Buffer Overflow
Monthly
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Remote code execution is achievable in Windows Schannel - Microsoft's built-in TLS/SSL security package - through a heap-based buffer overflow triggered over a network connection. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, all prior to Microsoft's patched releases. No public exploit has been identified at time of analysis, but the network-reachable attack surface, low complexity, and fully high-impact CVSS score of 8.8 make this a high-priority patch for any Windows environment relying on Schannel-backed services.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Heap-based buffer overflow in Windows Credential Guard enables a local low-privileged attacker to escalate privileges to full system control across multiple Windows 10 and Windows 11 releases. The vulnerability (CWE-122) resides in the virtualization-based security component responsible for isolating credential material, meaning successful exploitation can directly undermine the primary defense protecting NTLM hashes and Kerberos tickets. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Privilege escalation to SYSTEM in Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to fully compromise the affected Windows host via an integer overflow (CWE-190) in the biometric framework's internal processing. The flaw spans a broad surface of Microsoft Windows client and server editions from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in the Windows Defender Firewall Service (mpssvc) allows an authenticated local attacker holding only standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability spans every major Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, covering both client and server deployments. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Print Spooler Components (spoolsv.exe) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans an exceptionally wide swath of Microsoft's product portfolio - from legacy Windows Server 2012 through current Windows 11 26H1 and Windows Server 2025 - making patch coverage a substantial operational challenge. Microsoft has released fixes via its update guide; no public exploit or CISA KEV listing has been identified at time of analysis, but the component's history of critical vulnerabilities (PrintNightmare, etc.) makes it a high-priority patching target.
Heap-based buffer overflow in Microsoft WebP Image Extension versions prior to 1.2.31.0 enables remote code execution when a victim opens a specially crafted WebP image file. The root trigger is an integer overflow (CWE-190) that corrupts heap allocation sizing, producing a classic CWE-122 heap overflow; the CVSS vector confirms full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS score (8.8) and complete code-execution impact make patching urgent for any Windows environment where the extension is installed.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Print Spooler service allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) is exploitable locally with standard user credentials and no user interaction, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Print Spooler has a long history of high-profile exploitation, including PrintNightmare, making this class of bug a priority for patching.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Secure Kernel Mode enables an authorized local attacker with administrative privileges to escalate into the secure kernel isolation boundary, achieving full confidentiality, integrity, and availability impact (S:C, C:H/I:H/A:H). The vulnerability spans a broad range of Windows platforms - from Server 2016 and Windows 10 1607 through Windows 11 26H1 and Server 2025 - and was reported by Microsoft's own security engineering team. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in the Windows NTFS driver enables network-based privilege escalation across a broad range of Microsoft Windows desktop and server releases. An authenticated low-privileged attacker who can trigger user interaction can corrupt heap memory in the NTFS subsystem - most likely through a crafted network share or SMB-exposed filesystem operation - to achieve full SYSTEM-level control (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables unauthenticated remote code execution across a broad swath of Microsoft Windows desktop and server editions from Server 2012 through Windows 11 26H1. Exploitation requires user interaction - a victim must open or process a maliciously crafted image file - after which an attacker achieves full C/I/A compromise of the targeted system. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected version lines.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Privilege escalation in Windows Secure Kernel Mode enables a locally authenticated administrator to breach the virtualization-based security (VBS) trust boundary separating VTL0 (normal OS) from VTL1 (secure enclave). The root cause is CWE-190 integer overflow that leads to a buffer overflow condition within secure kernel processing, affecting Windows 10, Windows 11, and Windows Server across a broad range of release versions. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to trigger a heap-based buffer overflow and execute arbitrary code, per CVSS with full confidentiality, integrity, and availability impact (9.8). All supported Windows Server builds from 2012 through 2025 running the DHCP Server role are affected. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the network-facing unauthenticated RCE profile makes this a high-priority patch item for domain infrastructure.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) component enables a locally authenticated attacker to escalate privileges to SYSTEM level. The vulnerability spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem, triggered by a numeric truncation error, enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on all major supported Windows releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates low attack complexity and no user interaction required once local code execution is achieved, yielding full confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.
