchronization component allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across Windows 10 and Windows 11. The vulnerability (CWE-122) stems from improper bounds checking in a privileged Work Folders process and requires only a standard user account with no secondary user interaction. Microsoft has released cumulative updates addressing the flaw; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through 1.2.7279.0 exclusive) allows a remote unauthenticated attacker to execute arbitrary code on the client machine when a user connects to an attacker-controlled or compromised RDP server. The flaw carries a CVSS 8.8 with full C/I/A impact, requiring only that the victim initiate an RDP session. No public exploit identified at time of analysis, and a vendor-released patch is available at version 1.2.7279.0.
Remote code execution in Microsoft Office Word via a heap-based buffer overflow (CWE-122) allows an unauthenticated network attacker to fully compromise a victim system upon opening a crafted document. All major Office licensing tracks are affected on both Windows and macOS, spanning Office 2016 through Microsoft 365 Apps for Enterprise. No CISA KEV listing or public exploit code is referenced in available data, but the low-complexity, no-privileges-required vector with full confidentiality, integrity, and availability impact makes this a critical priority for enterprise patch cycles.
Out-of-bounds write (CWE-787) in multiple Microsoft Office versions enables remote code execution when a victim opens a specially crafted Office document. The vulnerability affects a broad matrix of products spanning Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and their Mac counterparts, covering virtually the entire modern Office product line. Vendor patches have been released via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis, but the network-deliverable, low-complexity nature and full C/I/A impact make this a high-priority patching target.
Heap-based buffer overflow in Microsoft Office Word's document parsing engine enables remote unauthenticated attackers to execute arbitrary code on target systems when a user opens a specially crafted document. The vulnerability affects a wide range of Microsoft Office releases - Word 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - making the attack surface extremely broad. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis, though UI:R interaction remains the sole barrier to exploitation.
Out-of-bounds read in Microsoft Office Excel enables remote code execution when a victim opens a crafted Excel workbook, achieving full C/I/A compromise on the target system. The vulnerability spans every major Office product line from Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS. Vendor-released patches are available for all Windows product lines with specific fixed builds enumerated; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables remote unauthenticated code execution when a victim opens a specially crafted document. Affects the full breadth of Office deployments - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Word 2016, and their Mac equivalents - making the attack surface extremely wide. No public exploit identified at time of analysis, but the CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) with full C/I/A impact places this firmly in priority patching territory for enterprise environments.
Heap-based buffer overflow in Microsoft Word's document-parsing engine, arising from a numeric truncation error, enables remote code execution when a user opens a specially crafted Word document. The flaw spans a wide matrix of Office SKUs on both Windows and Mac - including Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - and carries CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting full compromise with the only friction being the required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the ubiquity of the Office install base makes this a high-priority patching target.
Remote code execution in Microsoft Office Word exposes virtually every Windows and macOS Office release channel - Word 2016, Office 2019, LTSC 2021/2024, 365 Apps for Enterprise, and Office for Mac - to full system compromise via a specially crafted document. The heap-based buffer overflow (CWE-122) fires during document parsing with no authentication required from the attacker, only standard user interaction to open the malicious file, yielding C:H/I:H/A:H impact under a low-complexity attack path. Microsoft has issued patches across all Windows release branches and flags macOS editions as affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow (CWE-122) that a remote attacker can trigger to run arbitrary code with the victim's privileges. It affects a broad set of Office builds including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and the macOS Office editions. Microsoft has released a patch; no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft Office Outlook stems from a heap-based buffer overflow (CWE-122) that lets an unauthenticated network attacker run arbitrary code, per Microsoft's MSRC advisory and CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). The flaw affects Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Word 2016, and Office for Mac builds; Microsoft has released fixed builds. No public exploit identified at time of analysis, but the critical severity and no-interaction network vector make it a high patch priority.
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code on a victim's system when the victim opens a specially crafted Office document. Multiple product lines are affected, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and Mac variants of each. With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, this is a high-severity code execution path; no public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available.
