Buffer Overflow
Monthly
Remote code execution in the Microsoft Windows DirectShow media framework arises from an out-of-bounds memory condition (classed as heap overflow, CWE-122) that lets a remote attacker run arbitrary code when a victim system processes maliciously crafted media. It affects the DirectShow component across nearly all supported Windows client and server releases (Windows 10/11, Server 2012 through Server 2025). Microsoft self-reported and has shipped patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the Windows Device Association Service enables an authenticated, low-privileged network attacker to escalate privileges to full system compromise across Windows 10, Windows 11, and Windows Server 2012 through 2025. The vulnerability (CWE-121) requires user interaction to trigger but delivers complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has issued patches covering the full affected version range.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Local privilege escalation in the Windows USB Audio Class driver (usbaudio.sys) allows a low-privileged authenticated user to gain full system control via an integer overflow. The flaw affects an exceptionally broad range of Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected systems make this a meaningful enterprise patching priority.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Privilege escalation via a stack-based buffer overflow in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server 2019/2022/2025 across a wide range of release builds. A low-privilege network attacker who induces victim user interaction can achieve full confidentiality, integrity, and availability compromise of the targeted system, consistent with elevation to SYSTEM-level access. A vendor-released patch is available via Microsoft Patch Tuesday; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) service enables a low-privileged authenticated attacker to elevate privileges to a higher level over a network connection. The vulnerability (CWE-122) spans virtually the entire supported Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making it a broad enterprise patching obligation. Microsoft has released cumulative updates addressing the issue; no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Word's document-parsing engine enables network-delivered remote code execution with full system impact across all current Microsoft Office product lines on Windows and macOS. The vulnerability (CWE-121) is triggered when a user opens a specially crafted Word document, overflowing a fixed-size stack buffer and allowing an attacker to hijack control flow and execute arbitrary code in the context of the logged-in user. Affected versions span Word 2016 through Microsoft 365 Apps for Enterprise and LTSC editions on both x86/x64 Windows and macOS; patches are available per vendor advisory, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privilege, network-reachable attacker - following required user interaction - to escalate privileges to SYSTEM level, achieving full compromise (C:H/I:H/A:H) of the affected host. The vulnerability spans nearly every supported Windows version from Server 2012 through Server 2025 and Windows 10/11 across all major releases, creating an exceptionally broad attack surface. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; however, Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Microsoft Office Word's document parsing engine enables an unauthenticated remote attacker to achieve full code execution on a victim's system when a specially crafted Word document is opened. The flaw spans all major currently-supported Office release channels on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and macOS editions. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity, broad product footprint, and well-understood Office document exploitation tradecraft make this a high-priority patching candidate.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Heap-based buffer overflow in Windows Raw Image Extension (versions 2.1.0.0 through <2.4.24.0) enables remote code execution when a victim opens or previews a specially crafted raw camera image file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that no attacker authentication is required - only user interaction with a malicious file - yielding full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis, but the file-parsing attack surface and high CVSS impact make this a meaningful priority for environments with photography workflows.
Heap-based buffer overflow in Windows Spaceport.sys - the kernel-mode driver backing Microsoft Storage Spaces - permits an authenticated low-privileged network attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans virtually the entire modern Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels. Microsoft has released patched builds via the standard Windows Update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Heap-based buffer overflow in Microsoft Office Outlook enables remote unauthenticated attackers to execute arbitrary code on the victim's system across multiple current Office product lines. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects network-accessible exploitation requiring no privilege, with the sole limiting gate being user interaction-likely opening or previewing a crafted message. No active exploitation is confirmed via CISA KEV and no public exploit code is known at time of analysis; Microsoft has released patched builds across all affected product lines.
Heap-based buffer overflow in the Windows iSCSI service allows an authenticated, network-accessible attacker with low-level privileges to execute arbitrary code on affected systems. The vulnerability spans an exceptionally broad set of Windows releases - from Server 2012 and Windows 10 through Windows 11 26H1 and Server 2025 - making patch surface management a significant operational challenge for enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network vector and full CIA impact yield a CVSS score of 8.8.
Heap-based buffer overflow in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables low-privileged authenticated attackers to escalate privileges to SYSTEM-level over the network. Affecting Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2019 through 2025, the flaw carries a CVSS 8.0 rating with full CIA impact upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in the Windows HTTP Print Provider component enables an authorized low-privilege network attacker to achieve remote code execution with full C/I/A impact on affected Windows systems. The vulnerability spans an exceptionally wide range of Microsoft operating systems from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the breadth of affected versions and high CVSS score of 8.0 make this a significant patching priority across enterprise Windows environments.
