Buffer Overflow
Monthly
Heap-based buffer overflow in the Windows Device Association Service enables a low-privileged local user to escalate privileges to SYSTEM level across a broad range of Windows desktop and server platforms. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025 - all prior to their respective patched builds detailed in the Microsoft MSRC advisory. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV active-exploitation listing has been confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution with full system impact when a low-privileged user opens a specially crafted database file. Affected products span Access 2016 through Microsoft 365 Apps for Enterprise, covering the majority of Microsoft Office deployments. Microsoft has released patches across all affected product lines; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Local privilege escalation in the Windows Volume Manager Extension Driver allows a low-privileged authenticated user to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability spans an exceptionally wide range of Windows versions - from the legacy Windows Server 2012 and Windows 10 1607 through the current Windows 11 26H1 and Windows Server 2025 - making patching scope a significant operational challenge. No public exploit code or CISA KEV listing has been identified at the time of analysis, and the CVSS AC:H metric reflects meaningful exploitation complexity, but the vulnerability's kernel-mode scope and full C:H/I:H/A:H impact make it a high-value post-compromise tool.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker with standard user privileges to escalate to full system control across Windows 10 and Windows 11. The flaw (CWE-121) is triggered locally with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 vector. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-privilege requirement and zero interaction needed make this a realistic post-compromise escalation primitive.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Error Reporting (WER) enables network-based privilege escalation across a broad range of Windows desktop and server versions. An authenticated low-privileged attacker who can trigger user interaction can exploit the overflow to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level control. No public exploit code has been identified at time of analysis, but the breadth of affected versions (Windows 10 through Server 2025) and the ubiquity of WER in Windows deployments make this a high-priority patch item.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Power Dependency Coordinator component allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server systems. The flaw (CWE-122) requires only a local account and no user interaction, making it a reliable post-compromise escalation primitive. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the low attack complexity (AC:L) and broad platform coverage across Windows 10 through Server 2025 make patching a priority in any environment where insider threat or malware post-exploitation is a concern.
Heap-based buffer overflow in Microsoft Windows Speech (CWE-122) allows a local low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans the entire modern Windows platform - Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. No public exploit code or CISA KEV entry has been identified at time of analysis; however, the vendor patch is confirmed available via MSRC.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting low exploitation complexity once a local foothold is established. Microsoft has released patches across all affected build lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in Microsoft Windows Speech enables local privilege escalation across Windows 10, Windows 11, and Windows Server platforms from 2016 through 2025. An authorized local attacker holding only a standard user account can exploit the CWE-122 flaw without user interaction to obtain full system compromise (C:H/I:H/A:H), effectively achieving SYSTEM-level privileges. Vendor-supplied patches are available via MSRC; no public exploit code has been identified at time of analysis.
Remote code execution in Microsoft Office exposes unauthenticated network attackers to full system compromise when a target user opens a specially crafted document. The root cause is a heap-based buffer overflow (CWE-122) in Office's document parsing logic, affecting Office 2016 through Microsoft 365 Apps for Enterprise across a defined range of 16.x builds confirmed by EUVD-2026-73711. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score with a network attack vector and no required attacker privileges - beyond inducing user file-open interaction - reflects a credible, high-impact threat against the world's most widely deployed office productivity suite.
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker to achieve privilege escalation - and given the full C:H/I:H/A:H CVSS impact, effectively arbitrary code execution - on affected systems when a user interacts with attacker-controlled content. Affected are .NET 8.0 through 11.0 RC1 and Visual Studio 2022/2026 across multiple release trains. The Microsoft Security Response Center disclosed and patched the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Error Reporting (WER) via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker - holding only standard user privileges - to achieve full system compromise across all current Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity and no interaction requirement, making this an effective land-and-escalate primitive for threat actors with any initial foothold on a target host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.