Stack-based buffer overflow (CWE-121) in Microsoft Office Word enables a remote unauthenticated attacker to execute arbitrary code on a victim's machine by delivering a specially crafted Word document and inducing the target to open it. The vulnerability spans a wide swath of Office product lines - from Word 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise - on both Windows and macOS platforms. Microsoft has released patches across Windows product lines; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Microsoft SQL Server 2022 enables an authenticated low-privileged network attacker to execute arbitrary code on the database server host. Both the GDR and CU 26 servicing branches of SQL Server 2022 are affected, with Microsoft having released fixed builds in both channels. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and full network reachability make this a high-priority patching target for any organization running SQL Server 2022.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
Heap-based buffer overflow in the Windows OLE DB component of Microsoft SQL Server 2017 and 2019 enables a network-adjacent unauthenticated attacker to achieve remote code execution when a user interacts with a malicious OLE DB data source. The vulnerability (CWE-122, CVSS 8.8) affects multiple servicing branches across both SQL Server versions, covering both Cumulative Update and General Distribution Release tracks. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected branches.
Stack-based buffer overflow in Microsoft Graphics Component enables remote code execution when a victim opens a specially crafted file containing malicious graphics content. Affected products include Microsoft Office LTSC for Mac 2021 and 2024, Microsoft 365 for Mac, and Microsoft Office for Android prior to 16.0.20430.20000. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects no privilege requirements on the target system and network-accessible delivery, though user interaction - opening a malicious document - is required. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable via a heap-based buffer overflow triggered when a victim opens a specially crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates unauthenticated network-reachable exploitation requiring only that the target developer open an attacker-supplied artifact - a realistic social-engineering scenario in development environments. Full compromise of confidentiality, integrity, and availability of the victim's system is possible upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Visual Studio 2026 (versions 18.9.0 through 18.9.2) is achievable by unauthenticated network-reachable attackers via a heap-based buffer overflow in the IDE, though user interaction is required to trigger the flaw. The CVSS score of 8.8 reflects the high impact potential - full compromise of confidentiality, integrity, and availability - moderated only by the need for a developer to open or process a crafted file. A vendor patch has been released; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow (CWE-122) in multiple Microsoft Office versions enables remote code execution when a victim opens a specially crafted document. The CVSS vector (AV:N/AC:H/PR:N/UI:R) confirms network-based delivery without attacker authentication, but exploitation requires high attack complexity and active user interaction - consistent with a maliciously crafted Office file that triggers a memory corruption condition in Office's document parsing subsystem. Affected builds span Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac-platform variants; patched build numbers are available for Windows-based SKUs per EUVD-2026-73290, while Mac SKU fix versions are not specified in available data.
Denial-of-service via out-of-bounds read in Windows DHCP Server allows a remote, unauthenticated attacker to crash the DHCP service across a broad range of Windows Server versions. Exploitation requires only network access and no authentication, making it trivially reachable by any host on a network segment served by the vulnerable DHCP role. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and wide affected version range make this a credible operational risk for enterprise environments.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables network-delivered code execution on any Windows system where a user opens a crafted image file. The flaw affects an extremely broad surface spanning Windows Server 2012 through Windows Server 2025 and Windows 11 26H1, making it relevant to virtually every Windows-based enterprise environment. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, though the low-complexity, no-privileges-required vector is conducive to phishing-style mass targeting.
Remote code execution in Microsoft SQL Server 2017 and 2019 is enabled by an integer overflow that precipitates a heap-based buffer overflow (CWE-122), allowing an unauthenticated network attacker to execute arbitrary code on the database host. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low attack complexity and no required privileges, though some user interaction is required, moderating fully automated exploitation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all affected servicing branches.