Heap-based buffer overflow in Windows Fax Service enables a low-privileged local attacker to escalate privileges to SYSTEM on a wide range of Windows client and server versions. The flaw (CWE-122) is confirmed patched by Microsoft via their monthly update cycle, with fixed build numbers available across every affected version from Windows Server 2012 through Windows 11 26H1. No public exploit code or active exploitation has been identified at time of analysis; however, the all-high C:H/I:H/A:H impact and broad platform coverage make this a meaningful patch-cycle priority for any organization running Windows Fax Service.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Privilege escalation in the Windows exFAT File System driver (CWE-125, out-of-bounds read) allows an authenticated low-privilege attacker to gain elevated rights over a network connection. All major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 are confirmed affected per EUVD version data. No public exploit or CISA KEV listing was identified at time of analysis, though the broad affected scope across the entire current Windows ecosystem and the high CVSS score of 8.0 make patching urgent.
Stack-based buffer overflow in Microsoft Access enables remote code execution when a user opens a specially crafted database file, delivering full confidentiality, integrity, and availability compromise on the vulnerable host. Affected products span all current Microsoft Office release trains - Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad enterprise attack surface. Microsoft has released patches via its standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. A vendor-released patch is available; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Hyper-V enables a low-privileged guest VM user to escape the hypervisor sandbox and execute arbitrary code on the host system. The CVSS scope-change metric (S:C) and C:H/I:H/A:H impact ratings confirm this is a full VM-escape class vulnerability, giving an attacker inside a guest complete control over the underlying Hyper-V host. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through Server 2025; Microsoft has released patches via Windows Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in the Windows Local Security Authority Server (lsasrv.dll) enables an authenticated local attacker to escalate privileges to SYSTEM on affected Windows Server 2025 and Windows 11 systems. The vulnerability resides in a core authentication and security-policy component running under the lsass.exe process, making successful exploitation effectively equivalent to full system compromise. No public exploit identified at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) affects a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated local attacker with low-privilege access can trigger the overflow to gain full control of the affected system, achieving confidentiality, integrity, and availability compromise at SYSTEM level. No public exploit code or KEV listing has been identified at time of analysis, but the patch is available from Microsoft and should be prioritized on workstations and servers where biometric authentication is in use.
Heap-based buffer overflow in the Windows Universal Disk Format File System (UDFS) kernel driver enables a low-privileged local user to escalate privileges to SYSTEM across a broad swath of Windows releases spanning Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw resides in the filesystem driver responsible for reading UDF-formatted volumes (optical media, some removable storage), and exploitation requires only a standard user account with no user interaction. Microsoft has released patches through the update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a wide range of Windows desktop and server releases. The full C:H/I:H/A:H CVSS triad indicates complete host compromise once exploited. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions.
Remote code execution in Microsoft Windows PDF rendering affects a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds, where an integer overflow while parsing a crafted PDF wraps a size calculation and triggers a heap-based buffer overflow (CWE-122). An unauthenticated attacker who delivers a malicious PDF over the network can execute arbitrary code with the privileges of the rendering process. A vendor patch is available; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Privilege escalation in the Windows USB Video Driver affects Windows 10, Windows 11, and Windows Server 2012 through 2025, allowing a low-privileged local attacker to elevate to SYSTEM-level access. The root cause is an integer overflow or wraparound (CWE-190) in the kernel-mode USB video driver, which under exploitation yields full confidentiality, integrity, and availability compromise of the affected host. Microsoft has released patches via the standard update channel; no public exploit code or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server platforms. The flaw (CWE-122) affects Windows 10 through Windows 11 and Windows Server 2016 through 2025, with Microsoft having released patches for all affected builds. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity rating indicates reliable exploitability for a skilled attacker who has already achieved local access.
Local privilege escalation via a buffer over-read in the Windows Volume Manager Extension Driver enables authenticated local users to gain SYSTEM-level access across a broad range of Windows client and server releases. The flaw resides in a kernel-mode driver component where insufficient bounds checking during volume management operations allows reading beyond an allocated buffer, with the resulting memory condition exploitable to corrupt process tokens and elevate privileges. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables local privilege escalation across a wide swath of Microsoft Windows desktop and server releases. An authorized attacker holding only standard user privileges can trigger memory corruption in the biometric authentication subsystem, likely achieving SYSTEM-level code execution. The vulnerability spans Windows 10 through Windows 11 26H1 and Windows Server 2016 through Server 2025, representing virtually the entire active Windows ecosystem; a vendor-released patch is available with no public exploit identified at time of analysis.
Privilege escalation in the Windows Kernel via a numeric truncation error that leads to a heap-based buffer overflow allows a local low-privileged attacker to gain full SYSTEM-level control. The vulnerability spans virtually the entire active Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the low privilege requirement and full C/I/A impact make this a high-priority patch target for all Windows environments.