Heap-based buffer overflow in Windows Error Reporting (WER) enables a locally authenticated attacker to escalate privileges to SYSTEM or administrative level on affected Windows endpoints and servers. The vulnerability spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the local privilege escalation primitive is highly valuable for post-compromise attackers pivoting from user-level access.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Remote code execution in the Microsoft Windows Telnet Client (telnet.exe) stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code over the network. All currently-serviced Windows client and server editions - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - are affected until patched. Microsoft rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows IKE (Internet Key Exchange) Extension allows an authorized network-adjacent attacker to achieve remote code execution across a wide range of Windows client and server releases. The vulnerability (CWE-122) resides in the IKE/IPsec negotiation subsystem and requires low-privilege access to trigger, placing the full C:H/I:H/A:H impact triad within reach of authenticated network peers. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected builds.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. No public exploit has been identified at time of analysis, but Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Distributed File System (DFS) component allows a locally authenticated attacker to escalate privileges to SYSTEM-level access on affected Windows clients and servers. The vulnerability spans an exceptionally broad range of Microsoft Windows releases, from Windows 10 version 1607 and Windows Server 2012 through the most current Windows 11 26H1 and Windows Server 2025 builds. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a locally authenticated attacker to escalate privileges to SYSTEM level. The flaw affects a broad swath of Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels - making it relevant to virtually any unpatched Windows environment. Microsoft has released corrective builds addressing the vulnerability, with no public exploit or active exploitation observed at time of analysis.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Privilege escalation in the Windows Volume Manager Driver allows a local authenticated user to gain SYSTEM-level access via an integer overflow/wraparound in the kernel-mode driver. The vulnerability spans virtually every supported and extended-support Windows release, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patches; no public exploit identified at time of analysis, though the low-complexity, no-interaction profile makes this a high-value post-exploitation primitive.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Stack-based buffer overflow in the Windows Broker Infrastructure Service (CWE-121) allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM on a wide range of Windows client and server editions. The vulnerability affects Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, including Server Core installations. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Management Provider enables a locally authenticated attacker to escalate privileges to SYSTEM-level on affected hosts. The vulnerability (CWE-122) spans virtually the entire Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making its attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Heap-based buffer overflow in Windows Media Foundation enables remote code execution across a wide range of Windows 10, Windows 11, and Windows Server releases. An unauthenticated network attacker can trigger the overflow by inducing a target user to open or process a crafted media file, resulting in full compromise of confidentiality, integrity, and availability at the process level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the low attack complexity (AC:L) make this a significant patching priority.
Heap-based buffer overflow in the Windows Overlay Filter (WoF) kernel driver allows a low-privileged, authenticated attacker to escalate privileges over a network across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in a default-enabled kernel component, giving it a wide attack surface across the entire modern Windows ecosystem. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution when a victim opens a specially crafted document. Exploitation requires no attacker privileges but does require user interaction, making phishing-delivered malicious documents the expected delivery mechanism. The full C:H/I:H/A:H impact triad indicates complete system compromise upon successful exploitation; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Heap-based buffer overflow in the Win32K kernel subsystem (CWE-122) on Windows 11 and Windows Server 2025 enables a low-privileged local attacker to escalate to SYSTEM-level privileges. Affected builds span Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its Server Core variant, per EUVD-2026-73467. Microsoft has released patches addressing all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Fast FAT filesystem driver (fastfat.sys) enables local code execution across a wide range of Windows client and server versions. The vulnerability is reachable without elevated privileges (PR:N, AV:L) under high-complexity conditions, suggesting a crafted FAT volume - such as a malicious USB drive or mounted disk image - can trigger the overflow in kernel space. No public exploit or active exploitation has been identified at time of analysis, but the combination of full C:H/I:H/A:H impact and breadth of affected versions (Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025) makes patching a priority for environments with physical or removable-media exposure.