Heap-based buffer overflow in the Windows Audio Service (AudioSrv/audiosrv.dll) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM level on affected Windows 10, Windows 11, and Windows Server installations. The vulnerability is confirmed by Microsoft's Security Response Center (secure@microsoft.com) and affects a broad range of supported Windows releases from build 1809 through the latest 26H1 branch. Patches are available across all affected product lines. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in Windows Credential Providers enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges across a broad range of Windows 10, 11, and Windows Server releases. The CWE-122 flaw resides in the credential provider subsystem, requiring no user interaction and no elevated starting privileges, making it a reliable post-compromise escalation primitive for multi-stage attacks. No public exploit code or active exploitation has been confirmed at time of analysis; a vendor patch from Microsoft is available covering all affected branches.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of unpatched Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker can trigger the overflow via a crafted biometric request, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Text Shaping subsystem allows remote unauthenticated attackers to achieve arbitrary code execution, with full confidentiality, integrity, and availability impact across an exceptionally broad range of Windows versions spanning Server 2012 through Windows 11 26H1. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals network-reachable, authentication-free exploitation tempered by high attack complexity - indicating that triggering reliable code execution requires overcoming specific environmental conditions such as precise heap layout. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow (CWE-122) in Microsoft Office Access enables network-delivered remote code execution across six Microsoft Office product lines. When a victim opens a maliciously crafted Access database file delivered over a network, the overflow corrupts heap memory and allows an attacker to execute arbitrary code with the privileges of the logged-in user. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Heap-based buffer overflow in the Windows DHCP Client enables an authenticated attacker on the same network segment to escalate privileges on Windows 11 systems. The vulnerability (CWE-122) affects Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds, with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code and no active exploitation have been identified at the time of analysis; Microsoft has released a patch via the June/July 2026 Patch Tuesday cycle.
Heap-based buffer overflow in the Windows Biometric Framework (WBF) service permits a low-privileged, network-adjacent authenticated attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability requires some user interaction to trigger (UI:R per CVSS), and successful exploitation yields full confidentiality, integrity, and availability impact on the target host. No active exploitation has been identified at time of analysis, and Microsoft has released patches across all supported Windows versions.
Heap-based buffer overflow in the Windows Network File System (NFS) component enables remote attackers to execute arbitrary code on unpatched Windows Server and Windows 10/11 systems where NFS services are active. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with no privilege requirement but a user-interaction dependency - consistent with a client-side NFS processing scenario or triggered NFS operation. Microsoft has released patches covering a span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows HTTP Print Provider allows an unauthenticated network attacker to execute arbitrary code by exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Server 2012 through Windows 11 25H2 and Server 2025, and per the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector requires no authentication or user interaction. No public exploit identified at time of analysis, but the network-reachable, pre-auth nature and 9.8 severity make it a high-priority patch.
Remote code execution in the Windows RNDIS (Remote Network Driver Interface Specification) component affects the full supported Windows line, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An unauthorized attacker can trigger a heap-based buffer overflow (CWE-122) by delivering malformed RNDIS control/data messages, achieving arbitrary code execution with high confidentiality, integrity, and availability impact. Microsoft has published a patch across all affected builds; there is no public exploit identified at time of analysis and no KEV/EPSS data supplied.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution across all currently-supported Office editions when a victim opens a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through 2024 LTSC on both x86 and x64 platforms, the vulnerability requires no attacker privileges but depends on user interaction - the classic malicious-document delivery model. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating, full confidentiality/integrity/availability impact, and the near-universal enterprise footprint of Microsoft Office make this a high-priority patching candidate.
Stack-based buffer overflow in the Windows Win32K kernel-mode driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM level via a network-accessible exploit path, affecting 12 distinct Windows releases spanning Windows 10 1809 through Windows Server 2025 and Windows 11 26H1. The CWE-121 flaw resides in the kernel subsystem handling GDI rendering and windowing, making successful exploitation equivalent to full operating system compromise. Microsoft has released patches addressing all affected build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Word's document parsing engine allows remote unauthenticated attackers to execute arbitrary code with the privileges of the victim user when a specially crafted Word document is opened. The flaw (CWE-121) spans Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016 on both Windows and macOS. Microsoft has released patched builds; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution is possible in Microsoft Office Publisher across multiple Office suite versions when a victim opens a maliciously crafted Publisher document. The root cause is an integer overflow or wraparound (CWE-190) in the file-parsing subsystem, which typically produces an understated buffer allocation that an attacker can exploit to corrupt heap memory and redirect execution. Affected releases span Publisher 2016 through Microsoft 365 Apps for Enterprise; vendor-released patches are available for all affected versions, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain SYSTEM-level control via a heap-based buffer overflow triggered by an integer overflow or wraparound. The flaw affects a wide sweep of Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface nearly universal across modern Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, but vendor patch is available and should be prioritized given the full C:H/I:H/A:H impact after a successful escalation.