Heap-based buffer overflow in the Windows USB Audio Class kernel driver (usbaudio.sys) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and requires no user interaction beyond the attacker's own session. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Microsoft Update.
Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges on the local machine. The flaw spans an exceptionally broad range of Windows client and server releases - from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released targeted patches for all affected build lines; no public exploit code or active exploitation has been identified at time of analysis, though the full CIA:H impact and unchanged scope confirm full local system compromise is the end-state if exploited.
Heap-based buffer overflow (CWE-122) in Microsoft Office Word enables unauthenticated remote code execution when a victim opens a specially crafted document. All currently supported Office product lines are affected across Windows (x86/x64) and macOS, including Microsoft 365 Apps for Enterprise, Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 for Mac. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected products and full C/I/A impact make this a high-priority patching item across virtually all enterprise environments.
Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Privilege escalation in the Windows SMB Client component of Windows 11 26H1 allows a locally authenticated attacker with standard user privileges to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability is constrained to local attack vectors, meaning remote unauthenticated exploitation is not possible. Microsoft has released a patch (build 10.0.28000.2954); no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Camera Frame Server Monitor service enables a local authenticated user to elevate privileges to SYSTEM on Windows 11 and Windows Server 2025. Exploitation requires only a standard user account and no user interaction, making it a reliable post-exploitation privilege escalation primitive. Microsoft has released patches addressing all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local user to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server editions. The flaw (CWE-122) resides in the kernel-mode storage driver that handles VHD/VHDX virtual disk images, enabling an attacker with standard user rights to corrupt heap memory and execute arbitrary code in kernel context. No public exploit or active exploitation has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Spaceport.sys (the Storage Spaces kernel driver) allows a low-privileged authenticated attacker to achieve full system compromise via a numeric truncation error that triggers a heap-based buffer overflow. The vulnerability affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature updates, with fixed build numbers confirmed by Microsoft through MSRC. No public exploit identified at time of analysis, but the local LPE class in kernel drivers is historically a high-priority target for post-exploitation toolkits.
Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a user opens a specially crafted Access database file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network delivery requiring only a single user interaction - consistent with a malicious file attachment or download attack pattern. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) and broad affected version range spanning Office 2016 through Microsoft 365 Apps make this a high-priority patch-cycle item.
Heap-based buffer overflow in Microsoft Visual Studio and .NET affects multiple release branches and allows a remote unauthenticated attacker to execute arbitrary code on a victim's machine when the victim interacts with malicious content. Affected scope spans Visual Studio 2022 (17.14.x), Visual Studio 2026 (18.9.x), and the full current .NET runtime family (8.0, 9.0, 10.0, 11.0 RC1) as well as legacy .NET Framework branches from 3.5 through 4.8.1. Microsoft has released patches for all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Local privilege escalation in Windows Error Reporting (WER) allows a low-privileged authenticated user to gain SYSTEM-level access via a heap-based buffer overflow. The vulnerability affects a wide range of Windows desktop and server editions from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, no-interaction CVSS vector makes this a practical post-exploitation stepping stone.
Heap-based buffer overflow in Spaceport.sys - the Windows kernel-mode driver for Storage Spaces - allows a low-privileged authenticated attacker to escalate to SYSTEM-level privileges over a network, with full confidentiality, integrity, and availability impact. Every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 is affected before the patched builds. Microsoft has released patches via the MSRC advisory; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows MIDI Service Module enables local privilege escalation on Windows 11 systems across three major release branches. An authenticated local attacker with standard user privileges (PR:L) can trigger the overflow with low complexity and no user interaction, achieving full SYSTEM-level compromise (C:H/I:H/A:H). Microsoft has released patches covering Windows 11 versions 24H2, 25H2, and 26H1; no public exploit or KEV listing is present at time of analysis.
Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.
Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.
Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables a low-privileged local attacker to escalate privileges to SYSTEM level. The vulnerability (CWE-122) affects an extremely wide surface - fifteen distinct Windows 10, Windows 11, and Windows Server release trains from Server 2016 through Server 2025 - making it relevant to virtually every Windows enterprise environment. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through Windows Update.
Privilege escalation via heap-based buffer overflow in Windows Enterprise App Management affects a broad swath of Windows desktop and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated network attacker with low privileges who can induce a target user to interact with a crafted payload can trigger the overflow and achieve full system-level compromise (High C/I/A). No public exploit code or CISA KEV listing was identified at time of analysis, but the breadth of affected Windows versions and the vendor-released patch signal a systemic component-level flaw.
Privilege escalation to SYSTEM-level via a heap-based buffer overflow in the Windows Partition Management Driver affects multiple Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker with low privileges can exploit the CWE-122 heap overflow to achieve full confidentiality, integrity, and availability impact on the local system. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.