Heap-based buffer overflow in Windows Print Spooler Components enables network-reachable authenticated attackers to escalate privileges to full system control, achieving high confidentiality, integrity, and availability impact. Affected versions span the entire current Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this a broadly impactful privilege escalation path. Vendor-released patches are available via Microsoft's update guidance; no public exploit or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Heap-based buffer overflow in the Microsoft JScript scripting engine enables unauthenticated remote code execution across a broad range of Windows client and server platforms. The flaw (CWE-122) resides in the legacy JScript engine bundled with Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, exposing systems to full confidentiality, integrity, and availability compromise without requiring user interaction. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; however, the high attack complexity (AC:H) indicates reliable exploitation demands skilled heap-grooming techniques, moderating the risk of opportunistic mass exploitation.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is achievable by any standard local user via a heap-based buffer overflow (CWE-122). The flaw spans nearly every supported Windows release from Server 2012 through Windows 11 26H1, making the attack surface extremely broad. An attacker who already holds a low-privileged local account can exploit this with low complexity and no user interaction to gain full control of the machine; no public exploit or active exploitation is confirmed at time of analysis.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Heap-based buffer overflow in Microsoft Office enables remote unauthenticated attackers to achieve arbitrary code execution by convincing a target user to open a specially crafted Office document delivered over a network. All major Office perpetual and subscription releases are affected, spanning versions from Office 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024. Vendor-released patches are available via Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis, though the high-impact, low-complexity CVSS profile warrants prioritized patching in enterprise environments.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Heap-based buffer overflow in the Microsoft Account component of Windows 11 and Windows Server 2025 enables local privilege escalation to full system access. An authorized local attacker with standard user-level privileges exploits CWE-122 heap corruption to gain complete control over confidentiality, integrity, and availability of the affected host. Vendor-released patches are available for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Heap-based buffer overflow in Microsoft SQL Server allows a low-privileged local attacker to execute arbitrary code with full confidentiality, integrity, and availability impact on the SQL Server host. Affected versions span four major release generations - SQL Server 2017 through 2025 - across both Cumulative Update and GDR servicing tracks, indicating a systemic code path defect rather than an isolated regression. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected builds.
Heap-based buffer overflow in the Windows Device Association Service enables a low-privileged local user to escalate privileges to SYSTEM level across a broad range of Windows desktop and server platforms. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025 - all prior to their respective patched builds detailed in the Microsoft MSRC advisory. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV active-exploitation listing has been confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution with full system impact when a low-privileged user opens a specially crafted database file. Affected products span Access 2016 through Microsoft 365 Apps for Enterprise, covering the majority of Microsoft Office deployments. Microsoft has released patches across all affected product lines; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Local privilege escalation in the Windows Volume Manager Extension Driver allows a low-privileged authenticated user to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability spans an exceptionally wide range of Windows versions - from the legacy Windows Server 2012 and Windows 10 1607 through the current Windows 11 26H1 and Windows Server 2025 - making patching scope a significant operational challenge. No public exploit code or CISA KEV listing has been identified at the time of analysis, and the CVSS AC:H metric reflects meaningful exploitation complexity, but the vulnerability's kernel-mode scope and full C:H/I:H/A:H impact make it a high-value post-compromise tool.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker with standard user privileges to escalate to full system control across Windows 10 and Windows 11. The flaw (CWE-121) is triggered locally with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 vector. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-privilege requirement and zero interaction needed make this a realistic post-compromise escalation primitive.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Error Reporting (WER) enables network-based privilege escalation across a broad range of Windows desktop and server versions. An authenticated low-privileged attacker who can trigger user interaction can exploit the overflow to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level control. No public exploit code has been identified at time of analysis, but the breadth of affected versions (Windows 10 through Server 2025) and the ubiquity of WER in Windows deployments make this a high-priority patch item.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Power Dependency Coordinator component allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server systems. The flaw (CWE-122) requires only a local account and no user interaction, making it a reliable post-compromise escalation primitive. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the low attack complexity (AC:L) and broad platform coverage across Windows 10 through Server 2025 make patching a priority in any environment where insider threat or malware post-exploitation is a concern.