Heap-based buffer overflow in Microsoft SQL Server 2017 and 2019 enables unauthenticated network attackers to execute arbitrary code on the database host with high impact across confidentiality, integrity, and availability. The flaw (CWE-122) is reachable without credentials over the network, though user interaction is required per the vendor CVSS vector (UI:R), placing the CVSS base score at 8.8. A vendor patch is available, and no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server (versions 2017 through 2025) enables any authenticated network attacker holding a low-privileged SQL Server account to achieve full remote code execution on the database host. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires no user interaction and is low-complexity once a valid login is held, with complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; Microsoft has released patches across all affected major release branches including both CU and GDR servicing tracks.
Local privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects a broad range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized low-privileged local user can exploit the memory corruption flaw to achieve full SYSTEM-level code execution with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, but the broad platform footprint and straightforward CVSS vector (AC:L, PR:L, UI:N) make this a high-priority patching target for enterprise Windows environments.
Heap-based buffer overflow in the Windows Services for NFS ONCRPC XDR Driver enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM on a wide range of Windows and Windows Server releases. The affected component handles ONC RPC data serialization for NFS operations; triggering the overflow requires only an existing local session and no user interaction. Microsoft has released build-specific patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Windows Imaging Component (WIC) across a broad range of Microsoft Windows desktop and server releases via a heap-based buffer overflow triggered when a user opens or previews a specially crafted image file. The flaw is reachable over the network with no privileges required, making phishing or drive-by delivery viable attack vectors. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Windows Update.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2016 through 2025 installations. The vulnerability is exploitable with no user interaction beyond local code execution rights, and affects virtually the entire supported Windows ecosystem - from Windows 10 version 1607 through Windows 11 26H1 and all major Server SKUs. No public exploit code or CISA KEV listing has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access across a wide range of Windows releases spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all fifteen affected product/version combinations via the standard Windows Update channel. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the CVSS AC:L rating indicates reliable exploitation without race conditions, making this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in the Windows Graphic Fonts font-processing component enables remote code execution across virtually the entire Windows ecosystem, from Server 2012 to Windows 11 26H1 and Server 2025. The attack vector is network-based with user interaction required (CVSS AV:N/UI:R), consistent with a font delivered via a malicious document or webpage that triggers the vulnerable parser. Microsoft has released patches across all affected platform versions; no public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.
Heap-based buffer overflow in the Windows Graphics Kernel subsystem allows a locally authenticated, high-privileged attacker to execute arbitrary code with scope change to kernel context. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server releases from build 1809 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Microsoft Graphics Component enables remote code execution across a broad range of Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An unauthenticated network-based attacker can exploit this flaw by inducing a user to interact with maliciously crafted graphical content, triggering a CWE-122 heap overflow that yields full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis; vendor patch is available via Microsoft's August 2026 Patch Tuesday.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) affects authorized standard users across a sweeping range of Windows 10, Windows 11, and Windows Server versions from 2016 through 2025. A low-privileged local attacker can trigger the CWE-122 heap overflow to achieve full SYSTEM-level control (C:H/I:H/A:H) without user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the ubiquity of the affected platform and the low attack complexity make this a meaningful post-access privilege escalation primitive.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote unauthenticated attackers to execute arbitrary code on affected Windows systems when a user opens or previews a specially crafted image file. Affected platforms span Windows 10/11 desktop editions and Windows Server 2012 through 2025, covering a core OS image-processing library consumed by Explorer, Office, and countless third-party applications. No public exploit identified at time of analysis, but the unauthenticated network-reachable vector with a low-friction user-interaction trigger makes this a high patch-priority item given the enormous install base.
Heap-based buffer overflow in Windows Management Services enables a network-reachable, low-privileged authenticated attacker to escalate privileges with high impact across confidentiality, integrity, and availability on affected Windows systems. The vulnerability spans a broad range of Windows releases from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H1, making the remediation surface unusually wide. No public exploit code has been identified at time of analysis, but the low attack complexity and network reachability make this a high-priority patch-cycle item.