Heap-based buffer overflow in the Windows Link Layer Topology Discovery Protocol (LLTD) implementation enables unauthenticated attackers to execute arbitrary code on affected Windows systems via crafted network-layer frames. The flaw (CWE-122) spans nearly the entire supported Windows ecosystem - from Windows 10 through Windows 11 and from Windows Server 2012 through Server 2025. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Credential Providers enables a low-privileged authenticated attacker to execute arbitrary code over the network on affected Windows 11 and Windows Server 2025 systems. The flaw (CWE-122) is reachable via network with low complexity and no user interaction required, making it exploitable by any account holder with minimal privileges. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a network-based privilege escalation by an authenticated low-privilege attacker who can trigger user interaction. The vulnerability (CWE-122) spans a broad swath of Microsoft's supported Windows ecosystem, from Windows 10 version 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Exploitation results in full compromise of confidentiality, integrity, and availability on the target system. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected branches.
Stack-based buffer overflow in Microsoft Word (CWE-121) enables remote code execution by enticing a user to open a maliciously crafted document, with full compromise of confidentiality, integrity, and availability. Affected products span Office 2019, 2021, and 2024 LTSC on both Windows (x86/x64) and macOS, as well as Microsoft 365 Apps for Enterprise and Word 2016. Microsoft has released patches across all affected product lines; no public exploit code has been identified and CISA KEV confirmation is absent at time of analysis.
Heap-based buffer overflow in the Windows MIDI Service Module enables a local authenticated attacker on Windows 11 to escalate privileges, with full confidentiality, integrity, and availability impact in the compromised process scope. Affected builds span three servicing tracks - 24H2, 25H2, and 26H1 - with fixed builds published by Microsoft through MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in the Microsoft Windows DirectShow media framework arises from an out-of-bounds memory condition (classed as heap overflow, CWE-122) that lets a remote attacker run arbitrary code when a victim system processes maliciously crafted media. It affects the DirectShow component across nearly all supported Windows client and server releases (Windows 10/11, Server 2012 through Server 2025). Microsoft self-reported and has shipped patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the Windows Device Association Service enables an authenticated, low-privileged network attacker to escalate privileges to full system compromise across Windows 10, Windows 11, and Windows Server 2012 through 2025. The vulnerability (CWE-121) requires user interaction to trigger but delivers complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has issued patches covering the full affected version range.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Local privilege escalation in the Windows USB Audio Class driver (usbaudio.sys) allows a low-privileged authenticated user to gain full system control via an integer overflow. The flaw affects an exceptionally broad range of Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected systems make this a meaningful enterprise patching priority.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Privilege escalation via a stack-based buffer overflow in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server 2019/2022/2025 across a wide range of release builds. A low-privilege network attacker who induces victim user interaction can achieve full confidentiality, integrity, and availability compromise of the targeted system, consistent with elevation to SYSTEM-level access. A vendor-released patch is available via Microsoft Patch Tuesday; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) service enables a low-privileged authenticated attacker to elevate privileges to a higher level over a network connection. The vulnerability (CWE-122) spans virtually the entire supported Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making it a broad enterprise patching obligation. Microsoft has released cumulative updates addressing the issue; no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Word's document-parsing engine enables network-delivered remote code execution with full system impact across all current Microsoft Office product lines on Windows and macOS. The vulnerability (CWE-121) is triggered when a user opens a specially crafted Word document, overflowing a fixed-size stack buffer and allowing an attacker to hijack control flow and execute arbitrary code in the context of the logged-in user. Affected versions span Word 2016 through Microsoft 365 Apps for Enterprise and LTSC editions on both x86/x64 Windows and macOS; patches are available per vendor advisory, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privilege, network-reachable attacker - following required user interaction - to escalate privileges to SYSTEM level, achieving full compromise (C:H/I:H/A:H) of the affected host. The vulnerability spans nearly every supported Windows version from Server 2012 through Server 2025 and Windows 10/11 across all major releases, creating an exceptionally broad attack surface. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; however, Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Microsoft Office Word's document parsing engine enables an unauthenticated remote attacker to achieve full code execution on a victim's system when a specially crafted Word document is opened. The flaw spans all major currently-supported Office release channels on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and macOS editions. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity, broad product footprint, and well-understood Office document exploitation tradecraft make this a high-priority patching candidate.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Heap-based buffer overflow in Windows Raw Image Extension (versions 2.1.0.0 through <2.4.24.0) enables remote code execution when a victim opens or previews a specially crafted raw camera image file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that no attacker authentication is required - only user interaction with a malicious file - yielding full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis, but the file-parsing attack surface and high CVSS impact make this a meaningful priority for environments with photography workflows.