Heap-based buffer overflow in Microsoft Windows Speech (CWE-122) allows a local low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans the entire modern Windows platform - Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. No public exploit code or CISA KEV entry has been identified at time of analysis; however, the vendor patch is confirmed available via MSRC.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting low exploitation complexity once a local foothold is established. Microsoft has released patches across all affected build lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in Microsoft Windows Speech enables local privilege escalation across Windows 10, Windows 11, and Windows Server platforms from 2016 through 2025. An authorized local attacker holding only a standard user account can exploit the CWE-122 flaw without user interaction to obtain full system compromise (C:H/I:H/A:H), effectively achieving SYSTEM-level privileges. Vendor-supplied patches are available via MSRC; no public exploit code has been identified at time of analysis.
Remote code execution in Microsoft Office exposes unauthenticated network attackers to full system compromise when a target user opens a specially crafted document. The root cause is a heap-based buffer overflow (CWE-122) in Office's document parsing logic, affecting Office 2016 through Microsoft 365 Apps for Enterprise across a defined range of 16.x builds confirmed by EUVD-2026-73711. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score with a network attack vector and no required attacker privileges - beyond inducing user file-open interaction - reflects a credible, high-impact threat against the world's most widely deployed office productivity suite.
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker to achieve privilege escalation - and given the full C:H/I:H/A:H CVSS impact, effectively arbitrary code execution - on affected systems when a user interacts with attacker-controlled content. Affected are .NET 8.0 through 11.0 RC1 and Visual Studio 2022/2026 across multiple release trains. The Microsoft Security Response Center disclosed and patched the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Error Reporting (WER) via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker - holding only standard user privileges - to achieve full system compromise across all current Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity and no interaction requirement, making this an effective land-and-escalate primitive for threat actors with any initial foothold on a target host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.
Heap-based buffer overflow in Windows Error Reporting (WER) enables a locally authenticated attacker to escalate privileges to SYSTEM or administrative level on affected Windows endpoints and servers. The vulnerability spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the local privilege escalation primitive is highly valuable for post-compromise attackers pivoting from user-level access.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Remote code execution in the Microsoft Windows Telnet Client (telnet.exe) stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code over the network. All currently-serviced Windows client and server editions - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - are affected until patched. Microsoft rates it CVSS 9.8; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows IKE (Internet Key Exchange) Extension allows an authorized network-adjacent attacker to achieve remote code execution across a wide range of Windows client and server releases. The vulnerability (CWE-122) resides in the IKE/IPsec negotiation subsystem and requires low-privilege access to trigger, placing the full C:H/I:H/A:H impact triad within reach of authenticated network peers. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected builds.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. No public exploit has been identified at time of analysis, but Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Distributed File System (DFS) component allows a locally authenticated attacker to escalate privileges to SYSTEM-level access on affected Windows clients and servers. The vulnerability spans an exceptionally broad range of Microsoft Windows releases, from Windows 10 version 1607 and Windows Server 2012 through the most current Windows 11 26H1 and Windows Server 2025 builds. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a locally authenticated attacker to escalate privileges to SYSTEM level. The flaw affects a broad swath of Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels - making it relevant to virtually any unpatched Windows environment. Microsoft has released corrective builds addressing the vulnerability, with no public exploit or active exploitation observed at time of analysis.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Privilege escalation in the Windows Volume Manager Driver allows a local authenticated user to gain SYSTEM-level access via an integer overflow/wraparound in the kernel-mode driver. The vulnerability spans virtually every supported and extended-support Windows release, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patches; no public exploit identified at time of analysis, though the low-complexity, no-interaction profile makes this a high-value post-exploitation primitive.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Stack-based buffer overflow in the Windows Broker Infrastructure Service (CWE-121) allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM on a wide range of Windows client and server editions. The vulnerability affects Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, including Server Core installations. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Management Provider enables a locally authenticated attacker to escalate privileges to SYSTEM-level on affected hosts. The vulnerability (CWE-122) spans virtually the entire Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making its attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Heap-based buffer overflow in Windows Media Foundation enables remote code execution across a wide range of Windows 10, Windows 11, and Windows Server releases. An unauthenticated network attacker can trigger the overflow by inducing a target user to open or process a crafted media file, resulting in full compromise of confidentiality, integrity, and availability at the process level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the low attack complexity (AC:L) make this a significant patching priority.