Privilege escalation in the Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to gain SYSTEM-level access via a heap-based buffer overflow. Affecting 15 distinct Windows client and server builds spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw requires only a standard user account and no interaction from any other user. Microsoft has released patched builds across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated standard user to escalate privileges to SYSTEM on a broad range of affected Windows desktop and server editions. The flaw (CWE-122) requires only low-privilege local access with no user interaction, making it an attractive post-compromise escalation primitive. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows Graphics Component enables unauthenticated remote attackers to achieve arbitrary code execution on affected systems when a victim interacts with specially crafted graphical content. The vulnerability spans all currently supported Windows 10, Windows 11, and Windows Server editions from 2016 through 2025, making the attack surface exceptionally broad. Microsoft has released patches as part of the monthly security update cycle; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated user to gain full system control via an integer overflow or wraparound (CWE-190). Affected versions span Windows 10, Windows 11, and Windows Server 2016 through 2025, with Microsoft providing patched builds across all affected product lines. No public exploit code or CISA KEV listing was identified at time of analysis, but the low attack complexity and absence of user-interaction requirement make this a high-value post-compromise escalation primitive.
Heap-based buffer overflow in the Windows Biometric Service (WBF) enables a locally authenticated attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server versions. The flaw (CWE-122) is reachable by any standard user account and requires no user interaction, yielding full confidentiality, integrity, and availability compromise on the vulnerable host. Patch is available via Microsoft's Patch Tuesday update cycle; SSVC assessment indicates no exploitation observed and the attack is not automatable.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables any locally authenticated standard user to escalate privileges to SYSTEM across virtually all supported Windows 10, Windows 11, and Windows Server editions. The flaw (CWE-122) exploits the service's privileged execution context combined with its exposure to requests from low-privileged user sessions, yielding full confidentiality, integrity, and availability compromise of the host. Microsoft has released patched builds across all affected platforms; no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WinBio) allows an authenticated low-privileged user to gain full system control via a heap-based buffer overflow. The flaw spans a broad surface - Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2016 through 2025 - all pre-patched builds are affected. Microsoft has released security updates addressing the overflow; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service enables local privilege escalation to SYSTEM-level access across a wide range of Windows client and server releases. Any low-privileged, authorized local user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation across a wide range of Windows client and server editions from 2016 through current 2025 builds. An authenticated local attacker exploiting CWE-122 can corrupt heap memory to achieve full system-level compromise (C:H/I:H/A:H), making this a practical post-exploitation stepping stone after initial access. Microsoft has released patches for all affected versions; SSVC rates exploitation as none at time of analysis and no public exploit code has been identified.
Privilege escalation to SYSTEM-level in Windows Biometric Service (WinBioSrvc) affects virtually all supported Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authorized local attacker with low-privilege code execution can exploit a heap-based buffer overflow in the biometric service process to achieve full local compromise - gaining high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches across all 15 affected build branches as confirmed by EUVD-2026-73750.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables an authenticated local attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows endpoints and servers. The vulnerability spans a broad surface - Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it relevant across virtually all enterprise Windows deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity (AC:L) and the wide affected version range make this a meaningful patching priority.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) affects the full current Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated local user can trigger the overflow to achieve full SYSTEM-level code execution, with complete confidentiality, integrity, and availability impact on the local machine. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build branches via the standard update guide.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrv) enables a locally authenticated standard user to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans virtually every currently supported Windows release - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making organizational exposure exceptionally broad. Microsoft has released patched builds via the standard Patch Tuesday cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (wbiosrvc.exe) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across all major Windows 10, Windows 11, and Windows Server 2016 through 2025 releases. The flaw (CWE-122) can be triggered with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact over the affected host. No public exploit has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Heap-based buffer overflow in Microsoft Office Word enables remote unauthenticated attackers to achieve full code execution (C:H/I:H/A:H) by delivering a specially crafted Word document to a target user across all major Office suite versions on both Windows and macOS. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016, with fixed version thresholds confirmed by EUVD. No public exploit or CISA KEV listing identified at time of analysis, but the network-vector, no-auth delivery model is highly attractive for phishing-based initial access campaigns. Vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office Word's document-parsing engine enables remote code execution when a victim opens a specially crafted file, yielding full confidentiality, integrity, and availability compromise of the user's session. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, Word 2016, and corresponding macOS editions across both x86 and x64 architectures. No public exploit identified at time of analysis, but the AV:N/PR:N/UI:R CVSS pattern is historically associated with rapid phishing-campaign weaponization for Office document vulnerabilities.