Heap-based buffer overflow in the Windows Device Association Service enables a low-privileged local user to escalate privileges to SYSTEM level across a broad range of Windows desktop and server platforms. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025 - all prior to their respective patched builds detailed in the Microsoft MSRC advisory. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV active-exploitation listing has been confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution with full system impact when a low-privileged user opens a specially crafted database file. Affected products span Access 2016 through Microsoft 365 Apps for Enterprise, covering the majority of Microsoft Office deployments. Microsoft has released patches across all affected product lines; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Local privilege escalation in the Windows Volume Manager Extension Driver allows a low-privileged authenticated user to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability spans an exceptionally wide range of Windows versions - from the legacy Windows Server 2012 and Windows 10 1607 through the current Windows 11 26H1 and Windows Server 2025 - making patching scope a significant operational challenge. No public exploit code or CISA KEV listing has been identified at the time of analysis, and the CVSS AC:H metric reflects meaningful exploitation complexity, but the vulnerability's kernel-mode scope and full C:H/I:H/A:H impact make it a high-value post-compromise tool.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker with standard user privileges to escalate to full system control across Windows 10 and Windows 11. The flaw (CWE-121) is triggered locally with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 vector. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-privilege requirement and zero interaction needed make this a realistic post-compromise escalation primitive.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Error Reporting (WER) enables network-based privilege escalation across a broad range of Windows desktop and server versions. An authenticated low-privileged attacker who can trigger user interaction can exploit the overflow to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level control. No public exploit code has been identified at time of analysis, but the breadth of affected versions (Windows 10 through Server 2025) and the ubiquity of WER in Windows deployments make this a high-priority patch item.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Power Dependency Coordinator component allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server systems. The flaw (CWE-122) requires only a local account and no user interaction, making it a reliable post-compromise escalation primitive. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the low attack complexity (AC:L) and broad platform coverage across Windows 10 through Server 2025 make patching a priority in any environment where insider threat or malware post-exploitation is a concern.
Heap-based buffer overflow in Microsoft Windows Speech (CWE-122) allows a local low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans the entire modern Windows platform - Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. No public exploit code or CISA KEV entry has been identified at time of analysis; however, the vendor patch is confirmed available via MSRC.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting low exploitation complexity once a local foothold is established. Microsoft has released patches across all affected build lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in Microsoft Windows Speech enables local privilege escalation across Windows 10, Windows 11, and Windows Server platforms from 2016 through 2025. An authorized local attacker holding only a standard user account can exploit the CWE-122 flaw without user interaction to obtain full system compromise (C:H/I:H/A:H), effectively achieving SYSTEM-level privileges. Vendor-supplied patches are available via MSRC; no public exploit code has been identified at time of analysis.
Remote code execution in Microsoft Office exposes unauthenticated network attackers to full system compromise when a target user opens a specially crafted document. The root cause is a heap-based buffer overflow (CWE-122) in Office's document parsing logic, affecting Office 2016 through Microsoft 365 Apps for Enterprise across a defined range of 16.x builds confirmed by EUVD-2026-73711. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score with a network attack vector and no required attacker privileges - beyond inducing user file-open interaction - reflects a credible, high-impact threat against the world's most widely deployed office productivity suite.
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker to achieve privilege escalation - and given the full C:H/I:H/A:H CVSS impact, effectively arbitrary code execution - on affected systems when a user interacts with attacker-controlled content. Affected are .NET 8.0 through 11.0 RC1 and Visual Studio 2022/2026 across multiple release trains. The Microsoft Security Response Center disclosed and patched the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Error Reporting (WER) via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker - holding only standard user privileges - to achieve full system compromise across all current Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity and no interaction requirement, making this an effective land-and-escalate primitive for threat actors with any initial foothold on a target host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.