Heap-based buffer overflow in Windows Spaceport.sys - the kernel-mode driver backing Microsoft Storage Spaces - permits an authenticated low-privileged network attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans virtually the entire modern Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels. Microsoft has released patched builds via the standard Windows Update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Heap-based buffer overflow in Microsoft Office Outlook enables remote unauthenticated attackers to execute arbitrary code on the victim's system across multiple current Office product lines. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects network-accessible exploitation requiring no privilege, with the sole limiting gate being user interaction-likely opening or previewing a crafted message. No active exploitation is confirmed via CISA KEV and no public exploit code is known at time of analysis; Microsoft has released patched builds across all affected product lines.
Heap-based buffer overflow in the Windows iSCSI service allows an authenticated, network-accessible attacker with low-level privileges to execute arbitrary code on affected systems. The vulnerability spans an exceptionally broad set of Windows releases - from Server 2012 and Windows 10 through Windows 11 26H1 and Server 2025 - making patch surface management a significant operational challenge for enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network vector and full CIA impact yield a CVSS score of 8.8.
Heap-based buffer overflow in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables low-privileged authenticated attackers to escalate privileges to SYSTEM-level over the network. Affecting Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2019 through 2025, the flaw carries a CVSS 8.0 rating with full CIA impact upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in the Windows HTTP Print Provider component enables an authorized low-privilege network attacker to achieve remote code execution with full C/I/A impact on affected Windows systems. The vulnerability spans an exceptionally wide range of Microsoft operating systems from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the breadth of affected versions and high CVSS score of 8.0 make this a significant patching priority across enterprise Windows environments.
Heap-based buffer overflow in Windows Fax Service enables a low-privileged local attacker to escalate privileges to SYSTEM on a wide range of Windows client and server versions. The flaw (CWE-122) is confirmed patched by Microsoft via their monthly update cycle, with fixed build numbers available across every affected version from Windows Server 2012 through Windows 11 26H1. No public exploit code or active exploitation has been identified at time of analysis; however, the all-high C:H/I:H/A:H impact and broad platform coverage make this a meaningful patch-cycle priority for any organization running Windows Fax Service.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Privilege escalation in the Windows exFAT File System driver (CWE-125, out-of-bounds read) allows an authenticated low-privilege attacker to gain elevated rights over a network connection. All major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 are confirmed affected per EUVD version data. No public exploit or CISA KEV listing was identified at time of analysis, though the broad affected scope across the entire current Windows ecosystem and the high CVSS score of 8.0 make patching urgent.