Heap-based buffer overflow in the Windows Network Connection Broker service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - making it a broad-surface local privilege escalation risk. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches via the standard Patch Tuesday update cycle.
Heap-based buffer overflow in the Windows USB Video Driver (CWE-122) allows a locally authenticated, high-privileged attacker to escalate privileges with scope change, achieving full confidentiality, integrity, and availability impact across the broader system. Twelve Windows editions are confirmed affected, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Vendor-released patches are available via Microsoft's update guide; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Hyper-V allows a locally authenticated attacker with high privileges to escalate privileges and escape the guest VM boundary, achieving scope change to the underlying host. Affected across a broad range of Windows 10, 11, and Windows Server releases from 2016 through 2025. Vendor-released patches are available; no public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in Windows Media Player enables network-delivered remote code execution across 15 Windows OS SKUs, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. An unauthenticated remote attacker who can entice a user to open a crafted media file triggers memory corruption yielding full code execution at the victim's privilege level (C:H/I:H/A:H). No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the ubiquitous Windows footprint and well-understood heap-overflow exploit class warrant priority patching.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Deployment Services (WDS) allows a locally authenticated low-privileged attacker to execute arbitrary code, effectively achieving local privilege escalation on affected Windows Server and Windows 10 systems. The flaw spans a wide range of Microsoft server OS versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809. No public exploit identified at time of analysis, but Microsoft has released patches via the standard update mechanism.
Privilege escalation via heap-based buffer overflow in the Windows USB driver stack allows a low-privileged local attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) resides in kernel-mode USB driver handling, where malformed or malicious USB-related input can corrupt heap memory and redirect execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the low attack complexity and broad Windows footprint make this a meaningful post-exploitation and insider-threat vector.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker to execute arbitrary code with full system impact across a broad range of Microsoft Windows releases. The vulnerability (CWE-122) affects Windows 10, Windows 11, and Windows Server 2012 through 2025, with vendor-released patches available via MSRC. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low authentication bar (PR:L) and wide platform coverage make this a high-priority patch for any organization operating RRAS-enabled servers.
Heap-based buffer overflow in the Windows Storage Port Driver enables local privilege escalation on Windows 11 and Windows Server 2025. An authenticated low-privilege local attacker can exploit the overflow to achieve full C:H/I:H/A:H impact, effectively gaining SYSTEM-level access. No public exploit identified at time of analysis, and the flaw is not listed in the CISA KEV catalog; Microsoft has released patches resolving the issue.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Remote code execution is achievable in Windows Schannel - Microsoft's built-in TLS/SSL security package - through a heap-based buffer overflow triggered over a network connection. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, all prior to Microsoft's patched releases. No public exploit has been identified at time of analysis, but the network-reachable attack surface, low complexity, and fully high-impact CVSS score of 8.8 make this a high-priority patch for any Windows environment relying on Schannel-backed services.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Heap-based buffer overflow in Windows Credential Guard enables a local low-privileged attacker to escalate privileges to full system control across multiple Windows 10 and Windows 11 releases. The vulnerability (CWE-122) resides in the virtualization-based security component responsible for isolating credential material, meaning successful exploitation can directly undermine the primary defense protecting NTLM hashes and Kerberos tickets. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.