Heap-based buffer overflow in Windows Error Reporting (WER) enables a locally authenticated attacker to escalate privileges to SYSTEM or administrative level on affected Windows endpoints and servers. The vulnerability spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the local privilege escalation primitive is highly valuable for post-compromise attackers pivoting from user-level access.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Remote code execution in the Microsoft Windows Telnet Client (telnet.exe) stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code over the network. All currently-serviced Windows client and server editions - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - are affected until patched. Microsoft rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in the Microsoft Windows DirectShow media framework arises from an out-of-bounds memory condition (classed as heap overflow, CWE-122) that lets a remote attacker run arbitrary code when a victim system processes maliciously crafted media. It affects the DirectShow component across nearly all supported Windows client and server releases (Windows 10/11, Server 2012 through Server 2025). Microsoft self-reported and has shipped patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the Windows Device Association Service enables an authenticated, low-privileged network attacker to escalate privileges to full system compromise across Windows 10, Windows 11, and Windows Server 2012 through 2025. The vulnerability (CWE-121) requires user interaction to trigger but delivers complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has issued patches covering the full affected version range.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Local privilege escalation in the Windows USB Audio Class driver (usbaudio.sys) allows a low-privileged authenticated user to gain full system control via an integer overflow. The flaw affects an exceptionally broad range of Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) and breadth of affected systems make this a meaningful enterprise patching priority.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Privilege escalation via a stack-based buffer overflow in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server 2019/2022/2025 across a wide range of release builds. A low-privilege network attacker who induces victim user interaction can achieve full confidentiality, integrity, and availability compromise of the targeted system, consistent with elevation to SYSTEM-level access. A vendor-released patch is available via Microsoft Patch Tuesday; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) service enables a low-privileged authenticated attacker to elevate privileges to a higher level over a network connection. The vulnerability (CWE-122) spans virtually the entire supported Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making it a broad enterprise patching obligation. Microsoft has released cumulative updates addressing the issue; no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in Microsoft Word's document-parsing engine enables network-delivered remote code execution with full system impact across all current Microsoft Office product lines on Windows and macOS. The vulnerability (CWE-121) is triggered when a user opens a specially crafted Word document, overflowing a fixed-size stack buffer and allowing an attacker to hijack control flow and execute arbitrary code in the context of the logged-in user. Affected versions span Word 2016 through Microsoft 365 Apps for Enterprise and LTSC editions on both x86/x64 Windows and macOS; patches are available per vendor advisory, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privilege, network-reachable attacker - following required user interaction - to escalate privileges to SYSTEM level, achieving full compromise (C:H/I:H/A:H) of the affected host. The vulnerability spans nearly every supported Windows version from Server 2012 through Server 2025 and Windows 10/11 across all major releases, creating an exceptionally broad attack surface. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; however, Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Microsoft Office Word's document parsing engine enables an unauthenticated remote attacker to achieve full code execution on a victim's system when a specially crafted Word document is opened. The flaw spans all major currently-supported Office release channels on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and macOS editions. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity, broad product footprint, and well-understood Office document exploitation tradecraft make this a high-priority patching candidate.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Heap-based buffer overflow in Windows Raw Image Extension (versions 2.1.0.0 through <2.4.24.0) enables remote code execution when a victim opens or previews a specially crafted raw camera image file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that no attacker authentication is required - only user interaction with a malicious file - yielding full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis, but the file-parsing attack surface and high CVSS impact make this a meaningful priority for environments with photography workflows.
Heap-based buffer overflow in Windows Spaceport.sys - the kernel-mode driver backing Microsoft Storage Spaces - permits an authenticated low-privileged network attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans virtually the entire modern Windows ecosystem, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels. Microsoft has released patched builds via the standard Windows Update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Windows DNS Server across multiple Windows Server versions (2012 through 2025) contains a network-exploitable integer overflow (CWE-190) that unauthenticated remote attackers can trigger to crash or hang the DNS service, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making any exposed DNS server a direct target. No public exploit or active exploitation has been identified at time of analysis, but the ubiquity of Windows DNS in Active Directory environments and the critical downstream effects of DNS outages (authentication, name resolution, Group Policy) elevate operational risk beyond the 7.5 base score alone.
Heap-based buffer overflow in Microsoft Office Outlook enables remote unauthenticated attackers to execute arbitrary code on the victim's system across multiple current Office product lines. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects network-accessible exploitation requiring no privilege, with the sole limiting gate being user interaction-likely opening or previewing a crafted message. No active exploitation is confirmed via CISA KEV and no public exploit code is known at time of analysis; Microsoft has released patched builds across all affected product lines.
Heap-based buffer overflow in the Windows iSCSI service allows an authenticated, network-accessible attacker with low-level privileges to execute arbitrary code on affected systems. The vulnerability spans an exceptionally broad set of Windows releases - from Server 2012 and Windows 10 through Windows 11 26H1 and Server 2025 - making patch surface management a significant operational challenge for enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network vector and full CIA impact yield a CVSS score of 8.8.
Heap-based buffer overflow in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables low-privileged authenticated attackers to escalate privileges to SYSTEM-level over the network. Affecting Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2019 through 2025, the flaw carries a CVSS 8.0 rating with full CIA impact upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in the Windows HTTP Print Provider component enables an authorized low-privilege network attacker to achieve remote code execution with full C/I/A impact on affected Windows systems. The vulnerability spans an exceptionally wide range of Microsoft operating systems from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the breadth of affected versions and high CVSS score of 8.0 make this a significant patching priority across enterprise Windows environments.