Stack-based buffer overflow in Microsoft Access enables remote code execution when a user opens a specially crafted database file, delivering full confidentiality, integrity, and availability compromise on the vulnerable host. Affected products span all current Microsoft Office release trains - Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad enterprise attack surface. Microsoft has released patches via its standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. A vendor-released patch is available; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Hyper-V enables a low-privileged guest VM user to escape the hypervisor sandbox and execute arbitrary code on the host system. The CVSS scope-change metric (S:C) and C:H/I:H/A:H impact ratings confirm this is a full VM-escape class vulnerability, giving an attacker inside a guest complete control over the underlying Hyper-V host. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through Server 2025; Microsoft has released patches via Windows Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Remote code execution is achievable in Windows Schannel - Microsoft's built-in TLS/SSL security package - through a heap-based buffer overflow triggered over a network connection. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, all prior to Microsoft's patched releases. No public exploit has been identified at time of analysis, but the network-reachable attack surface, low complexity, and fully high-impact CVSS score of 8.8 make this a high-priority patch for any Windows environment relying on Schannel-backed services.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Heap-based buffer overflow in Windows Credential Guard enables a local low-privileged attacker to escalate privileges to full system control across multiple Windows 10 and Windows 11 releases. The vulnerability (CWE-122) resides in the virtualization-based security component responsible for isolating credential material, meaning successful exploitation can directly undermine the primary defense protecting NTLM hashes and Kerberos tickets. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Privilege escalation to SYSTEM in Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to fully compromise the affected Windows host via an integer overflow (CWE-190) in the biometric framework's internal processing. The flaw spans a broad surface of Microsoft Windows client and server editions from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in the Windows Defender Firewall Service (mpssvc) allows an authenticated local attacker holding only standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability spans every major Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, covering both client and server deployments. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Print Spooler Components (spoolsv.exe) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans an exceptionally wide swath of Microsoft's product portfolio - from legacy Windows Server 2012 through current Windows 11 26H1 and Windows Server 2025 - making patch coverage a substantial operational challenge. Microsoft has released fixes via its update guide; no public exploit or CISA KEV listing has been identified at time of analysis, but the component's history of critical vulnerabilities (PrintNightmare, etc.) makes it a high-priority patching target.
Heap-based buffer overflow in Microsoft WebP Image Extension versions prior to 1.2.31.0 enables remote code execution when a victim opens a specially crafted WebP image file. The root trigger is an integer overflow (CWE-190) that corrupts heap allocation sizing, producing a classic CWE-122 heap overflow; the CVSS vector confirms full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS score (8.8) and complete code-execution impact make patching urgent for any Windows environment where the extension is installed.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Print Spooler service allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) is exploitable locally with standard user credentials and no user interaction, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Print Spooler has a long history of high-profile exploitation, including PrintNightmare, making this class of bug a priority for patching.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Secure Kernel Mode enables an authorized local attacker with administrative privileges to escalate into the secure kernel isolation boundary, achieving full confidentiality, integrity, and availability impact (S:C, C:H/I:H/A:H). The vulnerability spans a broad range of Windows platforms - from Server 2016 and Windows 10 1607 through Windows 11 26H1 and Server 2025 - and was reported by Microsoft's own security engineering team. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in the Windows NTFS driver enables network-based privilege escalation across a broad range of Microsoft Windows desktop and server releases. An authenticated low-privileged attacker who can trigger user interaction can corrupt heap memory in the NTFS subsystem - most likely through a crafted network share or SMB-exposed filesystem operation - to achieve full SYSTEM-level control (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables unauthenticated remote code execution across a broad swath of Microsoft Windows desktop and server editions from Server 2012 through Windows 11 26H1. Exploitation requires user interaction - a victim must open or process a maliciously crafted image file - after which an attacker achieves full C/I/A compromise of the targeted system. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected version lines.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Privilege escalation in Windows Secure Kernel Mode enables a locally authenticated administrator to breach the virtualization-based security (VBS) trust boundary separating VTL0 (normal OS) from VTL1 (secure enclave). The root cause is CWE-190 integer overflow that leads to a buffer overflow condition within secure kernel processing, affecting Windows 10, Windows 11, and Windows Server across a broad range of release versions. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to trigger a heap-based buffer overflow and execute arbitrary code, per CVSS with full confidentiality, integrity, and availability impact (9.8). All supported Windows Server builds from 2012 through 2025 running the DHCP Server role are affected. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the network-facing unauthenticated RCE profile makes this a high-priority patch item for domain infrastructure.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) component enables a locally authenticated attacker to escalate privileges to SYSTEM level. The vulnerability spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem, triggered by a numeric truncation error, enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on all major supported Windows releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates low attack complexity and no user interaction required once local code execution is achieved, yielding full confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.