Heap-based buffer overflow in the Windows Overlay Filter (WoF) kernel driver allows a low-privileged, authenticated attacker to escalate privileges over a network across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in a default-enabled kernel component, giving it a wide attack surface across the entire modern Windows ecosystem. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution when a victim opens a specially crafted document. Exploitation requires no attacker privileges but does require user interaction, making phishing-delivered malicious documents the expected delivery mechanism. The full C:H/I:H/A:H impact triad indicates complete system compromise upon successful exploitation; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Heap-based buffer overflow in the Win32K kernel subsystem (CWE-122) on Windows 11 and Windows Server 2025 enables a low-privileged local attacker to escalate to SYSTEM-level privileges. Affected builds span Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its Server Core variant, per EUVD-2026-73467. Microsoft has released patches addressing all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Fast FAT filesystem driver (fastfat.sys) enables local code execution across a wide range of Windows client and server versions. The vulnerability is reachable without elevated privileges (PR:N, AV:L) under high-complexity conditions, suggesting a crafted FAT volume - such as a malicious USB drive or mounted disk image - can trigger the overflow in kernel space. No public exploit or active exploitation has been identified at time of analysis, but the combination of full C:H/I:H/A:H impact and breadth of affected versions (Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025) makes patching a priority for environments with physical or removable-media exposure.
Heap-based buffer overflow in Windows Print Spooler Components enables network-reachable authenticated attackers to escalate privileges to full system control, achieving high confidentiality, integrity, and availability impact. Affected versions span the entire current Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this a broadly impactful privilege escalation path. Vendor-released patches are available via Microsoft's update guidance; no public exploit or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Heap-based buffer overflow in the Microsoft JScript scripting engine enables unauthenticated remote code execution across a broad range of Windows client and server platforms. The flaw (CWE-122) resides in the legacy JScript engine bundled with Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, exposing systems to full confidentiality, integrity, and availability compromise without requiring user interaction. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; however, the high attack complexity (AC:H) indicates reliable exploitation demands skilled heap-grooming techniques, moderating the risk of opportunistic mass exploitation.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is achievable by any standard local user via a heap-based buffer overflow (CWE-122). The flaw spans nearly every supported Windows release from Server 2012 through Windows 11 26H1, making the attack surface extremely broad. An attacker who already holds a low-privileged local account can exploit this with low complexity and no user interaction to gain full control of the machine; no public exploit or active exploitation is confirmed at time of analysis.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Heap-based buffer overflow in Microsoft Office enables remote unauthenticated attackers to achieve arbitrary code execution by convincing a target user to open a specially crafted Office document delivered over a network. All major Office perpetual and subscription releases are affected, spanning versions from Office 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024. Vendor-released patches are available via Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis, though the high-impact, low-complexity CVSS profile warrants prioritized patching in enterprise environments.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Heap-based buffer overflow in the Microsoft Account component of Windows 11 and Windows Server 2025 enables local privilege escalation to full system access. An authorized local attacker with standard user-level privileges exploits CWE-122 heap corruption to gain complete control over confidentiality, integrity, and availability of the affected host. Vendor-released patches are available for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Heap-based buffer overflow in Microsoft SQL Server allows a low-privileged local attacker to execute arbitrary code with full confidentiality, integrity, and availability impact on the SQL Server host. Affected versions span four major release generations - SQL Server 2017 through 2025 - across both Cumulative Update and GDR servicing tracks, indicating a systemic code path defect rather than an isolated regression. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected builds.