Heap-based buffer overflow in Windows Fax Service enables a low-privileged local attacker to escalate privileges to SYSTEM on a wide range of Windows client and server versions. The flaw (CWE-122) is confirmed patched by Microsoft via their monthly update cycle, with fixed build numbers available across every affected version from Windows Server 2012 through Windows 11 26H1. No public exploit code or active exploitation has been identified at time of analysis; however, the all-high C:H/I:H/A:H impact and broad platform coverage make this a meaningful patch-cycle priority for any organization running Windows Fax Service.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Privilege escalation in the Windows exFAT File System driver (CWE-125, out-of-bounds read) allows an authenticated low-privilege attacker to gain elevated rights over a network connection. All major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 are confirmed affected per EUVD version data. No public exploit or CISA KEV listing was identified at time of analysis, though the broad affected scope across the entire current Windows ecosystem and the high CVSS score of 8.0 make patching urgent.
Stack-based buffer overflow in Microsoft Access enables remote code execution when a user opens a specially crafted database file, delivering full confidentiality, integrity, and availability compromise on the vulnerable host. Affected products span all current Microsoft Office release trains - Access 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - representing a broad enterprise attack surface. Microsoft has released patches via its standard update channel; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search Component allows a low-privilege authenticated local user to gain SYSTEM-level access across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The root cause is an integer overflow (CWE-190) that can corrupt memory in a privileged process context, yielding full confidentiality, integrity, and availability compromise of the local system. A vendor-released patch is available; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Hyper-V enables a low-privileged guest VM user to escape the hypervisor sandbox and execute arbitrary code on the host system. The CVSS scope-change metric (S:C) and C:H/I:H/A:H impact ratings confirm this is a full VM-escape class vulnerability, giving an attacker inside a guest complete control over the underlying Hyper-V host. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through Server 2025; Microsoft has released patches via Windows Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in the Windows Local Security Authority Server (lsasrv.dll) enables an authenticated local attacker to escalate privileges to SYSTEM on affected Windows Server 2025 and Windows 11 systems. The vulnerability resides in a core authentication and security-policy component running under the lsass.exe process, making successful exploitation effectively equivalent to full system compromise. No public exploit identified at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) affects a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated local attacker with low-privilege access can trigger the overflow to gain full control of the affected system, achieving confidentiality, integrity, and availability compromise at SYSTEM level. No public exploit code or KEV listing has been identified at time of analysis, but the patch is available from Microsoft and should be prioritized on workstations and servers where biometric authentication is in use.
Heap-based buffer overflow in the Windows Universal Disk Format File System (UDFS) kernel driver enables a low-privileged local user to escalate privileges to SYSTEM across a broad swath of Windows releases spanning Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw resides in the filesystem driver responsible for reading UDF-formatted volumes (optical media, some removable storage), and exploitation requires only a standard user account with no user interaction. Microsoft has released patches through the update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) lets network attackers run arbitrary code on affected hosts without authentication or user interaction. The flaw is a heap-based buffer overflow (CWE-122) in RRAS request handling, carrying a CVSS 9.8 and impacting the full supported Windows and Windows Server line (Windows 10/11 and Server 2012 through 2025). Microsoft has shipped fixes; no public exploit code or active-exploitation reporting has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a wide range of Windows desktop and server releases. The full C:H/I:H/A:H CVSS triad indicates complete host compromise once exploited. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions.
Remote code execution in Microsoft Windows PDF rendering affects a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds, where an integer overflow while parsing a crafted PDF wraps a size calculation and triggers a heap-based buffer overflow (CWE-122). An unauthenticated attacker who delivers a malicious PDF over the network can execute arbitrary code with the privileges of the rendering process. A vendor patch is available; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Privilege escalation in the Windows USB Video Driver affects Windows 10, Windows 11, and Windows Server 2012 through 2025, allowing a low-privileged local attacker to elevate to SYSTEM-level access. The root cause is an integer overflow or wraparound (CWE-190) in the kernel-mode USB video driver, which under exploitation yields full confidentiality, integrity, and availability compromise of the affected host. Microsoft has released patches via the standard update channel; no public exploit code or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server platforms. The flaw (CWE-122) affects Windows 10 through Windows 11 and Windows Server 2016 through 2025, with Microsoft having released patches for all affected builds. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity rating indicates reliable exploitability for a skilled attacker who has already achieved local access.
Local privilege escalation via a buffer over-read in the Windows Volume Manager Extension Driver enables authenticated local users to gain SYSTEM-level access across a broad range of Windows client and server releases. The flaw resides in a kernel-mode driver component where insufficient bounds checking during volume management operations allows reading beyond an allocated buffer, with the resulting memory condition exploitable to corrupt process tokens and elevate privileges. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables local privilege escalation across a wide swath of Microsoft Windows desktop and server releases. An authorized attacker holding only standard user privileges can trigger memory corruption in the biometric authentication subsystem, likely achieving SYSTEM-level code execution. The vulnerability spans Windows 10 through Windows 11 26H1 and Windows Server 2016 through Server 2025, representing virtually the entire active Windows ecosystem; a vendor-released patch is available with no public exploit identified at time of analysis.