Heap-based buffer overflow in the Windows Audio Service (AudioSrv/audiosrv.dll) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM level on affected Windows 10, Windows 11, and Windows Server installations. The vulnerability is confirmed by Microsoft's Security Response Center (secure@microsoft.com) and affects a broad range of supported Windows releases from build 1809 through the latest 26H1 branch. Patches are available across all affected product lines. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in Windows Credential Providers enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges across a broad range of Windows 10, 11, and Windows Server releases. The CWE-122 flaw resides in the credential provider subsystem, requiring no user interaction and no elevated starting privileges, making it a reliable post-compromise escalation primitive for multi-stage attacks. No public exploit code or active exploitation has been confirmed at time of analysis; a vendor patch from Microsoft is available covering all affected branches.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of unpatched Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker can trigger the overflow via a crafted biometric request, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Text Shaping subsystem allows remote unauthenticated attackers to achieve arbitrary code execution, with full confidentiality, integrity, and availability impact across an exceptionally broad range of Windows versions spanning Server 2012 through Windows 11 26H1. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals network-reachable, authentication-free exploitation tempered by high attack complexity - indicating that triggering reliable code execution requires overcoming specific environmental conditions such as precise heap layout. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow (CWE-122) in Microsoft Office Access enables network-delivered remote code execution across six Microsoft Office product lines. When a victim opens a maliciously crafted Access database file delivered over a network, the overflow corrupts heap memory and allows an attacker to execute arbitrary code with the privileges of the logged-in user. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Heap-based buffer overflow in the Windows DHCP Client enables an authenticated attacker on the same network segment to escalate privileges on Windows 11 systems. The vulnerability (CWE-122) affects Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds, with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code and no active exploitation have been identified at the time of analysis; Microsoft has released a patch via the June/July 2026 Patch Tuesday cycle.
Heap-based buffer overflow in the Windows Biometric Framework (WBF) service permits a low-privileged, network-adjacent authenticated attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability requires some user interaction to trigger (UI:R per CVSS), and successful exploitation yields full confidentiality, integrity, and availability impact on the target host. No active exploitation has been identified at time of analysis, and Microsoft has released patches across all supported Windows versions.
Heap-based buffer overflow in the Windows Network File System (NFS) component enables remote attackers to execute arbitrary code on unpatched Windows Server and Windows 10/11 systems where NFS services are active. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with no privilege requirement but a user-interaction dependency - consistent with a client-side NFS processing scenario or triggered NFS operation. Microsoft has released patches covering a span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows HTTP Print Provider allows an unauthenticated network attacker to execute arbitrary code by exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Server 2012 through Windows 11 25H2 and Server 2025, and per the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector requires no authentication or user interaction. No public exploit identified at time of analysis, but the network-reachable, pre-auth nature and 9.8 severity make it a high-priority patch.
Remote code execution in the Windows RNDIS (Remote Network Driver Interface Specification) component affects the full supported Windows line, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An unauthorized attacker can trigger a heap-based buffer overflow (CWE-122) by delivering malformed RNDIS control/data messages, achieving arbitrary code execution with high confidentiality, integrity, and availability impact. Microsoft has published a patch across all affected builds; there is no public exploit identified at time of analysis and no KEV/EPSS data supplied.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution across all currently-supported Office editions when a victim opens a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through 2024 LTSC on both x86 and x64 platforms, the vulnerability requires no attacker privileges but depends on user interaction - the classic malicious-document delivery model. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating, full confidentiality/integrity/availability impact, and the near-universal enterprise footprint of Microsoft Office make this a high-priority patching candidate.
Stack-based buffer overflow in the Windows Win32K kernel-mode driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM level via a network-accessible exploit path, affecting 12 distinct Windows releases spanning Windows 10 1809 through Windows Server 2025 and Windows 11 26H1. The CWE-121 flaw resides in the kernel subsystem handling GDI rendering and windowing, making successful exploitation equivalent to full operating system compromise. Microsoft has released patches addressing all affected build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Word's document parsing engine allows remote unauthenticated attackers to execute arbitrary code with the privileges of the victim user when a specially crafted Word document is opened. The flaw (CWE-121) spans Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016 on both Windows and macOS. Microsoft has released patched builds; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution is possible in Microsoft Office Publisher across multiple Office suite versions when a victim opens a maliciously crafted Publisher document. The root cause is an integer overflow or wraparound (CWE-190) in the file-parsing subsystem, which typically produces an understated buffer allocation that an attacker can exploit to corrupt heap memory and redirect execution. Affected releases span Publisher 2016 through Microsoft 365 Apps for Enterprise; vendor-released patches are available for all affected versions, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain SYSTEM-level control via a heap-based buffer overflow triggered by an integer overflow or wraparound. The flaw affects a wide sweep of Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface nearly universal across modern Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, but vendor patch is available and should be prioritized given the full C:H/I:H/A:H impact after a successful escalation.