Privilege escalation in the Windows Kernel via a numeric truncation error that leads to a heap-based buffer overflow allows a local low-privileged attacker to gain full SYSTEM-level control. The vulnerability spans virtually the entire active Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the low privilege requirement and full C/I/A impact make this a high-priority patch target for all Windows environments.
Heap-based buffer overflow in the Windows USB Audio Class kernel driver (usbaudio.sys) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and requires no user interaction beyond the attacker's own session. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Microsoft Update.
Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges on the local machine. The flaw spans an exceptionally broad range of Windows client and server releases - from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released targeted patches for all affected build lines; no public exploit code or active exploitation has been identified at time of analysis, though the full CIA:H impact and unchanged scope confirm full local system compromise is the end-state if exploited.
Heap-based buffer overflow (CWE-122) in Microsoft Office Word enables unauthenticated remote code execution when a victim opens a specially crafted document. All currently supported Office product lines are affected across Windows (x86/x64) and macOS, including Microsoft 365 Apps for Enterprise, Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 for Mac. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected products and full C/I/A impact make this a high-priority patching item across virtually all enterprise environments.
Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Privilege escalation in the Windows SMB Client component of Windows 11 26H1 allows a locally authenticated attacker with standard user privileges to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability is constrained to local attack vectors, meaning remote unauthenticated exploitation is not possible. Microsoft has released a patch (build 10.0.28000.2954); no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Camera Frame Server Monitor service enables a local authenticated user to elevate privileges to SYSTEM on Windows 11 and Windows Server 2025. Exploitation requires only a standard user account and no user interaction, making it a reliable post-exploitation privilege escalation primitive. Microsoft has released patches addressing all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local user to escalate to SYSTEM-level privileges across a broad range of Windows desktop and server editions. The flaw (CWE-122) resides in the kernel-mode storage driver that handles VHD/VHDX virtual disk images, enabling an attacker with standard user rights to corrupt heap memory and execute arbitrary code in kernel context. No public exploit or active exploitation has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Spaceport.sys (the Storage Spaces kernel driver) allows a low-privileged authenticated attacker to achieve full system compromise via a numeric truncation error that triggers a heap-based buffer overflow. The vulnerability affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature updates, with fixed build numbers confirmed by Microsoft through MSRC. No public exploit identified at time of analysis, but the local LPE class in kernel drivers is historically a high-priority target for post-exploitation toolkits.
Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a user opens a specially crafted Access database file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network delivery requiring only a single user interaction - consistent with a malicious file attachment or download attack pattern. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) and broad affected version range spanning Office 2016 through Microsoft 365 Apps make this a high-priority patch-cycle item.
Heap-based buffer overflow in Microsoft Visual Studio and .NET affects multiple release branches and allows a remote unauthenticated attacker to execute arbitrary code on a victim's machine when the victim interacts with malicious content. Affected scope spans Visual Studio 2022 (17.14.x), Visual Studio 2026 (18.9.x), and the full current .NET runtime family (8.0, 9.0, 10.0, 11.0 RC1) as well as legacy .NET Framework branches from 3.5 through 4.8.1. Microsoft has released patches for all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Local privilege escalation in Windows Error Reporting (WER) allows a low-privileged authenticated user to gain SYSTEM-level access via a heap-based buffer overflow. The vulnerability affects a wide range of Windows desktop and server editions from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, no-interaction CVSS vector makes this a practical post-exploitation stepping stone.
Heap-based buffer overflow in Spaceport.sys - the Windows kernel-mode driver for Storage Spaces - allows a low-privileged authenticated attacker to escalate to SYSTEM-level privileges over a network, with full confidentiality, integrity, and availability impact. Every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 is affected before the patched builds. Microsoft has released patches via the MSRC advisory; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows MIDI Service Module enables local privilege escalation on Windows 11 systems across three major release branches. An authenticated local attacker with standard user privileges (PR:L) can trigger the overflow with low complexity and no user interaction, achieving full SYSTEM-level compromise (C:H/I:H/A:H). Microsoft has released patches covering Windows 11 versions 24H2, 25H2, and 26H1; no public exploit or KEV listing is present at time of analysis.
Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.
Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.
Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables a low-privileged local attacker to escalate privileges to SYSTEM level. The vulnerability (CWE-122) affects an extremely wide surface - fifteen distinct Windows 10, Windows 11, and Windows Server release trains from Server 2016 through Server 2025 - making it relevant to virtually every Windows enterprise environment. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through Windows Update.
Privilege escalation via heap-based buffer overflow in Windows Enterprise App Management affects a broad swath of Windows desktop and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated network attacker with low privileges who can induce a target user to interact with a crafted payload can trigger the overflow and achieve full system-level compromise (High C/I/A). No public exploit code or CISA KEV listing was identified at time of analysis, but the breadth of affected Windows versions and the vendor-released patch signal a systemic component-level flaw.
Privilege escalation to SYSTEM-level via a heap-based buffer overflow in the Windows Partition Management Driver affects multiple Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker with low privileges can exploit the CWE-122 heap overflow to achieve full confidentiality, integrity, and availability impact on the local system. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.
Heap-based buffer overflow in the Windows Device Association Service enables a low-privileged local user to escalate privileges to SYSTEM level across a broad range of Windows desktop and server platforms. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025 - all prior to their respective patched builds detailed in the Microsoft MSRC advisory. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV active-exploitation listing has been confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution with full system impact when a low-privileged user opens a specially crafted database file. Affected products span Access 2016 through Microsoft 365 Apps for Enterprise, covering the majority of Microsoft Office deployments. Microsoft has released patches across all affected product lines; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Local privilege escalation in the Windows Volume Manager Extension Driver allows a low-privileged authenticated user to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability spans an exceptionally wide range of Windows versions - from the legacy Windows Server 2012 and Windows 10 1607 through the current Windows 11 26H1 and Windows Server 2025 - making patching scope a significant operational challenge. No public exploit code or CISA KEV listing has been identified at the time of analysis, and the CVSS AC:H metric reflects meaningful exploitation complexity, but the vulnerability's kernel-mode scope and full C:H/I:H/A:H impact make it a high-value post-compromise tool.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker with standard user privileges to escalate to full system control across Windows 10 and Windows 11. The flaw (CWE-121) is triggered locally with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 vector. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-privilege requirement and zero interaction needed make this a realistic post-compromise escalation primitive.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Error Reporting (WER) enables network-based privilege escalation across a broad range of Windows desktop and server versions. An authenticated low-privileged attacker who can trigger user interaction can exploit the overflow to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level control. No public exploit code has been identified at time of analysis, but the breadth of affected versions (Windows 10 through Server 2025) and the ubiquity of WER in Windows deployments make this a high-priority patch item.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Power Dependency Coordinator component allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server systems. The flaw (CWE-122) requires only a local account and no user interaction, making it a reliable post-compromise escalation primitive. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the low attack complexity (AC:L) and broad platform coverage across Windows 10 through Server 2025 make patching a priority in any environment where insider threat or malware post-exploitation is a concern.
Heap-based buffer overflow in Microsoft Windows Speech (CWE-122) allows a local low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans the entire modern Windows platform - Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. No public exploit code or CISA KEV entry has been identified at time of analysis; however, the vendor patch is confirmed available via MSRC.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting low exploitation complexity once a local foothold is established. Microsoft has released patches across all affected build lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in Microsoft Windows Speech enables local privilege escalation across Windows 10, Windows 11, and Windows Server platforms from 2016 through 2025. An authorized local attacker holding only a standard user account can exploit the CWE-122 flaw without user interaction to obtain full system compromise (C:H/I:H/A:H), effectively achieving SYSTEM-level privileges. Vendor-supplied patches are available via MSRC; no public exploit code has been identified at time of analysis.
Remote code execution in Microsoft Office exposes unauthenticated network attackers to full system compromise when a target user opens a specially crafted document. The root cause is a heap-based buffer overflow (CWE-122) in Office's document parsing logic, affecting Office 2016 through Microsoft 365 Apps for Enterprise across a defined range of 16.x builds confirmed by EUVD-2026-73711. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score with a network attack vector and no required attacker privileges - beyond inducing user file-open interaction - reflects a credible, high-impact threat against the world's most widely deployed office productivity suite.
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker to achieve privilege escalation - and given the full C:H/I:H/A:H CVSS impact, effectively arbitrary code execution - on affected systems when a user interacts with attacker-controlled content. Affected are .NET 8.0 through 11.0 RC1 and Visual Studio 2022/2026 across multiple release trains. The Microsoft Security Response Center disclosed and patched the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Error Reporting (WER) via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker - holding only standard user privileges - to achieve full system compromise across all current Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity and no interaction requirement, making this an effective land-and-escalate primitive for threat actors with any initial foothold on a target host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.
Heap-based buffer overflow in Windows Error Reporting (WER) enables a locally authenticated attacker to escalate privileges to SYSTEM or administrative level on affected Windows endpoints and servers. The vulnerability spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the local privilege escalation primitive is highly valuable for post-compromise attackers pivoting from user-level access.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Remote code execution in the Microsoft Windows Telnet Client (telnet.exe) stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code over the network. All currently-serviced Windows client and server editions - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - are affected until patched. Microsoft rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not listed in CISA KEV.