Heap-based buffer overflow in the Windows Link Layer Topology Discovery Protocol (LLTD) implementation enables unauthenticated attackers to execute arbitrary code on affected Windows systems via crafted network-layer frames. The flaw (CWE-122) spans nearly the entire supported Windows ecosystem - from Windows 10 through Windows 11 and from Windows Server 2012 through Server 2025. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Credential Providers enables a low-privileged authenticated attacker to execute arbitrary code over the network on affected Windows 11 and Windows Server 2025 systems. The flaw (CWE-122) is reachable via network with low complexity and no user interaction required, making it exploitable by any account holder with minimal privileges. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a network-based privilege escalation by an authenticated low-privilege attacker who can trigger user interaction. The vulnerability (CWE-122) spans a broad swath of Microsoft's supported Windows ecosystem, from Windows 10 version 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Exploitation results in full compromise of confidentiality, integrity, and availability on the target system. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected branches.
Stack-based buffer overflow in Microsoft Word (CWE-121) enables remote code execution by enticing a user to open a maliciously crafted document, with full compromise of confidentiality, integrity, and availability. Affected products span Office 2019, 2021, and 2024 LTSC on both Windows (x86/x64) and macOS, as well as Microsoft 365 Apps for Enterprise and Word 2016. Microsoft has released patches across all affected product lines; no public exploit code has been identified and CISA KEV confirmation is absent at time of analysis.
Heap-based buffer overflow in the Windows MIDI Service Module enables a local authenticated attacker on Windows 11 to escalate privileges, with full confidentiality, integrity, and availability impact in the compromised process scope. Affected builds span three servicing tracks - 24H2, 25H2, and 26H1 - with fixed builds published by Microsoft through MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in the Microsoft Windows DirectShow media framework arises from an out-of-bounds memory condition (classed as heap overflow, CWE-122) that lets a remote attacker run arbitrary code when a victim system processes maliciously crafted media. It affects the DirectShow component across nearly all supported Windows client and server releases (Windows 10/11, Server 2012 through Server 2025). Microsoft self-reported and has shipped patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the Windows Device Association Service enables an authenticated, low-privileged network attacker to escalate privileges to full system compromise across Windows 10, Windows 11, and Windows Server 2012 through 2025. The vulnerability (CWE-121) requires user interaction to trigger but delivers complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has issued patches covering the full affected version range.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Local privilege escalation in the Windows USB Audio Class driver (usbaudio.sys) allows a low-privileged authenticated user to gain full system control via an integer overflow. The flaw affects an exceptionally broad range of Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected systems make this a meaningful enterprise patching priority.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Privilege escalation via a stack-based buffer overflow in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server 2019/2022/2025 across a wide range of release builds. A low-privilege network attacker who induces victim user interaction can achieve full confidentiality, integrity, and availability compromise of the targeted system, consistent with elevation to SYSTEM-level access. A vendor-released patch is available via Microsoft Patch Tuesday; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) service enables a low-privileged authenticated attacker to elevate privileges to a higher level over a network connection. The vulnerability (CWE-122) spans virtually the entire supported Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making it a broad enterprise patching obligation. Microsoft has released cumulative updates addressing the issue; no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Word's document-parsing engine enables network-delivered remote code execution with full system impact across all current Microsoft Office product lines on Windows and macOS. The vulnerability (CWE-121) is triggered when a user opens a specially crafted Word document, overflowing a fixed-size stack buffer and allowing an attacker to hijack control flow and execute arbitrary code in the context of the logged-in user. Affected versions span Word 2016 through Microsoft 365 Apps for Enterprise and LTSC editions on both x86/x64 Windows and macOS; patches are available per vendor advisory, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privilege, network-reachable attacker - following required user interaction - to escalate privileges to SYSTEM level, achieving full compromise (C:H/I:H/A:H) of the affected host. The vulnerability spans nearly every supported Windows version from Server 2012 through Server 2025 and Windows 10/11 across all major releases, creating an exceptionally broad attack surface. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; however, Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Microsoft Office Word's document parsing engine enables an unauthenticated remote attacker to achieve full code execution on a victim's system when a specially crafted Word document is opened. The flaw spans all major currently-supported Office release channels on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and macOS editions. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity, broad product footprint, and well-understood Office document exploitation tradecraft make this a high-priority patching candidate.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Heap-based buffer overflow in Windows Raw Image Extension (versions 2.1.0.0 through <2.4.24.0) enables remote code execution when a victim opens or previews a specially crafted raw camera image file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that no attacker authentication is required - only user interaction with a malicious file - yielding full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis, but the file-parsing attack surface and high CVSS impact make this a meaningful priority for environments with photography workflows.
Heap-based buffer overflow in Windows Spaceport.sys - the kernel-mode driver backing Microsoft Storage Spaces - permits an authenticated low-privileged network attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans virtually the entire modern Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels. Microsoft has released patched builds via the standard Windows Update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Heap-based buffer overflow in Microsoft Office Outlook enables remote unauthenticated attackers to execute arbitrary code on the victim's system across multiple current Office product lines. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects network-accessible exploitation requiring no privilege, with the sole limiting gate being user interaction-likely opening or previewing a crafted message. No active exploitation is confirmed via CISA KEV and no public exploit code is known at time of analysis; Microsoft has released patched builds across all affected product lines.
Heap-based buffer overflow in the Windows iSCSI service allows an authenticated, network-accessible attacker with low-level privileges to execute arbitrary code on affected systems. The vulnerability spans an exceptionally broad set of Windows releases - from Server 2012 and Windows 10 through Windows 11 26H1 and Server 2025 - making patch surface management a significant operational challenge for enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network vector and full CIA impact yield a CVSS score of 8.8.
Heap-based buffer overflow in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables low-privileged authenticated attackers to escalate privileges to SYSTEM-level over the network. Affecting Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2019 through 2025, the flaw carries a CVSS 8.0 rating with full CIA impact upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in the Windows HTTP Print Provider component enables an authorized low-privilege network attacker to achieve remote code execution with full C/I/A impact on affected Windows systems. The vulnerability spans an exceptionally wide range of Microsoft operating systems from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the breadth of affected versions and high CVSS score of 8.0 make this a significant patching priority across enterprise Windows environments.
Heap-based buffer overflow in Windows Fax Service enables a low-privileged local attacker to escalate privileges to SYSTEM on a wide range of Windows client and server versions. The flaw (CWE-122) is confirmed patched by Microsoft via their monthly update cycle, with fixed build numbers available across every affected version from Windows Server 2012 through Windows 11 26H1. No public exploit code or active exploitation has been identified at time of analysis; however, the all-high C:H/I:H/A:H impact and broad platform coverage make this a meaningful patch-cycle priority for any organization running Windows Fax Service.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Privilege escalation in the Windows exFAT File System driver (CWE-125, out-of-bounds read) allows an authenticated low-privilege attacker to gain elevated rights over a network connection. All major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 are confirmed affected per EUVD version data. No public exploit or CISA KEV listing was identified at time of analysis, though the broad affected scope across the entire current Windows ecosystem and the high CVSS score of 8.0 make patching urgent.
Stack-based buffer overflow in Microsoft Access enables remote code execution when a user opens a specially crafted database file, delivering full confidentiality, integrity, and availability compromise on the vulnerable host. Affected products span all current Microsoft Office release trains - Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad enterprise attack surface. Microsoft has released patches via its standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. A vendor-released patch is available; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Hyper-V enables a low-privileged guest VM user to escape the hypervisor sandbox and execute arbitrary code on the host system. The CVSS scope-change metric (S:C) and C:H/I:H/A:H impact ratings confirm this is a full VM-escape class vulnerability, giving an attacker inside a guest complete control over the underlying Hyper-V host. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through Server 2025; Microsoft has released patches via Windows Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.